fbpx

INFORMATION ON THE PROCESSING OF PERSONAL DATA OF COUNTERPARTIES (SUPPLIERS AND BUSINESS CUSTOMERS) AND THEIR REPRESENTATIVES

This notice constitutes the fulfilment by Wydawnictwo SQN Romański, Kuśnierz, Rędziak Spółka komandytowa (limited partnership), with its registered office in Kraków (hereinafter: the Controller), of the information obligation arising from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 – the General Data Protection Regulation (hereinafter: the GDPR), and is addressed to:

  • the Controller’s counterparties, i.e. suppliers providing products or services to the Controller, as well as business customers (business entities) purchasing products and services from the Controller (hereinafter jointly: Counterparties) – to the extent that they are covered by the protection afforded by the GDPR; and
  • representatives of Counterparties, i.e. persons who represent Counterparties (regardless of their legal form of operation) and who cooperate with the Controller (hereinafter: Representatives).

We hereby inform you that:

1. Controller of personal data

The controller of your personal data is Wydawnictwo SQN Romański, Kuśnierz, Rędziak Spółka komandytowa, with its registered office in Kraków, ul. Huculska 17, 30-413 Kraków. The Controller has appointed a Data Protection Officer (DPO). The Controller and the DPO may be contacted by post at the address indicated in the preceding sentence, or by email at: iod@sqn.pl.

2. Purposes and legal bases of the processing

Your personal data will be processed for the following purposes:

  • conclusion and performance of the contract between the Controller and the Counterparty (including the quotation process, negotiations, performance and settlement of the contract, and ongoing contact concerning the cooperation) – on the basis of:

    • Art. 6(1)(b) GDPR, i.e. the necessity of the processing for the performance of a contract or in order to take steps at your request prior to entering into a contract, to the extent that you are a Counterparty (a natural person);
    • Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Controller, consisting in the ability to establish and conduct business cooperation;

    • „`

  • the performance by the Controller of its legal obligations – on the basis of Art. 6(1)(c) GDPR, i.e. compliance with legal obligations to which the Controller is subject (e.g. obligations arising from tax law);
  • direct marketing of the Controller’s products and services – on the basis of Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Controller, consisting in the ability to carry out informational, marketing and sales activities relating to the Controller’s business;
  • the conduct of analytical and statistical activities – on the basis of Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Controller, consisting in the need to analyse data concerning cooperation with Counterparties, including the products and services supplied by them and the quality thereof, or the products and services purchased by them from the Controller;
  • the establishment, exercise or defence of claims connected with the Controller’s cooperation with the Counterparty – on the basis of Art. 6(1)(f) GDPR, i.e. the legitimate interest of the Controller, consisting in the ability to make use of legal remedies in order to protect the Controller’s rights and interests;
  • the processing purposes to which you have given your consent in the course of cooperation with the Controller – on the basis of Art. 6(1)(a) GDPR, i.e. consent to the processing of personal data for a purpose expressly specified at the time the consent is given.

    • „`

3. Categories of personal data

The following categories of your personal data will be processed: basic identification data (first name, surname, position and – in the case of a Counterparty who is a natural person conducting business activity – also business details), other identification data (e.g. data derived from CEiDG (the Central Register and Information on Economic Activity) or the KRS (the National Court Register), or from a power of attorney), contact data (address, email address, telephone number), and any other data collected in the course of cooperation with the Controller.

4. Recipients of the data

The recipients of your personal data may include the following categories of entities:

  • entities providing specific services to the Controller where the provision of those services involves the processing of personal data (e.g. providers of IT services and systems, providers of legal services, security services, insurance and financial institutions, providers of marketing and analytical services);
  • institutions authorised to receive your personal data by operation of law (e.g. the tax office, courts).

5. Transfers of personal data outside the European Economic Area

Situations may arise in which it will be necessary to transfer your personal data outside the European Economic Area (EEA). This applies in particular to cases in which the Controller uses IT tools/services supplied by entities providing their services from outside the EEA. Any such transfer will be carried out with an adequate level of data protection ensured, in particular on the basis of a decision of the European Commission finding that the third country concerned ensures an adequate level of protection of personal data, and, in other cases, by means of the standard contractual clauses issued by the European Commission. Information on how to obtain a copy of the safeguards, or on where they have been made available, can be obtained by contacting the Controller.

6. Data retention period

Your personal data will be stored by the Controller for the duration of the Counterparty’s cooperation with the Controller and, after that cooperation ends, until the expiry of the obligation to store your data arising from the provisions of law. A longer retention period for personal data may be justified by the limitation period applicable to any claims arising out of that cooperation.

7. Rights of the data subject

In connection with the processing of your personal data, you have the right:

  • to access your data;
  • to rectification (correction) of the data;
  • to erasure of the data;
  • to restriction of the processing of the data;
  • to object to the processing of the data on grounds relating to your particular situation – in relation to processing based on Art. 6(1)(f) GDPR;
  • to withdraw your consent to the processing of personal data – at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal (to the extent that the processing is based on your consent);
  • to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office.

The rights indicated above are not absolute, and the scope of their application is determined by the provisions of the GDPR.

8. Source of the data

We obtained your personal data from the Counterparty or directly from you.

9. Other information

The Controller will not apply automated decision-making, including profiling, in relation to you. The provision of personal data is necessary for the conclusion and performance of the contract concluded by the Counterparty with the Controller, as well as for the achievement of the other processing purposes indicated in this document. Should you have any questions or comments concerning the Controller’s processing of your personal data, or should you wish to exercise the rights referred to in point 7 above, please contact the Controller (contact details are indicated in point 1 above).