„Our Data Protection Officer (DPO) handles everything himself."
Are you sure about that?
Privacy policy
1.1.2026 r.
ODO 24 sp. z o.o., ul. Kamionkowska 45, 03-812 Warsaw,
tel. 22 740 99 00, e-mail: [email protected],
VAT: 701-035-34-42, KRS: 0000434350
The Privacy Policy can also be downloaded: 
This Regulation shall enter into force on the date of its adoption.
Respecting the right to privacy of persons who have entrusted ODO 24 sp. z o.o. (hereinafter ‘ODO 24’)Your personal data, including that of individuals using our services and our contractorsWe and our employees and newsletter subscribers would like to inform you that,that we process the data collected in accordance with national and European lawand in conditions ensuring their safety.
In order to ensure the transparency of the processing processes carried out, we present theIn the Official Journal (OJ) 24, the principles for the protection of personal data laid down on the basis of the General Data Protection Regulation (GDPR)Europejskiego i Rady (UE) 2016/679 z dnia 27 kwietnia 2016 r. w sprawie ochronyNatural persons in connection with the processing of personal data andswobodnego przepływu takich danych oraz uchylenia dyrektywy 95/46/WE (ogólne rozporządzenie o ochronie danych, dalej „RODO").
Data Controller
The controller of your personal data, i.e. the person deciding on the purposes and waysProcessing is carried out by ODO 24 sp. z o.o. with its registered office in Warsaw, Kamionkowska Street 45(postal code: 03-812).
For personal data processing matters, please contact:z nami pod adresem [email protected] or in writing to the Administrator's registered office.
Data acquisition and purpose of processing
ODO 24 offers comprehensive solutions in the field of personal data protectionIn carrying out our business functions, wepersonal data for the following purposes:
| Purpose of processing: | Legal basis and data retention period: | Legitimate interest Article 6(1)(f) of the General Data Protection Regulation if applicable: |
|---|---|---|
| Actions aimed at concluding and executing an agreement with a clientor contractor, in the course of the administrator's activity, for the purpose ofrunning open training sessions, delivering the ‘Information Bulletin’, the ‘ODO 24 Help’ service, running ‘e-learning courses’, delivering the ‘ODO Navigator’ service, and organising webinars | art. 6 ust. 1 lit. b (concerning clients); Article 6(1)(f) of the General Data Protection Regulation (concerning persons cooperating with us under civil law contracts); | The need to contact clients / employees / contractors of clientsand contractors in relation to the actions taken to concludethe contract or its execution. |
| Dealing with complaints, requests and complaints. | Article 6(1)(b), (c) and (f) of the GDPR For the duration of the contract or until the warranty expires or the complaint is settled. | The need to contact employees/contractors of clients in connection withthe processing of complaints, requests and complaints. |
| Settlement, investigation and defence of claims. | Article 6(1)(f) of the General Data Protection Regulation For the period until the expiry of the limitation periods for contractual claims -in accordance with the applicable law. | Processing of data of clients or contractors and their employees/contractorsin connection with the settlement, investigation and defence of claims. |
| Conduct clearing, accounting and financial reporting. | Article 6(1)(c) of the General Data Protection Regulation During the period until the expiry of the data retention obligations arising from:with the provisions of law, with the details of keeping accounting documents(as a rule, for 5 years after the year in which the legal event occurred,which required the issuance of an accounting document). | - |
| Conducting statistics | Article 6(1)(f) of the General Data Protection Regulation During the course of another processing operation as indicated in HENT_38 of this table.We do not store personal data for statistical purposes only. | Improvement of activities through conclusions drawn on the basis ofthe statistical measures. |
| Conducting marketing activities (including the use of electronic communication means). | Article 6(1)(f) of the General Data Protection Regulation In cases where marketing uses a telephone number orThe email address of the data controller should be provided for the communication channel in accordance with the law.Until the objection, i.e. the demonstration, is filed.We're in the wrong way that you don't want to stay with us.or receive information about our activities, if any.by the time the claims are deferred. | Conduct marketing activities promoting products and services. |
| Monitoring on the premises of the data controller in order to improvethe safety of workers and the protection of property and confidentiality of information. | Article 6(1)(f) of the General Data Protection Regulation The image recordings shall only be processed for the purposes for which they were collected,and is stored for a period not exceeding three months from the date of recordingor until a reasoned objection has been lodged, unless the recording is evidenceuntil the legal proceedings are concluded. | Conducting access controls for persons residing within the OCTs 24our legitimate purposes, and in the case of employees, the prescriptionlaw (art. 22² Labour Code). |
| Processing of data in the ODO 24 profile frames on the Facebook social network. | Article 6(1)(f) of the General Data Protection Regulation The data are co-administered by ODO 24 and the Facebook portal. The data shall be processed until an objection to the processing is made. | Conduct current correspondence using the tools provided byFacebook, the Messenger messenger, and other activitiesmarketing activities. |
| The processing of cookies. | Article 6(1)(f) of the General Data Protection Regulation The data controller uses the necessary cookies to enableIn addition, in the case of conducting a study,statistical, marketing or recording of user preferences usingFor cookies, the administrator will obtain permission to store cookies on the device.the user. In such a case, the data will be processed for the periods indicated in the Cookies policy or until an objection to the processing is made. An objection can only be made by submitting an appropriate statement to the controller. | Enabling the basic functions of the site.Internet for users, for the purposes of marketing,In addition, it is important to ensure that users are able to use the services provided to them in a timely manner. |
| Human resource management Employees and co-workers. | Article 6(1)(b), (c) and (f) of the GDPR Article 6(1)(c) of the General Data Protection Regulation In accordance with current legislation requiring the archiving of documentsWe keep personal files for 50 years or 10 years. 10-year retention period for documentation relating to the employment relationshipthe employee's work and personal file is applicable to all employeesEmployed from 1 January 2019 onwards In accordance with current legislation requiring the archiving of documentsWe keep personal files for 50 years or 10 years. 10-year retention period for documentation relating to the employment relationshipthe employee's work and personal file is applicable to all employeesEmployed from 1 January 2019 onwards For workers employed after 31 December 1998 and before 1 January 19992019, documentation related to the employment relationship and employee records will bestored for 50 years from the date of termination or termination of the employment relationship,Whereas, in relation to the above-mentioned workers,The employer shall submit the information report referred to in Article 4(6)(a) of the Act.From 13 October 1998 to 24 October 1998 the social security system, periodstorage of documents and documents shall be reduced to 10 years from the end of the yearThe calendar in which this report was submitted. If the storage period for the selected documents is shorter, the administrator willHe kept that short deadline. Civil contracts shall be kept until the expiry of the deadlinesthe resulting claims. | Dissemination of an employee's/collaborator's image on the basis of Art. 81 of the Copyright and Related Rights Act is possible without additional consent to the image, if the image is merely a detail of the whole. |
| Conducting recruitment. | Article 6 (1) (a) is replaced by the following: (concerning candidates for employment); This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal. (concerning candidates for cooperation); Up to 6 months from the end of the recruitment process, in case of consentexpressed for further recruitment processes not more than one year. | - |
If the time limits for storing the documents are indicated in HENT_30__ heading Conducting settlements,accounting and financial reporting” are longer than the deadlines applicable tothe investigation of any claims, the longer deadlines indicated shall apply.
Recipients of personal data
In connection with its activities, UODO 24 will disclose your personal data to the following entities:
- persons engaged in business, lawyers and legal advisers,co-operating with Official Journal L 24 in the field of consultancy services forODO 24 clients and trainers during the IOD practical training periodAnd open training.
- To the Mazowiecki Curator of Education in the field of accreditation,
- Knowledge Foundation. This is security within the framework of the service's implementation.
- State authorities or other entities empowered by law,
- the entities supporting us in the work we commission,in particular: to providers of external IT systems supportingour business, our Microsoft, our auditors,an entity providing accounting services or entities cooperating with the Data Protection Officer (DPO) 24In the framework of marketing campaigns, such entities will process dataUnder the agreement of ODO 24 and only as directed by us.
- Payment service providers in accordance with the Law of 19 August 2011.about payment services, i.e. PayU S.A. with its registered office in Poznan, and alsoto banks, in the event that settlement is necessary,
- for jobseekers also an online recruitment portal.
Eligibility for the data processed and the willingness to submit them
Any person whose data are processed by ODO 24 shall have the right to:
- access to and receipt of copies of their data,
- correction of their data,
- the deletion of their data,
- restrictions on the processing of their data,
- the transfer of your data if consent is the legal basis for their processing(art. 6 para. 1 lit. a or art. 9 para. 2 lit. a GDPR) or a contract (art. 6 para. 1 lit. b GDPR),
- objecting to the processing of your personal data if there is a legal basistheir processing is a legitimate interest (art. 6 para. 1 lit. f GDPR),
- withdraw consent at any time, without affecting the lawfulness of the processing,which was made on the basis of consent prior to its withdrawal.
More information about the rights of data subjects is contained in the provisions of art. 12–23 RODO.
In addition, a person whose data are processed under ODO 24 has the right to lodge a complaintthe supervisory authority, i.e. the President of the Office for Personal Data Protection.temat znajdziesz na stronie of the Office.
Do you have to provide ODO 24 with your personal data?
The data is necessary for the conclusion of contracts and the settlement of activities.This means that if you wish to take advantage of theof the services we offer (including open training, GDPR audits, GDPR implementation support), become our contractor (supplier) or employee/associate,You have to give me your personal information.
If your employer or other entity has designated you as a contact person in connection with thewith the conclusion/execution of an agreement with ODO 24 (including in connection with your participationThe training we organise. Your data will be processed only to the extentdisclosed by that entity (typically name, surname, position, e-mail address and phone number).
In other respects (in particular, regarding the processing of data by ODO 24For marketing purposes, the data is voluntary.
Transfers of data to third countries
Personal data shall, in principle, not be transferred outside the European Economic Area(hereinafter: ‘EEA’). However, taking into account the provision of services by our subcontractorsthe implementation of support for telecommunications services and IT infrastructure, OJ L 24,may order the execution of certain tasks or IT tasks recognised by:Subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEAthe EEA.
In accordance with the Decision of the European Commission, non-EEA recipient States shall ensure that:an adequate level of protection of personal data in accordance with EEA standards.by the Commission vis-à-vis the USA includes companies participating in the Data PrivacyFramework. ODO 24 cooperates only with the firms participating in this programme.More information: https://www.dataprivacyframework.gov/s/
The administrator's method of securing your data is consistentYou can ask for further information on the rules set out in Section Vinformation on the insurance policies used in this field, obtain a copy of thesethe security and find out which sites are available.
Processing of personal data in an automated manner
Your personal data will not be used for the purpose of automated takingdecisions (including in the form of profiling) in such a way that as a result of suchautomated processing could lead to any decisions that would triggerlegal effects or in a similar way would affect any effects on customers,contractors, their employees or co-workers, as well as employees, orthe administrator's co-workers or job candidates.
