Privacy policy

1. Introductory information


Respecting the right to privacy of the persons who entrusted Fabryka Mebli BALMA SA (hereinafter „BALMA”) with their personal data, including the persons who make use of our services, our business partners and their employees, and Balma Newsletter subscribers, we wish to declare that we process the gathered data in accordance with the Polish and European laws and in conditions that guarantee its security.

In order to ensure the transparency of the implemented processing processes, we wish to present the principles applicable at  BALMA concerning personal data protection, based on the regulation of the European Parliament and Council (EU) 2016/679 of 27 April 2016 on protecting individuals with regard to processing personal data and on the free movement of such data and repealing Directive 95/46/WE (general regulation on data protection, hereinafter “GDPR”).


2. Data Administrator


Fabryka Mebli BALMA SA with registered office in Tarnowo Podgórne, ul. Poznańska 167 (postcode: 62-080) is the Administrator of your personal data, i.e. is an entity that decides upon the purposes and ways of processing. In matters related to the processing of personal data you can also contact us by email:


3. Data acquisition and the purpose of data processing


Fabryka Mebli BALMA SA is a manufacturer of office furniture. While implementing our business assumptions, we process personal data for the following purposes:

Purpose of processing: Legislative basis and data retention period: Legitimate interest (Art. 6 section 1 letter. f GDPR), if present:
Activities aimed at concluding and executing agreements with clients or business partners.

Art. 6 section 1 letter b
(applies to clients)

Art. 6 section 1 letter f GDPR
(applies to persons cooperating with us on behalf of clients/business partners)

The need to contact workers /co-workers of clients and business partners in connection with undertaking activities to conclude or execute agreements.
Investigating petitions, proposals and complaints.

Art. 6 section 1 letter b, c and f GDPR

For the duration of the agreement or until the warranty expires or the complaint is settled.

The need to contact workers /co-workers of clients in connection with investigating petitions, proposals and complaints.
Establishing, investigating and defending claims. Art. 6 section 1 letter f GDPR
For the period until the claims resulting from the agreement  are time-barred – in accordance with applicable law.
Processing the data of clients or business partners and their workers /co-workers in connection with establishing, investigating and defending claims.
Settlements, bookkeeping and financial reporting. Art. 6 section 1 letter c GDPR
Until the data storage obligations resulting from legal provisions expire, in particular storing accounting documents (as a rule, for 5 years after the year in which the legal event occurred that required issuing an accounting document).
Conducting marketing activities (including the use of electronic means of communication). Art. 6 section 1 letter f GDPR
In case of conducting marketing using a telephone number or an email address, the Administrator shall obtain consent for the communication channel in accordance with the act on providing services electronically or the act -Telecommunications Law. Until the objection is raised, i.e. you show us in any way that you do not wish to be contacted by us or receive any information on activities undertaken by us, or conceivably until the claims are time-barred.
Conducting marketing activities to promote products and services. Including sending Balma Newsletter, which contains information on our latest projects, the events we participate in, new products and solutions, and information on interesting posts on our blog.
Processing data as part of FM BALMA profile on Facebook. Art. 6 section 1 letter f GDPR
The data is co-administered by BALMA and Facebook portal.
The data shall be processed until an objection to data processing is raised.
Conducting current correspondence using the tools provided by Facebook, including Messenger, and conducting other marketing activities.
Processing cookies.

Art. 6 section 1 letter f GDPR
The data shall be processed for the periods indicated in Cookies policy  or until an objection to the processing of data is raised.Objecting may only be made by changing the settings of the end user’s browser, which will prevent collecting information with the use of cookies.

Adapting the content of websites to users’ needs, including for the marketing purposes optimising the use of websites.
Human Resources management – workers and co-workers.

Art. 6 section 1 letter a, b, c and f GDPR
Art. 9 section 2 letter b GDPR
Following the applicable regulations on archiving labour law documents, i.e. personal files, we keep them for 50 or 10 years.

The 10-year period of keeping documentation related to employment and employee’s personal files applies to all workers employed after 1 January 2019.  

Following the applicable regulations on archiving labour law documents, i.e. personal files, we keep them for 50 or 10 years.

The 10-year period of keeping documentation related to employment and employee’s personal files applies to all workers employed after 1 January 2019.

In case of workers employed after 31 December 1998 but before 1 January 2019 the documentation related to employment and employee’s personal files shall be kept for 50 years from the date of termination or expiry of employment, and with regard to those of the above-mentioned workers for whom the employer submits the information report referred to in Art. 4 p. 6a of Act of 13 October 1998 on social security system, the period of keeping documentation and files is reduced to10 years from the end of the calendar year in which this report was submitted.

If the retention period for selected documents is shorter, the Administrator will respect this shorter period.

Civil law contracts shall be stored until the expiry of the periods of limitation for the resulting claims.

Disseminating the image of worker /co-worker on the basis of copyright agreement.
Conducting recruitment.

Art. 6 section 1 letter a and c GDPR
(applies to candidates for employees)

Art. 6 section 1 letter a and b GDPR
(applies to candidates for co-workers)
Up to 6 months from the end of the recruitment process, and in case of consent to further recruitment processes not longer than a year.



If the specified periods to keep documents indicated in ”Settlements, bookkeeping and financial reporting” are longer than the periods appropriate to vindicate possible claims, the longer periods indicated apply.


4. Data recipients


In connection with its business activities, BALMA will reveal your personal data to the following entities:

  • Entities that support us with business activities ordered by us, in particular: suppliers of external ICT systems supporting our business, including Microsoft, entities which audit our activities, an entity which provides accounting services or entities which cooperate with BALMA in advertising campaigns, where such entities shall process data on the basis of an agreement with BALMA and exclusively according to our orders,
  • Authorised Sales Representatives and Company Showrooms, and also Carriers with whom we have signed agreements on personal data protection.


5. Rights to the processed data and voluntary submission of data


Each person whose data is processed by Fabryka Mebli BALMA has the right to:

  • access their data and obtain a copy of it,

  • amend (correct) their data,

  • remove their data,

  • limit the processing of their data,

  • transfer their data – if the legislative basis is: the consent (Art. 6 section 1 letter a or Art. 9 section 2 letter a GDPR) or agreement (Art. 6 section 1 letter b GDPR),

  • file an objection to the processing of their personal data – if the legislative basis for its processing is the legitimate interest (Art. 6 section 1 letter f GDPR).

For more information on rights of data subjects see the regulations of art. 12–23 RODO.

Additionally, any person whose data is processed by BALMA has the right to file a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office.

For more information visit:


6. Do you need to provide BALMA with your personal data?


Providing personal data is necessary to conclude agreements, settle business activities and comply with the law requirements by BALMA. That means if you want to make use of our offer, become our business partner (supplier) or worker /co-worker, you should provide your personal data.

If your employer or another entity has indicated you as a contact person, e.g. in connection with concluding/implementing an agreement with BALMA, your data will be processed in the scope revealed by that entity (standard data: name, surname, position, email address, and phone number).

In the remaining scope (in particular with regard to processing data by BALMA for marketing purposes) providing personal data is voluntary.


7. Transferring data to third countries


Personal data in principle shall not be transferred outside the European Economic Area (hereinafter: “EEA”). However, having in mind the services provided by our subcontractors in implementing the support for ICT services and IT infrastructure, BALMA may order recognised subcontractors that operate outside of the EEA to perform specific activities or IT tasks, which may result in transferring your data outside of the EEA. Following the decision of the European Commission, recipient countries outside of the EEA ensure an adequate level of personal data protection in compliance with the EEA standards.

In case of recipients in countries not covered by the decision of the European Commission to ensure the adequate level of this protection, the Administrator concludes agreements with recipients of personal data which are based on standard agreement provisions issued by the European Commission pursuant to Art.46 section 2 letter c GDPR.

A copy of the standard agreement provisions may be obtained from the Administrator – its contact details have been given above. The data protection method used by the Administrator is compliant with the principles provided for in chapter V GDPR. You may request further information on security means used in this respect, obtain a copy of the security means and find out in which places they are made available.


8. Processing personal data in an automated manner


Your personal data shall not be used for automated decision making (including profiling) in a manner that as a result of such automated processing there could be made any decisions which would cause legal consequences  or in a similar way would affect any results for clients, business partners, their workers or co-workers as well as Administrator’s workers or co-workers, or job candidates.

Information on cookies:

We use cookies to ensure the proper functioning of the website. We may also use our own and our partners’ cookies for analytical and marketing purposes, in particular to match the advertising content to your preferences. The use of analytical and marketing cookies requires your consent, which you can give by clicking “Accept.” If you do not want to give your consent to the use of cookies by us or our partners, click “Manage Cookies” and decide on your preferences. You can withdraw your consent at any time by changing your cookie preferences. For more information, visit the Privacy Policy.

The use of cookies for the purposes aforementioned is related to the processing of your personal data. Fabryka Mebli “BALMA” S.A. with the registered seat in Tarnowo Podgórne ul. Poznańska 167, 62-080 Tarnowo Podgórne is the administrator of your personal data. In some cases, our partners may also be administrators of personal data. For more information on the use of cookies by us and by our partners as well as processing your personal data, including your rights, visit Polityce prywatności.