We process your personal data for the following purposes:
1. to conclude and perform a contract pursuant to Article 6(1)(b) of the “Regulation”;
2. to issue sales invoices and enter them in the accounts pursuant to Article 6(1)(b) of the “Regulation”;
3. to handle payments and settlements pursuant to Article 6(1)(a) and (b) of the “Regulation”;
4. to process maintenance activities pursuant to Article 6(1)(b) of the “Regulation”;
5. to conduct analyses and statistics pursuant to Article 6(1)(f) of the “Regulation”;
6. to conduct marketing activities pursuant to Article 6(1)(f) of the “Regulation”;
7. to determine, assert and defend against claims pursuant to Article 6(1)(f) of the “Regulation”;
8. to archive data and documents pursuant to Article 6(1)(f) of the “Regulation”;
9. to reply to letters, requests and complaints pursuant to Article 6(1)(b) and (f) of the “Regulation”.
Data processing is based on:
1. the consent given pursuant to Article 6(1)(a) of the “Regulation”;
2. a contract to which you are a party or to take action at your request prior to the conclusion of a contract pursuant to Article 6(1)(b) of the “Regulation”;
3. a legal obligation imposed on the Controller, resulting in particular from legal provisions pursuant to Article 6(1)(c) of the “Regulation”, e.g.
o the Tax Ordinance of August 29, 1997,
o the Accounting Act of September 27, 1994,
4 the protection of your or another person’s vital interests (life and health) pursuant to Article 6(1)(d) of the “Regulation”;
5. a legitimate interest pursued by the Controller or by a third party pursuant to Article 6(1)(f) of the “Regulation”.

Voluntary or obligatory provision of personal data?
If the processing of personal data results from a request made by a person before the conclusion of a contract (business talks) or in connection with the concluded contract (Article 6(1)(b)), from applicable legal provisions (Article 6(1)(c)) or from a legitimate interest of the Controller in connection with the determination, assertion and defense against claims and in connection with responding to letters and complaints (Article 6(1)(f)), the provision of data is voluntary, but necessary for the conclusion and performance of the contract. In the case of failure to provide the indicated personal data, we may refuse to conclude a contract or conclude it on less attractive terms, not respond to a submitted letter or complaint or not present a commercial offer dedicated to your expectations.
If the processing of personal data is based on the consent given for a specific purpose, e.g. sending invoices by electronic means, then the provision of data is voluntary, as is giving consent. You should also remember that you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of personal data processing based on consent before its withdrawal.

How long do we keep your personal data?

The period for which personal data are stored depends on the purpose of their processing. It results from legal provisions (which require data retention for a specific period of time) or is necessary to perform the contract or legitimate interests pursued by the Controller or by a third party.
Examples of periods for which personal data may be stored:
1. retention data (correspondence, complaints) – 12 months;
2. data needed to issue an invoice and accounting evidence, handling of payments and settlements – 5 years from the end of the tax period;
3. data concerning the performance of the contract – up to 10 years;
4. analysis and statistics – up to 10 years;
5. data on court judgments (cases of misuse) – 10 years from the delivery of the judgment;
6. marketing activities – until consent is revoked or an objection is raised.

Do we share personal data and, if so, with whom?
1. the recipients are other entities providing services for Suszarnia Warzyw Jaworski Spółka Akcyjna Spółka Komandytowa exclusively within the scope of the service provided in accordance with the concluded contract,
2. the recipients are entities from the group of enterprises (Corporate Group),
3. the recipients are other entities, in the following scope:
– striving to comply with the requirements of applicable law, regulations, legal processes or legally binding requests of state institutions;
– detecting and preventing fraud, as well as addressing other problems concerning fraud, security and technical issues;
– protection of property rights or security of the Controller of personal data and other persons in a manner required or permitted by law.
We do not intend to transfer personal data to the so-called third countries (i.e. outside the European Economic Area covering the European Union, Norway, Liechtenstein and Iceland). However, if such a need arises, we can do so by providing an adequate level of protection and applying the relevant legal provisions.

Do you have any rights in connection with the processing of your personal data?
Yes, any person whose personal data are processed by the Controller has:
1. the right to information about the processing of personal data – on this basis, we will provide information about the processing of data, including in particular the purposes and legal grounds for the processing, the scope of the data held, the entities to which the data are disclosed and the planned date of data deletion;
2. the right to obtain a copy of the data – on this basis, we will provide you with a copy of the processed data concerning your person;
3. the right to rectification – on this basis, you have the right to demand rectification of the processed data,
4. the right to erasure (right to be forgotten) – on this basis, you may demand the deletion of data whose processing is no longer necessary for the fulfillment of any of the purposes for which they were collected;
5. the right to restriction of processing – on this basis, the cessation of operations on personal data – with the exception of operations which have been consented to – and their storage may be demanded, in accordance with established retention rules or until the reasons for restricting the processing have ceased to exist (e.g. a decision of the supervisory authority allowing further processing of the data is issued);
6. the right to data portability – on this basis, insofar as data are processed solely for the purpose of performance of a contract or on the basis of automated consent – the issue of personal data in machine-readable format may be requested. It is also possible to request that such data be sent to another entity – however, provided that there are technical possibilities in this respect on the part of both the Controller and the other entity;
7. the right to object to the processing of data for marketing purposes – on that basis, it is possible to object at any time to the processing of personal data for marketing purposes, without having to justify such an objection;
8. the right to object to other purposes of the processing – on this basis, personal data processing that takes place due to the legitimate interest of the Controller (e.g. for analytical or statistical purposes or for reasons related to the protection of property) may be objected to at any time; grounds for an objection in this scope should be included;
9. the right to withdraw consent – on this basis, only if personal data are processed on the basis of consent, such consent may be withdrawn at any time without affecting the lawfulness of the processing carried out prior to withdrawal of consent;
10. right of complaint – on this basis, if you consider that the processing of personal data violates the provisions of the “Regulation” or other provisions concerning the protection of personal data, you may file a complaint with the President of the Personal Data Protection Office.

How can I exercise my specific rights?
You can claim your right by contacting the Controller at any time. To do this, please send a message to the e-mail address: ado@jaworski.com.pl. The right of complaint shall be exercised by lodging a complaint with the President of the Personal Data Protection Office. You can find all the necessary information on www.uodo.gov.pl

Are the data subject to automated processing?
No, we do not currently process your data in an automated manner and your personal data are not subject to profiling that has legal effects or significantly affects you.

What personal data can be processed by us?
We collect and process the following data:
1. personal details (e.g. name, official address/address of residence);
2. entity details (e.g. name and address of the entity, details of the representative);
3. contact details (e.g. mailing address, telephone number, e-mail address);
4. identification data (e.g. personal card number and series, PESEL [personal identification number], NIP [tax identification number]);
5. transaction details (e.g. details on payment of liabilities, bank account details);
6. communication details (e.g. data resulting from correspondence);
7. contract details (e.g. details resulting from signed contracts and agreements);
8. details concerning legal relations (e.g. information necessary to execute an instruction in accordance with the granted power of attorney or authorization);
9. publicly available data;
10. technical data;
11. correspondence details (e.g. content of correspondence).

Where do we collect personal data from?
We collect personal data mainly from the data subject (that is, from you). However, we may, in justified cases, for example in order to confirm data or verify the statements made, obtain data from:
1. Register of Entrepreneurs of the National Court Register;
2. Central Registration and Information on Business.