GDPR
In connection with the commencement of application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and pursuant to Articles 13 and 14 of this Regulation, we provide the information required by the Regulation and inform you that as of 25 May 2018 you will have the rights listed below in relation to the processing of your personal data by MILA Spółka z o.o..
1. The controller of your personal data is MILA Spółka z o.o., with its registered office at: ul. Przejazdowa 6J, 42-280 Częstochowa, tax identification number (NIP): 7771002012, e-mail address: milacustic@mila.com.pl
2. Your personal data will be processed for at least one of the following purposes:
a. for the purpose of performing a contract to which the person or the company represented by that person, to whom the data relate, is a party, or in order to take steps at the request of the data subject prior to entering into a contract, on the basis of Article 6(1)(b) of the GDPR,
b. for the purpose of fulfilling legal obligations imposed on the Controller under generally applicable provisions of law, including accounting regulations, tax regulations and related laws, on the basis of Article 6(1)(c) of the GDPR,
c. for purposes arising from the legitimate interests pursued by the Controller or by a third party, consisting in acquiring new contacts to potential commercial customers in order to offer own products and services, conducting marketing and advertising campaigns, establishing possible claims or exercising or defending against claims, etc.,
d. for sales and marketing purposes pursued by the Controller on the basis of consent given by you to the processing of data pursuant to Article 6(1)(a) of the GDPR.
3. Your personal data has been obtained in one of the following ways:
a. by directly providing personal data, sending traditional or electronic correspondence, or completing an appropriate form on the Controller’s website,
b. from publicly available sources and registers such as: CEIDG, KRS, REGON, NIP, PKD, corporate websites, advertisements on the Internet, official company information lines operating under phone numbers published online,
c. through the purchase of a commercial contact database from entities which have confirmed in writing and are able to demonstrate that they hold your consent to process and transfer the data to third parties.
4. Based on the nature of the Controller’s business activity focused on serving natural persons, the categories of data collected and processed will include basic personal data such as: first name, last name, phone numbers, e-mail addresses, IP addresses.
5. Your personal data will be transferred to entities providing services to the Controller which are necessary for the performance and execution of the contract concluded or to be concluded with you, such as: accounting services, courier services, postal services, telecommunications service providers, hosting service providers, manufacturers and suppliers of products offered by the Controller to the extent necessary to obtain such products (e.g. software licensing, product registration, activation of service packages and similar), legal, analytical and marketing services, debt collection and contract settlement services, banking services for the purpose of processing payments, and to authorities authorised to receive your personal data under mandatory provisions of law.
6. The Controller does not intend to transfer personal data to a third country or to an international organisation.
7. Your personal data will be processed only for the longest of the following periods:
a. for the period required by applicable law, including accounting and tax regulations,
b. for a period of up to 3 years from the last contact,
c. for the period of use of a solution covered by warranties and similar obligations,
d. for the duration of the contract,
e. for the period necessary to pursue possible claims or to defend against such claims by the Controller,
f. the storage period of the data may in each case be extended by the limitation period for claims.
8. You have the right to access your personal data, to request their rectification, erasure, restriction of processing, to object to processing, as well as the right to data portability.
9. You have the right to lodge a complaint with the supervisory authority responsible for the protection of personal data if you consider that the processing of your personal data infringes the provisions of Regulation (EU) 2016/679.
10. Providing personal data is required by the Controller in order to respond and provide information, or in order to prepare, conclude and perform a contract. The consequence of failing to provide the personal data required by the Controller is the inability to respond and provide information, or the inability to prepare, conclude and perform a contract.
11. Your personal data will not be subject to profiling, and any automated operations will be performed only by IT systems servicing the Controller’s website, the e-mail system and an automated invoicing and debt collection system.
12. The information obligation in relation to the personal data received will be fulfilled by the Controller after obtaining the personal data, no later than within one month or at the time of the first communication with the data subject.
13. The information obligation will be fulfilled depending on the source of the data and the available communication channel:
a. in the case of receiving data from a form on the website, the obligation will be fulfilled after the form has been completed and sent, by redirecting to a link to this notice,
b. in the case of receiving data in the form of a business card, the obligation will be fulfilled by sending an electronic message containing a link to this notice,
c. after receiving traditional correspondence, the obligation will be fulfilled by sending a reply to that correspondence, either in traditional form or as electronic correspondence containing a link to this notice,
d. after receiving electronic correspondence, the obligation will be fulfilled by sending an electronic reply to that correspondence containing a link to this notice,
e. after receiving data from publicly available sources and registers, the obligation will be fulfilled after an initial meeting or conversation by sending electronic correspondence containing a link to this notice,
f. after receiving data through the purchase of a commercial contact database, the obligation will be fulfilled by sending electronic correspondence containing a link to this notice.
14. If it becomes necessary to delete your data, all collected personal data will be removed from media and registers or anonymised if deletion of the data would violate the structure of the datasets. In each case, we will make every effort to comply with your requests. However, it may turn out that this is technically or organisationally impossible or would involve a disproportionate effort – in such a case we will inform you of the inability to fulfil the request and the reasons for this.