Information notice from the personal data controller
1. SF-LB Jakub Ignyś, entered in the Central Register and Information on Economic Activity (CEIDG) maintained by the minister responsible for the economy, tax identification number (NIP) 7822261569, REGON 380426718, e-mail: jakub.ignys@gmail.com, is the controller of the personal data of its business partners with whom it has concluded cooperation agreements and of their employees, hereinafter collectively referred to as the Business Partners.
2. The Controller processes the personal data of the Business Partners to perform the agreements between the Controller and the Business Partners. Providing personal data is voluntary, but necessary to conclude and perform an agreement between the Controller and a Business Partner.
3. The Controller processes personal data for the period necessary to achieve the purposes specified in point 2 above. Personal data may be processed for a longer period where the Controller is entitled or required to do so under specific legal provisions or on the basis of the Controller’s legitimate interest referred to in point 5(c) below, namely until the limitation period for claims expires or the relevant proceedings are concluded if they were initiated during that limitation period.
4. The Business Partners are the source of the personal data being processed. The Controller may also process personal data of the Business Partners’ employees when those data are made available to it, if the agreement with the Business Partner requires activities to be carried out through those employees.
5. The legal bases for processing the personal data of the Business Partners are: (a) Article 6(1)(b) of the GDPR: processing necessary to perform an agreement between the Controller and a Business Partner or to take steps at the Business Partner’s request before entering into an agreement, where the Business Partner is a natural person conducting business; (b) Article 6(1)(c) of the GDPR: processing necessary to comply with the Controller’s legal obligations; (c) Article 6(1)(f) of the GDPR: the Controller’s legitimate interest in establishing, pursuing or defending claims until the limitation period expires or the relevant proceedings are concluded, if they were initiated during that period; (d) Article 6(1)(f) of the GDPR: the Controller’s legitimate interest in identifying persons authorised to represent the Business Partner or to carry out tasks under the agreement between the Controller and the Business Partner; (e) Article 6(1)(a) of the GDPR: the Business Partner’s consent to the processing of personal data for specific purposes where other legal bases do not apply.
6. The personal data of the Business Partners are not transferred to a third country or an international organisation within the meaning of the GDPR.
7. The Controller does not disclose personal data to third parties without the explicit consent of the data subject. Without the data subject’s consent, data may be disclosed only to entities authorised to process personal data under applicable law, such as law enforcement authorities, the Social Insurance Institution (ZUS) or the tax office. In particular, the Controller discloses the personal data of the Business Partners to payment operators, companies providing postal, IT and courier services, and tax authorities.
8. Personal data may be entrusted to processors that process those data on behalf of the Controller. The Controller entrusts the personal data of the Business Partners to: (a) IT companies providing hosting services and maintaining the Controller’s computer systems; (b) companies providing other services necessary for the Controller’s day-to-day operations.
9. The personal data of the Business Partners are not subject to profiling.
10. Under the GDPR, the Business Partners have the right to: (a) be informed about the processing of personal data; (b) access their personal data; (c) correct, complete, update and rectify their personal data; (d) have data erased (the right to be forgotten); (e) restrict processing; (f) data portability; (g) object to the processing of personal data; (h) where consent is the legal basis, withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal; (i) not be subject to profiling; (j) lodge a complaint with the supervisory authority, namely the President of the Polish Personal Data Protection Office (UODO), subject to the rules governing the exercise of these rights under the GDPR.
11. All enquiries, requests and complaints concerning the Controller’s processing of personal data should be sent by e-mail to jakub.ignys@gmail.com or in writing to: Kiekrz, ul. Powstańców Wielkopolskich 1, 62-090 Rokietnica.
12. The request or complaint should clearly specify: (a) the details of the person or persons concerned; (b) the event giving rise to the request or complaint; (c) the demands and their legal basis; (d) the expected manner of resolving the matter.
