PERSONAL DATA PROCESSING POLICY
at the Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna
The Data Administrator (hereinafter referred to as the Administrator) - Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna with its registered office in Zielona Góra at ul. Chemiczna 3, 65-713 Zielona Góra; e-mail: email@example.com;
BOLL - Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna with its registered office in Zielona Góra;
personal data - all information about an identified or identifiable physical person by one or more specific factors determining the physical, physiological, genetic, psychological, economic, cultural or social identity of a natural person, including name, e-mail address, telephone number, address;
protection of personal data (PPD) - protection of personal data at Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna;
GDPR - General Data Protection Regulation- Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals (natural persons) with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (Journal of Laws EC.L No. 119, p. 1).
This Policy of processing personal data refers to the processing of personal data by
Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna, as the Data Administrator. The Administrator processes personal data of the following persons:
people in contact by e-mail, letter;
contractors - natural persons conducting business activity, persons representing the contractor, employees and associates of the contractor;
people in contact by telephone.
OBJECTIVES AND LEGAL BASIS OF DATA PROCESSING BY THE ADMINISTRATOR
Processing of data of people contacting BOLL (by e-mail, letter)
In the case of sending the Administrator e-mail correspondence or by traditional means, not related to the services rendered to the sender or other contract concluded with him/her, personal data contained in this correspondence is processed solely for the purpose of communication and handling of the matter to which this correspondence relates. In such a case, providing certain data is required by the Administrator only if it is necessary for the above purpose, and the lack of providing such data results in the inability to settle the matter. The legal basis of the processing is the justified interest of the Administrator (Art. 6 section 1 letter f) of the GDPR), consisting in conducting correspondence addressed to him/her in connection with the conducted business activity. The Administrator processes only the personal data necessary for the case to which the correspondence relates. All correspondence is stored in a manner that ensures the security of the personal data contained in it and other information and is disclosed only to authorised persons. If there is already a legal relationship between the Administrator and the person in contact, the legal basis for processing is the necessity to process the contract/service (Art. 6 section 1 letter b) of the GDPR).
Processing of data of people contacting BOLL (by telephone)
In the event of contacting the Administrator by telephone, in matters not related to the contract or services rendered, we may request personal data only if it is necessary to handle the matter to which the contact relates. In this case, the lack of data will result in the inability to handle this matter. The legal basis in this case is the justified interest of the Administrator (Art. 6 section 1 letter f) of the GDPR), consisting in the necessity to settle a reported matter related to the business activity. If there is already a legal relationship between the Administrator and the person in contact, the legal basis for processing is the necessity to process the contract/service (Art. 6 section 1 letter b) of the GDPR).
Contractors - natural persons conducting business activity, persons representing the contractor, employees and associates of the contractor.
The Administrator processes the personal data of business partners - natural persons conducting business activity, persons representing the contractor, employees or associates who are contact persons with the contractor in connection with the performance of contracts and provision of services. Your data may be processed by the Administrator in terms of:
preparation, conclusion or performance of the contract, pursuant to Art. 6 section 1 letter b) of the GDPR);
documenting the correct performance of the contract pursuant to Art. 6 section 1 letter f) of the GDPR, where it is a legitimate interest to establish, assert or defend against claims;
fulfilment of legal obligation consisting in keeping accounting records, archiving documentation regarding, among others, concluded contracts, deliveries, settlements, complaints, accounting documentation, i.e. pursuant to Art. 6 section 1 letter c) of the GDPR (in connection, among others, with the provisions of the Accounting Act and Tax Ordinance);
conducting correspondence in connection with the Administrator's business (in current business matters, including the implementation of contracts between the Administrator and you/and the employer or the entity they represent, presenting offers, placing orders/receiving orders, answering questions), pursuant to Art. 6 section 1 letter b) of the GDPR, where the reasonable interest is the possibility of ongoing contact with our contractors and their employees and associates in business matters;
conducting direct marketing of the Data Administrator's goods and services, including providing information on the current offer and scope of activity. The legal basis for processing, depending on the tools used, is a legitimate interest (Art. 6 section 1 letter f) of the GDPR) consisting in the possibility of conducting marketing activities and increasing sales or your consent (Art. 6 section 1 letter a) of the GDPR).
Processing data of potential contractors
The data administrator may also collect data of potential contractors in order to:
• creating a database of potential contractors, based on the legally justified interest of Art. 6 clause 1 lit. f of the general regulation on the protection of personal data of 27 April 2016 (hereinafter the GDPR), where the legitimate interest is to expand the market (we can plan a visit of a sales representative to the place of your business, we can send a request regarding the possibility of sending a commercial offer) .
• conducting direct marketing of the Data Administrator's goods and services, including the provision of information on the current offer and scope of activity. The legal basis for processing, depending on the tools used, is a legitimate interest (art.6 par.1 lit.f RODO) consisting in the possibility of conducting marketing activities and increasing sales or your consent (art.6 par.1 lit.a RODO) .
Data processing in other cases
In connection with the activities carried out, the Administrator collects personal data also in other cases - e.g. during business meetings or by exchanging business cards - for purposes related to establishing and maintaining of business contacts. Providing the data is voluntary. The legal basis of the processing is the justified interest of the Administrator (Art. 6 section 1 letter f) of the GDPR), consisting in creating a network of contacts in connection with the conducted activity.
INFORMATION WHICH WE RECEIVE FROM OTHER SOURCES
If personal data was not provided to the Administrator directly by you, the Administrator obtained it from your employer or from the contractor/associate whom you represent. If you are not our contractor or employee, principal or associate of the contractor with whom we have a business relationship, then your data may have been obtained from publicly available sources to contact our sales representatives, e.g. by visiting the place of business or sending an inquiry regarding the possibility of sending commercial information.
PERIOD OF PERSONAL DATA PROCESSING
The period of data processing by the Administrator depends on the type of service provided and the purpose of the processing. If the basis of the processing is indispensable for the conclusion and performance of the contract, the data will be processed until its completion, and after that time until the expiry of possible claims. The data processing period may also result from legal provisions where they constitute the basis for processing. In the situation when the data processing is based on the justified interest of the Administrator - e.g. in order to conduct correspondence in connection with the Administrator's activity - the data is processed for a period enabling its implementation or to submit an effective opposition to data processing. If the processing is based on consent, the data is processed until it is withdrawn. The data processing period may be extended if the processing is necessary to establish and assert any claims or defend against them, and after that time only in the event and to the extent required by law.
RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
The data subjects have the following rights:
The right to access personal data stored by the Administrator.
The right to correct any incorrect personal data stored by the Administrator.
The right to remove any information about you stored by the Administrator. This right can be exercised, for example, if:
we will no longer need your personal data to reach the goal for which we have collected it;
you withdraw your consent to the processing of your personal data;
you object to how we process your personal data. Pursuant to Article 17 of the GDPR, however, there are exceptions to this right (e.g. if the Administrator processes your personal data for the purposes of determining, pursuing or defending claims).
The right to limit the processing of your personal data stored by the Administrator. This right applies, for example, if:
you do not agree with the correctness of your personal data held by the Administrator,
we no longer need to process your data, but you prefer that the Administrator, instead of deleting the data, limit its processing,
we no longer need to process your personal information to achieve the purposes for which we have collected it, but you need it to establish, investigate or defend your legal claims.
The right to receive personal data that you provided to us in an orderly, commonly used and machine-readable format. This right applies if the processing is based on consent or agreement (see above) and the processing takes place in an automated manner.
The right to object to the processing of your personal data for reasons related to a particular situation, if we process personal data based on our legitimate interest. In the case described, in the event of your objection, we will have to stop processing your data unless we demonstrate a substantial, reasonable basis for processing that should objectively prevail over your interests or is necessary to establish, investigate or defend claims (e.g. evidentiary purposes or in the event of a claim). The right of objection also applies if the processing concerns direct marketing (regardless of whether the legal basis for such processing is the consent or legitimate interest of the Administrator). Whenever the processing concerns direct marketing, your opposition or withdrawal of consent in this respect will result in discontinuing the processing of your data for this purpose.
The right to withdraw consent to the processing of personal data at any time, if consent is the legal basis for data processing.
The right to lodge a complaint with the Office for Personal Data Protection dealing with the protection of personal data in the event that it considers that the processing of personal data violates the provisions of the GDPR or other provisions regarding the protection of personal data.
In connection with the provision of services, personal data may be disclosed to external entities, including in particular:
service providers responsible for the operation of information systems (including programing) and provision of hosting services;
entities such as banks and payment operators in the event of settlements;
postal operators in connection with correspondence;
couriers and entities providing logistics services in order to service the order;
possible other entities providing services to the Administrator based on relevant agreements.
The Administrator may also share data with entities authorised to obtain data on the basis of legal provisions.
TRANSMISSION OF DATA OUTSIDE OF THE EUROPEAN ECONOMIC AREA
The level of protection of personal data outside of the European Economic Area (EEA) differs from that provided by European law. For this reason, the Administrator does not provide personal data outside the EEA.
SECURITY OF PERSONAL DATA
The Administrator ensures that all operations on personal data are recorded and made only by authorised employees and associates. The Administrator undertakes all necessary actions so that its subcontractors and other cooperating entities guarantee that appropriate security measures will be applied whenever they process personal data at the request of the Administrator.
Contact with the Administrator is possible in writing to the address of Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna with registered office in Zielona Góra at ul. Chemiczna 3,
65-713 Zielona Góra or at the e-mail address: firstname.lastname@example.org
THE DATA PROTECTION OFFICER
On behalf of the Data Administrator, the sphere of personal data processing is supervised by the Data Protection Officer, who can be contacted at: email@example.com or by sending correspondence to the following address: Agencja Handlowa "BOLL" Wojciech Dalewski Spółka Jawna, ul. Chemiczna 3, 65-713 Zielona Góra with the note "Data Protection Officer".
CHANGES OF INFORMATION CONCERNING PERSONAL DATA PROTECTION
Information concerning PPD is verified on an ongoing basis and updated as necessary. The last update was accepted and is effective from 10 April 2019.