1. The Controller of your personal data is “IH Systems Sp. z o. o.” limited liability company, with its seat in Toruń, at 6 Wapienna Street, KRS no. 0000717395.
2. You can contact the Controller at the above-mentioned address, and also by e-mail at: firstname.lastname@example.org and by phone: 56 610 28 25 or fax: 56 648 04 00.
3. The Controller appointed a person responsible for personal data protection and you can contact them in all matters related to your personal data protection, by e-mail at: email@example.com, by phone: 56 610 28 25, or by letter sent to the address of our seat indicated under point 1.
4. The Controller processes your data for the following purposes:
a. taking actions necessary to conclude a contract, such as making an offer, correspondence to agree upon the terms of contract, etc. (legal basis: Art. 6 supbara. 1 letter b) of GDPR);
b. performance of contracts concluded with the Controller, which includes, among other things, issuing invoices, telephone and e-mail contact, delivery of ordered products, etc. (legal basis: Art. 6 subpara. 1 letter b) of GDPR);
c. offering products and services by the Controller directly (direct marketing), which includes tailoring them to your needs (legal basis: Art. 6 subpara. 1 letter f of GDPR);
d. offering products and services of companies which cooperate with the Controller (our partners) directly (direct marketing), which constitutes a pursuit of legitimate interest of the Controller and its partners (legal basis: Art. 6 subpara. 1 letter f of GDPR);
e. researching customer satisfaction, which constitutes a pursuit of the Controller’s legitimate interest, analysing the quality of customer service and researching satisfaction of Controller’s customers with regard to the products and services provided thereby (legal basis: Art. 6 subpara. 1 letter f of GDPR);
f. internal administrative purposes of the Controller, including analytics and statistics (for a better adjustment of services to the customers’ needs, general optimisation of products, optimisation of customer service, building knowledge concerning the customers, financial analyses, etc), which constitute a pursuit of the Controller’s legitimate interest (legal basis: Art. 6 subpara. 1 letter f of GDPR);
g. possible determination and investigation of claims, or defence against them, which constitutes a pursuit of the Controller’s legitimate interest (legal basis: Art. 6 subpara. 1 letter f of GDPR);
h. archiving (evidence-related) which constitutes a pursuit of the Controller’s legitimate interest, in order to secure information in the case of a legitimate necessity to demonstrate facts (legal basis: Art. 6 subpara. 1 letter f of GDPR);
i. video surveillance in the Controller’s seat carried out in order to protect employees and property/ supervise production/ ensure confidentiality of information the disclosure of which could be detrimental to the Controller; (Art. 6 subpara. 1 letter f) of GDPR);
j. providing the “Newsletter” service, if you consented thereto (legal basis: Art. 6 subpara. 1 letter a) of GDPR);
5. Your personal data shall be processed for a period necessary to fulfil the purposes of processing listed under point 4:
a. with regard to conclusion and performance of contracts, determination and investigation of claims, or defence against them – until the contract’s performance is completed, and after that, for a period required by legal provisions, or in order to secure possible claims (i.e. the longest possible limitation period for claims arising from this contract plus 1 year from the end of the year when the contract expired – an additional period of 1 year has been introduced in case of claims being notified right before the end of limitation period and with the aim to standardise the deadline for the removal of data concerning contracts which are to expire in a given year;
b. if no contract was concluded based on the offer presented to you within two months, your personal data related to this offer shall be immediately removed, expect for the data necessary for the purposes of direct marketing;
c. with regard to the data processed for the purposes of direct marketing – until you withdraw your consent for the processing, object to their processing for this purpose, or until it is found out that they are no longer up-to-date.
d. with regard to the internal administrative purposes, purposes of archiving and customer satisfaction research – until the Controller’s legitimate interest being the basis for data processing is achieved, or until you object to the processing.
e. video surveillance recordings shall be stored for a maximum of three months from the day they were recorded, or until you object to such processing. If video surveillance footage makes up evidence in lawful proceedings, or if the Controller becomes aware that it might become evidence in such proceedings, the footage shall be stored until the proceedings are lawfully completed.
6. If data processing is carried out based on your consent thereto, you have the right withdraw this consent at any time, however, data processing carried out before this withdrawal remains legal. You can withdraw your consent by phone, by e-mail or by letter sent to the address indicated under point 2.
7. At any time, you have the right to object to the processing of your data for the purposes indicated under point 4 letters e-h. The Controller shall cease to process your data for these purposes, unless we can demonstrate that in the case of your data, there exist legally justified reasons that are important for us, which are superior to your interest, rights and freedoms, or unless we may need your data for the purposes of a possible establishment and investigation of claims or defence against them.
8. At any time, you have the right to object to the processing of your data for the purpose of direct marketing (point 4 letters c and d). If you decide to avail yourself of this right, the Controller shall cease to process your data for that purpose.
9. With regard to the processing of your personal data by the Controller, you have the right to:
a) access your data and receive a copy thereof,
b) rectify your data,
c) erase your data (“the right to be forgotten”), in cases set forth under Art. 17 of GDPR,
d) limit the scope of data processing
e) object to the processing of data,
f) transmit your data elsewhere.
10. Your personal data may become disclosed:
Your personal data may also be accessed by our subcontractors (processing entities), for example: accounting firms, law firms, IT companies, loss adjusters, loss adjustments services contractors, marketing agencies.
11. If you believe that the processing of your data by the Controller infringes upon the GDPR provisions, you have the right to lodge a complaint to the supervisory authority (up to 25th May 2018, it is the Inspector General for the Protection of Personal Data, and after that date, a successor thereof).
12. If your personal data are processed for the purpose of conclusion and performance of a contract with the Controller, providing your data is a condition for concluding this contract. Providing your data is voluntary but if you decline thereto, it will not be possible to conclude and perform the contract. Furthermore, taking certain actions, which include the provision of services and/or performance of contracts with us, may require you to accept our use of video surveillance at the Controller’s seat/office if you visit our seat/office.