From 25 May 2018, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: the “Regulation”) will come into force. This Regulation introduces a number of changes regarding the obligations of entities processing personal data. Its purpose is to expand and unify the rights to the protection of personal data of European Union citizens.
WHO IS THE DATA CONTROLLER?
The administrator of your personal data is Arthur-Hunt with its registered office in Warsaw (registered office address Szucha 16/17 00-582 Warsaw).
WHAT DATA DO WE COLLECT?
We process your data for the following purposes:to take all actions at your request aimed at concluding a contract and performing the contract (Article 6(1)(b) of the Regulation), fulfilling all legal obligations incumbent on us in connection with the cooperation undertaken (Article 6(1)(c) of the Regulation), this purpose is related to the legal obligations to store certain documents for the time indicated in the provisions of law, e.g.: Article 74(2)(1)-(8) of the Accounting Act of 29.09.1994 (Journal of Laws of 2017, item 1858); Article 8b(3) in connection with Article 9k of the Act of 16.11.2000. on counteracting money laundering and terrorist financing (Journal of Laws of 2000 No. 116, item 1216); Article 86 § 1 and 2 of the Act of 29 August 1997 – Tax Ordinance (Journal of Laws of 1997 No. 137 item 926). for archiving (evidence) purposes to secure information in the event of a legal need to prove facts, which is our legitimate interest (basis in Article 6(1)(f) of the Regulation); in order to establish, pursue or defend against claims, which is our legitimate interest (legal basis: Article 6(1)(f) of the Regulation); for a specific purpose on the basis of your consent to the processing of your personal data for one or more purposes (basis under Article 6(1)(a) of the Regulation) – if you consent to the use of your data, the content of this consent will specify the specific purpose for which we will process this data. Please be advised that for the purposes indicated above, we will not perform profiling, i.e. automated analysis of your data and the development of predictions about preferences or future behaviour (profiling means, e.g. in the case of marketing profiling, determining which offer you may be most interested in based on your previous choices). In the event of a change in the decision regarding profiling, you will be informed about the above by supplementing this information and sending it to the e-mail address indicated by you.
WHAT DATA SHOULD YOU PROVIDE TO US?
In order to conclude a contract / order, we require you to provide the data on the contract / order form (if you do not provide them, we will not conclude the contract / order and we will not perform the order). In addition, we may ask for optional data that do not affect the conclusion of the contract (if we do not receive it, we will not be able to, for example, call a contact number). During the term of the contract / order, when providing services, we come into possession of your other data. The appearance of your personal data with us is a consequence of the operation of our services that you use. When concluding a contract or during the term of the contract, you can additionally, for example, order services not yet covered by the contract/order. If this requires the use of your data in a manner other than that described in this document, we will complete and provide the missing information, if possible, prior to the collection of the data. Otherwise, the information on data processing contained in this document will remain up-to-date.
WHO MAY WE SHARE YOUR PERSONAL DATA WITH?
Public authorities, to the extent that they do not receive data as part of a specific legal procedure (depending on the basis of competence); Entities that process your personal data on behalf of the company on the basis of a personal data processing agreement concluded with the Company (the so-called processors). These will be, m.in, IT specialists, archiving companies, entities providing banking and payment services, hosting companies. External data controllers (the so-called Parallel Controller, to whom the data is shared, e.g. legal advisors and advocates, entities conducting courier or postal activities, entities acquiring receivables – in the event of your failure to pay our invoices on time), Recipients in a third country or an international organization, if we decide to transfer such transfer.
HOW LONG WILL WE KEEP YOUR PERSONAL DATA?
Your personal data will be processed for the period necessary to achieve the purposes of processing indicated in point 1, i.e.: within the scope of the implementation concluded by you with Arthur-Hunt for the period until its completion is completed, and after this time: for the period required by law, e.g. for the storage of specific accounting documentation and specific data in accordance with tax regulations; for the period resulting from the legitimate interests of the company (i.e. the limitation period for securing possible claims), in the scope of fulfilling legal obligations incumbent on the company in connection with conducting legal activity and the performance of concluded contracts, for the period specified by law until the company fulfils these obligations; for internal administrative purposes, for a period until the legitimate interests of the company constituting the basis for this processing are fulfilled or until you object to such processing; in the field of marketing and promotion of services offered by the Administrator – for the period until objection to the processing of data; in the scope of the consent – until it is withdrawn.
TRANSFER OF DATA TO THIRD COUNTRIES
We do not transfer your data outside the territory of Polish, the European Union and the European Economic Area (including the European Union, Norway, Liechtenstein and Iceland). However, it may turn out that during the term of the contract/mandate we decide to transfer data outside the EEA – only to the extent that the law allows us to. Such a transfer will take place only if the third country ensures adequate protection of your personal data. You will be informed about this situation by e-mail or phone.
In the event that your personal data is transferred to a third country that has not been recognised by the European Commission as providing an adequate level of protection, we will ask you for your explicit consent to such transfer, informing you of the prior risks associated with such transfer pursuant to Article 40(1)(a) of the Regulation.
RIGHT TO ACCESS AND RECTIFY DATA
You have the following rights: the right to access the personal data we process (Article 15 of the Regulation), the right to rectify the entrusted personal data, including their correction (Article 16 of the Regulation), the right to delete personal data from our systems, the so-called “right to be forgotten” – if in your opinion there are no grounds for us to process your data, you can request to delete it (Article 17 of the Regulation), the right to restrict the processing of personal data – you can request that we limit the processing of your personal data only to their storage or to the performance of activities agreed with you, if in your opinion we have incorrect data about you or we process it unjustifiably; or you do not want us to delete it because you need it to establish, exercise or defend legal claims; or for the duration of your objection to the processing of data (Article 18 of the Regulation), Right to data portability – you have the right to receive from us in a structured, commonly used and machine-readable format (e.g. “.csv format”) your personal data, which we are in possession of on the basis of a contract or your consent. You will be entitled to this right if we have your data in electronic format – if we have your data only in paper form, you will not be able to exercise this right. You can instruct us to send this data directly to another entity (Article 20 of the Regulation), the right to withdraw your consent to the processing of your personal data (you have the right to withdraw your consent to the processing of personal data that we process on the basis of your consent at any time) – Article 7(3) of the Regulation. Withdrawal of your consent will not affect the lawfulness of the processing that was carried out on the basis of your consent before its withdrawal. The withdrawal of consent occurs by sending an e-mail. In order to exercise the above rights, please send an application with the appropriate content to the company’s address or submit it in person at the office in Warsaw, Szucha 16/17 00-582 Warsaw.
In the event that your personal data is transferred to a third country that has not been recognised by the European Commission as providing an adequate level of protection, we will ask you for your explicit consent to such transfer, informing you of the prior risks associated with such transfer pursuant to Article 40(1)(a) of the Regulation.
RIGHT TO OBJECT
Notwithstanding the rights listed above, you may object at any time to the processing of your data (including profiling, if any) for direct marketing purposes – Article 21 of the Regulation. Once we have accepted your request in this regard, we are obliged to stop processing your data for this purpose. In special situations, you may object at any time to our processing of your personal data (including profiling, if it is carried out), if the basis for the use of the data is our legitimate interest or public interest – Article 21 of the Regulation. In such a situation, after considering your request, we will no longer be able to process the personal data covered by the objection on this basis, unless we demonstrate that there are: compelling legitimate grounds for the processing of the data, which are considered by law to override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims. More information can be found in Article 21 of the Regulation.
In the event that your personal data is transferred to a third country that has not been recognised by the European Commission as providing an adequate level of protection, we will ask you for your explicit consent to such transfer, informing you of the prior risks associated with such transfer pursuant to Article 40(1)(a) of the Regulation.
INFORMATION ON THE VOLUNTARY NATURE OF PROVIDING DATA
To the extent that the processing of your data takes place for the purpose of concluding and performing a contract/order, providing your data is a condition for concluding this contract/order. Providing data is voluntary, however, the consequence of not providing this data will be the inability to conclude and perform this contract/order.
In the event that your personal data is transferred to a third country that has not been recognised by the European Commission as providing an adequate level of protection, we will ask you for your explicit consent to such transfer, informing you of the prior risks associated with such transfer pursuant to Article 40(1)(a) of the Regulation.
INFORMATION ON THE CHANGE OF THE PURPOSES OF DATA PROCESSING BY THE ADMINISTRATOR
If the Company decides to process your personal data for a purpose other than the purpose for which the personal data was collected, we will inform you of this other purpose and provide any other relevant information prior to such further processing.
CONSENT
If our use of your data is not necessary for the performance of a contract, compliance with a legal obligation or does not constitute our legitimate interest, we may ask for your consent for specific purposes of using your data. Such consent may enable, for example, sharing data with other entities for the purposes of promotional campaigns or automatic decision-making based on your data and at your request, or contacting you by phone/e-mail in order to provide information on the progress of the contract. You can withdraw the consent you have given us at any time (this will not affect the lawfulness of the use of your data before the withdrawal of such consent). The withdrawal of consent takes place by appropriate information, in accordance with point g point 1 of the chapter “Right to access and rectification of data” of this document.
If you consent to the use of your data, the content of this consent will specify the purpose for which we will process this data. The consent for the processing of your data will be used only for purposes for which other premises for processing indicated in letters a)-e) above will not apply.
INFORMATION ON THE CHANGE OF THE PURPOSES OF DATA PROCESSING BY THE ADMINISTRATOR
If, in your opinion, the processing of personal data by Arthur-Hunt violates the provisions of the Regulation, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection.