GDPR INFORMATION CLAUSE

GDPR INFORMATION CLAUSE

VITKAC attaches great importance to the protection of your personal data under the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).

Below we present information concerning the processing of your data in connection with a submitted complaint or a declaration of withdrawal from the contract (return).

1. CONTROLLER OF PERSONAL DATA
The controller of your personal data is:

VITKAC – Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) in Warsaw, with the following registration numbers: NIP (Tax ID) 5210125041, REGON (Statistical ID) 012014330, KRS (National Court Register No.) 0000205145, with its registered office in Warsaw at ul. Górczewska 53, 01-401 Warsaw, Poland, whose records are kept by the District Court for the Capital City of Warsaw (Sąd Rejonowy dla m.st. Warszawy w Warszawie).

Contact to the Data Protection Officer: [email protected]

2. PURPOSES AND LEGAL BASES FOR DATA PROCESSING
Your personal data will be processed for the following purposes:

• Handling and examining complaints and returns – Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(c) GDPR (compliance with a legal obligation under the Polish Consumer Rights Act and the Polish Civil Code).

• Pursuing possible claims or defending against claims (disputes) – Art. 6(1)(f) GDPR (legitimate interests of the controller, namely: establishing, pursuing or defending against claims; internal reporting and control; demonstrating compliance with legal obligations; protection against fraud).

• Fulfilment of accounting and tax obligations – Art. 6(1)(c) GDPR (compliance with a legal obligation – tax and accounting regulations).

3. RECIPIENTS OF THE DATA
Your data may be transferred to entities providing accounting, legal and IT services, to postal operators/couriers, to banks (for the purpose of refunding payments), as well as to authorities entitled to receive it under the provisions of law.

4. DATA RETENTION PERIOD
The data will be processed for the period necessary to achieve the purpose (examination of the complaint/return), and subsequently for the period corresponding to the limitation period for claims (as a rule 6 years, counted until the end of the calendar year) and for the period required by tax and accounting regulations (as a rule 5 years, counted from the end of the calendar year).

5. TRANSFERS OF DATA TO THIRD COUNTRIES (OUTSIDE THE EEA)
The data may be transferred outside the European Economic Area (EEA): to the United States. We apply appropriate or suitable safeguards, which include transferring data in accordance with the European Commission's adequacy decision under the EU-U.S. Data Privacy Framework (provided that the given entity has joined it), or on the basis of Standard Contractual Clauses (SCC). You have the right to request information about the above safeguards and to obtain a copy of the Standard Contractual Clauses (SCC). To this end, please contact the controller.

6. YOUR RIGHTS RELATED TO DATA PROCESSING

To the extent provided for by the GDPR, you have the right to:

• access your data,

• rectification of your data,

• erasure of your data,

• restriction of processing,

• data portability.

You also have the right to:

• object to the processing,

• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.

7. VOLUNTARY PROVISION OF DATA
Providing personal data is voluntary but necessary in order to examine your complaint or return and to process the refund.