In accordance with Article 13 of the General Data Protection Regulation of 27 April 2016 (hereinafter referred to as the GDPR), we hereby inform you that:

1. The controller of personal data is Nowodvorski Lighting sp. z o.o. with its registered office in Częstochowa (42-202), ul. Mariusza Bojemskiego 11, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Częstochowa, 17th Commercial Division of the National Court Register, under KRS number 0000994571. If you have any doubts regarding the processing of your data, you can contact the Data Protection Officer appointed by the Administrator at: iod@nowodvorski.com, or in writing to the Administrator's address.

2. Your personal data will be processed:
a) for the purpose of pursuing the legitimate interest of the controller consisting in the marketing of its own products and services (Article 6(1)(f) of the GDPR) using the following forms of communication:
- e-mails,
- text messages,
- voice calls.
NOTE: the use of certain forms of communication requires separate consent for the use of that channel. This applies to e-mails, voice calls and text messages (Article 398 of the Electronic Communications Law). in order to fulfil obligations under the law, in particular the Telecommunications Law and the Act on the provision of electronic services (Article 6(1)(c) of the GDPR).
b) in connection with the pursuit of the Controller's legitimate interest in establishing, pursuing or defending against claims related to the sending of marketing communications, if such claims are made (Article 6(1)(f) of the GDPR).
c) in connection with the pursuit of the Controller's legitimate interest in analysing the effectiveness of marketing and sales activities, including keeping statistics on the number of leads acquired, sales conversions and the number of contracts concluded with customers who have expressed interest in the Controller's offer (Article 6(1)(f) of the GDPR)
d) as well as for the purposes indicated in the consent to the processing of personal data, if such consent has been given (Article 6(1)(a) of the GDPR).

3. The recipients of your personal data may be:
a) Suppliers of external ICT systems, providing support and delivering IT solutions
b) Entities providing marketing communication services on our behalf.
c) Companies providing consulting and auditing services.
d) Subcontractors and suppliers of the organisation,
e) Companies providing services or delivering IT solutions.
f) Companies archiving and destroying documents.
g) Public authorities receiving data in connection with the fulfilment of the controller's legal obligations.
h) Companies providing courier and postal services.
i) Distributors cooperating with the Controller.

4. As a rule, we obtain data directly from you.

5. As a rule, personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, considering the services provided by the Controller's subcontractors in the provision of ICT services and IT infrastructure support, the Controller may commission specific IT activities or tasks to recognised subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipients outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of personal data protection in line with EEA standards. In the case of recipients in countries not covered by the European Commission's decision, in order to ensure an adequate level of protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the standard contractual clauses can be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Controller complies with the rules set out in Chapter V of the GDPR. You may request further information about the safeguards used in this regard, obtain a copy of these safeguards and information about where they are available.

6. Your data will be stored until you object to marketing activities or withdraw your consent, depending on the legal basis for sending communications, i.e. you indicate to us in any way that you do not wish to receive information from us about our activities/services.

If you make specific claims related to the marketing communications we send, the data will be stored until the expiry of the limitation periods for these claims.
Certain data will also be stored until the expiry of the data storage obligations resulting from specific regulations, in particular the Telecommunications Law.

If we process specific data on the basis of the Controller's legitimate interest (Article 6(1)(f) of the GDPR) and you raise an effective objection to the processing before the end of the basic storage period, the data will be processed for that specific purpose for a shorter period, i.e. until the objection is considered (unless the objection concerns processing for direct marketing purposes – in which case there is no requirement to justify the objection).

If we process certain data on the basis of your consent (Article 6(1)(a) of the GDPR) and your consent is withdrawn before the end of the basic storage period, the data will be processed for that specific purpose for a shorter period, i.e. until your consent is withdrawn.
In situations provided for by law, within the limits set by the GDPR, you have the right to request access to your data and receive a copy of it, the right to rectify (correct) your data, the right to erase your personal data, the right to restrict the processing of your data, and the right to transfer your data.

You also have the right to object to the processing of personal data if the legal basis for their processing is a legitimate interest (Article 6(1)(f) of the GDPR).

7. If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

8. Your data will not be subject to automated decision-making.