Privacy policy – HS LOGISTIK

Version of 16 September 2026. In case of any discrepancy, the Polish version of this privacy policy prevails.

1. Controller

The controller of personal data is Henryk Sosnówka, trading as HS LOGISTIK Henryk Sosnówka, Godziszów Drugi 111A, 23-302 Godziszów, Poland, tax number (NIP) 8621517695, business number (REGON) 545643227 (hereinafter: the „Controller”).

For matters concerning personal data you can contact us:

by phone: +48 724 641 020,
by e-mail: biuro@hslogistik.pl,
by post: HS LOGISTIK Henryk Sosnówka, Godziszów Drugi 111A, 23-302 Godziszów, Poland.

2. What data we process, for what purpose and on what basis

Transport enquiries, quotes and contracts

When you call, send an e-mail or submit an enquiry through the form, we process the data you give us, in particular: the contact person's name, company name, phone number, e-mail address and details of the planned transport (loading and unloading places, loading date and hours, type of goods, number of pallets and weight, body type and special requirements).

Preparing a quote, answering your enquiry and concluding and performing a carriage or forwarding contract where you are the party to that contract (for example, you are a sole trader or you order transport as a private individual) — Article 6(1)(b) GDPR (steps taken at your request before entering into a contract, and performance of the contract).
The same activities where you act on behalf of a customer company as its employee, representative or named contact person — Article 6(1)(f) GDPR. The Controller's legitimate interest is handling enquiries and concluding and performing the contract with the customer.

Data we receive from other people

Some data does not come directly from the people it concerns. We receive it:

from customers (ordering parties and senders) — data of their employees and associates named as contacts, and of contact persons at loading and unloading places: name, position, phone number, e-mail address;
from consignees — data of the people confirming receipt on the transport documents: name, signature;
from carriers we subcontract — data of drivers and vehicles: name, phone number, vehicle registration number.

We process this data in order to arrange and carry out the transport and to stay in touch during it. The basis is the Controller's legitimate interest (Article 6(1)(f) GDPR) and, where the person is a party to the contract, performance of that contract (Article 6(1)(b) GDPR). Retention periods, recipients and your rights are described in sections 3–6.

Invoicing

If cooperation goes ahead, we process the data needed to issue invoices and keep records in order to meet our obligations under tax law — Article 6(1)(c) GDPR.

Recruitment

When you send us a CV or an application for a vacancy, we process the data from your application in order to run the recruitment process:

for the data an employer may require from a candidate under Article 22¹ § 1 of the Polish Labour Code (name, date of birth, contact details, education, professional qualifications, employment history) — Article 6(1)(c) GDPR, and for recruitment under a civil-law contract — Article 6(1)(b) GDPR,
for driver recruitment — also for the data confirming that the requirements of Article 39a(1) of the Polish Road Transport Act are met (driving entitlement, initial qualification and periodic training, no medical or psychological contraindications to working as a driver) — Article 6(1)(c) and Article 9(2)(b) GDPR in connection with Article 22¹ § 4 of the Polish Labour Code,
for any other data you include in your application yourself (for example a photograph or interests), and in order to take part in future recruitment — on the basis of your consent, Article 6(1)(a) GDPR in connection with Article 22^1a of the Polish Labour Code. Withholding or withdrawing that consent has no effect on the outcome of the recruitment.

If you send a CV outside a specific vacancy, in response to the invitation on the Careers page, we keep it so that we can contact you when a position opens. The basis is your consent, given by sending the application for that purpose (Article 6(1)(a) GDPR).

Please do not include information about criminal records, or data on health, religion, opinions or trade union membership — we do not need it at the application stage, and we may not process criminal record data on the basis of consent.

You may withdraw your consent at any time by phone, e-mail or post using the details given in section 1. Withdrawal does not affect the lawfulness of processing carried out before it.

Establishing, pursuing and defending claims

We may also process data in order to establish, pursue or defend claims connected with an enquiry or a concluded contract — Article 6(1)(f) GDPR.

Facebook page

We run the HS LOGISTIK page on Facebook. When you visit it, comment, react to posts or write to us through Messenger, we process the data visible to us on the platform (profile name, content of comments and messages) in order to run the page and reply to messages — Article 6(1)(f) GDPR. As regards page statistics, which Meta makes available to us only in aggregate form, we are joint controllers with Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The terms of this arrangement are set out in Meta's document: Page Insights Controller Addendum. Otherwise, Meta is the controller of data on Facebook, on the terms described in its privacy policy.

3. How long we keep the data

Enquiries that did not lead to cooperation — up to 12 months from the last contact.
Data relating to a concluded contract — for the duration of its performance and then until the claims under it become time-barred: for domestic carriage and forwarding, as a rule 1 year (Article 77 of the Polish Transport Law, Article 803 of the Polish Civil Code); for international carriage 1 year, or 3 years in the case of wilful misconduct or equivalent default (Article 32(1) of the CMR Convention); for other claims connected with business activity 3 years (Article 118 of the Polish Civil Code). If the limitation period is suspended (for example by a complaint) or interrupted, or a dispute is pending, we keep the data until it is concluded.
Invoices and other accounting documents, including transport orders and transport documents underlying invoices — until the tax liability becomes time-barred (Article 86 § 1 of the Polish Tax Ordinance, Article 112 of the Polish VAT Act). As a rule this is 5 years, counted from the end of the calendar year in which the tax payment fell due (Article 70 § 1 of the Polish Tax Ordinance).
Documents submitted for a specific vacancy — until that recruitment ends (a candidate is chosen or the vacancy is closed); we then delete them.
CVs sent outside a specific vacancy and applications in which you consented to taking part in future recruitment — for 12 months from the date we receive them, or until you withdraw your consent earlier.
Data from the Facebook page (comments, messages) — until deleted by their author or by us, and no longer than for as long as the page is run.
Technical server logs — for the period the hosting provider keeps them for the security and correct operation of the service and, where an entry is needed to investigate a security incident or to defend claims, until that matter is concluded.

4. Who we share the data with

Data may be received by entities that support the Controller in running the business and process it on the Controller's instructions, in particular providers of website hosting and e-mail, IT services and accounting services. When a transport is carried out, the data needed to perform it may be received by the carriers or subcontractors involved, as well as by the sender and the consignee, to the extent set out in the transport documents. We may also disclose data to public authorities where the law requires it.

5. Transfers of data outside the European Economic Area

The website uses Google Fonts, which the browser downloads from Google's servers (fonts.googleapis.com and fonts.gstatic.com). During that download the browser passes to Google the device's IP address and the standard information contained in the request, including the browser type and version and the address of our page. We use these fonts so that text on the site appears in a consistent typeface across devices. The basis is the Controller's legitimate interest (Article 6(1)(f) GDPR), and you have the right to object to this processing. Google LLC is established in the USA and is a certified participant in the EU-U.S. Data Privacy Framework; the data is transferred on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on an adequate level of protection (Article 45 GDPR).

Where a transport goes to a country outside the European Economic Area (for example Switzerland or the United Kingdom), we pass the data contained in the order and the transport documents, such as the details of contact persons and the driver, to the consignee and to the parties involved in the transport in that country. The basis is a European Commission decision on an adequate level of data protection in that country (Article 45 GDPR) or, where there is none, the necessity of the transfer for the performance of the carriage contract (Article 49(1)(b) or (c) GDPR).

Apart from the cases described above, the Controller does not transfer data to countries outside the European Economic Area.

6. Your rights

You have the right to:

access your data and obtain a copy of it,
have the data rectified,
have the data erased,
restrict the processing,
data portability — for data processed on the basis of consent or a contract,
withdraw consent at any time, where the processing is based on it.

Right to object

You have the right to object at any time — on grounds relating to your particular situation — to the processing of your data based on the Controller's legitimate interest (Article 6(1)(f) GDPR). This covers contact with people representing customers or named as contacts, data received from other people, establishing, pursuing and defending claims, running the Facebook page, technical server logs and the downloading of Google Fonts. After you object we will stop processing the data for those purposes, unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims (Article 21(1) GDPR).

To exercise your rights, contact the Controller by phone, e-mail or post (section 1). You also have the right to lodge a complaint with the President of the Polish Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland.

7. Whether you have to provide the data

Providing data with a transport enquiry is voluntary, but without contact details and information about the transport we cannot answer the enquiry, prepare a quote or conclude a contract. Providing the data needed to issue an invoice is a statutory requirement (Article 106e of the Polish VAT Act).

In recruitment, providing the data listed in Article 22¹ § 1 of the Polish Labour Code — and, for drivers, also the data confirming that the requirements of Article 39a(1) of the Polish Road Transport Act are met — is a statutory requirement, and without it we cannot consider the application. Providing any other data is entirely voluntary: withholding it, withholding consent or withdrawing consent has no effect whatsoever on the outcome of the recruitment.

We do not make automated decisions and we do not profile the people whose data we process.

8. Cookies and technical data

The website uses no analytics or advertising cookies and contains no tracking tools such as Google Analytics or the Facebook pixel. During ordinary browsing the site stores no cookies or other data in your browser. Cookies necessary for signing in are set by the content management system (WordPress) only after the administration login page is opened and for signed-in users. You can restrict or disable the storing of cookies in your browser settings.

The server hosting the website records basic connection information in technical logs, such as the IP address, date and time, and the address of the page visited. This serves the security and correct operation of the site — Article 6(1)(f) GDPR. The logs are kept by the hosting provider as a processor acting on the Controller's instructions.

There is a link to the HS LOGISTIK Facebook page on this website. Simply viewing our site does not send any data to Facebook, because the site loads no Facebook scripts or plug-ins. Only when you click the link does your browser connect to Facebook and pass on, among other things, your IP address and the address of our page you are coming from.

9. Changes to this policy

This policy may be updated, for example when the ways of contacting us or the tools used on the site change. The current version is always available on this page, and the version date is given at the top.