PRIVACY POLICY

KRAKÓW,  24 MAY 2018

 

1. GENERAL PROVISIONS

 

1. This document constitutes a description of the Privacy Policy of 7R S.A. with its registered office in Kraków (address: ul. Ludwinowska 7, 30 331 Kraków), entered into the register of entrepreneurs of the National Court Register kept by the District Court for Kraków Śródmieście in Kraków, 11th Commercial Division of the National Court Register under KRS No.: 0000379632, Tax ID No. (NIP): 6772320831 and Statistical No. (REGON): 120812966, hereinafter referred to as: “the Company”. The purpose hereof is to de fine the principles, method of processing and use of data and information originating from users of the website administered by the Company, including those contacting the Company through the contact indicated therein, and it contains information on the ri ghts of natural persons with regard to the personal data provided by them.
2. Please read this policy carefully. By accessing or using the website, sending us any personal data or contacting us using the telephone number, fax number or email address indicated at the Company’s website, the user agrees to the terms of this Privacy Policy.
3. Please note that leaving the Company’s website (e.g. through a link to a website in another domain), the user will be transferred to an area where this Privacy Policy does not apply. The Company shall not be held responsible for the privacy policies of third parties’ websites.

 

2. PERSONAL DATA CONTROLLER

 

1. The Company is the Controller of the personal data provided by the users at the Company’s website:
2. The Company exercises due diligence to ensure that all personal data are processed in accordance with the purpose for which they were collected and used in accordance with the conditions and categories of data processed permitted by law.

 

3. CONTACT

 

1. In all matters related to data protection and processing of personal data originating from users of the website administered by the Company, as well as establishing contact with the Company using the phone number, fax number or e mail address indicated at the Company’s website, the Comp any may be contacted via e mail: [email protected] or in writing to the address of the Company indicated in item 1.1. above.

 

4. INFORMATION SECURITY AND SAFEKEEPING AND DATA PROCESSING RULES

 

1. The Company ensures the security of personal data through appropriate technical and organizational measures aimed to prevent unlawful data processing and their accidental loss, destruction a nd damage. The Company’s website and the contact form at the Company’s website are encrypted.
2. The Company exercises due diligence to ensure that personal information is processed in accordance with the principles of personal data processing specified in th e GDPR, that is
   • processed lawfully, fairly and in a transparent manner in relation to the data subject (lawfulness, fairness and collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompa tible with those purposes (“purpose limitation”);
   • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);
   • accurate and, where necessary, kept up to date; personal data that are inaaccurate and, where necessary, kept up to date; personal data that are inaccurate, ccurate, having regard to the purposes for which they are processed, will be deleted or having regard to the purposes for which they are processed, will be deleted or rectified without delay (‘accuracy’);rectified without delay (‘accuracy’);
   • kept in a form which permits identification of data subjects for no longer than is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personnecessary for the purposes for which the personal data are processed (“storage al data are processed (“storage limitation”);limitation”);
   • processed in a manner that ensures appropriate security of the personal data, processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriaaccidental loss, destruction or damage, using appropriate technical or organizational te technical or organizational measures (‘integrity and confidentiality’).measures (‘integrity and confidentiality’).

 

5. PURPOSE OF PERSONAL DATA PROCESSING AND LEGAL BASIS

 

1. The Company collects personal data when:
   • the user of the website administered by the Company contacts the Company by means ofmeans of a contact form;
   • the user of the website administered by the Company subscribes to the newsletter;
   • the data subject contacts the Company using the telephone number provided at the website;
   • the data subject contacts the Company using the e-mail address or fmail address or fax no. provided ax no. provided at the website.
2. Each time the purpose of data processing by the Controller results from actions taken by users of the website administered by the Company, as well as establishing contact with the of the website administered by the Company,as well as establishing contact with the Company using the phone number, fax number or Company using the phone number, fax number or e-mail address indicated at the Company’s mail address indicated at the Company’s the website.
3. The purposes and legal bases for the collection of personal data in such cases shall be as follows:
   • processed in order to contact the data subject once in a specified form with regard to processed in order to contact the data subject once in a specified form with regard to the demand,the demand, e.g. presentation of an offer, provision of information e.g. presentation of an offer, provision of information — legal basis: legal basis: Article 6, section 1, letter f of the GDPR (providing answers to requests and inquiries Article 6, section 1, letter f of the GDPR (providing answers to requests and inquiries made using the contact form or in another form, including storing relevant requests made using the contact form or in another form, including storing relevant requests and answers and answers provided in order to comply with the principle of accountability);
   •  in the case of telephone contact and recording of conversations during which in the case of telephone contact and recording of conversations during which personal data may be transferred, the data will be processed in order to enable personal data may be transferred, the data will be processed in order to enable contact with the data subject incontact with the data subject in relation to the demand, e.g. presentation of an offer, relation to the demand, e.g. presentation of an offer, provision of information provision of information — legal basis: Article 6, section 1, letter f of the GDPR legal basis: Article 6, section 1, letter f of the GDPR (responding to requests and inquiries made using a contact form or in any other (responding to requests and inquiries made using a contact form or in any other form, including storing relevant requform, including storing relevant requests and answers provided in order to comply ests and answers provided in order to comply with the principle of accountability);
   • w przypadku jednoczesnego wyrażenia zgody na otrzymywanie komunikacji marketingowej, dane osobowe będą wykorzystane w celu przedstawienia informacji o produktach i usługach Spółki lub podmiotów wchodzących w skład grupy kapitałowej 7R, których aktualna lista stanowi załącznik do niniejszej Polityki Prywatności/których aktualna lista znajduje się
   • in the case of simultaneous consent to receive marketing communications, personal in the case of simultaneous consent to receive marketing communications, personal data will be used to present information on the products and services of the data will be used to present information on the products and services of the Company or enCompany or entities belonging to the 7R capital group, whose current list is attached tities belonging to the 7R capital group, whose current list is attached to this Privacy Policy / whose current list isto this Privacy Policy / whose current list is HERE; providing the data and giving such d giving such consent is voluntary, however the lack there of will prevent receiving marketing consent is voluntary, however the lack there of will prevent receiving marketing communications communications – legal basis: Article 6, section 1, letter a of the GDPR (marketing legal basis: Article 6, section 1, letter a of the GDPR (marketing activities promoting the business conducted using eactivities promoting the business conducted using e-mail addresses and telephmail addresses and telephone one numbers)
   • in the event of concluding an agreement with the Company, personal data shall be in the event of concluding an agreement with the Company, personal data shall be used for the purposes of the implementation thereof used for the purposes of the implementation thereof – legal basis: Article 6, section legal basis: Article 6, section 1, letter b of the GDPR.1, letter b of the GDPR.

 

6. PERIOD OF PERSONAL DATA PROCESSING 

 

1. The Company examines whether personal data processed by it are not processed for a longer period than is necessary for the purposes for which the data are processed.a longer period than is necessary for the purposes for which the data are processed.
2.  Personal data processed on the basis of the granted consent will be processed until such csuch consent is revoked or the purpose for which they were collected ceases to exist. onsent is revoked or the purpose for which they were collected ceases to exist. The consent granted may be revoked at any time without affecting the lawfulness of processing carried out on the basis of the consent prior to its revocation.processing carried out on the basis of the consent prior to its revocation.
3. Data provided using the contact form or during telephone contact, by fax or eng the contact form or during telephone contact, by fax or e-mail mail will be processed for the time of meeting the demand, e.g. presentation of an offer, will be processed for the time of meeting the demand, e.g. presentation of an offer, providing information, but not longer than 2 years in order to comply with the providing information, but not longer than 2 years in order to comply with the principle of accountabilitprinciple of accountability.
4. Data processed in connection with the presentation of an offer, provision of services, conclusion and performance of an agreement will be processed in accordance with conclusion and performance of an agreement will be processed in accordance with the applicable regulations, however, no longer than until the expiry of the period in the applicable regulations, however, no longer than until the expiry of the period in which the Company or the data subject may pursue claims related thereto.
5. Data processed for the purpose of direct marketing will be processed until consent is revoked or objections are raised.revoked or objections are raised.

 

7. USER RIGHTS

 

1. The Company is responsible for exercising the rThe Company is responsible for exercising the rights of persons whose data are ights of persons whose data are processed in accordance with the applicable provisions of law. Should you have any processed in accordance with the applicable provisions of law. Should you have any questions or requests regarding the scope and exercise of your rights, or if you would questions or requests regarding the scope and exercise of your rights, or if you would like to contact us precisely in order to exercise yourlike to contact us precisely in order to exercise your specific data protection right, specific data protection right, please contact us by eplease contact us by e–mail at: [email protected]. The Company reserves mail at: [email protected]. The Company reserves the right to exercise the following rights after a positive verification of the identity of the right to exercise the following rights after a positive verification of the identity of the person applying for a given action.the person applying for a given action.
2. Access to personal data. Natural persons have the right to access data held by the personal data. Natural persons have the right to access data held by the Company.
3. Change of personal data. Natural persons have the right to change, including update, Change of personal data. Natural persons have the right to change, including update, their personal data processed by the Company.
4. Revocation of consent. Where personal data Revocation of consent. Where personal data are processed on the basis of consent, are processed on the basis of consent, natural persons have the right to revoke their consent at any time.
5. The right to limit or object to the processing of personal data. Natural persons shall have the right to restrict or object to the processing of theihave the right to restrict or object to the processing of their personal data at any r personal data at any time on account of their particular situation, unless such processing is required by time on account of their particular situation, unless such processing is required by law.
6. The right to request the deletion of data and the right to data transfer. Natural persons shall have the right to request the deletion of data persons shall have the right to request the deletion of data when they are no longer when they are no longer necessary for the purpose for which they were collected, in the event of revocation necessary for the purpose for which they were collected, in the event of revocation of consent, in the event of objection to processing or when the processing is of consent, in the event of objection to processing or when the processing is unlawful. The right to data transfer, on the other hand, applies when unlawful. The right to data transfer, on the other hand, applies when a person’s data a person’s data are processed on the basis of a consent or an agreement and when the processing is are processed on the basis of a consent or an agreement and when the processing is carried out automatically. In such a case, the Company issues or provides to the carried out automatically. In such a case, the Company issues or provides to the indicated entity the data of the person who requests it, in a structured, coindicated entity the data of the person who requests it, in a structured, commonly mmonly used format suitable for machine readout.
7. The Company informs that there is no obligation to delete data if the processing is necessary to: fulfill a legal obligation of processing under EU or the Polish law, or to necessary to: fulfill a legal obligation of processing under EU or the Polish law, or to perform a task in the public interperform a task in the public interest, or to establish, pursue or defend a claim.est, or to establish, pursue or defend a claim.
8. Whenever it is found that a natural person’s rights under the law and this Privacy Policy are violated, the natural person shall have the right to lodge a complaint with Policy are violated, the natural person shall have the right to lodge a complaint with the President of the Office for Personthe President of the Office for Personal Data Protection.

 

8. SCOPE OF PROVISION OF DATA ON USERS

 

1. The Company declares that it shall not sell, share or transfer the personal data collected for processing to other persons or institutions, unless it is done with the collected for processing to other persons or institutions, unless it is done with the express consent or at the reqexpress consent or at the request of that person or at the request of state authorities uest of that person or at the request of state authorities authorized under the law, for the purposes of the proceedings conducted by them.
2. The Company informs that personal data processed by the Company, including data processed for marketing purposes, maprocessed for marketing purposes, may be made available to entities from the 7R y be made available to entities from the 7R Capital group, the current list of which constitutes an appendix to this Privacy Capital group, the current list of which constitutes an appendix to this Privacy Policy/the current list of which may be foundPolicy/the current list of which may be found HERE. Article 6, section 1, letter f) of . Article 6, section 1, letter f) of the GDPR (and motif 48 of the GDPR) constitutes legal basis for the foregoing, and the GDPR (and motif 48 of the GDPR) constitutes legal basis for the foregoing, and therefore such processing of personal data shall take place when it is necessary for therefore such processing of personal data shall take place when it is necessary for the purposes resulting from the legitimate interestthe purposes resulting from the legitimate interests pursued by the Company, except s pursued by the Company, except when the interests or fundamental rights and freedoms of the data subject, which when the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, in particular when the data subject is a child, require the protection of personal data, in particular when the data subject is a child, take precedence over those interests.
3. The Company informs that personal data processed by the Company, including data orms that personal data processed by the Company, including data processed for marketing purposes, may be made available to other entities only if it processed for marketing purposes, may be made available to other entities only if it is permitted by law. In such a case, in a relevant agreement concluded with a third is permitted by law. In such a case, in a relevant agreement concluded with a third party, the Company proparty, the Company provides for security provisions and mechanisms in order to vides for security provisions and mechanisms in order to protect data and maintain the Company’s standards in terms of data protection, protect data and maintain the Company’s standards in terms of data protection, confidentiality and security.Such agreements are called personal data processing confidentiality and security.Such agreements are called personal data processing outsourcing agreements, and the Companyoutsourcing agreements, and the Company has control over how and to what extent has control over how and to what extent the entity to which the Company has entrusted the processing of certain categories the entity to which the Company has entrusted the processing of certain categories of personal data processes such data. Therefore, we wish to point out that the of personal data processes such data. Therefore, we wish to point out that the recipients of personal data processed by the Company recipients of personal data processed by the Company as a personal data controller as a personal data controller may be entities processing personal data pursuant to data processing agreements may be entities processing personal data pursuant to data processing agreements concluded with the Company, including financial institutions, whereas the Company concluded with the Company, including financial institutions, whereas the Company transfers personal data to such entities only to the extent thattransfers personal data to such entities only to the extent that it is actually necessary it is actually necessary to achieve the purpose of concluding and performing the agreement with a data to achieve the purpose of concluding and performing the agreement with a data subject.

 

9. TRANSFER OF DATA OUTSIDE EEA

 

1. The Company informs that personal data processed by the Company shall not be transferred outside the EEA.transferred outside the EEA.

 

10. AMENDMENTS TO THE PRIVACY POLICY

 

1. The Company undertakes to review this Privacy Policy regularly and to amend it if necessary due to: new legislation, new guidelines of authorities responsible for necessary due to: new legislation, new guidelines of authorities responsible for supervision over personal data protection processes, practisupervision over personal data protection processes, practices in the area of ces in the area of personal data protection. The Company also reserves the right to amend this Privacy personal data protection. The Company also reserves the right to amend this Privacy Policy in the event of changes in the technology used to process personal data (in so Policy in the event of changes in the technology used to process personal data (in so far as such changes affect the wording of this document), as well afar as such changes affect the wording of this document), as well as in the ways, s in the ways, purposes or legal bases of the processing of personal data by the Company.