Privacy policy

The processing of personal data in Osprzęt Roma Dudzińska Sp. z o. o.

According to Article 13 paragraph 1 and paragraph 2 of Regulation (EU) 2016/679 of the European
Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
(hereinafter referred to as the GDPR), which came into force on May 25, 2018, we hereby inform you about
the method and purpose we process your personal data (hereinafter referred to as “data”) and about your
rights.

1. Who is in charge of processing data and how can be contacted?
The administrator of your personal data is Osprzęt Roma Dudzińska Sp. z o.o., and can be contacted in
writing – by traditional mail to the following address: 61-371 Poznań, ul. Romana Maya 1 or via e-mail:
osprzet@osprzet.com.

2. What is the purpose and the legal basis of processing of your personal data?

2.1. Data is processed for carrying out the activities, signing or performing the contract in relation to which it
was transferred to the Administrator (inter alia: carrying out the order, billings, communication concerning
the execution of the services, communication via our contact form).
The basis of the processing is the necessity to execute the contract (art. 6 par. 1(b) the GDPR)

2.2. Data is processed for the purpose of the Administrator’s commercial activities and providing other services in
the performance of contracts agreed upon with the customer or for the purpose of carrying out activities
carried out at the request of the customer before or in connection with the signed contract.

2.3. Handling customer complaints and possibly other claims.
The basis of the processing is the justified interest of the Administrator, which lies in securing information
about the cooperation in order to handle claims.

2.4. Fulfillment of administrative and public law obligations by the Administrator.

2.5. We process your data on the basis of your written or verbal consent (art. 6 par. 1(a) the GDPR) for
specified reasons (inter alia marketing campaigns).

2.6. Previously given consents to the processing of personal data remain valid.

2.7. You can withdraw your consent at any time. Withdrawing your consent does not affect the lawfulness of
data processing until the withdrawal of consent or when the Administrator is processing your data on other
bases than your consent.

3. How do we obtain your data and what are its categories?
3.1. Most of the data processed by the Administrator comes directly from the entity concerned (e.g. the
customer, employee).

3.2. Data of companies are also obtained from public sources, i.e. Register of Entrepreneurs of the National
Court Register (KRS = Krajowy Rejestr Sądowy), Central Registration and Information on Business (CEiDG
= Centralna Ewidencja i Informacja o Działalności Gospodarczej) or similar sources located outside Poland
or private sources specialized in collecting and sharing data.

3.3. In the case of representatives of companies or people working for them otherwise, the data is collected
as mentioned above and from the companies themselves.

4. With whom can we share your personal data?
4.1. We might share the data with third parties in order to execute the contract, to fulfill legal obligations by
Administrator, based on your consent or for purposes justified by the law.

4.2. Authorized employees of the Administrator and other people acting under his authority may be the third
party. The data is shared with the entity processing the data on the Administrator’s order, if and only when
the third party acts under contracts with the Administrator and has agreed to keep professional secrecy.

4.3. We do not sell your private data to third parties.

5. Will your data be transferred to other countries (outside the European Union)?
The data might be transferred outside European Union if it is necessary to execute the contract between you
and the Administrator or to carry out activities before signing the contract to sign the contract or within the
Administrator’s use of the IT infrastructure (cloud, e-mail).

6. Is it obligatory to provide personal data
Providing personal data is voluntary.

7. How long do we process (store) your personal information?
We keep your personal data for as long as it is required in order to fulfill the purposes described in section 2.,
i.e.:

• execution of the contract – up until its completion, in addition also: after the contract expires, the data will
  be kept for the obligations arising from bookkeeping and tax regulations for their required time, and for the
  legal purposes until the statute of limitation on possible claims,
• fulfilment of legal obligations by Administrator, regarding running the business and executing contracts –
  up until the obligations are fulfilled,
• for processing carried out solely on the basis of consent – up until immediate deleting the data on the basis
  of your request,
• up until fulfillment legally justified interests of the Administrator that are the basis of the processing or
  until you object further processing, as long as there is no legal basis to further processing the data.

8. What are your rights in order to ensure the proper protection of your data?
You have the rights to:

• access your data, correction of your data, limit the processing of your data or deleting your data,
• withdraw your prior consent to the processing of your data to the extent of your consent, provided that the
  withdrawal will not affect lawfulness of the processing, which has been carried out prior to the withdrawal,
• lodge a complaint with a supervisory authority, in Poland with the President of Personal Data Protection
  Office, if you deem the processing of your data breaching the laws, including the GDPR,
• object to the processing of the data on grounds relating to your specific situation where the Administrator
  processes your data for purposes based on legally justified interests (art. 21 par. 1 the GDPR)
• object to the processing of your data related to direct marketing, including profiling for marketing purposes,
  to the extent that the data processing is related to direct marketing.