Pursuant to General Data Protection Regulation (EU) 2016/679 (the “GDPR”), we provide the following information about the processing of personal data of natural persons representing the Contractor and Contractor employees designated as contacts for matters related to contract performance.
Controller and Data Protection Officer
-
The controller of your personal data is ASTRAFOX Sp. z o.o., with its registered office at ul. Poloneza 93, 02-826 Warsaw, telephone: +48 22 355 21 60, email: office@astrafox.pl, hereinafter the “Controller.”
-
The Controller has appointed a Data Protection Officer (DPO), who can be contacted by email at iod@astrafox.pl or by mail at the address of the Controller’s registered office.
Purposes and legal bases for processing
- Personal data will be processed for the following purposes:
– entering into, performing, and terminating this contract on the basis of Art. 6(1)(b) GDPR (where the Contractor is a natural person operating a sole proprietorship) and on the basis of a legitimate interest (Art. 6(1)(f) GDPR) with respect to representatives of legal entities;
– complying with the legal obligations incumbent on the Controller arising, among other things, from tax and accounting regulations, i.e., financial and tax settlements (for example, settling invoices or bills and maintaining accounting records), on the basis of Art. 6(1)(c) GDPR;
– pursuing or defending against any claims arising from the contract, which constitutes the Controller’s legitimate interest under Art. 6(1)(f) GDPR;
– contacting the Contractor and its employees/associates concerning contract performance on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR), which is contact for the purpose of performing the contract.
Data recipients
- Recipients of the personal data processed may include entities with which the Controller has entered into appropriate agreements concerning, for example, IT, legal, archiving, and advisory services, as well as entities entitled to obtain data under applicable laws, for example, banks, courts, law enforcement agencies, or state institutions when they submit a request based on an appropriate legal basis.
Retention period
- Personal data will be processed for the duration of the contract and, after its completion, until claims associated with the contract expire and for the period required by law, including tax regulations and financial reporting regulations.
Information on the requirement to provide data
-
Providing the personal data of individuals representing the Contractor is a contractual requirement and is necessary to enter into and perform the contract.
-
Providing the personal data of the Client’s/Ordering Party’s employees is voluntary, but it may be an obligation arising from an employment or other relationship between the employee and the Client/Ordering Party and may be necessary for proper performance of the contract.
-
The personal data of the Client’s/Ordering Party’s employees/associates is provided to the Controller by the Client/Ordering Party.
Rights of natural persons
- Natural persons have the right to:
– access their data and request its rectification, erasure, or restriction of processing;
– object where data is processed on the basis of the Controller’s legitimate interest;
– lodge a complaint with the President of the Personal Data Protection Office (UODO) if a natural person believes that the processing of personal data concerning them violates the GDPR.
- To exercise your rights, please contact the Controller or the Data Protection Officer at the email addresses specified in Sections 1 and 2 above, or by mail at the address of the Controller’s registered office.
Information on the absence of profiling and transfers of data outside the EEA
- The personal data processed will not be subject to automated decision-making, including profiling, and will not be transferred outside the European Economic Area.