GDPR

GDPR Information Obligation

On May 25, 2018, new rules on the protection of personal data came into effect, pursuant to Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

We would like to assure you that we exercise due diligence when processing personal data, operate in compliance with the law, and implement appropriate technical and organizational measures to ensure the security of the personal data entrusted to our company. We prioritize the protection of personal data right from the design phase of new initiatives.

Personal Data Controller

Elpolap, a limited liability company with its registered office in Zalasewo (62-020), at 21 Orzechowa Street, registered in the Business Register by the District Court for Poznań Nowe Miasto-Wilda in Poznań, under KRS number 0000998412, NIP 777 339 64 75, REGON 523459038, with a share capital of 5,000 zlotys (fully paid up), is the controller of the personal data of its employees, associates, customers, and individuals who have provided their data via  a form on the website or via email, as well as other entities that have consented to the processing of their personal data.

Personal Data Processor

Elpolap, a limited liability company, also processes personal data entrusted to it by other data controllers, particularly when carrying out orders in which Elpolap, a limited liability company, acts as a subcontractor. In such cases, Elpolap, a limited liability company, acts as a personal data processor.

Legal Basis and Purposes of Personal Data Processing

Elpolap, a limited liability company, processes personal data only if at least one of the following conditions is met:

1. The data subject has consented to the processing of their personal data (Article 6(1)(a) of the GDPR),
2. The processing is necessary for the performance of a contract to which the data subject is a party or for taking steps prior to entering into a contract (Article 6(1)(b) of the GDPR),
3. Processing is necessary for compliance with a legal obligation to which Elpolap spółka z ograniczoną odpowiedzialnością is subject (Article 6(1)(c) of the GDPR);
4. Processing is necessary to protect the vital interests of the data subject or another natural person (Article 6(1)(d) of the GDPR);
5. Processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR),
6. The processing is necessary for the purposes of the legitimate interests pursued by Elpolap spółka z ograniczoną odpowiedzialnością or by a third party (Article 6(1)(f) of the GDPR),.

The processing of data provided to Elpolap, a limited liability company, via email or through the form on the website is based on Article 6(1)(a), (b), (c), or (f) of the GDPR and includes, among other things, data such as: first name, last name, email address, phone number, and other data provided in electronic correspondence. This data is processed for the purpose for which it was provided.

Data processed on the basis of consent (Article 6(1)(a) of the GDPR), in particular first name, last name, email address, and phone number, are used for the purpose for which consent was granted and are processed until consent is withdrawn or until the purpose for which consent was granted has been fulfilled.

Data processed in connection with the conclusion of a contract pursuant to Article 6(1b) of the GDPR includes, in particular, first name, last name, address, phone number, email address, tax identification number (NIP)/personal identification number (PESEL), bank account number, and other data resulting from the specific nature of the contract, and are used for the purpose of performing that contract.

Data regarding individuals through whom our business partners perform contracts concluded with Elpolap, a limited liability company, is processed pursuant to Article 6(1)(f) of the GDPR and includes, among other things, first name, last name, email address, and phone number. This data is used for the purpose of performing the contract.

Data entrusted for processing by other controllers, in particular for the purpose of performing services provided by Elpolap, a limited liability company, is processed pursuant to Article 6(1)(c) or (1)(f) of the GDPR and includes, among other things: first name, last name, mailing address, email address, PESEL number, and other data necessary to provide the services, depending on their type. Processing is carried out for the purpose of performing the commissioned service.

Obligation to Provide Data and Consequences of Failure to Provide Data

Providing personal data in connection with the contract being concluded is voluntary but necessary for the conclusion and performance of the contract and for the related financial settlements.

Consent to the processing of personal data, particularly for marketing or informational purposes, is voluntary, and consent may be withdrawn at any time without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.

Providing an email address and other information in electronic correspondence is voluntary. Withdrawing consent to data processing will make it impossible to continue email correspondence.

Retention Period for Personal Data 

Personal data collected for the purpose of performing a contract is retained until the statute of limitations for claims arising from the contract expires or until the legal obligation to retain the data expires, in particular the obligation to retain financialor employment records.

If consent is the sole basis for processing, the withdrawal of consent will result in the cessation of data processing, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.

Rights of Data Subjects

Data subjects have the right to access their personal data, the right to have it corrected, the right to request its erasure, as well as  as well as the right to restrict processing, the right to data portability, and the right to object to the processing  of personal data.

If the legal basis for the processing of personal data is consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Furthermore, if you believe that the processing of personal data violates the provisions of the EU’s GDPR, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (uodo.gov.pl/pl/p/kontakt).

Recipients of Personal Data

Personal data may be disclosed to third parties with the consent of the data subject.

In addition, personal data may be disclosed when required for the performance of a contract between the parties or to fulfill the obligations of the Personal Data Controller.

When processing personal data on behalf of third parties, Elpolap, a limited liability company, acts as a processor, and the data is disclosed in accordance with the rules set forth by the Data Controller.

Depending on the category of data, the entities to which the data may be disclosed include: entities processing personal data on behalf of Elpolap, a limited liability company; the Data Controller’s subcontractors; IT service providers; entities providing accounting services, entities conducting occupational safety and health training, entities entering into insurance contracts, and other institutions authorized by law, such as the Tax Office, the Court, or the Social Insurance Institution (ZUS).

Profiling

Elpolap, a limited liability company, may automatically tailor certain content to the needs of customers and individuals who have provided their data via a form on the website or by email, as well as other entities that have consented to the processing of their personal data; that is, to perform profiling using the personal data they have provided.

This profiling primarily involves automatically assessing which products these individuals might be interested in, based on their previous online activities, including on the websites of Elpolap, a limited liability company, and on the display of product advertisements profiled in this manner.

Profiling carried out by Elpolap, a limited liability company, does not result in decisions that have specific legal effects on these individuals or affect them in a similarly significant manner.

Information on Automated Decision-Making 

The data will not be subject to profiling, which means that it will not serve as a basis for automatically attributing specific characteristics or traits, nor will it be used to predict behavior or preferences.

Contact Information

You can contact us in the following ways:

• by mail to our registered office address: Elpolap, a limited liability company with its registered office in Zalasewo (62-020), at 21 Orzechowa Street
• by phone at +48 724 967 482
• via email at biuro@elpolap.com.pl