Privacy Policy
To download:
Version No. 1.0.0. valid from 01/06/2022
Content of the document:
§1
(General Provisions)
1. This Privacy Policy (hereinafter referred to as the “Policy”) provides information on personal data processing by eDev Studio Sp. z o.o. with its registered office in Olsztyn, including personal data of our Clients and Clients’ representatives. In particular, the Policy provides information on:
a) the entity that is the controller of your data;
b) the purpose and grounds for the processing of your data;
c) who we share your data with;
d) the retention period for which your data are stored;
e) the rights that can be exercised by the data subjects.
2. We make every effort to ensure full security of personal data processing and meet all other obligations resulting from the provisions on personal data protection, including in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), i.e. the so called “GDPR”.
3. In the Policy, the “Personal Data” shall mean information about a natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data or an online identifier. Personal data also refer to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
§2
(Personal Data Controller)
1. The Controller of your personal data is eDev Studio Sp. z o.o. with its registered office in Olsztyn, ul. Władysława Trylińskiego 2, 10-687 Olsztyn, entered in the register of entrepreneurs of the National Court Register maintained by the District Court in Olsztyn, 8th Commercial Division of the National Court Register under the number KRS: 0000722653, hereinafter referred to as the “Personal Data Controller”, the “Company” or “we”. The Company is an owner of such trade brands as EDS CONTROLLERS, Ambity Line, including the related communication channels (website, mail, etc.), where or with the use of which the Company may also obtain personal data.
2. In all matters relating to personal data protection, you may contact our Data Protection Officer at: admi1.2h67en@edev-studio.com. You may of course choose to contact us otherwise, however then it may take us longer to respond or take appropriate steps. If you use other forms of communicating with us, in matters relating to personal data management, you should ensure that the message is properly identified so that we can forward it to a competent person dealing with such matters.
§3
(The purpose of, grounds for and period of personal data processing)
1. Your personal data are only processed for specific, explicit and legitimate purposes.
2. The purpose of data processing is the reason for which we process your personal data. If we intend to process your personal data for other purposes that are not indicated below, you will be informed separately.
3. The purposes for which we process your personal data include:
3.1. Preparation of an offer:
a) we will process the personal data in order to handle your inquiry concerning our offer and potentially agree detailed terms of cooperation,
b) replying to your inquiries as a potential Client and engaging in talks or correspondence relating to future cooperation is our legitimate interest that justifies the processing of data under Article 6.1(f) of the GDPR (such grounds will be hereinafter referred to as: our legitimate interest). Your personal data may be also processed in order to conclude an agreement between us; in this case the processing will take place on the grounds provided for in Article 6.1(b) of the GDPR,
c) data processing duration: personal data will be stored for 12 months of sending an inquiry, unless steps are taken to conclude an agreement. In this case the data will processed in accordance with the rules of processing personal data of the Company Clients or the processing of personal data of representatives of the Company Clients.
3.2. Conclusion, proper performance, termination of agreements or other activities that are necessary for the performance of a concluded agreement/execution of an order (in the case of Company Clients):
a) personal data will be processed in order to conclude an agreement between you and us, as well as in connection with any activities taken in preparation for the conclusion of an agreement, performance of an agreement/execution of an order, service support, handling complaints, termination of an agreement, archiving, as well as performing other legal acts relating to an agreement,
b) legal grounds: Article 6.1(b) of the GDPR under which personal data can be processed if they are necessary for performance of an agreement or taking steps that lead to the conclusion of an agreement,
or
Article 6.1(a) of the GDPR under which personal data can be processed on the basis of consent granted on a voluntary basis - if you provided us with your name and surname as well, we assume that you also granted us consent for the processing of such data,
or
Article 6.1(f) of the GDPR under which personal data can be processed for potential enforcement of civil law claims, defence against such claims as well as to protect oneself against a potential inspection carried out by fiscal administration authorities (such grounds will be hereinafter referred to as “our legitimate interest”); our legitimate interest consists in ensuring a possibility to take effective actions in order to enforce our potential claims against you, defend against potential claims that may be lodged against us and to ensure a possibility to prove that the Agreement has really been performed,
c) data processing duration: personal data will be stored for the time when the Agreement is performed, and also after its termination - until we are no longer obliged to archive documents relating to the conclusion and performance of the Agreement, until the expiry of the limitation period of our mutual claims or until the expiry of the period of limitation of tax liabilities relating to the Agreement (whichever of these dates comes later).
3.3. Meeting obligations resulting from legal regulations, including the accounting and tax activities:
a) we will process the personal data to meet obligations resulting from applicable law, in particular the accounting and tax regulations (if the personal data obtained are included in the accounting documents),
b) legal grounds: Article 6.1(c) of the GDPR under which personal data can be processed if it is necessary to meet the obligations resulting from legal regulations,
c) data processing duration: until the Company meets the obligations specified in individual legal regulations.
3.4. Establishment, exercise or defence of claims:
a) personal data will be processed to establish, exercise and defend the Company against claims, including client and third party claims,
b) legal grounds: Article 6.1(f) of the GDPR under which personal data can be processed if it is necessary for the purpose of legitimate interests of the processor,
c) data processing duration: until fulfilment of legitimate interests of the Company that provide grounds for the processing or until submission of an objection to the processing, for a period no longer than 10 years, and in the event of pending disputes or proceedings, in particular court proceedings, the retention period shall be calculated from the dispute completion date or final and valid termination of the proceedings.
3.5. Using the Company websites to ensure communication or provide the services:
a) personal data will be processed in order to enable communication or the provision of services through the Company websites,
b) legal grounds: Article 6.1(b) of the GDPR under which personal data can be processed if they are necessary for performance of an agreement or taking steps that lead to the conclusion of an agreement,
or
Article 6.1(f) of the GDPR under which personal data can be processed if it is necessary for the purpose of legitimate interests of the processor,
c) data processing duration: in the period of communication or the provision of services, but no longer than until an effective objection is submitted,
or
in the period until the termination of an agreement, and after that time, for other legitimate purposes connected with an agreement, e.g. the period of securing potential claims, i.e. 10 years.
3.6. Marketing of the Company products or services:
a) personal data will be processed for the Company’s marketing purposes, in particular in order to provide, display or send commercial information by traditional mail or, if the relevant consent is obtained, with the use of electronic and telephone communication devices,
b) legal grounds: Article 6.1(f) of the GDPR under which personal data can be processed if it is necessary for the purpose of legitimate interests of the processor,
c) data processing duration: until an objection to such processing is submitted or until expiry of agreements with the Company.
3.7. Activities conducted on the basis of the consent granted:
a) Personal data will be processed to conduct the activities that you have granted your consent to: this applies to all data, such as e.g. marketing of the services and products of companies that cooperate with the Company, and the consent obtained will specify in each case, inter alia, the purpose of data processing that we want to pursue based on the consent,
b) legal grounds: Article 6.1(a) of the GDPR under which personal data can be processed on the basis of consent granted on a voluntary basis,
c) data processing duration: until the consents granted are withdrawn.
3.8. Other purposes pursued within the so called legitimate interest:
a) this relates to any data for which the Company’s legitimate interest has been identified, whereby in each case it is necessary to take into account:
- relations between the purposes for which personal data have been collected and the purposes of the intended further processing,
- context in which the personal data have been collected, [in particular the relation between the data] subjects and the Company,
- nature of personal data,
- consequences of the intended processing,
- the presence of appropriate safeguards relating to their processing,
b) legal grounds: Article 6.1(f) of the GDPR under which personal data can be processed if it is necessary for the purpose of a legitimate interest pursued by the processor, e.g. for evidence purposes to secure information which could be used to prove legally significant facts,
c) data processing duration: until fulfilment of legitimate interests of the Company that provide grounds for the processing or until submission of an objection to the processing, for a period no longer than 10 years. In the event of pending disputes or proceedings, in particular court proceedings, the retention period shall be calculated from the dispute completion date or final and valid termination of the proceedings.
4. We obtain the personal data processed:
a) directly from you - the data that you provide us with while placing an order or contacting us, e.g. via the contact form, e-mail or by phone,
b) indirectly from you - the data that we are provided with by tools or means of communication when we obtain data directly from you or during your activity at our website, e.g. the data recorded by our server,
c) from generally available public sources, e.g. the National Court Register (KRS), the Central Registration and Information on Economic Activity (CEIDG), your website.
5. Depending on the relations between you and us, in order to achieve the above-mentioned purposes, we may process the following categories of personal data:
a) personal data (e.g. name and surname, residence address/domicile),
b) contact details (e.g. e-mail address, phone number, fax number, mailing address, client number),
c) identification details (e.g. identity card number, Personal ID number PESEL, IP address),
d) contact details (e.g. order number, details of the concluded agreements and the course of their performance),
e) transaction details (e.g. bank account number, data included in bank statements that confirm transactions),
f) publicly available data (e.g. data obtained from the National Court Register (KRS), the Central Registration and Information on Economic Activity (CEIDG)),
g) audio-visual data (e.g. data relating to recording conversations for safety and evidence purposes),
h) data relating to website activity (e.g. date and time of the site visit, information on the operating system, approximate location, information on the Internet browser, time spent at the site, subsites visited).
§4
(The requirement of personal data provision)
1. The provision of personal data is voluntary and you do it at your own discretion, but it is a condition of the conclusion or performance of the Agreement.
2. If you do not provide us with your personal data, we will not be able to conduct the activities that we are expected to conduct, such as contact you in order to prepare and present an offer, carry out a commercial transaction, undertake activities relating to order execution, after-sales support, including the provision of service and warranty support.
§5
(Automated decision making and profiling)
We do not use your personal data for any decisions made automatically or on the basis of profiling.
§6
(Recipients of personal data)
1. We need your personal data both for activities that we do on our own as well as for activities done in cooperation with or by other entities.
2. Inside the Company’s organizational structure, access to your personal data will be given only to authorized employees of the Company and only to a limited extent.
3. In certain situations, your personal data may be disclosed to recipients outside the Company’s organizational structure. In this case we always carefully check legal grounds for personal data disclosure.
4. The recipients of your personal data may include:
a) banks; financial, credit or other institutions, which may receive personal data in connection with the performance of economic relations, e.g. banks acting as agents in the execution of transfers,
b) entities dealing with the provision of economic information and exchange of economic data, e.g. the National Debt Register (KRD), ERiF Biuro Informacji Gospodarczej S.A.,
c) entities entrusted by the Company with personal data processing on the basis of concluded agreements, e.g. courier service providers,
d) authorized distributors of the Company product offer, entrusted by the company with personal data processing on the basis of the concluded commercial agreements,
e) entities that provide telecom and postal services,
f) entities that provide personnel and accounting services, e.g. an accounting firm,
g) entities that provide advisory services, e.g. auditing firms,
h) entities that process data for debt collection purposes or to provide legal representation services, e.g. law firms,
i) entities with respect to which we have obtained your consent for the sharing with them and processing of your personal data,
j) public authorities, institutions or third parties authorized to request access to or provision of personal data on the basis of legal regulations.
§7
(Transfer of personal data to third countries or international organizations)
The Company does not transfer personal data to third countries or international organizations nor uses any external technical data storage resources located outside the European Union or the European Economic Area.
§8
(Your rights)
1. You have the right of access to your personal data, including the right to obtain a copy, rectification and erasure of your data and restriction of processing.
2. If you are entitled to additional rights (e.g. the right to data portability or the right to object to processing), you will find information on this in the relevant information clause above.
3. You have the right to object to processing of your personal data if they are processed to fulfil legitimate interests of the Company. At the same time we wish to inform you that in accordance with the law we can refuse to accept the objection if we prove that there are legal grounds for processing that prevail over your interests, rights and freedoms or there are grounds to establish, exercise or defend claims. The above right of refusal shall not apply to objections submitted when your personal data are processed for marketing purposes. In this case, after receipt of an objection, we will cease to process your personal data for this purpose. In addition, objection to data processing for marketing purposes does not have to be justified.
4. You have the right to receive your personal data from the Company in a structured format and to have your personal data transmitted to another controller. If the data are transferred, on the basis of other legal regulations, the need may arise to obtain your consent or the consent of another person or to meet other conditions resulting from such regulations.
5. If the processing takes place on the basis of the consent granted, you have the right to withdraw at any time the consents granted for individual purposes of processing. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal
6. At the same time we wish to inform you that the afore-mentioned rights may be limited or conditional by law, thus in certain situations, we may lawfully refuse to comply with them. Each refusal is, however, preceded with careful analysis and assessment of a given case.
§9
(The right to lodge a complaint)
If you believe that the processing of your personal data is inconsistent with applicable law, you can lodge a complaint with the President of the Office for Personal Data Protection (website where you can find contact details: https://uodo.gov.pl/p/kontakt).