Privacy policy

GDPR NOTICE

To fulfil our obligation to provide information on personal data protection as required by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L 119 of 2016, p. 1) (“GDPR”), in connection with your personal data we have acquired, we hereby advise you as follows:

1. Personal data controller
   Please be advised that the Controller of your personal data, i.e., the party that decides on the purposes and methods of processing, is INVADO Sp. z o.o., ul. Leśna 2, 42-793 Ciasna, KRS (National Court Register Number): 0000066190, NIP (Tax Identification Number): 5750007575, REGON (National Official Business Register Number): 002748808, phone number: 48 34 3510540.
2. Contact information
   You may contact the Controller for all matters connected with personal data processing and exercise of your rights related to data processing at the following address: INVADO Sp. z o.o., Dzielna, ul. Leśna 2, 42-793 Ciasna, or you may e-mail us at: rodo@INVADO.pl.
3. Purpose and basis of processing
   Your data will be processed, upon your consent, for the following purposes:
   1. to perform a contract to which you are a party or to take steps at your request to enter into and execute a contract, legal basis – Article 6(1)(b) of the GDPR,
   2. to reply to an enquiry or request if you fill out the contact form or submit your enquiry otherwise (e.g., by e-mail, by phone or via social media) – by filling out the form, you consent for us to contact you in connection with your enquiry or request; you may withdraw your consent at any time, which may prevent us from replying to your enquiry or request, legal basis – Article 6(1)(a) of the GDPR,
   3. to send you the newsletter, i.e., to use your e-mail address to send you current information about our products and services and about the activities of the Controller and their partners; you may withdraw the consent at any time, legal basis – Article 6(1)(a) of the GDPR,
   4. to fulfil our obligations relating to the retention of accounting documents concerning the performance of contracts – the legal basis for processing is the need to fulfil a legal obligation of the Controller arising from the Accounting Act – Article 6(1)(c) of the GDPR,
   5. for marketing purposes – i.e., to offer our products to you, legal basis – data processing is required to pursue our legitimate interest; it is a legitimate interest of the Controller to provide our customers with information about our products and services – Article 6(1)(f) of the GDPR,
   6. in connection with an ongoing recruitment process and future recruitment conducted within one year from the submission of the application documents, legal basis – Article 221 of the Labour Code Act and Article 6(1)(b) and (f) of the GDPR; if other personal data are provided, they will be processed based on a consent given by applying for the indicated recruitment process or other recruitment processes, depending on the consent given,
   7. to establish or exercise claims or defend against claims connected with the contract signed with you, legal basis – data processing is required to pursue our legitimate interest; it is a legitimate interest of the Controller to exercise their claims and defend against claims – Article 6(1)(f) of the GDPR.
4. Automated decision-making based on profiling
   1. The Controller does not engage in any automated decision-making, including profiling, with legal effects concerning the data subject.
   2. As part of the recruitment processes, the Controller advises that the provided data may be profiled – but not using automated means – in order to adapt the application to the available job opportunities.
5. Refusal to provide personal data
   Providing the data in connection with the contract to be entered into is required to enter into the contract and perform the activities arising from the contract – it will not be possible to enter into the contract without providing the data. Providing the data for marketing purposes is entirely optional.
6. Personal data provided to other parties by the Controller
   1. Access to the personal data processed by the employees and partners of the Controller is limited to the authorised persons, who use the personal data only to fulfil the duties connected with their job.
   2. Your data may be provided, in particular, to delivery companies, service providers and partners of the Controller to the extent necessary for the performance of contracts, marketing activities and routine operations of the company.
   3. Parties that process the data on behalf of the Controller, pursuant to relevant agreements, e.g.: delivery companies, companies acting as agents in the sale of our products and services; companies providing us with marketing, consulting, analytical, audit, legal or tax services.
   4. Parties that process your data as controllers on their own behalf, e.g.: postal and courier companies – in connection with the delivery of correspondence; companies that provide banking services; companies that provide legal and tax services – to the extent to which they become a data controller.
   5. Your personal data may be provided to entities of the ARBONIA Group, of which the Controller is a member (companies affiliated with the Controller).
7. Transfer of personal data to third countries or international organisations (outside the European Economic Area)
   Your personal data may be transferred to be kept outside of the European Economic Area when they are entered into a system installed on the servers in the Swiss Confederation. Pursuant to a decision of the European Commission dated 26 July 2000, the Swiss Confederation was found to be a state that ensures an adequate level of personal data protection.
8. Processing period
   1. Your personal data will be processed until the end of the limitation period for claims arising from the concluded contracts or until the expiry of the obligation to process the data arising from the law, or until you withdraw your consent, where the processing was done based on your consent.
   2. Personal data connected with recruitment will be retained for the following period:
      1. duration of the recruitment processes, but in any case not more than one year, if you consent to participate in future recruitment processes,
      2. until the lapse of the limitation periods for potential discrimination claims, for at least 3 years from the date on which the claim matures.
9. Your rights relating to personal data
   You have the right to:
   1. access your data and request that they be rectified or erased or that their processing be restricted,
   2. data portability, i.e., to receive from the Controller information about the processed data in a structured, commonly used, machine-readable format, where your data are processed to enter into and perform a contract or where they are processed based on your consent (you may send the provided personal data to another data controller),
   3. object to personal data processing to the extent to which the basis for personal data processing is a legitimate interest of the Controller,
   4. withdraw your consent at any time, where the basis for personal data processing is your consent; the withdrawal of your consent does not affect the lawfulness of any processing done by us based on your consent before its withdrawal,
   5. lodge a complaint with the President of the Personal Data Protection Office.
10. Exercise of your rights
    The Controller enables the data subject to exercise their rights in connection with personal data processing under the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC). To exercise these rights, please contact the Controller.
11. Right to lodge a complaint
    If you believe that we process your personal data unlawfully, you may lodge a complaint with the supervisory authority competent for data protection, i.e., the President of the Personal Data Protection Office.