Privacy Policy

DURATION OF DATA PROCESSING

The Service Provider will process personal data until any of the following conditions are met:

1. the personal data is no longer necessary for the purpose for which it was collected or otherwise processed;
2. the data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing;
3. the data subject objects to the processing, and there are no overriding legitimate grounds for the processing;
4. the Service Provider has processed the personal data unlawfully;
5. the personal data must be erased in order to comply with a legal obligation under the law applicable to the Service Provider;
6. the statutory retention period for the personal data has expired;
7. the personal data is incomplete or incorrect—and this condition cannot be lawfully remedied—provided that the law does not preclude erasure;
8. the competent data protection authority or a court has ordered the erasure of the personal data.

The Service Provider is required to retain the record of the complaint submitted by the data subject and the related response for a period of 5 (five) years.

RIGHTS OF THE DATA SUBJECT AND THEIR EXERCISE

What rights does the data subject have regarding data processing?

The data subject has the following rights regarding data processing:

• the right to be informed (Articles 13 and 14 of the GDPR);
• the right of access to personal data (Article 15 of the GDPR);
• the right to rectification and completion of personal data (Article 16 of the GDPR);
• the right to erasure of personal data (Article 17 of the GDPR);
• the right to restriction of processing (Article 18 of the GDPR);
• the right to data portability (Article 20 of the GDPR);
• and the right to object to the processing of personal data (Article 21 of the GDPR).

What does the right to information mean?

During the period of data processing, the data subject may request information from the Data Controller regarding the processing of their personal data.

The data subject may request information regarding the processing of their personal data at any time in writing by sending a registered letter or a letter with return receipt requested to the Data Controller’s registered office, or by sending an email to the contact information provided by the Data Controller in this Notice.

The Data Controller shall consider the request for information to be authentic and actionable if i) in the case of a letter sent by mail, the data subject can be clearly identified, and ii) in the case of an email, if the email was sent from the email address previously provided by the data subject. The Data Controller reserves the right to verify the data subject’s identity by other means prior to fulfilling the request for information.

The information provided by the Data Controller covers the details regulated by the GDPR, which specifically includes the following: the Service Provider’s details (including the name and contact information of its representative), the purpose and legal basis of data processing, the source of the data, the duration of personal data storage (or the criteria for determining it), the data subject’s rights (access to personal data, the right to request rectification, erasure, or restriction of processing, or to object to the processing of personal data, as well as the data subject’s right to data portability), the right to withdraw consent, the right to seek legal remedy (complaint, judicial remedy), the legitimate interests of the Service Provider as the data controller or of a third party (if the processing is based on this), the recipients of the personal data (if any), and the fact that the Service Provider, as the data controller, intends to transfer the personal data to a third country or an international organization (if applicable).

What does the right of access to personal data mean?

The data subject has the right to receive confirmation from the Data Controller as to whether their personal data is being processed. If such processing is taking place, the data subject has the right to access their personal data and the information detailed in the previous section.

What does the right to rectification and completion of personal data mean?

The data subject has the right to have inaccurate personal data concerning him or her rectified by the Data Controller without undue delay upon request.

The data subject has the right to request that incomplete personal data be completed—including by means of a supplementary statement—taking into account the purpose of the data processing.

If the Data Controller determines that the personal data it processes is incorrect, it shall rectify the data based on available documents or official records, or, if necessary, after consulting with the data subject.

If the data cannot be corrected, the Data Controller shall delete it. In the event that there is any obstacle to correction or deletion, the data must be permanently blocked with a note indicating the correction.

What does the right to erasure of personal data mean?

The data subject—following proper identification—has the right to request that the Data Controller erase personal data concerning him or her without undue delay. The Data Controller may refuse to comply with the data subject’s request for erasure if the processing is necessary

1. for the exercise of the right to freedom of expression and the right to information;
2. to comply with a legal obligation under the law applicable to the Service Provider that requires the processing of personal data, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
3. on grounds of public interest in the area of public health;
4. for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, insofar as the right to erasure is likely to render such processing impossible or seriously jeopardize it;
5. or for the establishment, exercise, or defense of legal claims.

If the Data Controller refuses to comply with the data subject’s request for erasure, it shall in all cases inform the data subject of this, stating the reason for the refusal and providing information on the available legal remedies.

If the request for erasure is granted, the personal data must be erased in such a way that it can no longer be recovered.

In what cases is personal data blocked instead of being erased?

Personal data must be blocked instead of being erased if the data subject requests it, or if, based on the information available, it can be assumed that erasure would harm the data subject’s legitimate interests.

What does the right to restriction of processing mean?

The data subject has the right to request that the Data Controller restrict processing if

1. the data subject contests the accuracy of the personal data (in this case, the restriction applies for a period enabling the controller to verify the accuracy of the personal data); or
2. the processing is unlawful, and the data subject opposes the erasure of the data and requests the restriction of their use instead; or
3. the purpose of the data processing has been fulfilled, but the data subject requires the data to assert, exercise, or defend legal claims; or
4. the data subject has objected to the processing (In this case, the restriction applies for the period until it is determined whether the Service Provider’s legitimate grounds take precedence over the data subject’s legitimate grounds.).

What does the right to data portability mean?

The data subject has the right to receive the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used, and machine-readable format. The data subject is also entitled to transmit this data to another data controller without hindrance from the Service Provider to whom the personal data was provided, if:

the processing is based on the data subject’s consent or on a contract to which the data subject is a party, or the processing is necessary for taking steps at the data subject’s request prior to entering into a contract; and
the processing is carried out by automated means.
The data subject’s right to data portability extends to the data subject’s right—where technically feasible—to request that the Service Provider directly transmit the personal data to another data controller.

What does the right to object to the processing of personal data mean?

The data subject has the right to object at any time to the processing of their personal data—including profiling—provided that

1. the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Service Provider; or
2. the processing is necessary for the purposes of the legitimate interests pursued by the Service Provider or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data; or
3. if the processing or transfer of personal data is necessary solely for compliance with a legal obligation to which the Service Provider is subject, except in cases of mandatory data processing; or
4. if the processing of personal data is carried out for the purposes of direct marketing, opinion polling, or scientific research; in such cases, the data subject has the right to object at any time to the processing of personal data concerning him or her for the purposes set forth in this subsection, including profiling, to the extent that it is related to direct marketing.

If the Data Controller accepts the data subject’s objection, it shall cease data processing—including further data collection and data transfer—and block the data, and shall notify all parties to whom the personal data subject to the objection was previously transferred of the objection, and the measures taken based on it to all those to whom the personal data subject to the objection was previously transferred and who are required to take action to enforce the right to object.

How does the Data Controller proceed when the data subject exercises the above rights?

The Data Controller shall inform the data subject of the measures taken in response to the request without undue delay, but no later than 1 (one) month from the receipt of the request. Depending on the complexity of the request and the number of requests received, the Data Controller may extend this deadline by up to 2 (two) months, in which case it shall notify the data subject within the original deadline, specifying the reasons for the delay. In the case of a request submitted electronically—unless the data subject requests otherwise—the Data Controller will provide the information electronically.

If the Data Controller fails to fulfill the above obligation within the deadline, the data subject may avail themselves of the remedies described in this Notice.

The Data Controller provides this information to the data subject free of charge.

RULES RELATING TO DATA SUBJECTS UNDER THE AGE OF 18

Persons under the age of 18 may provide their personal data only with the written consent of the person exercising parental authority.

This means that a person under the age of 18 is not independently authorized to provide their personal data and is required to obtain the consent of their legal representative. In the absence of such consent, the personal data of a person under the age of 18 may be processed only on a legal basis other than consent.

In the event that a person under the age of 18 does not establish personal contact with the Data Controller when providing their personal data, the data subject is obligated to ensure compliance with this provision, and the Data Controller shall not be held liable for any failure to do so. The Data Controller shall consider the provision of personal data to constitute a declaration by the data subject that the data subject is not subject to any restrictions regarding the provision of personal data.

However, the Data Controller reserves the right to verify the lawfulness of the data processing and the existence of a legal basis for such processing, including the consent of the person exercising parental authority.

The Data Controller will, of course, take all necessary measures to delete personal data of persons under the age of 18 that has been unlawfully transferred or made available to the Data Controller, and will ensure that such data is neither transferred nor processed.