INFORMATION ON THE PROCESSING OF PERSONAL DATA
With regard to performing the requirements of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”), we would like to inform you about the principles of your personal data processing for the purpose of concluding and performing agreements, performing legal obligations, pursuing the legitimate interests and on the basis of consents expressed, also we would like to inform you about your rights relating thereto.
The below-mentioned principles are in force as of 25 May 2018.
1. The controller of your personal data is: Infinite Sp. z o.o. with its registered office in Lublin (20-209), Projektowa 1, Poland, entered in the register of entrepreneurs of National Court Register run by the District Court Lublin East in Świdnik, 6th Commercial Division, under the number 0000016222, VAT No (NIP) 946-18-94-773, Statistical Registration Identification (REGON) 430801543 – hereinafter referred to as the Controller.
2. If you have any questions about the methods and the scope of your personal data processing with regard to activities undertaken by the Data Controller and your rights relating thereto, please contact the Data Protection Officer by e-mail: Ten adres pocztowy jest chroniony przed spamowaniem. Aby go zobaczyć, konieczne jest włączenie w przeglądarce obsługi JavaScript. or in writing – to the Controller address.
3. Controller – processes your personal data on the basis of the binding law, agreements concluded, for the purpose of pursuing the legitimate interests of the Controller and on the basis of the consent expressed.
4. Your personal data are processed for the following purposes:
a) concluding or performing agreements with business partners of the Controller (legal basis: Article 6.1 point (b) of the GDPR) – during the term of the agreement and settlements upon the agreement termination,
b) performing legal obligations, to which the Controller is subject to e.g. issuing or storing invoices and other accounting documents, replying to complaints (legal basis: Article 6(1) point (c) of the GDPR) – during the term when data is to be stored, pursuant to the binding legal regulations,
c) defining, defending and pursuing claims (legal basis: Article 6(1) point (f) of the GDPR) – during the limitation period of claims,
d) verifying the creditworthiness (legal basis: Article 6(1) point (f) of the GDPR) – during the period of time which is essential to evaluate the creditworthiness while concluding, prolonging or expanding the scope of the agreement,
e) direct marketing (legal basis: Article 6(1) point (f) of the GDPR) – during the term of the agreement or until an objection is filed,
f) fraud detection and prevention (legal basis: Article 6(1) point (c) and point GDPR) - during the term of the agreement and next, during the limitation period of claims or for the period of time, when proceedings are pursued by the competent public authorities,
g) in all other cases, your personal data are processed on the basis of the consent you have expressed, within the scope and the purpose named in the very consent (Article 6(1) point (a) of the GDPR) – from the moment the consent has been expressed till its withdrawal.
5. With regard to the processing of personal data for the purposes listed in point 4, entities from the following categories can be the recipients of your personal data:
a) entities processing personal data on behalf of the Controller on the basis of the applicable agreements, e.g.: maintaining IT systems of the Controller, subcontractors, advertising agencies, intermediaries, entities performing consulting, legal counselling, debt collection, accounting, auditing, mail delivery services on behalf of the Controller
b) entities from the capital group which the Controller belongs to,
c) entities entitled to receive the personal data by law, e.g.: courts and public authorities.
6. Currently, we do not intend to transfer your personal data outside the EEA (including the EU, Norway, Lichtenstein, Iceland), except when your personal data are acquired by means of the Controller websites and upon acquiring your consent to receive commercial messages, including a newsletter or upon approving the use of cookie files, when your personal data will be transferred to a third country, e.g. USA with regard to creating profiles in Google Analytics.
7. With regard to the processing of your personal data, you have the following rights:
a) the right to access your personal data, including the right to obtain a copy of them;
b) the right to request the rectification (correction) of your personal data – if your personal data are incorrect or incomplete;
c) the right to request the removal of your personal data (the so-called „right to be forgotten), if:
* data are no longer needed for the purposes they have been collected for or processed in any other manner,
* the data subject has objected to the processing of personal data,
* the data subject has withdrawn the consent to the processing of personal data, which comprised the legal basis for data processing and there is no other legal basis for data processing,
* personal data processing breaches the legal regulations,
* personal data are to be removed for the purposes arising from the obligations imposed by law,
d) the right to request the restriction of the personal data processing, if:
* the data subject questions the correctness of personal data,
* personal data processing breaches the law, while the data subject objects to the removal of the data and requests for the restriction of the personal data processing, the Controller no longer needs the personal data for his or her purposes, while the data subject needs the personal data to define, defend or pursue claims,
* the data subject has objected to the processing of personal data, until it is agreed if the legitimate interests of the Controller are superior to grounds of the objection
e) the right to transfer personal data – if the following conditions are met altogether:
* data processing is carried out on the basis of the agreement concluded with the data subject or on the basis of the consent expressed by the data subject,
* data processing is carried out in an automated manner,
f) the right to object to the processing of personal data, if circumstances arise with regard to your extraordinary situation, while the legal basis for data processing the indispensability of data for the legitimate interests pursued by the Controller or a third party (Article 6.1 point (f) of the GDPR), except for situations, when the Controller:
* proves that important legitimate grounds for the processing exist, which are superior to the interests, rights and freedoms of the data subject, and which require for the protection of personal data, in particular if the data subject is a child, or
* proves the grounds for defining, pursuing or defending claims.
If your personal data are processed for direct marketing purposes (including profiling), you have the right to object at any time, then the Controller will no longer be entitled to process your personal data on these grounds.
8. If the processing of personal data is carried out on the basis of the consent of a person to the processing of personal data (Article 6.1 point (a) of the GDPR), you have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing of personal data, which was carried out on the basis of the consent before the very consent was withdrawn, as defined by the binding law.
9. If you acquire information that the processing of your personal data by the Controller breaches the legal regulations, you have the right to file a complaint to the Chairman of the Data Protection Office.
10. If the processing of personal data is carried out on the basis of the consent expressed by the data subject, submitting your personal data is voluntary. If an agreement is to be concluded, submitting the personal data is voluntary, yet essential to conclude and perform the agreement.
11. Your personal data can be processed in an automated manner. Your personal data will not be profiled, except when the personal data are acquired by means of the Controller websites and upon acquiring the consent to receive commercial messages, including a newsletter or upon approving the use of cookie files from the data subject. Profiling is carried out on the basis of possessed data, i.e. in particular: data with regard to services provided, transmission data, location data, information acquired by means of cookie files. Detailed information on automated decision-making, including profiling, can be found in the Privacy Policy.