In accordance with Article 13, paragraph 1 and paragraph 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) it is announced as follows:
Personal Data Controller
The Controller of the personal data collected is:
- Pakuj Plecak Association with its registered office in Pruszków (05-800), at ul. Narodowa 18/1, entered into the Register of Entrepreneurs kept by the District Court in Warsaw, 14th Commercial Division, of the National Court Register under Number: 0000711582, Polish Tax Identification Number (NIP): 5342572305, Polish National Business Register Number (REGON): 369226209,
- Pakuj Plecak sp. z o.o. with its registered office in Pruszków (05-800), at ul. Narodowa 18/1, entered into the Register of Entrepreneurs kept by the District Court in Warsaw, 14th Commercial Division, of the National Court Register under Number: 0000887378, Polish Tax Identification Number (NIP): 5342636324, Polish National Business Register Number (REGON): 388361935.
Data Protection Officer (DPO)
In matters related to the processing of personal data and the exercise of rights vested in the users in accordance with the provisions on the protection of personal data, the Controller is available to contact by letter sent to its registered office or via e-mail: kontakt@pakujplecak.pl.
Purposes of personal data processing
The personal data is processed for the following purposes:
- conclusion, implementation and settlement of a civil law contract based on Article 6 paragraph 1 letter b of GDPR,
- disclosing data to entities authorised under the provisions of generally applicable law, including: tax authorities and the Social Insurance Institution (ZUS) under Article 6 paragraph 1 letter c of GDPR and provisions of tax laws and regulations of the social insurance system, as well as provisions of implementing acts issued under the aforementioned acts,
- possible pursuit of claims by the Controller, resulting from a concluded civil law contract, which is the legitimate interest of the Controller (based on Article 6 paragraph. 1 letter f of GDPR),
- to a broader extent than resulting from generally applicable provisions of law, as an example for the Controller’s marketing purposes, e.g. by including one’s image in photographs taken and video recordings recorded during various types of events organised by the Controller, which is the legitimate interest of the Controller (based on Article 6 paragraph 1 letter f of GDPR)*,
- in case of voluntary consent to the processing of the data for a specific purpose, the basis for the processing is Article 6 paragraph 1 letter a of GDPR.
Data storage period
The personal data is stored for the period resulting from:
- performance of the concluded civil law contract and until the expiry of the limitation periods for any claims resulting from this contract,
- the provisions of law that may oblige the Controller to process data, including the accounting act, tax law, copyright law as well as the provisions of implementing acts issued on the basis of the abovementioned acts,
- aplicability of protection of the interests of the Controller,
- validity of other purposes based on the legitimate interest of the Controlleror or until the consent is withdrown.
If the personal data is processed based on your voluntary consent, it will be stored by the Controller until withdrawal of the consent**.
Recipients of data
The recipients of the personal data may include:
- employees, associates and members of the Controller’s bodies,
- entities processing data on behalf of the Coltroller, for the purpose and to the extent related to the implementation of a civil law contract, whereby such entities process data on the basis of specific agreements concluded with the Controller and only in accordance with the instructions and scope indicated by the Controller,
- entities authorised under generally applicable legal provisions.
Transfer of data outside the EEA
The personal data colledted are generally not transferred to entities based outside the European Economic Area (EEA), i.e. in third countries. However, the transfer of the personal data outside the EEA may be applicable in order to perform the Controller’s obligations resulting from a civil law contract, including the participation of subcontractors or associates of the Controller based outside the EEA in the proper implementation of a civil law contract.
Automated decision-making, including profiling
The personal data collected will not be subject to automated decision-making or profiling.
Rights of the data subject:
With respect to the personal data provided to the Controller, the provider has the right to:
- access the data provided, request its rectification, obtain a copy it,
- delete or limit the data processing, in cases defined by law,
- object to the processing of the data if it is based on the legally justified interest of the Controller,
- withdraw consent if the basis for the processing of the data is consent. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal. Consent may be withdrawn at any time,
- transfer the personal data, which means to receive information from the Controller about the personal data collected, in a structured, commonly used machine-readable format. The data reveived may be transferred to another data Controller,
- lodge a complaint to the Data Protection Authority if they consider that the Controller, when processing the personal data, has violated the provisions of GDPR or other relevant data protection acts.
In order to exercise the abovementioned rights, one should contact the Controller as described above.
Information on the obligation to provide data and the consequences of refusal of its provision
Providing personal data is voluntary. Although the refusal of the personal data provision results in the inability to conclude a civil law contract with the Controller.
