PERSONAL DATA CONTROLLER’S DECLARATION

Pursuant to art. 13 sec. 1-2 of the Regulation (UE) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/47/WE (Official Journal of the European Union of 2016, no. 116) – hereinafter referred to as GDPR, we hereby inform you about the rules for processing personal data provided by a person to whom such data refer to, which are effective from May 25, 2018:

1. The controller of your personal data, at the same time being the entity processing such personal data, is Grupa Kapitałowa Kurkus Holding Spółka z ograniczoną odpowiedzialnością, with registered office in Białe Błota at ul. Łochowska 69, 86-005 Białe Błota, entered into the National Court Register, kept by the District Court in Bydgoszcz, Economic Division no. 13 of the National Court Register, under number KRS 0000566859, hereinafter referred to as the ‘Controller’.

2. We hereby inform you that the Controller does not process personal data by automated means, e.g. profiling. We care about the privacy of natural persons and so we do not increase our rights to process the personal data provided to us. At the same time we declare that the personal data provided to us are kept in a safe manner and you have the right to request access, rectification or erasure of the data referred to in item 5 of this declaration.

3. Your personal data are processed for the purpose of and to the extent necessary for the performance of the Controller’s tasks connected with performance of concluded agreements and
provided services. The processing of your personal data may be necessary for us to comply with our legal obligations under applicable law.

4. We hereby inform you that the indicated personal data are not transferred to third countries or international organisations.

5. We hereby inform you that your personal data shall be processed according to the following legal basis and for the following purpose: legal basis: art. 6 sec. 1 let. b of GDPR, i.e. the processing of personal data is necessary for the performance (actions preceding the conclusion, the conclusion itself and the performance) of the agreement concluded between us; legal basis: art. 6 sec. 1 let. c of GDPR, i.e. to the extent that the processing of your personal data is necessary for us to comply with our legal obligations under applicable law, including tax and administrative obligations; legal basis:
art. 6 sec. 1 let. F of GDPR, i.e. our legitimate interest to establish, exercise or defend against claims connected with the agreements concluded between us relating to collection and recovery of debts and using the services of data recipients; art. 6 sec. 1 let. a of GDPR, i.e. carrying out marketing and promotional activities, if we provide such marketing services, including via a newsletter.

6. Your personal data shall be processed for the duration of the agreement and the performance of the said agreement, and later until the expiration of possible claims connected with the concluded agreement and performance of legal obligation or until such time as you withdraw your consent to the processing of such data (at least 12 months for the company safety).

7. We also inform you that as we process your personal data, you have the right to access, rectify or erase such personal data, as well as to have the processing restricted and to object to the processing, and the right to transfer your personal data. You have the right to lodge a complaint to a supervisory authority. We also inform you that for safety reasons and in order to preserve company assets, the personal data (first and last name, type and number of and authority issuing a proof of identity, license plate number) of the persons visiting Grupa Kapitałowa Kurkus Holding Sp. z o.o. shall be kept for at least 12 months from the time they were obtained. After this period, those data shall be erased from the Kurkus Holding personal database. Failure to provide the aforementioned data (first name, last name and ID card number) by the persons visiting Kurkus Holding Sp. z o.o. may result in denial of access to the premises (for safety reasons).

8. We also draw your attention to the fact that giving your personal data mentioned above is voluntary. Failure to provide some parts of your personal data shall prevent us from providing you
our services.

9. We inform you that your personal data are not transferred to personal data recipients, unless the necessity to transfer such data results from the performance of concluded agreements or the performance of services to the entities from which we received such data. The recipients of your personal data may also include public authorities, including tax authorities, accounting entities, accounting offices, entities providing accounting services, law offices, dept collecting agencies, and financial institutions.

10. The personal data referred to in item 1 are kept only for the period necessary to perform the agreement concluded between us and to perform services and after such period, the said data shall be kept only for the purposes of pursuing or defending against claims that may arise as a result of performing the agreement connected with providing services, fulfilling the obligations under applicable law, in particular tax, administrative, and archiving law.

11. We inform you that we have not appointed a Data Protection Inspector. In the matters relating to personal data protection, please contact the Data Controller. Contact details can be found at: www.bas.pol.pl and www.bkte.pl.

RODO