Privacy Policy Tutore LLC
1. General Terms and Conditions
1. The aim of Privacy Policy is to define general principles involving data processing of workers, coworkers, customers, contractors and users of Administrators' Internet websites regarding to conducting business activity based on: selling and organizing courses for young and adult students.
2. Privacy Policy defines principles of personal data processing particularly within the framework of maintenance of websites, Call Center department contact, helpline with the Customer, Business Customers, and organization of courses and camps.
3. Based mainly on the provisions of Regulation (EU) 2016/679 of the European Parliament and Council of April 27, 2016, regarding the protection of natural persons with regard to the processing of personal data and its data flow along with repealing the Directive 95/46 / EC, hereinafter referred to as the GDPR, the Controllers shall take all necessary security measures to protect the personal data being processed
4. Under the concept of personal data should be understood all the information on identified or possible to identify by a natural person that this data concerns. Possible to identify a natural person is a person who can be identified directly or indirectly, especially based on identification such as: name and surname, identification number, localization data, internet identification or one or more factors specific to the physical, physiological, genetic ,mental, economic, cultural or social identity of a natural person.
II. Definitions
1. Administrator - Tutore LLC with its headquarters in Łódź (93-578), Wróblewskiego 19A/8 street, registered in Register of Entrepreneurs National Court Register under the number NCR 0000670834, Tax Number:7272812193, share capital : 1664 600 zł, court register: the Regional Court for Łódź-Śródmieście in Łódź, XX the Commercial Division of National Court Register
2. Customer - the natural person, that is at least 18 years of age and has the complete ability for legal actions, is not conducting any business activity or a natural person, running a business on its own behalf, only when the contract concluded with Administrator is directly correlated with its business activity and when content of the agreement shows the lack of occupational character, resulted mostly from the subject of business activity, shared according to Central Registry and Business Activity Information policy- making orders and concluding the agreement with Administrator, mediated by Websites, as well as via mail, by phone on their or participant's behalf.
3. Participant- a person enrolled by Customer for a course or a camp organized by Administrator
4. Work candidate - an individual applying for a job, either including internship or function at Administrator's.
5. Worker - a person employed by Administrator based on work contract.
6. Co workers - a person cooperating with Administrator based on Civil Law Contract, especially a contract of mandate or specific-task contract.
7. Counterparty - a natural person,legal person and organizational unit mentioned in art.33 1 § 1 Civil code, conducting the business or occupational activity on its own behalf, which concluding a civil law contract with Administrator directly related with business activity as well as the content of the contract shows that it has a professional character for the counterparty resulting from the subject of its business activity, shared according to Central Register and Business Activity Information policy.
8. Website - Internet platform used by the Administrator, where it is possible to contact the Administrator or to book the Services offered by him/her, i.e..tutore.eu/ - courses for adults, children and youth.
III. Personal Data
1. Policy finds its application to all individuals' data processing activities performed by Administrators, with significant consideration personal data:
a. Customers and Participants,
b. Candidates for employment with the Administrator,
c. Workers of Administrator,
d. Co workers of Administrator,
e. Administrator's contractors, their employees, co-workers and persons authorized by contractors to contact the Administrator by contractors.
IV. Personal data processed by the Administrator
1. The personal data administrator is Tutore Poland LCC with its headquarters in Łódź (93-578), Wróblewskiego 19A/8 street, registered in Register of Entrepreneurs National Court Register under the number NCR 0000670834, Tax Number:7272812193, Share capital : 1664 600 zł, Court register: the Regional Court for Łódź-Śródmieście in Łódź, XX the Commercial Division of National Court Register hereinafter named Administrator.
2. Contact with Administrator is possible at the address: Wróblewskiego 19A/8 Street, 93-578 Łódź, by phone number: 500 965 135 and via contact with Data Protection Officer by mail: info@tutore.eu
3. Administrator processes personal data of:
1. Customers and Participants' following purposes:
a. performing the contract by Administrator including participants' enrollment for courses and its organization (inter alia, in order to transfer data to log on the classes, to pass on extra class materials, checking class attendance) as well as, providing contact with Customer and Participant.
Legal basis for processing constitutes indispensability of processing to perform the contract that correlates with personal data or taking actions on person's request before concluding an agreement. (art.6 (1) (b) GDPR). Processed data corresponds with Participant as well, that means, for whom the contract has been concluded.
Administrator organizes and conducts courses for children and teenagers. Participants are enrolled in a course by Customer (i.e. a parent or legal guardian). Course is conducted within a set time planned beforehand, defined in contract between Customer and Administrator, usually through the whole school year. Courses are conducted online via Click Meeting or Zoom applications. Therefore, agreement is concluded between Administrator and Customer. Concluding a contract includes the necessity of personal data processing that is a contracting party- Customer, as well as children or teenagers enrolled in a course by Customer. What is more,
Administrator contacts with a customer via e-mail, phone number shared by Customer i.e. in order to provide data for conducted classes - links to log in, date of the classes or extra class materials.
b. the handling of organised courses, including changing the group, providing information on rescheduled classes, resolving ongoing problems by the Helpline department. The legal basis for the processing is the necessity of the processing for the performance of a contract to which the data subject is a party or to take action at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). The data processed also concerns the Participant, i.e. the person for whose benefit the contract was concluded. The day-to-day handling of the courses is provided by Tutore Poland sp. z o.o., with which the Administrator has concluded an agreement on the entrustment of personal data processing. Tutore Poland sp. z o.o. processes personal data of Customers and Participants in order to fulfil their requests and provide necessary information on the courses. The Administrator shall make every effort to ensure that the Infoline department of the processor has access to personal data only to the extent necessary for the performance of the entrusted tasks.
c. to ensure the highest standards of service for lessons delivered by Employees/Co-workers via the ClickMeeting platform, Zoom, the correctness of the performance of the entrusted activities and the possible improvement of the quality of the lessons, to safeguard the interests of the company in situations of disputes with the client (evidence) by monitoring and recording online courses. The legal basis for the processing is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR). The online courses organised by the Administrator are held through the ClickMeeting platform, Zoom, among others. The courses are taught by qualified staff with experience in the field of instruction. In order to maintain a high and uniform level of classes Tutore Poland sp. z o.o., with which the Administrator has concluded an agreement on entrusting the processing of personal data, records the course of individual classes and stores the recordings for a period not longer than 3 months. After this period, the recordings are automatically deleted from the Tutore Poland sp. z o.o. databases. The recordings may be stored for a longer period only for the purpose of resolving disputes with the Customer, i.e. handling complaints, pursuing claims and asserting rights (purpose specified in point o below). The recordings include the image of the class leader and the Participants together with their voices, provided that this is done on the basis of consent. Consent to the recording is voluntary, but necessary for participation in the class. Such consent may be withdrawn at any time, but withdrawal of consent will result in termination of the agreement with the Administrator.
d. to establish contact with the Administrator, including the booking of trial classes for the Participant by the Client. The legal basis for the processing of data for the above-described purpose is the natural person's voluntary consent to the processing of personal data - (Article 6(1)(a) GDPR). Tutore Poland sp. z o.o., with which the Administrator has concluded an agreement on entrusting the processing of personal data, makes it possible to contact the Administrator and to book classes for the Participant through the booking form made available on the tutore.eu website/. Within the form, processing of personal data takes place.
e. to ensure the highest standards of customer service, for training purposes - to improve the quality of service, to safeguard the interests of Tutore Poland sp. z o.o., with whom the Administrator has entered into an agreement of entrustment of personal data processing, in situations of disputes with the Customer (evidence), to ensure the safety of Employees / Co-workers of Tutore Poland sp. z o.o.in the case of undesirable and dangerous events from the side of Customers or Participants (e.g. criminal threats) through the recording of conversations with consultants of Call Center and Hotline Tutore Poland sp. z o.o.. The legal basis for the processing of data for the above-described purpose is the consent given by the Customer during a telephone conversation with a consultant of Tutore Poland sp. z o.o.- (Article 6(1)(a) GDPR). Consent is voluntary and can be withdrawn at any time. The processing of personal data is necessary in the event that the Customer makes a complaint to the Administrator regarding the arrangements made over the telephone. The Administrator reserves the right to verify the content of the telephone conversation made with the Customer. The Administrator makes every effort to maintain the security of telephone call recordings, among other things, by limiting as much as possible the circle of persons who have access to the recordings.
f. to establish contact with Customers and to market its own products and services, including those offered by the Administrator's Education department (courses for children and young people). The legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) GDPR). Tutore Poland sp. z o.o., with whom the Administrator has entered into an agreement on entrusting the processing of personal data, undertakes marketing and information activities on behalf of the Administrator concerning its services, which constitute a form of direct marketing. Marketing purposes are carried out using the Customer's telephone number obtained by the Administrator from the Relationship Marketing and Present-service databases, and then also based on data obtained independently by the Administrator from the Customer or a third party within the meaning of Article 14 GDPR.
g. processing of complaints, claims and rights. The legal basis for the processing of data for the above-described purpose is the legitimate interest of the Administrator - (Article 6(1)(f) GDPR). The processing of personal data is necessary in the event that a Customer or a Business Customer makes a complaint to the Administrator regarding the services or products offered. The above is further supplemented by the assertion of mutual claims and the assertion of rights in the course of possible judicial and extrajudicial proceedings.
h. fulfilment of a legal obligation incumbent on the Administrator under tax and accounting law. The legal basis is the legal obligation incumbent on the Administrator regulated by Article 6(1)(c) of the GDPR in connection with the wording of the Accounting Act, the Tax Code, the Personal Income Tax Act, the Value Added Tax Act and other tax legislation . The Administrator is obliged to keep accounts in a manner that complies with the applicable legal provisions. In addition, it has certain tax obligations. The above entails the necessity to process customers' data, in particular entrepreneurs, for whom the Administrator issues VAT invoices, accounting and bookkeeping is carried out by Tutore Poland sp. z o.o., with which the Administrator has concluded an agreement on entrusting personal data processing.
2. Job candidates for the following purposes:
a. conducting recruitment process on the basis of the entitlement stipulated in z Art. 22¹ para 1 of the Labour Code. The basis for processing the above-mentioned personal data is the legal obligation of the Controller (Art. 6 [1] c of the GDPR) – throughout the period of the recruitment process,
b. conducting the recruitment process, on the basis of the consent of the candidate to process his/her personal data i.e.personal data different from that stipulated in Art. 22¹ para 1 of the Labour Code. The basis for processing is the above-mentioned consent (Art. 6 [1] a of the GDPR)– throughout the period of the recruitment process,
c. the pursuit of legitimate interest of the Controller in the scope of data obtained from the candidate in connection to verifying the abilities and skills required to work on a particular post. The basis of data processing is the legitimate interest of the Administrator (Art. 6 [1] f of the GDPR)– throughout the period of the recruitment process,
d. conducting future recruitment processes on the basis of a consent of the candidate to process his/her personal data. The basis for the data processing is the consent (Art. 6 [1] a of the GDPR) – until the next recruitment process, in which the candidate will be taken into consideration by the Controller;
3. Employees in the following purposes:
a. arranging and managing the work of employees – in a necessary scope stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
b. calculating and paying the remuneration – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
c. deductions from the remuneration – in order to implement the obligations in the scope of court seizures stipulated in the labour code, code of civil procedure, act on administrative enforcement proceedings, act on court enforcement officers (Art. 6 [1] c of the GDPR) – over 3 years since the last deduction,
d. fulfilling the obligations of the employer towards the employees resulting from the generally applicable labour regulations (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – throughout the period of employment,
e. fulfilling the obligations resulting from occupational health and safety (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over 10 years since the termination of employment,
f. keeping employment records – in order to fulfill the obligations of the employer stipulated in the labour code, act on the national archival resources and archives and ordinance on the scope of keeping documentation on matters related to an employment relationship by the employers and the way the employees files are kept (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 5o or 10 years since the termination of the employment,
g. fulfilling the obligations towards ZUS (Social Insurance Institution) – in order to fulfill the obligations of the payer of pension contributions stipulated in the act on old-age and disability pensions from the Social Insurance Fund (ZUS), act on social insurance system and act on healthcare services financed from public funds (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 50 or 10 years in the scope of keeping the documents on the grounds of which the basis for old-age and disability pension entitlements is established,
h. fulfilling the tax obligations - in order to fulfill the obligations of the income tax payer stipulated in the tax ordinance act, act on personal income tax and other tax regulations (Art. 6 [1] c of the GDPR) – over the period of 5 years since the end of the calendar year,
i. fulfilling the accounting obligations – in order to fulfill the obligations stipulated in the act on accounting, tax ordinance act and corporate income tax act (Art. 6 [1] c of the GDPR)– over the period of time of 5 years since the end of the fiscal year in which the event occurred,
j. physical security of the Administrator's buildings, premises and property
k. providing the highest possible standards of service to the classes conducted by the Coworkers by means of ClickMeeting or Zoom platforms, correct performance of the assigned duties and possible improvement of the quality of classes, securing the company’s interests in disputes with customer (evidence) by monitoring and recording the online courses – on the basis of voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) – The image and voice of the Coworker will be processed over the period of 3 months. In the case the recordings of registered classes constitute evidence in the proceedings conducted on the basis of provisions of law or the Controller has been informed that they may constitute evidence in the proceedings, the period is extended until the final conclusion of the proceedings. When these periods of time expire, the recordings which contain personal data shall be destroyed.
l. providing the possibility of sharing the recordings with new Employees and Coworkers recording online trainings conducted by means of Zoom platform – on the basis of a voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) - The image and voice of the Coworker will be processed until the consent is withdrawn. In the case the consent is withdrawn, the recordings including personal data shall be destroyed,
m. to ensure the highest standards of service of the lessons provided by the Associates via the ClickMeeting or Zoom platform, the correctness of the performance of the entrusted activities and possible improvement of the quality of the lessons, safeguarding the interests of the company in situations of disputes with the client (evidence) by monitoring and recording online courses - based on the voluntary consent of the recorded person (Article 6(1)(a) GDPR) - the Image and voice of the Associate will be processed for a period of 3 months. Where the recordings of the recorded classes constitute evidence in proceedings under the law or the Administrator has become aware that they may constitute evidence in the proceedings, this period shall be extended until the proceedings are legally concluded. After the expiry of these periods, the recordings containing personal data shall be destroyed,
n. pursuing claims or defending against claims - on the basis of legitimate interest of the Controller (Art. 6 [1] f of the GDPR) relying on taking part in court cases – over the period of 3 years since the termination of employment, in the case of pending proceedings over the period of the proceedings until the final conclusion and limitation of claims;
4. Coworkers in the following purposes:
a) concluding and performing civil-law contracts – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] b, c, f of the GDPR) – over the period of cooperation,
b) calculating and paying the remuneration – in order to fulfill the obligation stipulated in the labour code (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of cooperation,
c) deductions from the remuneration – in order to implement the obligations in the scope of court seizures stipulated in the labour code, code of civil procedure, act on administrative enforcement proceedings, act on court enforcement officers (Art. 6 [1] c of the GDPR) – by the period of time stipulated by the generally applicable provisions of law,
d) fulfilling the tax obligations - in order to fulfill the obligations of the income tax payer stipulated in the tax ordinance act, act on personal income tax and other tax regulations (Art. 6 [1] c of the GDPR) – over the period of 5 years since the end of the calendar year,
e) fulfilling the obligations towards ZUS (Social Insurance Institution) – in order to fulfill the obligations of the payer of pension contributions stipulated in the act on old-age and disability pensions from the Social Insurance Fund (ZUS), act on social insurance system and act on healthcare services financed from public funds (Art. 6 [1] c, Art. 9 [2] b of the GDPR) – over the period of 5 years since the end of calendar year,
f) fulfilling the accounting obligations – in order to fulfill the obligations stipulated in the act on accounting, tax ordinance act and corporate income tax act (Art. 6 [1] c of the GDPR) – over the period of time of 5 years since the end of the fiscal year in which the event occurred,
g) physical security of the buildings, rooms and property of the Controller – on the basis of the legitimate interest of the Controller (Art. 6 [1] f of the GDPR) – over the period of cooperation,
h) providing the highest possible standards of service to the classes conducted by the Coworkers by means of ClickMeeting or Zoom platforms, correct performance of the assigned duties and possible improvement of the quality of classes, securing the company’s interests in disputes with customer (evidence) by monitoring and recording the online courses – on the basis of voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR)– The image and voice of the Coworker will be processed over the period of 3 months. In the case the recordings of registered classes constitute evidence in the proceedings conducted on the basis of provisions of law or the Controller has been informed that they may constitute evidence in the proceedings, the period is extended until the final conclusion of the proceedings. When these periods of time expire, the recordings which contain personal data shall be destroyed,
i) providing the possibility of sharing the recordings with new Employees and Coworkers recording online trainings conducted by means of Zoom platform – on the basis of a voluntary consent of the person being recorded (Art. 6 [1] a of the GDPR) - The image and voice of the Coworker will be processed until the consent is withdrawn. In the case the consent is withdrawn the recordings including personal data shall be destroyed,
j) to provide the highest standard of customer service, for training and service quality improvement purposes, to secure the company’s interests in disputes with the customer (evidence), to ensure the safety of employees in the event of undesirable and potentially dangerous circumstances provoked by Customers (e.g., punishable threats) by monitoring telephone conversations between the Administrator’s Customers – provided a legitimate interest of the Administrator exists (ART. 6 (1) (f) GDPR) – for a period of up to 3 months. Should the recordings of phone conversations be considered evidence in legal proceedings governed by the applicable law provisions, the period shall be extended until a legally binding conclusion is reached. Following these periods, the recordings shall be destroyed.
l. pursuing or defending against claims - on the basis of the Administrator's legitimate interest (Article 6(1)(f) GDPR) consisting in appearing in court cases - in the case of pending proceedings, for the duration of the proceedings until their final and legally binding conclusion and for the period set by generally applicable laws;
5. Contractors’ data are processed for the following purposes:
a. Establishing partnership – to undertake action at the request of the data owner prior to signing a contract, including participating in negotiations (ART.6 (1) (b, c, f) GDPR) – prior to signing a civil law contract between the parties involved.
b. Ensuring effective communication with a Contractor (e-mail address, phone number) – for the proper execution of a contract to which the data owner is a party (ART. 6 (1) (b, f) GDPR) – for the period specified in an agreement between the parties.
c. Executing the rights and obligations specified by a civil law contract between the parties, including the adherence to the Civil Code (ART. 6 (1) (b, c, f) GDPR) for the period specified in an agreement between the parties.
d. Keeping the log of correspondence – necessary for the execution of legally justified purposes (ART. 6 (1) (c, f) GDPR) - for the period specified in an agreement between the parties.
e. Keeping the log of cooperation (including payment processing) – for the proper execution of a civil law contract between the parties (ART. 6 (1) (b, c) GDPR) - for the period specified in an agreement between the parties.
f. Executing claims and rights - on the basis of the Administrator's legitimate interest (Article 6(1)(f) of the GDPR) consisting in court proceedings - in the case of pending proceedings, for the duration of the proceedings until their final and legally binding conclusion and for the period specified by generally applicable laws, performing tax obligations (contractor's data) - in order to fulfil obligations of an income tax or VAT payer resulting from the Tax Ordinance, the Personal Income Tax Act, the Value Added Tax Act and other tax regulations (Article. 6(1)(c) GDPR) - for a period of 5 years from the end of the calendar year, bookkeeping and accounting is carried out by Tutore Poland sp. z o.o, with whom the Administrator has entered into an agreement for the entrustment of personal data processing,
4. The Administrator obtains information about the parties specified in:
a) Points 3, 4, and 5 above due to the presence of the statutory obligation to store such data, allowing for an effective recruitment process. The provision of data which is not indispensable in the light of the statutory obligation is voluntary.
b) Points 1, 2, and 5 through the voluntary provision of personal data, in particular on the tutore.eu website, as well as to third parties.
5. The Administrator may store personal data only for the period of time necessary to fulfill the purposes for which the data was collected. Taking the above into account, the Administrator will store the personal data of Customers and Students for the following periods of time:
a. Data processed for the purposes specified in Paragraph 3 (1) (a, b, f) – for the duration of the contract. Following the contract expiration, the data will be stored for the time specified in applicable law regulations, especially pursuing legal claims.
b. Data processed for the purposes specified in Paragraph 3 (1) (c, d, o, p, l, t) – until the objection is raised by the party.
c. Data processed for the purposes specified in Paragraph 3 (1) (d, e) – until the consent to process the data is withdrawn.
d. ta processed for the purposes specified in Paragraph 3 (1) (g, h) – for the timeframe specified by applicable law regulations.
VI. Processing the data by the Administrator
The Administrator commits to ensuring that personal data is processed with due diligence, including adherence to the provisions of applicable national law, especially GDPR. It is the duty of the Administrator to ensure that:
a. Data is processed in accordance with national law and in a way that is transparent for the party sharing their personal data.
b. Data is gathered for purposes justified by national law and will not be used otherwise.
c. Data will not be processed in any other way than necessitated by the nature of the agreement between parties.
d. Corrected and updated when necessary.
e. Data is stored in a way that allows for straightforward identification of the applicable party. The data shall not be stored longer than necessary to execute a contract agreement.
f. Data will be processed in a secure way, including protecting the data from being processed in an illegal manner and any potential damages. The Administrator will ensure that appropriate technical resources are used to protect the data.
2. Students’ data are processed with due diligence, and the Administrator is obliged to ensure that the data is properly secured.
3. Data is gathered for legally justifiable purposes and will not be used otherwise. Should a legally justifiable purpose cease to exist, the Administrator is obliged to erase the data immediately unless specified otherwise by the applicable national laws. The Administrator is obliged to perform a regular assessment of whether the storing and processing of the data remains justifiable.
4. The Administrator should ensure that the data is processed in an adequate and appropriate manner and that it is not used for any other, unjustified purposes. It is the Administrator’s duty to minimise the amount of data being processed. The Administrator should perform regular assessments of whether the data gathered should be processed or permanently removed.
5. The Administrator is responsible for ensuring the data stored is accurate and performs frequent data updates.
6. The data of the parties mentioned in section III point 2 above may be transferred to public authorities and/or parties performing public tasks or acting on behalf of public authorities for purposes justifiable by the provision of applicable national laws. The data may be processed by any other entity that provides specific services to the Administrator (e.g., consulting, accounting, IT services). It is the Administrator’s duty to ensure that the data is processed with due diligence and that all the necessary security standards are adhered to.
7. 7. The data of the parties mentioned in section III point 2 above shall not be processed in an automatic way, and the data shall not undergo profiling processes, with the exception of data of people processed within the framework of the Websites and courses of the ProfiLingua School.
8. Any party whose data are processed by the Administrator retains the right to:
a. Access the data – The data subject shall have the right to obtain from the Administrator confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: the purposes of the processing, the categories of personal data stored, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, including the criteria used to determine that period, the existence of the right to request data rectification, permanent deletion of personal data, or restriction of processing of the personal data, the right to file a complaint with a supervisory authority (ART. 15 GDPR);
b Request a copy of the data - The Administrator shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs (ART. 15 par. III GDPR);
c.Request data rectification – The Administrator is obliged to rectify inaccurate personal data without undue delay. (ART.. 16 GDPR);
d. Request the permanent deletion of data - The Administrator is obliged to permanently delete personal data in cases when personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (ART. 17 GDPR);
e. Request restriction of processing – The Administrator is obliged to restrict the processing of the data (ART. 18 GDPR) in the following circumstances:
i. The accuracy of the personal data is contested by the party, for the period enabling the Administrator to verify the accuracy of the personal data.
ii. The processing is not legally justified, and the person whose data are processed objects to the deletion of the personal data and opts for restriction of processing
iii. The Administrator no longer needs the personal data for the purposes of the processing, but they are necessary for the establishment, exercise or defence of legal claims
iv. The party whose data are stored has objected to the data processing – until the decision is reached whether the legitimate grounds of the Administrator override those of the party.
f. Request data transfer – the Administrator is obliged to deliver personal data in a structured manner, using a commonly used and machine-readable format. Additionally, the Administrator is obliged to transfer the data to another Administrator, provided the transfer and processing are based on the consent provided by the data subject, and the processing of the data is carried out by automated means. (ART. 20 GDPR).
g. Object to data processing – the party whose data are collected and processed retains the right to object data processing in legally justified circumstances, including data profiling. The Administrator shall no longer process the personal data unless there exist legitimate grounds for the continuance of the processing that override the interests, rights, and freedom of the requesting party or for the establishment, exercise or defence of legal claims. In cases when the rights of the data subject override the rights of the
9. Each data subject has the right to file a complaint to the supervisory organ – the President of the Personal Data Protection Office – when the subject feels that the processing of the subject’s data violates the existing law regulations. Complaints may be submitted:
a. in writing to the following address ul. Stawki 2, 00-193 Warszawa,
b. electronically through individual ePUAP platform.
10. Sharing your personal data is voluntary, with the exception to:
a. Customers, Participants, Business Customers and Employees/Co-workers of Business Customers - is a condition for the performance of a civil law contract for the benefit of the subject of the the data subject, and refusal to provide the data will prevent the Administrator from fulfilling the contract
b. Potential employees – sharing personal data is necessary to initiate the recruitment process, and the lack of agreement to share personal information renders the Administrator unable to initiate the process.
c. Employees – sharing personal data is necessary for the execution of an employment contract. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
d. Collaborators of the Administrator – sharing personal data is necessary for the execution of a civil law contract between the Administrator and any potential collaborators. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
e. Contractors of the Administrator – sharing personal data is necessary for the execution of a civil law contract between the Administrator and any potential contractor. The lack of agreement to share personal data renders the Administrator unable to execute the contract.
11. Under no circumstances will the personal data be shared with a third country (a country that is not a member of the EU or is not a member of the following group: Iceland, Liechtenstein, Norway, Switzerland).
VII. Final provisions:
1. The above privacy policy becomes effective as of 01st September 2023.
2. In matters not mentioned in the document, generally applicable provisions of law shall apply, especially GDPR and national legal regulations regarding the protection of personal data.
3. The Administrator retains the right to implement necessary adjustments to the privacy policy. Any such adjustments shall be announced through the website of the Administrator.