GDPR information clause

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 119 of 4 May 2016), hereinafter referred to as "GDPR", we inform you that:

1. The Controller of your personal data is WABAR sp. z o. o. with its registered office at ul. Komandora Wiktora Węgrzyna 1, 05-250 Emilianów, formerly WABAR Agnieszka Hanna Ogonowska with its registered office at ul. Komandora Wiktora Węgrzyna 1, 05-250 Emilianów. You can contact the Controller via e-mail: wabar@wabar.pl
 
2. Purposes and legal basis of data processing:
Your personal data are processed by the Controller: in order to conclude a contract with the Controller and its subsequent implementation (legal basis for processing: Article 6 paragraph 1 letter b) of the GDPR)
– in order for the entity you represent to conclude an agreement with the Controller and its subsequent implementation (legal basis for processing: Article 6, paragraph 1, letter f) of the GDPR)
– in order for the Controller to carry out activities you request, other than the activities specified above, or in order to carry out activities to which you consent (legal basis for processing: Article 6(1)(a) of the GDPR)
– in order to fulfill the legal obligations incumbent on the Controller in connection with the type of business activity conducted and the implementation of contracts concluded by the Controller (legal basis for processing: Article 6 paragraph 1 letter c) of the GDPR)
– as part of the legitimate interest of the Controller, for example: (a) to prepare commercial offers, (b) for archival and evidentiary purposes, (c) to determine, pursue or defend against claims, (d) for the analytical selection of services to the needs of the Controller’s customers, (e) for customer satisfaction surveys, (f) for internal administrative purposes, (g) for the purpose of handling complaints (legal basis for processing: Article 6(1)(f) of the GDPR)
 
3. Types and categories of personal data processed: personal data identifying a given person and allowing the Administrator to prepare offers
– data identifying or verifying a given person, i.e. data allowing to establish or check the identity of a given person or entity, for example in order to place an order and sign a contract with the Controller
– data relating to persons or entities required to fulfil the legal obligations incumbent on the Controller or processed within the framework of the Controller’s legitimate interest,
– personal data relating to browsing the Administrator’s website, which are collected in accordance with the Cookies Policy and Privacy Policy or the Customer’s individual consents in a given case.
 
4. Your data may be made available to the following recipients or categories of recipients:
– Your data may be accessed by the Controller’s subcontractors, for example: law firms, IT companies, debt collection companies and other entities, on the basis of personal data processing agreements signed with them by the Controller
– authorized third parties may also have access to the data on the basis of generally applicable legal provisions
 
5. The Controller may transfer your personal data, if you are employed or provide services to the Controller, outside the European Economic Area, i.e. to the United Kingdom, due to the nature of the business. The European Commission has adopted a decision confirming the adequacy of personal data protection provided by the United Kingdom.
 
6. Period of data storage by the Administrator:
– within the scope of the implementation of the contract concluded by you or the entity you represent with the Administrator, for the duration of its validity
– in the scope of data processing based on consent to processing, until such consent is withdrawn by the data subject, without affecting the lawfulness of processing based on consent before its withdrawal
– in the scope of fulfilling the legal obligations incumbent on the Administrator in connection with the management and implementation of concluded contracts, for the period obliging the Administrator to fulfill these obligations –
– within the scope of the existence of a legitimate interest of the Controller, for the period in which the Controller will be able to document the existence of such an interest and demonstrate the overriding nature of its legal interest over the interests or fundamental rights and freedoms of the data subjects.
 
7. Rights of data subjects:
– the right to access data, i.e. obtain information about the purpose and method of processing personal data and a copy of the data
– the right to data portability
– the right to withdraw consent, which means that you can withdraw any consent you have given at any time, and the withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal (from the moment such an instruction is given, the Data Controller does not process the data for the purpose indicated by the data subject)
– the right to rectify and supplement personal data if they are incorrect or incomplete
– the right to lodge a complaint with the President of the Personal Data Protection Office as the supervisory authority
– the right to object, which means that in certain situations you can object to the processing of your data at any time
– the right to limit data processing
– the right to partial or complete deletion of data processing (right to be forgotten) that is processed by the Data Controller without legitimate legal grounds
– the right to transfer personal data, i.e. to send data to another data controller (e.g. another operator).
 
8. The provision of your personal data in relation to most processes carried out by the Controller is not based on your consent and, although in many cases it is voluntary, it is necessary in order to carry out the data processing processes.
 
9. In the vast majority of cases, the source of data are the data subjects, therefore they are obtained directly from the persons with whom the Controller carries out a given legal or factual activity, whereas in the case of obtaining personal data in a manner other than from the data subjects, the source of data are third parties.
 
10. The Administrator does not process personal data in an automated manner through profiling, with the exception of certain data of specific website users. www.wabar.pl, which processes are described in the Privacy Policy and Cookies Policy posted on the Administrator's website.
 
11. Personal data is collected with due diligence and appropriately protected against access by unauthorized persons.