Personal Data Protection Regulation

In accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, so-called "GDPR"), we present the principles of personal data processing at PPH Kostrzewa sp.k. ul. Przemysłowa 11A, 11-500 Giżycko, tel. +48 87 429 56 00 , e-mail: biuro@kostrzewa.com.pl and the rights of data subjects.

1. The controller of the processed personal data is PPH Kostrzewa sp.k. ul. Przemysłowa 11A, 11-500 Giżycko, tel. +48 87 429 56 00 , e-mail: biuro@kostrzewa.com.pl .
2. In matters concerning personal data protection, you can contact us at the following correspondence address: PPH Kostrzewa sp.k. ul. Przemysłowa 11A, 11-500 Giżycko, tel. +48 87 429 56 00 , e-mail: biuro@kostrzewa.com.pl .
3. Personal data will be processed for the purpose of:
   1. conclusion and performance of contracts for the sale of goods/services or other commercial cooperation agreements between your company and PPH Kostrzewa sp.k. ul. Przemysłowa 11A, 11-500 Giżycko, tel. +48 87 429 56 00 , e-mail: biuro@kostrzewa.com.pl , in connection with art. 6 sec. 1 letter b) of the GDPR,
   2. the controller's fulfilment of the personal data's legal obligations in relation to conducting business, including, among others, those based on the provisions of the Act of 29 August 1997, the Tax Ordinance, tax regulations, accounting regulations, regulations on the obligations to archive accounting documentation - the basis for processing is Article 6, paragraph 1, letter c) of the GDPR,
   3. resulting from the legitimate interest of the administrator – the basis for processing is Article 6 paragraph 1 letter f) of the GDPR; the legitimate interest of the administrator may be, in particular, the efficient implementation of business and administrative processes related to the Administrator’s activities,
   4. direct marketing of the administrator's own products and services, including for analytical purposes - the basis for processing is Article 6 paragraph 1 letter a) of the GDPR, i.e. the consent of the data subject and Article 6 paragraph 1 letter f) of the GDPR, i.e. processing is necessary for the purposes resulting from the legitimate interest of the administrator; the legitimate interest of the administrator is the ability to provide the customer with information about its products or services, present offers, increase the sales of its goods and services,
   5. protection of the vital interests of the data subject, - the basis for processing is Article 6 paragraph 1 letter d) of the GDPR,
   6. the implementation of the legitimate interest of the company, consisting in the possible determination or pursuit of claims or defense against claims, the basis for processing is Article 6 paragraph 1 letter f) of the GDPR,
   7. for one or more specific purposes for which you have given your consent.
4. Your personal data may be made available to other recipients or categories of recipients to the extent that they are necessary to achieve the above-mentioned processing purposes. Such recipients include, in particular:
   1. tax offices and other state authorities,
   2. suppliers of IT systems and IT services,
   3. other entities cooperating with the data controller, including those providing advisory, legal, accounting, consulting, debt collection, insurance, courier, postal, transport or forwarding services – in order to perform the concluded contract,
   4. law enforcement agencies, bailiffs, judicial authorities and other state authorities – to the extent required by applicable law and at their request based on legal provisions.
5. Your personal data will be stored for the period necessary to achieve the above-mentioned purposes, in particular:
   1. in the scope of performance of contracts concluded with you – until its completion, as well as in order to secure any claims arising from the concluded contract until the expiry of the limitation period,
   2. in the case of personal data for which the applicable provisions of law require their possession, archiving and processing for a specified period - until the expiry of the obligation to store data resulting from the provisions of law, in particular the obligation to store accounting documents,
   3. in the case of data processing for marketing purposes – until an objection is raised or consent to the processing of data for this purpose is withdrawn.
6. Every data subject has the right to (subject to limitations imposed by law):
   1. access to the content of your data (in accordance with Article 15 of the General Data Protection Regulation);
   2. rectification (correction) of personal data – if the data is incorrect or incomplete (in accordance with Article 16 of the General Data Protection Regulation);
   3. deletion of data (in accordance with Article 17 of the General Data Protection Regulation);
   4. restrictions on data processing (pursuant to Article 18 of the General Data Protection Regulation);
   5. data portability (pursuant to Article 20 of the General Data Protection Regulation);
   6. the right to object (pursuant to Article 21 of the General Data Protection Regulation);
   7. withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
   8. lodge a complaint with the supervisory authority (President of the Personal Data Protection Office) if it is found that the processing of personal data violates the provisions of the General Data Protection Regulation.
7. Providing your personal data is mandatory when the premise for processing personal data is a legal provision, an agreement concluded between the parties or the implementation of the legitimate interest of the administrator. The consequence of not providing personal data required by PPH Kostrzewa sp.k. ul. Przemysłowa 11A, 11-500 Giżycko, tel. +48 87 429 56 00 , e-mail: biuro@kostrzewa.com.pl is the inability to conclude and perform an agreement or provide a service. In the event that the processing of personal data takes place on the basis of consent, providing personal data is voluntary.
8. Your personal data will not be transferred to a third country/international organisation, unless the personal data controller is obliged to do so under the applicable legal provisions.
9. The data administrator does not use automated decision-making or profiling.