Privacy Policy

1. Definitions
   1. Administrator – PPH KOSTRZEWA sp.k. with its registered office in Giżycko, ul. Przemysłowa 11A, 11-500. In case of any questions related to data processing, please contact us via e-mail at rodo@kostrzewa.com.pl .
   2. Personal data – information about a natural person identified or identifiable through one or more specific factors determining their physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, internet identifier and information collected through cookies and other similar technologies.
   3. Policy – ​​this Privacy Policy.
   4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
   5. Website – the website run by the Administrator at https://r290.uk/
   6. User – any natural person visiting the Website or using one or more services or functionalities described in the Policy.
2. Processing of Personal Data in connection with the use of the Service
   1. In connection with the User's use of the Service, the Administrator collects data to the extent necessary to provide the individual services offered. Detailed principles and purposes of processing Personal Data collected during the User's use of the Service are described below.
3. Purposes and legal basis for processing Personal Data on the Website
   1. Using the Service
      1. Personal data of all persons using the Website are processed by the Administrator:
         1. in order to provide services electronically in the scope of making the content collected on the Website available to Users – then the legal basis for processing is the necessity of processing for the performance of the contract (Article 6, paragraph 1, letter b of the GDPR);
         2. in order to establish and pursue claims or defend against claims – the legal basis for processing is the legitimate interest of the Administrator (Article 6 paragraph 1 letter f of the GDPR), consisting in the protection of its rights.
   2. Contact form
      1. The Administrator provides the possibility of contacting him using an electronic contact form. Using the form requires providing Personal Data necessary to establish contact with the User and respond to the inquiry. The User may also provide other data to facilitate contact or handling the inquiry. Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to provide them results in the inability to handle it. Providing the remaining data is voluntary.
      2. Personal data are processed for the purpose of identifying the sender and handling their query sent via the provided form – the legal basis for processing is the necessity of processing for the performance of the service provision agreement (Article 6, paragraph 1, letter b of the GDPR); in the scope of data provided optionally, the legal basis for processing is consent (Article 6, paragraph 1, letter a of the GDPR).
   3. Marketing
      1. The User's personal data may also be used by the Administrator to send marketing content to him/her via various channels, i.e. via e-mail, MMS/SMS. Such actions are taken by the Administrator only if the User has given consent to them, which he/she may withdraw at any time.
      2. Personal data are processed:
         1. in order to send the ordered commercial information – the legal basis for processing, including the use of profiling, is the legitimate interest of the Administrator (Article 6, paragraph 1, letter f of the GDPR) in connection with the consent given;
         2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Article 6, paragraph 1, letter f of the GDPR), consisting in conducting analyses of Users’ activity on the Website in order to improve the functionalities used.
4. Cookies
   1. The Administrator uses cookies as part of the Service. The purposes and principles of using cookies can be found in the Cookies Policy.
5. The period of processing of Personal Data
   1. The period of data processing by the Administrator depends on the type of service provided and the purpose of processing. As a rule, data is processed for the duration of the service, until the consent is withdrawn or an effective objection is raised to data processing in cases where the legal basis for data processing is the legitimate interest of the Administrator.
   2. The data processing period may be extended if processing is necessary to establish and pursue potential claims or defend against claims, and after that time only if and to the extent required by law. After the processing period, the data is irreversibly deleted or anonymized.
6. User Rights
   1. The User has the right to access the content of the data and to request its rectification, deletion, restriction of processing, the right to transfer data and the right to lodge a complaint with the supervisory authority responsible for the protection of Personal Data.
   2. The User also has the right to object to the processing of data which is carried out on the basis of the legitimate interest of the Administrator.
   3. To the extent that the User's data are processed on the basis of consent, this consent may be withdrawn at any time by contacting the Administrator via e-mail at rodo@kostrzewa.com.pl .
7. Recipients of Personal Data
   1. In connection with the provision of services, Personal Data will be disclosed to external entities, in particular IT service providers enabling the proper use of the Website.
   2. If the User consents, their data may also be made available to other entities for their own purposes, including marketing purposes.
   3. The Administrator reserves the right to disclose selected information concerning the User to competent authorities or third parties who submit a request for such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.
8. Transfer of Personal Data outside the EEA
   1. The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers Personal Data outside the EEA only when necessary and with an adequate level of protection, in particular through:
      1. cooperation with entities processing Personal Data in countries for which an appropriate decision of the European Commission has been issued regarding the assurance of an adequate level of protection of Personal Data;
      2. use of standard contractual clauses issued by the European Commission;
      3. application of binding corporate rules approved by the relevant supervisory authority.
   2. The Administrator always informs about the intention to transfer Personal Data outside the EEA at the stage of their collection.
9. Personal Data Security
   1. The Administrator conducts ongoing risk analysis to ensure that Personal Data is processed by him in a secure manner – ensuring, above all, that only authorized persons have access to the data and only to the extent necessary for the tasks they perform. The Administrator ensures that all operations on Personal Data are recorded and performed only by authorized employees and associates.
   2. The Administrator shall take all necessary measures to ensure that its subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process Personal Data on behalf of the Administrator.
10. Contact details
    1. Contact with the Administrator is possible at the correspondence address: PPH KOSTRZEWA sp.k. with its registered office in Giżycko, ul. Przemysłowa 11A, 11-500 and via e-mail address rodo@kostrzewa.com.pl .
11. Changes to Privacy Policy
    1. The policy is constantly reviewed and updated as necessary.
    2. The current version of the Policy has been adopted and is effective from 01.03.2023.