Category
Privacy Policy
Update date: 06.08.2026
Privacy Policy
We are the controller of Your personal data
Looking after their safety is not only a duty for us, but above all a matter of trust, which we want to build up mutually.
That is why we created this document.
You will find information about what we use your data for, why we have the right to do so and how long we keep it. In addition, you will find out here what rights you have through the RODO.
We have divided the information into two parts:
- in the first part we write about your data – when and how we process it – the information is presented in the form of dedicated information clauses;
- In the second part, we explain how cookies and other tools that observe your online activity in relation to your use of our website work.
Use the links in the table of contents to quickly find the information you are interested in.
Within the framework of this privacy policy, we present the most important information concerning our processing of personal data on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: “RODO”). Nowodvorski Lighting sp. z o.o. dissolves personal data for various purposes, and you will find detailed information on this subject below.
The controller, i.e. the entity deciding on the purposes and methods of processing personal data, is Nowodvorski Lighting sp. z o.o. with its registered office in Częstochowa (42-202), 11 Mariusz Bojemskiego St. Nowodvorski Lighting sp. z o.o. has appointed a Data Protection Inspector, whom you can contact at the following e-mail address: [email protected]
Table of contents
We are the controller of your personal data
We have divided the information into two parts
Job applicants
Employees and persons employed under civil law contracts
Those using the “Contact Us” tab on the website
Those using the widget on the website to leave contact details
Customers and their representatives
Contractors (including suppliers) and their representatives
Customer service contact persons
Recipients of marketing messages
Website users (data derived from cookies or other tracking technologies)
Cookies
Changes to the Privacy Policy
Job applicants
| Aims and legal bases of the processing | |
| Objective | To take the steps necessary for the conclusion of a contract, at your request (Article 6(1)(b) RODO). |
| Objective | Implementation of the recruitment process, insofar as this is a direct consequence of the law, in particular Article 22(1) § 1 of the Labour Code (Article 6(1)(c) RODO). |
| Objective | Implementation of the recruitment process, in the event that you voluntarily provide other data than that required by law (Art. 6(1)(a) RODO). NOTE: the provision of information by the candidate that exceeds the minimum data scope regulated by employment law is an explicit action, tantamount to consenting to the processing of this data for recruitment purposes. |
| Objective | The fulfilment of the Administrator’s legitimate interest in establishing, asserting or defending against claims (Article 6(1)(f) RODO and, in the event that special category data is provided, also Article 9(2)(f) RODO). |
| Objective | Consideration of your candidature for future recruitments, if you give additional consent (Article 6(1)(a) of the DPA). |
| Objective | Verification of the references provided to you, in case you give additional consent (Article 6(1)(a) RODO). |
| Data storage time | Your data will be held until the end of the recruitment process and then for a period of 3 months so that we can contact you should we nevertheless decide to employ you during this additional period. If claims related to possible employment discrimination may be associated with the processing, your data will be stored until the statute of limitations for these claims has expired. The data retention period is then 3 years, in accordance with Article 291 § 1 of the Labour Code. If you are employed, we will continue to process your data in accordance with the periods appropriate for an employee/co-worker. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) RODO) and you raise an effective, justified objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is taken into account. If we process certain data on the basis of your consent (Article 6(1)(a) RODO) and you withdraw your consent before the expiry of the basic retention period, then the data will be processed for this specific purpose for a shorter period, i.e. until you withdraw your consent. |
| Scope of data | We process the data you provide us with yourself, i.e. the data contained in your application documents. This includes, in particular, your contact details, data on your qualifications or experience. In the course of recruitment, we may also collect additional data, e.g. data provided verbally during the recruitment interview, data on the results of tests taken. |
| Data source | We acquire data directly from you. When we use recruitment agencies to source candidates and then provide us with their data, the agencies are the source of the data. If you were recommended for a job through a referral scheme, the source of the data was the referrer. |
| Obligation to provide data | The provision of certain data is a statutory obligation for a candidate for an employment contract, in particular the data referred to in Article 22(1) § 1 of the Labour Code (first name(s) and surname; date of birth; contact details indicated by you; education; professional qualifications; previous employment history). The provision of certain data may also be a condition for the conclusion of an employment/co-operation contract. |
| What if you do not provide your data | If you do not provide data for which there is a statutory or contractual obligation, we will not be able to carry out the recruitment process and consequently employ you. |
| Recipients of data | Recipients are external entities to whom we pass your data: – recruitment agencies and services, – providers of IT services, ICT systems and hosting services, – entities providing archiving and disposal services for us, – our group companies, – providers of legal and advisory services, – courier and postal service companies, – state authorities or other entities authorised under applicable law, – reference persons indicated by the candidate, – Occupational health facilities (if a decision is taken to employ the candidate). |
| Data transfer | No, we will not transfer your data outside the European Economic Area. The data will be transferred to [name of country], in accordance with the European Commission’s decision finding an adequate level of protection for personal data (Article 45 RODO). The data will be transferred to [name of country] following the conclusion of the so-called standard contractual clauses adopted by the European Commission (Article 46(2)(c) of the RODO). Please contact us if you would like a copy of the concluded standard contractual clauses. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar significant impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 RODO,b) to rectify their personal data – within the limits of Article 16 of the RODO, c) the erasure of your personal data – within the limits of Article 17 of the RODO, d) restrict the processing of your personal data – within the limits of Article 18 RODO, e) the portability of your personal data – within the limits of Article 20 RODO, f) to withdraw at any time your consent to the processing, if it was the basis for the processing, without this affecting the lawfulness of the processing carried out before your consent was withdrawn, as well as g) The right to object at any time to the processing of your personal data – within the limits of Article 21 RODO – if the legal basis for the processing is the legitimate interest of the Controller or a third party (Article 6(1)(f) RODO) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection relates to processing for direct marketing purposes – in which case there is no requirement to indicate such a reason. |
| Right of action | If you believe that we are processing your personal data unlawfully, you can lodge a complaint with the President of the Data Protection Authority. You can find more information about this on the Office’s website. |
Employees and persons employed under civil law contracts
| Aims and legal bases of the processing | Fulfilment of the employment contract/civil contract (Article 6(1)(b) RODO). |
| Objective | Applies to the processing of ordinary data. Fulfilment of the Administrator’s obligations arising from the employment relationship, including but not limited to those related to the organisation of work, the provision of safe and healthy working conditions, anti-discrimination, the settlement of accounts receivable, the maintenance and archiving of personal files, the Administrator’s obligations arising from the provisions on social security, health insurance, taxes, the company social benefit fund, employee capital plans, trade unions, accounting, general duty of defence (Article 6(1)(c) RODO). Applies to the processing of special categories of data Fulfilment of the Administrator’s obligations in the field of labour law, social security and social protection, in particular health data, including within the framework of the company’s social benefits fund (Article 9(2)(b) RODO). |
| Objective | The fulfilment of the Administrator’s legitimate interest in establishing, asserting or defending against claims (Article 6(1)(f) of the RODO and, where special category data is provided, also Article 9(2)(f) of the RODO). |
| Objective | The purposes indicated in the content of the consents for the processing of personal data, if such consents were given (Article 6(1)(a) RODO, Article 9(2)(a) RODO). |
| Objective | Applies to data obtained by means of: email monitoring, GPS monitoring in company cars, monitoring of websites visited: to ensure the organisation of work to enable full use of working time and the proper use of the working tools provided to the employee (or person employed under a civil law contract) (Article 6(1)(f) RODO in connection with Article 22(3) § 1 of the Labour Code). |
| Objective | Applies to data obtained by means of video surveillance: to ensure the safety of employees or the protection of property or the control of production or to maintain the secrecy of information the disclosure of which could expose the employer to harm (Article 6(1)(f) RODO in conjunction with Article 22(2) § 1 of the Labour Code). |
| Objective | Organisation of community events and initiatives, in the event that you wish to participate (Article 6(1)(f) of the DPA). |
| Objective | Execution of contracts with the Administrator’s customers, contractors and suppliers (Article 6(1)(f) RODO). |
| Objective | Conducting marketing of the Administrator’s products and services to potential customers, using personal data of employees/persons employed under civil law contracts (Article 6(1)(f) RODO). |
| Data storage time | The data will be retained for a period of 10 years from the end of the calendar year in which the employment relationship ceased/terminated, when it was established no earlier than 01.01.2019. The data will be retained for a period of 50 years from the end of the calendar year in which the employment relationship ceased/terminated, where it was established earlier than 01.01.2019. In the case of persons employed under civil law contracts, the data will be stored until the expiry of the limitation period for contractual claims or the expiry of legal retention obligations, in particular the retention of accounting documents. Video surveillance recordings will be stored for up to three months and, if necessary for the establishment, investigation or defence of claims, until the final settlement of the claims asserted or the expiry of the limitation period. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) RODO) and you raise an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is taken into account. If we process certain data on the basis of your consent (Article 6(1)(a) RODO) and you withdraw your consent before the expiry of the basic retention period, then the data will be processed for this specific purpose for a shorter period, i.e. until you withdraw your consent. |
| Scope of data | At the time of employment, we process those data that you provide to us yourself. This is data that is necessary for the conclusion of an employment contract or a civil contract and, if you are employed under an employment contract, also data related to the fulfilment of many of the employer’s obligations, such as data on your family members, data on your disability or data on your fitness for work. In the course of your employment contract or civil law contract, we acquire a range of new data about you. These include, for example, data on training you have attended, data on your use of employee benefits, your image (obtained, for example, in connection with the production of a promotional video), data on your activity in the resources made available to you (so-called logs), data on your geolocation (in the context of company cars) and a number of other data, the catalogue of which may vary in the various stages of the duration of the employment contract or civil law contract. |
| Data source | As standard, we obtain data directly from you. In exceptional situations, we obtain this data from sources other than you. An example of such a situation is a summons from a bailiff to seize your salary. Another example is when we ask our customers about their satisfaction with the service, in which case we obtain your personal data from them in the form of their opinions about you. |
| Obligation to provide data | The provision of certain data is a statutory obligation for an employee employed under an employment contract, in particular the data referred to in Article 22(1) of the Labour Code. The provision of certain data may also be a condition for the conclusion of an employment or civil law contract. |
| What if you do not provide your data | If you do not provide data for which there is a statutory or contractual obligation, we will not be able to employ you or fulfil your rights / our obligations under specific legislation. |
| Recipients of data | Recipients are external entities to whom we pass your data: – state authorities or other entities authorised by law, if this is necessary for the fulfilment of legal obligations, – our clients, – our suppliers, including the service providers referred to below, – entities that provide us with IT tools to store your data or entities that have access to your data as part of ongoing maintenance work on IT systems, – entities auditing our activities or experts, – providers of accounting, human resources or legal services, – trade unions and employee benefit societies, – users of the website, social media or other audiences, in the event that your data is made public, – companies that dispose of or archive documents and other media, – courier and postal service companies, – medical facilities, – banks, insurance companies and other financial and payment institutions, – companies preparing personalised clothing, badges or certificates, – companies providing security services, access control and monitoring the use of work tools, – training companies, – hotels and transport companies. |
| Data transfer | As a general rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, having regard to the services provided by the Administrator’s subcontractors in the provision of support for ICT services and IT infrastructure, the Administrator may outsource certain activities or IT tasks to recognised subcontractors operating outside the EEA which may result in the transfer of your data outside the EEA. Recipients outside the EEA, as decided by the European Commission, shall ensure an adequate level of protection of personal data in accordance with EEA standards. For recipients in the territory of States not covered by the European Commission Decision, in order to ensure an adequate level of such protection, the Controller shall contract with the recipients of your personal data based on the standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the RODO. A copy of the standard contractual clauses can be obtained from the Controller by contacting the contact details provided above. The method used by the Controller to secure your data complies with the principles provided for in Chapter V of the RODO. You may request further information on the safeguards applied in this regard, obtain a copy of these safeguards and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar significant impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 RODO, b) to rectify their personal data – within the limits of Article 16 of the RODO, c) the erasure of your personal data – within the limits of Article 17 of the RODO, d) restrict the processing of your personal data – within the limits of Article 18 RODO, e) the portability of your personal data – within the limits of Article 20 RODO, f) to withdraw at any time your consent to the processing, if it was the basis for the processing, without this affecting the lawfulness of the processing carried out before your consent was withdrawn, as well as g) The right to object at any time to the processing of your personal data – within the limits of Article 21 of the RODO – if the legal basis for the processing is the legitimate interest of the Controller or a third party (Article 6(1)(f) of the RODO) – when submitting an objection you should indicate the reasons related to your particular situation, unless the objection relates to processing for direct marketing purposes – in which case there is no requirement to indicate such a reason. |
| Right of action | If you believe that we are processing your personal data unlawfully, you can lodge a complaint with the President of the Data Protection Authority. You can find more information about this on the Office’s website. |
Those using the “Contact Us” tab on the website
| Aims and legal bases of the processing | |
| Objective | Contacting a potential customer – taking pre-contractual action, at the customer’s request, expressed by leaving your details in the “Contact Us” section of the website (Article 6(1)(b) RODO – if you are a potential customer; Article 6(1)(f) RODO – if you are an individual acting for or on behalf of a customer). |
| Objective | To provide an answer to a question asked via the “Contact us” tab (Article 6(1)(f) of the DPA). |
| Objective | The purposes indicated in the content of the consents for the processing of personal data, if such consents were given (Art. 6(1)(a) RODO). |
| Data storage time | Personal data will be held until your enquiry, submitted via the contact form, has been processed and then for a period of 3 months after the response. Personal data will be held until an offer is made to you and then for a period of 3 months after the offer has been made if the offer is not accepted. If our offer has been accepted and we are bound by a contract, then we will process your data for the time dedicated to customers with an active contract If your enquiry did not relate to our offer, then we will keep your data for a period of 3 months after we have answered you. If you have a specific relationship with the Administrator (e.g. you are a customer with an active contract), then we may also store your data obtained via the Contact tab until the statute of limitations for claims arising from the legal relationship between you and the Administrator. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) RODO) and you raise a legitimate objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is taken into account. If we process certain data on the basis of your consent (Article 6(1)(a) RODO) and you withdraw your consent before the expiry of the basic retention period, then the data will be processed for this specific purpose for a shorter period, i.e. until you withdraw your consent. |
| Scope of data | Normally these are: first name, last name, e-mail address . |
| Data source | As standard, we obtain data directly from you. |
| Obligation to provide data | The provision of certain data is not a statutory condition or a contractual requirement. |
| What if you do not provide your data | If you do not provide your details, we will not be able to provide you with our offer or answer any other question you may have. |
| Recipients of data | Recipients are external entities to whom we pass your data: – entities that provide us with IT tools to store your data or entities that have access to your data as part of ongoing maintenance work on IT systems. -website provider. |
| Data transfer | As a general rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, having regard to the services provided by the Administrator’s subcontractors in the provision of support for ICT services and IT infrastructure, the Administrator may outsource certain activities or IT tasks to recognised subcontractors operating outside EEA which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, as decided by the European Commission, shall ensure an adequate level of protection of personal data in accordance with EEA standards. For recipients in the territory of countries not covered by the European Commission Decision, in order to ensure an adequate level of such protection, the Controller shall contract with recipients of your personal data based on the standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the RODO. A copy of the standard contractual clauses can be obtained from the Controller by contacting the contact details provided above. The method used by the Controller to secure your data complies with the principles provided for in Chapter V of the RODO. You may request further information on the safeguards applied in this regard, obtain a copy of these safeguards and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar significant impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 RODO, b) to rectify their personal data – within the limits of Article 16 of the RODO, c) the erasure of your personal data – within the limits of Article 17 of the RODO, d) restrict the processing of your personal data – within the limits of Article 18 RODO, e) the portability of your personal data – within the limits of Article 20 RODO, f) to withdraw at any time your consent to the processing, if it was the basis for the processing, without this affecting the lawfulness of the processing carried out before your consent was withdrawn, as well as g) The right to object at any time to the processing of your personal data – within the limits of Article 21 of the RODO – if the legal basis for the processing is the legitimate interest of the Controller or a third party (Article 6(1)(f) of the RODO) – when submitting an objection you should indicate the reasons related to your particular situation, unless the objection relates to processing for direct marketing purposes – in which case there is no requirement to indicate such a reason. |
| Right of action | If you believe that we are processing your personal data unlawfully, you can lodge a complaint with the President of the Office for the Protection of Personal Data . You can find more information about this on the Office’s website. |
Participants in training and events organized by the administrator
| Purposes and legal bases of processing | |
| Purpose | Organization of the event, which is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR). In the case of dissemination of data in the form of an image – promotion of the Administrator (to the extent resulting from the consent granted to disseminate the image expressed in accordance with Article 81 of the Act of 4 February 1994 on Copyright and Related Rights, hereinafter referred to as the copyright consent) – the legal basis for the processing is Article 6(1)(f) of the GDPR. PLEASE NOTE: in the case of participation in events organized by the Administrator, which are recorded by means of film or photographs, participation in them is tantamount to consent to the recording and/or free use and/or dissemination of the image/voice/statement in promotional and marketing materials without time and territorial limitations. Such consent includes all forms of dissemination and sharing, in particular making it available on the Administrator’s websites, on profiles maintained by the Administrator on social networks such as Facebook, Twitter and Instagram, as well as in promotional materials printed or transmitted on the Internet in electronic form. The image can be used for various forms of electronic image processing, framing and composition, without the obligation to accept the final product, but not in forms that are offensive or generally considered unethical. The image of the Event Participant will be juxtaposed with the images of other participants and with the content concerning the subject of the Administrator’s and/or its partners’ activities, including marketing and promotional content. (The Event Participant waives now and in the future any claims, including financial claims, that he or she may be entitled to due to the publication of the image in the above-mentioned materials). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in establishing, pursuing or defending against claims related to the organized event, if such are submitted (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Data retention period | Personal data will be stored until the end of the event, and if claims may be associated with the processing, the data will be stored until the expiry of the limitation periods for these claims. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | Normally, these are only the data necessary to send the invitation and organize the event. Depending on the event, these may include: name and surname, e-mail address, phone number, and then – your image registered during the event. If you contact us via social media, we may additionally process your data in the form of your account name or your profile picture (if it contains your image). |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing data is neither a contractual nor a statutory requirement. |
| What if you don’t provide your details | Failure to provide data may result in the inability to participate in the event. |
| Data recipients | Recipients are third parties to whom we transfer your data: – providers of external ICT systems, providing support and providing IT solutions, – entities supporting the organization and conduct of the event, – entities from the Administrator’s capital group, – entities auditing our business, – entities providing accounting, debt collection or legal services, – security companies Third-party service providers: As part of our business, we use third-party technology providers who may process personal data on our behalf or as independent data controllers. Below are the key service providers we use: Microsoft Teams (Microsoft Corporation) We use the Microsoft Teams platform as a tool for internal and external communication, including the organization of online meetings, webinars and training. Meta Platforms, Inc. (Facebook, Instagram) For marketing purposes and to communicate with users via social networks, we use the services of Meta Platforms, Inc., the owner of Facebook and Instagram. LinkedIn (LinkedIn Corporation) We use LinkedIn for recruitment, marketing and company image building purposes |
| Data transfer | With regard to the services provided by providers of technological solutions, the Controller transfers some of your personal data to a third country, which is the United States, on the basis of Article 45 of the GDPR. We would like to inform you that the following companies: Microsoft Corporation, Meta Platforms, Inc, LinkedIn Corporation, have joined the Data Privacy Framework, which means that they are so-called certified data recipients due to the fact that these entities provide an adequate level of protection. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
| Last updated date | 01.01.2023 |
People using the widget on the website – “stay up to date”, allowing you to leave contact details
| Purposes and legal bases of processing | |
| Purpose | Contact with a potential customer – taking actions prior to concluding a contract, at the client’s request, expressed by leaving data in a widget posted on the website (Article 6(1)(b) of the GDPR – if you are a potential customer; Article 6(1)(f) of the GDPR – if you are a natural person acting on behalf of or for the benefit of the client). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Data retention period | If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | Typically, these are: name, e-mail address and phone number. |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing data is not a statutory condition or a condition for concluding a contract. |
| What if you don’t provide your details | If you do not provide the data, we will not be able to present you with our offer. |
| Data recipients | Recipients are third parties to whom we transfer your data: – providers of external ICT systems, providing support and providing IT solutions, – website provider, – marketing agencies, if we use their services as part of handling inquiries. |
| Data transfer | No, we will not transfer your data outside the European Economic Area. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
People using the “B2b Zones/Designer Zone” tab on the website
| Purposes and legal bases of processing | |
| Purpose | Contact with persons who have created an account and logged in to the Designer’s Zone – taking actions prior to concluding the agreement, at the client’s request, expressed by leaving data in the “Designer’s Zone” tab on the website (Article 6(1)(b) of the GDPR – if you are a potential client; Article 6(1)(f) of the GDPR – if you are a natural person acting on behalf of or for the benefit of the client). |
| Purpose | Answering a question asked using the “Designer’s Zone” tab (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Data retention period | Personal data will be stored until your inquiry is processed as part of the contact form, and then for a period of 3 months from the moment of response. Personal data will be stored until the offer is presented to you, and then for a period of 3 months after its submission if the offer has not been accepted. If our offer has been accepted and we are bound by a contract, then we will process your data for a period dedicated to customers with an active contract If your inquiry was not related to our offer, then we will store your data for a period of 3 months from the date of your response. If you are in a specific relationship with the Administrator (e.g. you are a customer with an active contract), then we may also store your data obtained through the Contact tab until the statute of limitations for claims resulting from the legal relationship between you and the Administrator expires. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you submit a justified objection to the processing before the expiry of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | By default, these are: name, surname, e-mail address. |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing some data is not a statutory condition or a condition for concluding a contract. |
| What if you don’t provide your details | If you do not provide the data, we will not be able to present you with our offer or answer any other question you have asked. |
| Data recipients | Recipients are third parties to whom we transfer your data: – entities that provide us with IT tools to store your data or entities that have access to your data as part of maintenance work in IT systems. -website provider. |
| Data transfer | As a rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, taking into account the services provided by the Administrator’s subcontractors in the implementation of support for ICT services and IT infrastructure, the Administrator may outsource the performance of certain IT activities or tasks to recognized subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of protection of personal data in accordance with EEA standards. In the case of recipients in the territory of countries not covered by the decision of the European Commission, in order to ensure an adequate level of this protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the Standard Contractual Clauses may be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Administrator is in accordance with the principles provided for in Chapter V of the GDPR. You can request further information about the security measures in place in this regard, obtain a copy of these security measures and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | h) access to their personal data – within the limits of Article 15 of the GDPR, i) rectify their personal data – within the limits of Article 16 of the GDPR, j) delete their personal data – within the limits of Article 17 of the GDPR, k) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, l) transfer of their personal data – within the limits of Article 20 of the GDPR, m) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and n) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons for its processing related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – in which case there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
People who use the “Become a Partner of the Nowodvorski Lighting brand” tab
| Purposes and legal bases of processing | |
| Purpose | Contact with persons who have created an account and logged in to the Brand Partner Zone – taking actions prior to concluding the agreement, at the customer’s request, expressed by leaving data in the “Become a Partner of the Nowodvorski Lighting brand” tab on the website (Article 6(1)(b) of the GDPR – if you are a potential customer; Article 6(1)(f) of the GDPR – if you are a natural person acting on behalf of or for the benefit of the client). |
| Purpose | Answering a question asked using the “Become a Partner of the Nowodvorski Lighting brand” tab (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Data retention period | As a rule, we process your data for the entire time you have an account on the administrator’s website, i.e. until the account on our website is deleted. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you submit a justified objection to the processing before the expiry of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | Typically, these are: name, surname, e-mail address, log data, address, telephone number, position, NIP. |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing some data is not a statutory condition or a condition for concluding a contract. |
| What if you don’t provide your details | If you do not provide the details, you will not be able to create an account for “B2b Zone/ Designer Zone”. |
| Data recipients | Recipients are third parties to whom we transfer your data: – entities that provide us with IT tools to store your data or entities that have access to your data as part of maintenance work in IT systems. -website provider. |
| Data transfer | As a rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, taking into account the services provided by the Administrator’s subcontractors in the implementation of support for ICT services and IT infrastructure, the Administrator may outsource the performance of certain IT activities or tasks to recognized subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of protection of personal data in accordance with EEA standards. In the case of recipients in the territory of countries not covered by the decision of the European Commission, in order to ensure an adequate level of this protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the Standard Contractual Clauses may be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Administrator is in accordance with the principles provided for in Chapter V of the GDPR. You can request further information about the security measures in place in this regard, obtain a copy of these security measures and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
Customers and their representatives
| Purposes and legal bases of processing | |
| Purpose | Performance of a contract with a client or taking actions prior to entering into a contract, at the client’s request, expressed in any way, e.g. by filling in a contact form on the website (Article 6(1)(b) of the GDPR – if you are a customer; Article 6(1)(f) of the GDPR – if you are a natural person acting on behalf of or for the benefit of a client). |
| Purpose | Fulfilment of obligations arising from legal provisions, in particular tax and accounting provisions (Article 6(1)(c) of the GDPR). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in establishing, pursuing or defending against claims (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). Note: providing data other than those requested by the Administrator or data marked as optional is an explicit action, tantamount to giving consent to the processing of personal data for the purposes for which they were provided. |
| Data retention period | Personal data will be stored until the expiry of the limitation period for claims arising from the contract with the client. Certain data will also be stored until the expiry of the data retention obligations resulting from special regulations, in particular the storage of accounting documents. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | Our client (party to the contract) may be a natural person or an institution, e.g. a commercial law company. In the latter case, we process personal data of persons who act on behalf of the institution, e.g. the president, proxy or contact persons regarding the performance of the contract. Before concluding a contract with a client, we obtain the data necessary to present an offer. Usually these are basic contact details: name, email address, phone number. In the case of clients – natural persons, before concluding the contract, we obtain additional data necessary for its conclusion, e.g. PESEL or address of residence, depending on the product/service we sell. In the course of the contract with the client, we obtain or process further data, such as data on concluded transactions or in general – the history of cooperation, including the results of the satisfaction survey. Note: if you have registered an account on our website in connection with the use of our services/purchase of products offered by us, please remember that such an account is a separate service and information on the processing of your data as part of the provision of this service by us can be found in another section of this Policy. |
| Data Source | As a standard, we obtain data directly from you. Your personal data may also be obtained from another source, e.g. from our client – a company, if you are an employee or representative of our company. Sometimes we obtain personal data from public sources, e.g. the client’s website or from the so-called business intelligence agencies, if we want to verify the client before establishing cooperation with him. |
| Obligation to provide data | Providing some data is necessary for the conclusion and subsequent performance of the contract. Remember that the contract can be concluded in various ways, e.g. by placing an order in an online store. |
| What if you don’t provide your details | If you do not provide the data that is a condition for concluding the contract, the contract cannot be concluded. |
| Data recipients | Recipients are third parties to whom we transfer your data: – state authorities or other entities authorized under the regulations, if it is necessary for the performance of legal obligations, – providers of external ICT systems, providing support and providing IT solutions, – entities auditing our activities or appraisers, – entities providing accounting, consulting or legal services, – companies that dispose of or archive documents and other media, – companies providing courier and postal services, – banks and other financial and payment institutions, – marketing agencies. |
| Data transfer | As a rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, taking into account the services provided by the Administrator’s subcontractors in the implementation of support for ICT services and IT infrastructure, the Administrator may outsource the performance of certain IT activities or tasks to recognized subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of protection of personal data in accordance with EEA standards. In the case of recipients in the territory of countries not covered by the decision of the European Commission, in order to ensure an adequate level of this protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the Standard Contractual Clauses may be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Administrator is in accordance with the principles provided for in Chapter V of the GDPR. You can request further information about the security measures in place in this regard, obtain a copy of these security measures and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
Contractors (including suppliers) and their representatives
| Purposes and legal bases of processing | |
| Purpose | Performance of a contract with a contractor or taking actions prior to the conclusion of the agreement, at the request of the contractor, expressed in any way, e.g. by filling in the contact form on the website (Article 6(1)(b) of the GDPR – if you are a contractor; Article 6(1)(f) of the GDPR – if you are a natural person acting on behalf of or for the benefit of a contractor). |
| Purpose | Fulfilment of obligations arising from legal provisions, in particular tax and accounting provisions (Article 6(1)(c) of the GDPR). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in establishing, pursuing or defending against claims (Article 6(1)(f) of the GDPR). |
| Data retention period | Personal data will be stored until the expiry of the limitation period for claims arising from the contract with the contractor. Certain data will also be stored until the expiry of the data retention obligations resulting from special regulations, in particular the storage of accounting documents. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is accepted. |
| Data range | Our contractor (party to the contract) may be a natural person or an institution, e.g. a commercial law company. In the latter case, we process personal data of persons who act on behalf of the institution, e.g. the president, proxy or contact persons for the performance of the contract. Before concluding an agreement with a contractor, we obtain the data necessary to start negotiating the terms of cooperation. Usually these are basic contact details: name, email address, phone number. In the case of contractors – natural persons, before concluding the agreement, we obtain additional data necessary for its conclusion, e.g. PESEL or address of residence. In the course of the contract with the contractor, we obtain or process further data, such as data on invoices issued by the contractor or, in general, the history of cooperation. |
| Data Source | As a standard, we obtain data directly from you. Your personal data may also be obtained from another source, e.g. from our contractor – a company, if you are its employee or representative. Sometimes we obtain personal data from publicly available sources, e.g. from the contractor’s website or the so-called business intelligence agencies, if we want to verify the contractor before establishing cooperation with him. |
Handling complaints
| Purposes and legal bases of processing | |
| Purpose | Implementation of the obligation to consider complaints (Article 6(1)(c) of the GDPR in conjunction with Article 7a of the Consumer Rights Act). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in enabling the preparation of an answer to the question asked, not related to the complaint, and its dispatch (Article 6(1)(f) of the GDPR). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in establishing, pursuing or defending against claims (Article 6(1)(f) of the GDPR). |
| Data retention period | Data processed in connection with the consideration of complaints are stored until the expiry of the data retention obligations resulting from special regulations (e.g. in connection with the payment of funds), in other cases – for a period of 2 years from the end of the complaint procedure, understood as responding to the complaint. The data processed for the purpose of preparing an answer to the question asked, not related to the complaint, and sending it will be processed for a period of 2 years from the date of the answer. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter period, i.e. until your objection is accepted. |
| Data range | Usually these are basic contact details: name and surname, e-mail address, phone number and information regarding the complaint/inquiry submitted unrelated to the complaint. |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing data is not a statutory requirement or a condition for concluding a contract. |
| What if you don’t provide your details | If you do not provide information, we will not be able to process your complaint or provide you with an answer to a question unrelated to the complaint. |
| Data recipients | Recipients are third parties to whom we transfer your data: – state authorities or other entities authorized under the regulations, if it is necessary for the performance of legal obligations, – providers of external ICT systems, providing support and providing IT solutions, – entities providing accounting services (if, for example, we make refunds), advisory, auditing or legal services, – companies that dispose of or archive documents and other media, – companies providing courier and postal services, – banks and other financial and payment institutions, if, for example, we make refunds, – companies from the Administrator’s capital group. |
| Data transfer | No, we will not transfer your data outside the European Economic Area. The data will be transferred to [name of country] in accordance with the decision of the European Commission establishing an adequate level of protection of personal data (Article 45 GDPR). – [link to the decision] The data will be transferred to [name of country] after the so-called standard contractual clauses adopted by the European Commission have been concluded (Article 46(2)(c) of the GDPR). Please contact us if you would like a copy of the standard contractual clauses you have concluded. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
Recipients of marketing messages
| Purposes and legal bases of processing | |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in the marketing of its own products and services (Article 6(1)(f) of the GDPR) using the following forms of communication: e-mails, for the purpose of sending a newsletter. PLEASE NOTE: the use of certain forms of communication requires a separate consent to the use of this channel, in accordance with Article 398 of the Electronic Communications Law. |
| Purpose | Pursuing the legitimate interest of companies cooperating with the Administrator consisting in marketing their products and services, when you give your consent to this (Article 6(1)(a) of the GDPR). |
| Purpose | Fulfilment of obligations arising from the provisions of law, in particular the Electronic Communications Law (Article 6(1)(c) of the GDPR). |
| Purpose | Implementation of the Administrator’s legitimate interest consisting in establishing, pursuing or defending against claims related to the sending of marketing messages, if such are reported (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Data retention period | Personal data will be stored until you object to marketing activities or withdraw your consent, depending on the legal basis for sending communications, i.e. you show us in any way that you do not want to receive information from us about our activities/services. If you make certain claims in connection with the sending of marketing communications by us, the data will be stored until the statute of limitations for these claims expires. Certain data will also be stored until the expiry of the data retention obligations resulting from special regulations, in particular the Electronic Communications Law. If we process certain data on the basis of the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR) and you file an effective objection to the processing before the expiry of the basic storage period, then the data will be processed for this specific purpose for a shorter time, i.e. until your objection is accepted (unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to justify the objection). If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent before the end of the basic storage period, then the data will be processed for a shorter period for this specific purpose, i.e. until you withdraw your consent. |
| Data range | Normally, these are only the data necessary to send a marketing message, i.e. name and surname, e-mail address, phone number, and in the case of messages sent by traditional mail – also the correspondence address. |
| Data Source | As a standard, we obtain data directly from you. |
| Obligation to provide data | Providing data is neither a contractual nor a statutory requirement. |
| What if you don’t provide your details | No effect due to the above. |
| Data recipients | Recipients are third parties to whom we transfer your data: – providers of external ICT systems, providing support and providing IT solutions, – entities providing services for sending marketing messages on our behalf. |
| Data transfer | As a rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, taking into account the services provided by the Administrator’s subcontractors in the implementation of support for ICT services and IT infrastructure, the Administrator may outsource the performance of certain IT activities or tasks to recognized subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of protection of personal data in accordance with EEA standards. In the case of recipients in the territory of countries not covered by the decision of the European Commission, in order to ensure an adequate level of this protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the Standard Contractual Clauses may be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Administrator is in accordance with the principles provided for in Chapter V of the GDPR. You can request further information about the security measures in place in this regard, obtain a copy of these security measures and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. We do not make automated decisions based on this data that we process in the process of sending messages. However, we may make such decisions on the basis of data obtained in other processes, e.g. in the process of performing a contract concluded with you. We use your purchase history to build your profile and then decide which offers to send you. This is done on the basis of Article 22(2)(c) of the GDPR; the condition is that you have obtained your prior explicit consent to do so. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
Website users (data from cookies or other tracking technologies)
| Purposes and legal bases of processing | PLEASE NOTE: if you have a registered account on our website or make purchases on it, you can find information about data processing in this regard in other parts of the Policy. |
| Purpose | To ensure the functionality of the website and to facilitate its use (Article 6(1)(f) of the GDPR). |
| Purpose | Conducting analysis and statistics on the use of the Administrator’s website by users (Article 6(1)(f) of the GDPR). |
| Purpose | Purposes indicated in the content of consents to the processing of personal data, if such consents have been given (Article 6(1)(a) of the GDPR). |
| Purpose | Fulfilment of obligations arising from the provisions of law, in particular the Electronic Communications Law (Article 6(1)(c) of the GDPR). |
| Data retention period | Certain data will also be stored until the expiry of the data retention obligations resulting from special regulations, in particular the Electronic Communications Law. If we process certain data on the basis of the legitimate interest of the Controller (Article 6(1)(f) of the GDPR) and you submit a justified objection to the processing, then the data will be processed for this specific purpose until your objection is accepted. If we process certain data on the basis of your consent (Art. 6 (1) (a) GDPR) and you withdraw your consent, the data will be processed for this specific purpose until you withdraw your consent. |
| Data range | Typically, this includes data such as your IP address and any information about you that comes from cookies or the actions of so-called other tracking technologies. This may include, for example, information about the device from which you connect to us (from which you access our website), information about the browser you use, information about what you clicked on on our website. For details of what this data may be, please see the Cookie Policy section. |
| Data Source | As a standard, we collect data directly from you as a user of our website. |
| Obligation to provide data | Providing data is not a contractual or statutory requirement. |
| What if you don’t provide your details | No effects due to the above. |
| Data recipients | Recipients are third parties to whom we transfer your data: – our suppliers, including the service providers referred to below, – entities that provide us with IT tools to process your data, including entities that provide us with so-called tracking technologies, – marketing agencies. |
| Data transfer | As a rule, your personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, taking into account the services provided by the Administrator’s subcontractors in the implementation of support for ICT services and IT infrastructure, the Administrator may outsource the performance of certain IT activities or tasks to recognized subcontractors operating outside the EEA, which may result in the transfer of your data outside the EEA. Recipient countries outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of protection of personal data in accordance with EEA standards. In the case of recipients in the territory of countries not covered by the decision of the European Commission, in order to ensure an adequate level of this protection, the Administrator concludes agreements with the recipients of your personal data, based on standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR. A copy of the Standard Contractual Clauses may be obtained from the Controller by contacting the contact details provided above. The method of securing your data used by the Administrator is in accordance with the principles provided for in Chapter V of the GDPR. You can request further information about the security measures in place in this regard, obtain a copy of these security measures and information on where they are available. |
| Automated decisions | Your data will not be subject to a decision based solely on automated processing, including profiling, producing legal effects or having a similar material impact. |
| Your rights | a) access to their personal data – within the limits of Article 15 of the GDPR, b) rectify their personal data – within the limits of Article 16 of the GDPR, c) delete their personal data – within the limits of Article 17 of the GDPR, d) restriction of the processing of their personal data – within the limits of Article 18 of the GDPR, e) transfer of their personal data – within the limits of Article 20 of the GDPR, f) withdraw consent to data processing at any time, if it was the basis for processing, whereby this does not affect the lawfulness of the processing carried out before the withdrawal of consent, and g) the right to object to the processing of your personal data at any time – within the limits of Article 21 of the GDPR – if the legal basis for their processing is the legitimate interest of the Administrator or a third party (Article 6(1)(f) of the GDPR) – when submitting an objection, you should indicate the reasons related to your particular situation, unless the objection concerns processing for the purposes of direct marketing – then there is no requirement to indicate such a reason. |
| Right of complaint | If you believe that we are processing your personal data unlawfully, you can file a complaint with the President of the Office for Personal Data Protection. More information on this topic can be found on the office’s website. |
If there are changes in the way we process your personal data, we will update this Privacy Policy and post the most recent version on our website, in advance in proportion to the materiality of the change.