GDPR information obligation

On May 25, 2018, new provisions on the protection of personal data (GDPR) came into force. So we want to explain what this means for you in practice. The security of your data is our priority, therefore we make every effort to ensure that their processing is safe and transparent for you. For this purpose, we have introduced a separate policy dedicated to the protection of personal data.

Its idea is to present you with all the rights you have in connection with the provisions on the protection of personal data and the obligations that we must fulfill towards you on the basis of, inter alia, art. 13 of the GDPR (the so-called information obligation).

1. At the beginning, we want to explain to you what the GDPR really is.

GDPR is nothing more than an abbreviation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC . So whenever we use this abbreviation, we will refer to this legal act. We will also often use the term "General Data Protection Regulation" interchangeably.

2. What is an Administrator?

The data administrator, i.e. the entity deciding for what purpose and how your data will be processed is: BTS GROUP Agata Bekier in Warsaw, ul. Mazowiecka 11/49, 00-052 Warszawa, NIP: 522-285-64-77, REGON: 146064120, hereinafter referred to as the "Administrator".

3. Who is the Data Protection Officer (DPO)?

The data protection officer (DPO) is a person you can contact if you have questions or doubts as to the scope of processing your data by the Administrator.

This function in our company is performed by: Agata Bekier

We have enabled you to contact the Data Protection Officer in several ways:

a) as a rule, we recommend contacting us by e-mail at the following e-mail address: kontakt@cyklorama.com.pl. This form will enable us to specifically and transparently refer to the correspondence sent by you.

b) if, however, you find that e-mail contact is inconvenient for you, you can contact the Data Protection Officer by phone: +48 22 498 09 28

4. We process your data for the following purposes:

a) in order to conclude a contract and implement the complaint process (the basis of Article 6 (1) (b) of the GDPR);

b) in order to send commercial or marketing information by e-mail based on your consent - if it is expressed (the basis of Article 6 (1) (a) of the GDPR);

c) for archival (evidence) purposes to secure information in the event of a legal need to prove facts, which is our legitimate interest (the basis of Article 6 (1) (f) of the GDPR in conjunction with Article 7 (1) and (3) GDPR);

d) in order to possibly establish, investigate or defend against claims, which is our legitimate interest (the basis of Article 6 (1) (f) of the GDPR);

e) to test customer satisfaction and determine the quality of our service, which is our legitimate interest (the basis of Article 6 (1) (f) of the GDPR)

f) in order to offer your products and services directly (direct marketing, which is our legitimate interest (the basis of Article 6 (1) (f) of the GDPR);

g) fulfillment of the legal obligation incumbent on the Administrator (Article 6 (1) (c) of the GDPR), e.g. for accounting purposes and for tax reasons.

5. Legal basis for the processing of personal data - art. 6 paragraph 1 lit. a GDPR1, art. 6 paragraph 1 lit. b GDPR, art. 6 sec. 1 lit. c GDPR, art. 6 paragraph 1 lit. f GDPR.

6. Information about the recipients of personal data:

We care about the confidentiality of your data. We will also be able to make them available to entities with whom we have concluded an entrustment agreement pursuant to Art. 28 GDPR. In particular, data may be entrusted to suppliers of technological solutions (ICT service providers), organizational (companies dealing with the transport of goods and people, logistics support services). If you want to get more detailed information on the scope of services provided by data processors, you can always contact the Data Protection Officer or another employee of the Administrator for this purpose. We will also be able to share your personal data with other entities cooperating with us in order to ensure business continuity, especially in the case of organizing additional events, classes or other types of services that are not provided on a continuous basis, but also insurance entities, banks or electronic payment services. Your data may also be made available to companies operating in the field of legal services and debt collection, i.e. law offices, debt collection companies, etc., when we will be forced to pursue our claims.

7. Your personal data will not be transferred to a third country.

8. Retention period, i.e. how long will we process your personal data?

We will process your data no longer than necessary.

a) For accounting purposes and for tax reasons, we will process them as long as we are obliged to do so by law. Under the current regulations, it is a period of 5 years counted from the end of the calendar year in which the tax obligation arose;

b) If personal data are processed by us in order to pursue claims (including in court proceedings), we will be able to process them for this purpose for the period of limitation of claims in accordance with the provisions of the Civil Code;

c) If you give us your consent to the processing of your personal data, be it for marketing purposes, image dissemination and in many other cases, when we ask for your consent, then we will process it until you withdraw your consent;

d) After the completion of the primary purpose for which your data was collected (e.g. performance of the contract, processing is necessary to perform the contract), your data will be processed for archival purposes for a period consistent with the archival regulations in force in us and for the period necessary to defend against claims directed against us, on the basis of generally applicable legal provisions, taking into account the limitation periods for claims specified in generally applicable provisions of law.

9. Please be advised that you have:

a) the right to access your personal data and receive a copy of it;

b) the right to rectify (correct) your data;

c) the right to delete data - if in your opinion there are no grounds for us to process this data, you may request that we delete it;

d) the right to limit data processing - you may request that we limit the processing of your personal data only to their storage or performance of activities agreed with you, if in your opinion we have incorrect data about you or we process them unfoundedly; or you do not want us to remove them because they are needed to establish, assert or defend claims; or for the duration of the objection to data processing;

e) the right to object to data processing - "Marketing" objection. You have the right to object to the processing of your data for the purpose of direct marketing. If you exercise this right - we will stop processing your data for this purpose.

f) the right to object due to a special situation. You also have the right to object to the processing of your data on the basis of a legitimate interest for purposes other than direct marketing. You should then indicate to us a special situation that, in your opinion, justifies the cessation of the processing covered by the objection. We will cease to process your data for these purposes, unless we prove that the grounds for processing your data override your rights or that your data is necessary for us to establish, pursue or defend claims;

g) the right to transfer data - you have the right to receive from us in a structured, commonly used and machine-readable format your personal data that we have on the basis of a contract or your consent. You can also order us to send this data directly to another entity;

h) the right to lodge a complaint to the supervisory body - if you believe that we are processing your data unlawfully, you may submit a complaint to the President of the Personal Data Protection Office or another competent supervisory authority;

i) the right to withdraw consent to the processing of personal data - at any time you may withdraw your consent to the processing of personal data that we process on the basis of your consent. Withdrawal of consent will not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.

In order to exercise your rights, please send your request to the email address: kontakt@cyklorama.com.pl

Please remember that before exercising your rights, we will have to make sure that you are you, i.e. identify you accordingly.

10. We also inform you that in relation to personal data processed on the basis of your consent - you have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal. The consent may be withdrawn in the same form as the consent was given.

11. Providing data is voluntary, but often necessary to be able to conclude a contract with us, use our services or simply be able to contact us. However, if we want to provide you with additional services, e.g. product marketing by e-mail or telephone, we will always ask for your consent. If you do not consent to marketing, it does not affect the conclusion of the contract for the provision of cyclorama services. We treat your consent as a voluntary, informed, unequivocal declaration of will, which may be withdrawn at any time.

12. Your personal data will be processed in an automated manner. We process them, both on paper and many times in IT systems. However, this does not involve automatic decision making, including profiling.

1) GDPR - REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (general regulation on data protection).