Privacy Policy Tutore Poland LLC
I. General provisions
1. The aim of Privacy Policy is to define general principles involving data processing of workers, coworkers, customers, contractors and users of Administrators' Internet websites regarding to conducting business activity based on:
a. selling and organizing courses for young and adult students
b. webstore management with guitars and other accessories,
c. selling and organising camps for children and teenagers,
d. selling and organising courses for companies, their employees and associates.
Privacy Policy defines principles of personal data processing particularly within the framework of maintenance of websites, Call Center department contact, helpline with the Customer, Business Customers and their workers and associates, and organization of courses and camps.
2. Based mainly on the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and its data flow along with repealing the Directive 95/46 / EC, hereinafter referred to as the GDPR, the Controllers shall take all necessary security measures to protect the personal data being processed.
3. Under the concept of personal data should be understood all the information on identified or possible to identify by a natural person that this data concerns. Possible to identify a natural person is a person who can be identified directly or indirectly, especially based on identification such as: name and surname, identification number, localization data, internet identification or one or more factors specific to the physical, physiological, genetic ,mental, economic, cultural or social identity of a natural person.
V. Information on profiling within the websites and courses of ProfiLingua School
1. On the basis of your personal data, we may carry out profiling, i.e. the automatic assessment of certain personal characteristics about you.
2. The purpose of profiling is direct marketing of the Administrator's own products and services, including analytical and profiling purposes. The legal basis for the processing is that the processing is necessary for the Administrator's legitimate interest in being able to carry out direct marketing of its services. Through profiling you are likely to receive less information but better tailored to your preferences.
3. For the purpose of profiling, we typically use information such as age, gender, region of residence and size of locality, family status, interests, profession, job title, device type (model for mobile devices), internet provider, screen resolution, operating system and browser version, language preference settings, as well as information related to your activities on our websites and products and services ordered.
4. The legal basis for data processing is voluntary consent.
5. We will stop processing your data used for direct marketing purposes, including profiling and analytical purposes, if you object to the
processing for these purposes or you withdraw the consent you have given us in this respect.
6. To the extent that the processing of your personal data is based on the premise of a legitimate interest of the controller, you have the right to object to the processing of your personal data on grounds of your particular situation. In particular, you have the right to object to processing for direct marketing purposes, including profiling.
II. Definitions
1) Administrator - Tutore Poland LLC with its headquarters in Łódź (93-578), Wróblewskiego 19A/8 street, registered in Register of Entrepreneurs National Court Register under the number NCR 0000670834, Tax Number:7272812193, share capital : 1664 600 zł, court register: the Regional Court for Łódź-Śródmieście in Łódź, XX the Commercial Division of National Court Register
2) Custome r- the natural person, that is at least 18 years of age and has the complete ability for legal actions, is not conducting any business activity or a natural person, running a business on its own behalf, only when the contract concluded with Administrator is directly correlated with its business activity and when content of the agreement shows the lack of occupational character, resulted mostly from the subject of business activity, shared according to Central Registry and Business Activity Information policy- making orders and concluding the agreement with Administrator, mediated by Websites, as well as via mail, by phone on their or participant's behalf.
3) Participant- a person enrolled by Customer for a course or a camp organized by Administrator.
4) Business Customer - a natural person,legal person and organizational unit mentioned in art.33 1 § 1 Civil code, conducting the business or occupational activity on its own behalf, which concluding a civil law contract with Administrator directly related with business activity as well as the content of the contract shows that it has a professional character for the counterparty resulting from the subject of its business activity, shared according to Central Register and Business Activity Information policy - making an order and concluding a contract with the Administrator, including via the Websites as well as by e-mail and telephone for his/her own benefit or for the benefit of Employees/co-workers of a business customer.
5) Employees/Co-workers of Business Customer- a person enrolled by the business customer
Business Customer for a course organised by the Administrator.
6) Work candidate - an individual applying for a job, either including internship or function at Administrator's.
7) Worker - a person employed by Administrator based on work contract.
8) Co workers - a person cooperating with Administrator based on Civil Law Contract, especially a contract of mandate or specific-task contract.
9) Counterparty - a natural person,legal person and organizational unit mentioned in art.33 1 § 1 Civil code, conducting the business or occupational activity on its own behalf, which concluding a civil law contract with Administrator directly related with business activity as well as the content of the contract shows that it has a professional character for the counterparty resulting from the subject of its business activity, shared according to Central Register and Business Activity Information policy
10) Contractor's potential customer - an individual who is at least 18 years of age and has full legal capacity, not running a business or a natural person, conducting a business or professional activity on his/her own behalf, but only if the the contract concluded with the Administrator is directly related to his/her business activity and where it is apparent from the content of the contract that it is not of a professional nature for that person, resulting in particular from the subject of his/her business activity, available on the basis of the provisions of the Central Business Activity Register and Information Economic Activity - with whom the Administrator contacts in order to present the Contractor's offer.
11) Platform User - a person logged on to www.tutore.eu as either a class tutor or a Customer or Participant,
12) Websites - internet platforms created and run by Administrators that allow establishing contact with Administrator, reservation of its offered services as well as purchase of equipment:
a) www.tutore.eu - a platform for people taking part in educational or language courses,
b) tutore.eu/ - courses for children and young people,
c) sklep.tutore.eu/ - guitars and other accessories,
d) musicandmore.pl/ - camps for children and young people,
e) profilinguadlafirm.pl/ - language courses for business customers or their Employees/Co-workers,
f) profi-lingua.pl/ - language courses for adults and educational or language courses for children and and teenagers,
g) profi-lingua.langlion.com/ - a platform for people taking language courses,
h) profimatura.pl/ - a platform for those taking an educational course.
13) Online shop - internet platform created and run by Administrator in the framework of Website mentioned in point 8 above that allows purchasing equipment offered by Administrator.
III. Personal Data
Policy finds its application to all individuals' data processing activities performed by Administrators, with significant consideration personal data:
a. Customers and Participants,
b. Business Customers and Employees/Co-workers of Business Customers,
c. Candidates for employment with the Administrator,
d. Employees of the Administrator,
e. Employees of the Administrator,
f. Administrator's contractors, their employees, co-workers and persons authorized by contractors to contact the Administrator by contractors,
g. Contractor's potential customers,
h. Users of the platform.
IV. Personal data processed by the Administrator
1. The personal data administrator is Tutore Poland Sp z .o.o. with Tutore Poland LCC with its headquarters in Łódź (93-578), Wróblewskiego 19A/8 street, registered in Register of Entrepreneurs National Court Register under the number NCR 0000670834, Tax Number:7272812193, Share capital : 1664 600 zł, Court register: the Regional Court for Łódź-Śródmieście in Łódź, XX the Commercial Division of National Court Register hereinafter named Administrator.
2. Contact with Administrator is possible at the address: Wróblewskiego 19A/8 Street, 93-578 Łódź, by phone number: 500 965 135 and via contact with Data Protection Officer by mail: info@tutore.eu
3.Administrator processes personal data of:
1. Customers and Participants' following purposes:
a) performing the contract by Administrator including participants' enrollment for courses and its organization (inter alia, in order to transfer data to log on the classes, to pass on extra class materials, checking class attendance) as well as, providing contact with Customer and Participant.
Legal basis for processing constitutes indispensability of processing to perform the contract that correlates with personal data or taking actions on person's request before concluding an agreement. (art.6 (1) (b) GDPR). Processed data corresponds with Participant as well, that means, for whom the contract has been concluded.
Administrator organizes and conducts courses for children and teenagers. Participants are enrolled in a course by Customer (i.e. a parent or legal guardian). Course is conducted within a set time planned beforehand, defined in contract between Customer and Administrator, usually through the whole school year. Courses are conducted online via Click Meeting or Zoom applications. Therefore, agreement is concluded between Administrator and Customer. Concluding a contract includes the necessity of personal data processing that is a contracting party- Customer, as well as children or teenagers enrolled in a course by Customer. What is more,
Administrator contacts with a customer via e-mail, phone number shared by Customer i.e. in order to provide data for conducted classes - links to log in, date of the classes or extra class materials.
b) organized course service i.e. group changes, providing information about class date changes, solving ongoing problems through helpline department.
Legal basis for processing constitutes indispensability of processing to perform the contract that correlates with personal data or taking actions on person's request before concluding an agreement. (art.6 (1) (b) GDPR). Processed data corresponds with Participant as well, that means, for whom the contract has been concluded.
Current service is ensured by Administrator's Helpline department by processing Customers' and Participants' personal data in order to carry out Customers' requests and to provide information about courses.
Administrator makes every effort for Helpline department to have an access to personal data only the scope necessary to perform assigned tasks.
c) providing the highest standards while conducting lessons implemented by Workers, Co workers via ClickMeeting or Zoom, accuracy of performed activities and eventual class quality improvement, safeguarding the company interests in contentious issues with Customer (evidence) by monitoring and recording online courses.Legal basis for processing constitutes for legitimate Administrator's interest. (art.6 (1) (f) GDPR).
Courses organized by Administrator are conducted via ClickMeeting or Zoom platforms. Courses are conducted by qualified staff, experienced in specified class topics. In order to maintain high quality classes Administrator registers the course of classes and stores recordings for a period not exceeding 3 months. After this period, recordings are automatically removed from Administrator's data base.
Recordings must be stored for a prolonged period exclusively to solve the dispute with customer i.e. process claims, pursuing claims. Recordings include tutor's image and Participants' voices, subject to their prior consent. A consent for recording is optional, whereas necessary to participate in the course. That consent can be withdrawn anytime, yet withdrawing the consent results in the inevitability of terminating the contract with Administrator.
d) establishing contact with Customers and marketing its own products and services including products and services offered by Administrator's Tourism department (camps for children and teenagers). Legal basis for processing constitutes for legitimate Administrator's interest. (art.6 (1) (f) GDPR).
Administrator takes marketing and information activities concerning its own products and Tutore Poland LCC products by being a form of direct marketing.Marketing purposes are realised by using Customer's phone number obtained by Administrator from Marketing relation data base and Present-service, subsequently in reliance on data collected by Administrator from the Customer or a third party within the meaning of art.14 GDPR.
e) establishing contact with Administrator, including reservation of trial lessons for Participant. Legal basis for processing constitutes optional natural person's agreement for personal data processing - (art.6 (1) (a) GDPR).
Administrator enables contact and class reservation for Participant via reservation form shared by Website tutore.eu/.
Executing the personal data processing happens by reservation form.
f) selling products offered by Administrator through online shop i.e. order processing. Legal basis for processing personal data is the necessity for performing the contract, which party is the person that the data concerns or taking actions by person's request before concluding a contract. (art.6 (1) (b) GDPR).
Administrator conducts product sale via shop- guitars and other accessories (executes orders). In connection with above, the agreement is concluded within Administrator and Customer.
Concluding the contract is associated with the necessity of processing personal data....
g) ensuring the highest standards of customer service quality, for training purposes - enabling improvement of the quality of service, securing the company's interests in disputes with the customer (evidence), ensuring the safety of employees / colleagues in case of the events of unwanted and dangerous events caused by customers (e.g. criminal threats) by recording conversations with consultants from the Call Center department and the Administrator's Helpline. The legal basis for data processing for the given purpose is the consent given by the Customer during a telephone conversation with the Administrator's consultant - (Article 6 (1) (a) of the GDPR). The consent is voluntary and may be withdrawn at any time.
The processing of personal data is necessary if the Customer submits a complaint to the Administrator regarding the arrangements made by phone. The Administrator reserves the right to verify the content of the telephone conversation with the Customer. The Administrator makes every effort to maintain the security of telephone call recordings for instance by limiting the number of people who have access to the recordings as much as possible.
h) performance of the Agreement by the Administrator, including the Participants' enrollment to camps and the organization of camps (including the way of providing data regarding preparation of the child for departure, time and place of collection) and ensuring contact with the Customer and Participant. The legal basis for processing is the necessity of processing in order to perform a contract to which the party is the data subject , or to take action at the request of the data subject prior to entering into a contract. (Article 6 (1) (b) of the GDPR). The processed data also applies to the Participant, i.e. the person for whom the contract has been concluded.
The administrator organizes camps for children and teenagers. Participants are enrolled in the camp by the Customer (parent, legal guardian). Therefore, an agreement is concluded between the Administrator and the Customer. The conclusion of the contract requires the processing of personal data of a natural person who is a party to the contract - the Customer, and the Participant - children or young people enrolled in the course by the Customer. In addition, the Administrator contacts the Customer via the e-mail address or telephone number provided by the Customer, for instance in order to provide data about the camp - methods of preparing a child for the camp, place and time of collection, qualification card.
i) servicing organized camps for children and teens, including changing the camps, solving current problems by the Call Centre department. The legal basis for processing is the necessity of processing to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (Article 6 (1) (b) of the GDPR). The processed data also applies to the Participant, namely the person for whom the contract has been concluded.
The employees of the Administrator's Call Centre department provide day-to-day service of the camps. They process the personal data of Customers and Participants in order to fulfill Customers' requests and to provide the necessary information about the camps. The administrator makes every effort to ensure that the Call Centre department has access to personal data only to the extent necessary to perform the entrusted tasks.
j) fulfillment of the legal obligation of the Administrator resulting from the provisions of art. 92k of the Education System Act of 7th September, 1991 and the Regulation of the Minister of National Education of 30th March, 2016 on recreation for children and adolescents. The legal basis is the legal obligation incumbent on the Administrator, regulated in art. 6 sec. 1 lit. c GDPR in connection with the provisions of the Act of 7 September 1991 on the education system. The above provisions oblige the Administrator to set up qualification cards for participants of recreation, which contain personal data of children and adolescents, including sensitive data (data regarding health, diet).
k) ensuring proper care for camp participants, including appropriate medications and diets. The legal basis for processing is the necessity of processing to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract (Article 6 (1) (b) of the GDPR). The processed data also applies to the Participant, i.e. the person for whom the contract has been concluded.
The administrator, as the organizer of a camp for children and adolescents, is obliged to provide them with proper care. Therefore, it is necessary to have information about the Participant's health, diet and medications.
l) performance of the Agreement in the scope of providing the Customers with photo coverage from the camp (pendrive, fanpage on facebook and musicandmore.pl website). The legal basis for data processing for the given purpose is the voluntary consent of a natural person to the processing of personal data - (Article 6 (1) (a) of the GDPR).
The administrator offers customers the option of purchasing a flash drive with photos and recordings of the camp participants for the additional fee. The administrator also uses the photo report as marketing materials on his fanpage on Facebook and on the musicandmore.pl website. The Administrator collects the Customers' consents to process the images of the Participants
m) making contact with customers and marketing their own products and services, including products and services offered by the Administrator's Education department (courses for children and adolescents). The legal basis for processing is the Controller's legitimate interest (Article 6 (1) (f) of the GDPR).
The administrator undertakes marketing and information activities regarding the Administrator's own products and products, which are a form of direct marketing. Marketing purposes are carried out using the Customer's telephone number obtained by the Administrator from the Marketing relations and Present-service databases, and then also based on data obtained independently by the Administrator from the Customer or a third party within the meaning of art. 14 GDPR.
n) making contact with the Administrator, including registering the Participant for a camp, language course or returning contact with the Customer via the forms available on the musicandmore.pl websites. The legal basis for data processing for the given purpose is the voluntary consent of a natural person to the processing of personal data - (Article 6 (1) (a) of the GDPR).
The administrator enables contact with each other and enrollment of the Participant for a camp or language course via the booking forms available on the Websites. When it comes to the mentioned forms, personal data is processed.
o) performance of the Agreement by the Administrator, including the registration of Participants for language courses and the organization of language courses (including the transfer of data for logging in to classes, providing additional materials for classes, checking attendance during the classes) and ensuring contact with the Customer and Participant. The legal basis for processing is the necessity of processing to perform a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract (Article 6 (1) (b) of the GDPR). The processed data also applies to the Participant, i.e. the person for whom the contract has been concluded.
p) The administrator organizes and runs language courses for children, adolescents and adults. An adult Participant is also a Customer, while underage Participants are enrolled in the course by the Customer (parent, legal guardian). The course is conducted for a predetermined period of time, specified in the agreement between the Customer and the Administrator, and usually covers the school year. Courses are conducted online via the ClickMeeting or Zoom platforms. In connection with the above, an agreement is concluded between the Administrator and the Customer. The conclusion of the contract requires the processing of personal data of a natural person who is a party to the contract - the Customer, as well as children or young people enrolled in the course by the Customer. In addition, the Administrator contacts the Customer via the e-mail address or telephone number provided by the Customer, for instance in order to provide data on the classes being conducted - login links, dates of the classes, extra materials from the classes.
q) making contact with Business Customers and Employees/Co-workers of Business Customers and marketing their own products and services, including products and services offered by the Administrator's Education department (courses for children and adolescents). The legal basis for processing is the Controller's legitimate interest (Article 6 (1) (f) of the GDPR).
The Administrator undertakes numerous marketing and information activities concerning its own products and services, which constitute a form of direct marketing. Marketing purposes
are carried out using the e-mail address provided by the customer. Via Website it is possible to subscribe to a newsletter containing information about news, promotions, products and services related to the activities carried out by the Administrator. In order to send the newsletter, the e-mail address provided by the Customer. The legal basis for processing personal data in the case of the newsletter is the following legitimate interest regulated by (Article 6 (1) (f) of the GDPR). and the consent expressed by ticking the relevant checkbox content when subscribing to the newsletter. Checking the checkbox implies consent to receive commercial information pursuant to Article 10 of the Act on the provision of services by electronic means in connection with Article 172 of the Telecommunications Act Telecommunications Law. Such consent can be withdrawn at any time by opting out of receiving the newsletter by clicking on the unsubscribe link in the footer of each newsletter.
2. Business Customers and Employees/Co-workers of Business Customers in the following purposes:
a) making contact with Business Customers and Employees/Co-workers of Business Customers and marketing their own products and services, including products and services offered by the Administrator's Education department (courses for children and adolescents). The legal basis for processing is the Controller's legitimate interest (Article 6 (1) (f) of the GDPR) - throughout the period of employment,
b) ensuring contact with the Business Customer (e-mail address, telephone number) - for the purpose of proper performance of a contract to which the data subject is a party (art. 6(1) lit. b, f RODO) - throughout the period of employment,
c) Keeping the log of correspondence – necessary for the execution of legally justified purposes (ART. 6 (1) (c, f) GDPR) - throughout the period of employment,
d) Keeping the log of cooperation (including payment processing) – for the proper execution of a civil law contract between the parties (ART. 6 (1) (b, c) GDPR) - throughout the period of employment,
e) exercising the rights and obligations under the civil law contract concluded with the Business Customer business customer, including the enrolment of Employees/Co-workers of business customers on courses and the organisation of courses (e.g. for the purpose of providing login data for classes, providing additional materials for classes, checking attendance at classes, issuing course completion certificates) and providing contact with Business Customer Employees/Co-workers. The legal basis for processing is the necessity of the processing for the performance of a contract to which the data subject is a party, or to take action on behalf of the data subject. data subject, or to take steps at the request of the data subject prior to entering into a contract (ART. 6 (1) (b, c) GDPR). The data processed also concerns Employees/co-workers of business customers, i.e. the person for whose benefit the contract has been concluded.
The administrator organises and runs language courses for companies. In this case Employees/co-workers are enrolled in the course by the business customer (employer, customer, service recipient). The course is conducted for a predetermined period of time, specified in the Business Customer's contract with the Administrator, and usually covers a school year. The courses are conducted either stationary or online via ClickMeeting,Zoom, ProfiLingua's learner area. The conclusion of an agreement between the Administrator and the Business Customer therefore takes place. The conclusion of the agreement involves the necessity of processing the personal data of the natural person who is a party to the agreement - the Business Customer, as well as the Employees/Co-workers enrolled in the course by the Business Customer. In addition, the Administrator contacts the Employees/Co-workers via the e-mail address or telephone number provided by the Business Customer, e.g. in order to provide data on the classes conducted - login links, class dates, additional materials from the classes.
f) The ongoing service of language courses is provided by the employees of the Administrator's Call Centre department. They process the personal data of Customers and Participants in order to fulfill Customers' requests and provide the necessary information about the courses. The administrator makes every effort to ensure that the Call Centre department has access to personal data only to the extent necessary to perform the entrusted tasks.
The day-to-day management of language courses is provided by the Administrator's call centre staff. They process personal data of Customers and Participants for the purpose of fulfilling Customer requests and providing the necessary information on the courses. The Administrator makes every effort to ensure that the Hotline department has access to personal data only to the extent necessary to perform the tasks entrusted to it.
g) ensuring the highest standards of service for lessons carried out by employees / colleagues via the ClickMeeting or Zoom platform, the correctness of the performance of the entrusted activities and possible improvement of the quality of lessons, securing the company's interests in disputes with the customer (evidence material) by monitoring and recording online courses. The legal basis for processing is the Controller's legitimate interest (Article 6 (1) (f) of the GDPR).
Courses organized by the Administrator are held via the ClickMeeting or Zoom platforms. The courses are conducted by qualified staff with experience in the field of conducted classes. In order to maintain a high and uniform level of classes, the Administrator records the course of individual classes and stores the recordings for a period not longer than 3 months. After this period, the recordings are automatically deleted from the Administrator's databases. The recordings may be stored for a longer period only for the purpose of resolving disputes with the customer, i.e. considering complaints, pursuing claims and rights (the purpose specified in point l below). The recordings include the image of the teacher and Participants along with their votes, subject to express consent to the recording. Consent to record is voluntary, but necessary to participate in the classes. Such consent may be withdrawn at any time, however, the withdrawal of consent will result in the necessity to terminate the contract with the Administrator.
h) making contact with Business Customers and Employees/Co-workers of Business Customers and marketing their own products and services, including products and services offered by the Administrator's Education department (courses for children and adolescents). The legal basis for processing is the Controller's legitimate interest (Article 6 (1) (f) of the GDPR).
The administrator undertakes marketing and information activities regarding the Administrator's own products and products, which are a form of direct marketing. Marketing purposes are carried out using the Customer's telephone number obtained by the Administrator from the Marketing relations and Present-service databases, and then also based on data obtained independently by the Administrator from the Customer or a third party within the meaning of art. 14 GDPR.
i) ensuring the highest standards of customer service quality, for training purposes - enabling improvement of the quality of service, securing the company's interests in disputes with the customer (evidence), ensuring the safety of employees /colleagues in the event of adverse and dangerous events from customers (e.g. criminal threats) ) by recording conversations with consultants from the Call Center department and the Administrator's Helpline. The legal basis for data processing for the above-described purpose is the consent given by the Customer during a telephone conversation with the Administrator's consultant - (Article 6 (1) (a) of the GDPR). The consent is voluntary and may be withdrawn at any time.
The processing of personal data is necessary in the event of an application by a Business Customer or an Employee/Co-worker of a Business Customer to the Administrator.
Business Customer or Business Customer's Employee/Co-worker to the Administrator with a complaint regarding an arrangement made over the telephone. The Administrator reserves the right to The Administrator reserves the right to verify the content of a telephone conversation conducted with a Business Customer or Business Customer's Employee/Co-worker. The Administrator shall make all efforts to maintain the security of telephone call recordings, inter alia, by limiting the circle of persons as far as possible.
The Administrator makes every effort to maintain the security of the telephone call recordings, inter alia, by limiting the circle of people who have access to the recordings as much as possible.
j) processing of complaints, claims and rights. The legal basis for processing data for the above-described purpose is the legitimate interest of the Administrator - (Art. 6 [1] a of the GDPR) for the duration of the proceedings until their final conclusion and for the period designated by generally applicable laws.
The processing of personal data is necessary in the case of an application by a Customer Business Customer or Employee/Co-worker of the Business Customer to the Administrator with a a complaint regarding the services or products offered. The above is supplemented additionally by the assertion of mutual claims and the assertion of rights in the course of possible court and out-of-court proceedings.
k) fulfilling legal obligation imposed on the Controller as of provisions of tax law and accounting. The legal obligation regulated by Art. 6 [1] c of the GDPR imposed on the Controller constitutes the legal basis with reference to the wording of the provisions of the act as of 29th September 1994 on accounting.
The Controller is obliged to keep the accounting records in a way that is compliant with the current provisions of law. Additionally, he/she is subject to particular tax liabilities. The above-mentioned is connected to the necessity of processing customers’ data and in particular entrepreneurs’ data whom the Controller issues VAT.
3. Work candidates in the following purposes:
a) conducting recruitment process on the basis of the entitlement stipulated in z Art. 22¹ para 1 of the Labour Code. The basis for processing the above-mentioned personal data is the legal obligation of the Controller (Art. 6 [1] c of the GDPR) – throughout the period of the recruitment process,
b) conducting the recruitment process, on the basis of the consent of the candidate to process his/her personal data i.e.personal data different from that stipulated in Art. 22¹ para 1 of the Labour Code. The basis for processing is the above-mentioned consent (Art. 6 [1] a of the GDPR)– throughout the period of the recruitment process,
c) the pursuit of legitimate interest of the Controller in the scope of data obtained from the candidate in connection to verifying the abilities and skills required to work on a particular post. The basis of data processing is the legitimate interest of the Administrator (Art. 6 [1] f of the GDPR)– throughout the period of the recruitment process,
d) conducting future recruitment processes on the basis of a consent of the candidate to process his/her personal data. The basis for the data processing is the consent (Art. 6 [1] a of the GDPR) – until the next recruitment process, in which the candidate will be taken into consideration by the Controller;
4. Employees in the following purposes:
a) arranging and managing the work of employees – in a necessary scope stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
b) calculating and paying the remuneration – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
c) deductions from the remuneration – in order to implement the obligations in the scope of court seizures stipulated in the labour code, code of civil procedure, act on administrative enforcement proceedings, act on court enforcement officers (Art. 6 [1] c of the GDPR) – over 3 years since the last deduction,
d) fulfilling the obligations of the employer towards the employees resulting from the generally applicable labour regulations (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
e) fulfilling the obligations resulting from occupational health and safety (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over 10 years since the termination of employment,
f) keeping employment records – in order to fulfill the obligations of the employer stipulated in the labour code, act on the national archival resources and archives and ordinance on the scope of keeping documentation on matters related to an employment relationship by the employers and the way the employees files are kept (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 5o or 10 years since the termination of the employment,
g) fulfilling the obligations towards ZUS (Social Insurance Institution) – in order to fulfill the obligations of the payer of pension contributions stipulated in the act on old-age and disability pensions from the Social Insurance Fund (ZUS), act on social insurance system and act on healthcare services financed from public funds (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 50 or 10 years in the scope of keeping the documents on the grounds of which the basis for old-age and disability pension entitlements is established,
h) fulfilling the tax obligations - in order to fulfill the obligations of the income tax payer stipulated in the tax ordinance act, act on personal income tax and other tax regulations (Art. 6 [1] c of the GDPR) – over the period of 5 years since the end of the calendar year,
i) fulfilling the accounting obligations – in order to fulfill the obligations stipulated in the act on accounting, tax ordinance act and corporate income tax act (Art. 6 [1] c of the GDPR)– over the period of time of 5 years since the end of the fiscal year in which the event occurred,
j) physical security of the buildings, rooms and property of the Controller – on the basis of legitimate interest of the Controller (Art. 6 [1] f of the GDPR) – over the period of employment,
k) providing the highest possible standards of service to the classes conducted by the Coworkers by means of ClickMeeting or Zoom platforms, correct performance of the assigned duties and possible improvement of the quality of classes, securing the company’s interests in disputes with customer (evidence) by monitoring and recording the online courses – on the basis of voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) – The image and voice of the Coworker will be processed over the period of 3 months. In the case the recordings of registered classes constitute evidence in the proceedings conducted on the basis of provisions of law or the Controller has been informed that they may constitute evidence in the proceedings, the period is extended until the final conclusion of the proceedings. When these periods of time expire, the recordings which contain personal data shall be destroyed,
l) providing the possibility of sharing the recordings with new Employees and Coworkers recording online trainings conducted by means of Zoom platform – on the basis of a voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) - The image and voice of the Coworker will be processed until the consent is withdrawn. In the case the consent is withdrawn, the recordings including personal data shall be destroyed,
m) to ensure the highest standards of service of the lessons provided by the Associates via the ClickMeeting or Zoom platform, the correctness of the performance of the entrusted activities and possible improvement of the quality of the lessons, safeguarding the interests of the company in situations of disputes with the client (evidence) by monitoring and recording online courses - based on the voluntary consent of the recorded person (Article 6(1)(a) GDPR) - the Image and voice of the Associate will be processed for a period of 3 months. Where the recordings of the recorded classes constitute evidence in proceedings under the law or the Administrator has become aware that they may constitute evidence in the proceedings, this period shall be extended until the proceedings are legally concluded. After the expiry of these periods, the recordings containing personal data shall be destroyed,
(n) marketing of the Administrator - based on the voluntary consent of the recorded person (Art. 6 para. 1 lit. a RODO) - The Employee's image and voice will be processed and made available on the platform www.tutore.eu until consent is withdrawn. If consent is withdrawn, recordings containing personal data personal data, shall be destroyed,
o) pursuing claims or defending against claims - on the basis of legitimate interest of the Controller (Art. 6 [1] f of the GDPR) relying on taking part in court cases – over the period of 3 years since the termination of employment, in the case of pending proceedings over the period of the proceedings until the final conclusion and limitation of claims;
5. Coworkers in the following purposes:
a) concluding and performing civil-law contracts – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] b, c, f of the GDPR) – over the period of cooperation,
b) calculating and paying the remuneration – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of cooperation,
c) deductions from the remuneration – in order to implement the obligations in the scope of court seizures stipulated in the labour code, code of civil procedure, act on administrative enforcement proceedings, act on court enforcement officers (Art. 6 [1] c of the GDPR) – by the period of time stipulated by the generally applicable provisions of law,
d) fulfilling the tax obligations - in order to fulfill the obligations of the income tax payer stipulated in the tax ordinance act, act on personal income tax and other tax regulations (Art. 6 [1] c of the GDPR) – over the period of 5 years since the end of the calendar year,
e) fulfilling the obligations towards ZUS (Social Insurance Institution) – in order to fulfill the obligations of the payer of pension contributions stipulated in the act on old-age and disability pensions from the Social Insurance Fund (ZUS), act on social insurance system and act on healthcare services financed from public funds (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 5 years since the end of calendar year,
f) fulfilling the accounting obligations – in order to fulfill the obligations stipulated in the act on accounting, tax ordinance act and corporate income tax act (Art. 6 [1] c of the GDPR) – over the period of time of 5 years since the end of the fiscal year in which the event occurred,
g) physical security of the buildings, rooms and property of the Controller – on the basis of the legitimate interest of the Controller (Art. 6 [1] f of the GDPR) – over the period of cooperation,
h) providing the highest possible standards of service to the classes conducted by the Coworkers by means of ClickMeeting or Zoom platforms, correct performance of the assigned duties and possible improvement of the quality of classes, securing the company’s interests in disputes with customer (evidence) by monitoring and recording the online courses – on the basis of voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR)– The image and voice of the Coworker will be processed over the period of 3 months. In the case the recordings of registered classes constitute evidence in the proceedings conducted on the basis of provisions of law or the Controller has been informed that they may constitute evidence in the proceedings, the period is extended until the final conclusion of the proceedings. When these periods of time expire, the recordings which contain personal data shall be destroyed,
i) providing the possibility of sharing the recordings with new Employees and Coworkers recording online trainings conducted by means of Zoom platform – on the basis of a voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) - The image and voice of the Coworker will be processed until the consent is withdrawn. In the case the consent is withdrawn the recordings including personal data shall be destroyed,
j) to provide the highest standard of customer service, for training and service quality improvement purposes, to secure the company’s interests in disputes with the customer (evidence), to ensure the safety of employees in the event of undesirable and potentially dangerous circumstances provoked by Customers (e.g., punishable threats) by monitoring telephone conversations between the Administrator’s Customers – provided a legitimate interest of the Administrator exists (ART. 6 (1) (f) GDPR) – for a period of up to 3 months. Should the recordings of phone conversations be considered evidence in legal proceedings governed by the applicable law provisions, the period shall be extended until a legally binding conclusion is reached. Following these periods, the recordings shall be destroyed.
k) Administrator's marketing - based on voluntary consent provided by the parties being recorded (ART. 6 (1) (a) GDPR). The image and the voice of the Administrator’s employees will be processed and stored until the applicable consent is withdrawn. In such a scenario, the corresponding recordings of personal data shall be destroyed.
l) pursuing or facing legal claims – in the presence of a legally justifiable interest of the Administrator (ART. 6 (1) (f) GDPR), including situations when the Administrator is a party in a legal process – for the duration of legal proceedings until a legally binding conclusion is reached and/or as specified by applicable law regulations.
6. Contractors’ data are processed for the following purposes
a) Establishing partnership – to undertake action at the request of the data owner prior to signing a contract, including participating in negotiations (ART.6 (1) (b, c, f) GDPR) – prior to signing a civil law contract between the parties involved.
b) Ensuring effective communication with a Contractor (e-mail address, phone number) – for the proper execution of a contract to which the data owner is a party (ART. 6 (1) (b, f) GDPR) – for the period specified in an agreement between the parties.
c) Executing the rights and obligations specified by a civil law contract between the parties, including the adherence to the Civil Code (ART. 6 (1) (b, c, f) GDPR) for the period specified in an agreement between the parties.
d) Keeping the log of correspondence – necessary for the execution of legally justified purposes (ART. 6 (1) (c, f) GDPR) - for the period specified in an agreement between the parties.
e) Keeping the log of cooperation (including payment processing) – for the proper execution of a civil law contract between the parties (ART. 6 (1) (b, c) GDPR) - for the period specified in an agreement between the parties.
f) Executing claims and rights – necessary for the execution of legally justified purposes (ART. 6 (1) (f) GDPR), including pending legal cases, for the period necessitated by the legal proceedings and until a legally binding conclusion is reached.
g) Compliance with tax regulations (contractor’s data) – to fulfil the regulations of a taxpayer, as indicated by applicable tax regulations, the Act on personal taxation, the Act on taxation of goods and services, and other applicable tax regulations (ART. 6 (1) (c) GDPR) – for the period of five years, starting from the end of the calendar year.
7. Potential customers of the Contractor for the following purposes:
a) making contact with the Contractor's potential customers and to market its products and services. The legal basis for the processing of data for the purposes described above is the voluntary
individual's consent to the processing of personal data - (Art. 6 [1] f of the GDPR). On the basis of the Agreement concluded between the Administrator and the Contractor, the Administrator shall undertake the following activities marketing and information activities concerning the Contractor's products and services. For this purpose, Administrator uses the telephone number of the Contractor's potential customer obtained
from Present-service databases or a third party within the meaning of art. 14 GDPR.
b) to ensure the highest quality standards of service for the Contractor's Potential Customers, for training purposes - enabling the improvement of service quality, to secure the company's interests in disputes with the Contractor's Potential Customers (evidence), to ensure the safety of the Administrator's Employees/Co-workers in the event of undesirable and dangerous events on the part of the Customers or Participants (e.g. criminal threats) by recording conversations with the Administrator's Call Centre and Infoline department consultants. The legal basis for the processing of data for the above-described purpose is the consent given by the Contractor's Potential Customer during a telephone conversation with the Administrator's consultant - (Art. 6 [1] f of the GDPR) The consent is voluntary and can be withdrawn at any time. The processing of personal data is necessary in the event that the Contractor's Potential Customer makes a complaint to the Administrator regarding the arrangements made over the telephone. The Administrator reserves the right to verify the content of a telephone conversation conducted with a Potential Customer of the Contractor. The Administrator shall make every effort to maintain the security of telephone call recordings, inter alia, by limiting the circle of persons who have access to the recordings as much as possible.
c) considering complaints, pursuing claims or rights. Legal basis for processing the data in the above-mentioned way for the described purpose is the legitimate interest of the Controller – (Art. 6 [1] f of the GDPR).
Data processing is necessary in the case when the Customer makes a complaint to the Controller in the scope of offered services and products. The above-mentioned is additionally supplemented with exercising reciprocal claims and enforcing the rights in the course of any possible judicial and out-of-court proceedings.
8. Users of the platform for the following purposes:
a) the performance by the Administrator of the contract concluded with the Customer or the Administrator's Employee/Contractor and the
providing the account management service - the Administrator organises educational and language courses on the www.tutore.eu platform in which the Customer, Employee/Contractor
Administrator or an employee/co-worker of the Administrator's Contractor may participate in the course. In addition, the Administrator provides the aforementioned persons with a service which consists in maintaining an account that collects the data provided by:
- Customer,
- Administrator's Employee/Contractor, i.e..
-employee/co-worker of the Administrator's Contractor, i.e. the Customer.
The legal basis for the processing of personal data for the purposes indicated above (ART. 6 (1) (c) GDPR), according to which the processing of data is lawful if the processing is necessary for the performance of a contract to which the data subject is party, or to take action at the request of the data subject prior to entering into a contract;
b) to ensure contact and continuity of cooperation - the legal basis for the processing of personal data for the aforementioned purpose is (Art. 6 [1] f of the GDPR) , i.e. the legitimate interest of the interest of the Administrator,
c) to handle complaints, assert claims and rights. The legal basis for the processing data for the above-described purpose is the legitimate interest of the Administrator - (Art. 6 [1] f of the GDPR) - processing of personal data is necessary in case of asserting mutual claims and asserting rights in the course of possible judicial and out-of-court proceedings.
4. The Administrator obtains information about the parties specified in:
a) Points 3, 4, and 5 above due to the presence of the statutory obligation to store such data, allowing for an effective recruitment process. The provision of data which is not indispensable in the light of the statutory obligation is voluntary.
b) Points 1, 2, 6, 7 and 8 through the voluntary provision of personal data during phone calls with the Call Centre, the Helpline, and on the Administrator’s websites.
5. The Administrator may store personal data only for the period of time necessary to fulfill the purposes for which the data was collected. Taking the above into account, the Administrator will store the personal data of Customers and Students for the following periods of time:
a) Data processed for the purposes specified in Paragraph 3 (1) (a, b, f, h, i, k, m, n) – for the duration of the contract. Following the contract expiration, the data will be stored for the time specified in applicable law regulations, especially pursuing legal claims.
b) Data processed for the purposes specified in Paragraph 3 (1) (c, d, o, p, l, t) – until the objection is raised by the party.
c) Data processed for the purposes specified in Paragraph 3 (1) (e, g, l, r, s) – until the consent to process the data is withdrawn.
d) ta processed for the purposes specified in Paragraph 3 (1) (j, u) – for the timeframe specified by applicable law regulations.
V. Information on profiling within the websites and courses of ProfiLingua School
1. On the basis of your personal data, we may carry out profiling, i.e. the automatic assessment of certain personal characteristics about you.
2. The purpose of profiling is direct marketing of the Administrator's own products and services, including analytical and profiling purposes. The legal basis for the processing is that the processing is necessary for the Administrator's legitimate interest in being able to carry out direct marketing of its services. Through profiling you are likely to receive less information but better tailored to your preferences.
3. For the purpose of profiling, we typically use information such as age, gender, region of residence and size of locality, family status, interests, profession, job title, device type (model for mobile devices), internet provider, screen resolution, operating system and browser version, language preference settings, as well as information related to your activities on our websites and products and services ordered.
4. The legal basis for data processing is voluntary consent.
5. We will stop processing your data used for direct marketing purposes, including profiling and analytical purposes, if you object to the
processing for these purposes or you withdraw the consent you have given us in this respect.
6. To the extent that the processing of your personal data is based on the premise of a legitimate interest of the controller, you have the right to object to the processing of your personal data on grounds of your particular situation. In particular, you have the right to object to processing for direct marketing purposes, including profiling.
VI. Processing the data by the Administrator
1. The Administrator commits to ensuring that personal data is processed with due diligence, including adherence to the provisions of applicable national law, especially GDPR. It is the duty of the Administrator to ensure that:
a. Data is processed in accordance with national law and in a way that is transparent for the party sharing their personal data.
b. Data is gathered for purposes justified by national law and will not be used otherwise.
c. Data will not be processed in any other way than necessitated by the nature of the agreement between parties.
d. Corrected and updated when necessary.
e. Data is stored in a way that allows for straightforward identification of the applicable party. The data shall not be stored longer than necessary to execute a contract agreement.
f. Data will be processed in a secure way, including protecting the data from being processed in an illegal manner and any potential damages. The Administrator will ensure that appropriate technical resources are used to protect the data.
2. Students’ data are processed with due diligence, and the Administrator is obliged to ensure that the data is properly secured.
3. Data is gathered for legally justifiable purposes and will not be used otherwise. Should a legally justifiable purpose cease to exist, the Administrator is obliged to erase the data immediately unless specified otherwise by the applicable national laws. The Administrator is obliged to perform a regular assessment of whether the storing and processing of the data remains justifiable.
4. The Administrator should ensure that the data is processed in an adequate and appropriate manner and that it is not used for any other, unjustified purposes. It is the Administrator’s duty to minimise the amount of data being processed. The Administrator should perform regular assessments of whether the data gathered should be processed or permanently removed.
5 . The Administrator is responsible for ensuring the data stored is accurate and performs frequent data updates.
6. The data of the parties mentioned in section III point 2 above may be transferred to public authorities and/or parties performing public tasks or acting on behalf of public authorities for purposes justifiable by the provision of applicable national laws. The data may be processed by any other entity that provides specific services to the Administrator (e.g., consulting, accounting, IT services). It is the Administrator’s duty to ensure that the data is processed with due diligence and that all the necessary security standards are adhered to.
7. The data of the parties mentioned in section III point 2 above shall not be processed in an automatic way, and the data shall not undergo profiling processes, with the exception of data of people processed within the framework of the Websites and courses of the ProfiLingua School.
8. Any party whose data are processed by the Administrator retains the right to:
a. Access the data – The data subject shall have the right to obtain from the Administrator confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing, the categories of personal data stored, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, including the criteria used to determine that period, the existence of the right to request data rectification, permanent deletion of personal data, or restriction of processing of the personal data, the right to file a complaint with a supervisory authority (ART. 15 GDPR).
b Request a copy of the data - The Administrator shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs (ART. 15 par. III GDPR).
c.Request data rectification – The Administrator is obliged to rectify inaccurate personal data without undue delay. (ART.. 16 GDPR)
d. Request the permanent deletion of data - The Administrator is obliged to permanently delete personal data in cases when personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (ART. 17 GDPR).
e. Request restriction of processing – The Administrator is obliged to restrict the processing of the data (ART. 18 GDPR) in the following circumstances:
i. The accuracy of the personal data is contested by the party, for the period enabling the Administrator to verify the accuracy of the personal data.
ii. The processing is not legally justified, and the person whose data are processed objects to the deletion of the personal data and opts for restriction of processing
iii. The Administrator no longer needs the personal data for the purposes of the processing, but they are necessary for the establishment, exercise or defence of legal claims
iv. The party whose data are stored has objected to the data processing – until the decision is reached whether the legitimate grounds of the Administrator override those of the party.
f. Request data transfer – the Administrator is obliged to deliver personal data in a structured manner, using a commonly used and machine-readable format. Additionally, the Administrator is obliged to transfer the data to another Administrator, provided the transfer and processing are based on the consent provided by the data subject, and the processing of the data is carried out by automated means. (ART. 20 GDPR).
g. Object to data processing – the party whose data are collected and processed retains the right to object data processing in legally justified circumstances, including data profiling. The Administrator shall no longer process the personal data unless there exist legitimate grounds for the continuance of the processing that override the interests, rights, and freedom of the requesting party or for the establishment, exercise or defence of legal claims. In cases when the rights of the data subject override the rights of the
9. Each data subject has the right to file a complaint to the supervisory organ – the President of the Personal Data Protection Office – when the subject feels that the processing of the subject’s data violates the existing law regulations. Complaints may be submitted:
a) in writing to the following address ul. Stawki 2, 00-193 Warszawa,
b) electronically through individual ePUAP platform
10. In case of any doubt, the data subject may contact the Data Protection Officer appointed by the Controller at the e-mail address: mlokaj@mlkancelaria.com.
11. Sharing your personal data is voluntary, with the exception to:
a) Customers, Participants, Business Customers and Employees/Co-workers of Business Customers - is a condition for the performance of a civil law contract for the benefit of the subject of the the data subject, and refusal to provide the data will prevent the Administrator from fulfilling the contract
b) Potential employees – sharing personal data is necessary to initiate the recruitment process, and the lack of agreement to share personal information renders the Administrator unable to initiate the process.
c) Employees – sharing personal data is necessary for the execution of an employment contract. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
d) Collaborators of the Administrator – sharing personal data is necessary for the execution of a civil law contract between the Administrator and any potential collaborators. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
e) Contractors of the Administrator – sharing personal data is necessary for the execution of a civil law contract between the Administrator and any potential contractor. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
12. Under no circumstances will the personal data be shared with a third country (a country that is not a member of the EU or is not a member of the following group: Iceland, Liechtenstein, Norway, Switzerland).
VIII. . Final provisions:
1. The above privacy policy becomes effective as of 01st September 2023.
2. In matters not mentioned in the document, generally applicable provisions of law shall apply, especially GDPR and national legal regulations regarding the protection of personal data.
3. The Administrator retains the right to implement necessary adjustments to the privacy policy. Any such adjustments shall be announced through the website of the Administrator.