Cracow, 24 May 2018
Ladies and Gentlemen,
Vistula Group Spółka Akcyjna with its registered office in Cracow, Pilotów 10, 31-462 Cracow, entered into the National Court Register (KRS) by the District Court for Cracow-Śródmieście in Cracow, under KRS number 0000047082 ("Administrator"), in connection with entry into force on 25 May 2018 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR"), hereby informs that it may process your data as a personal data controller if there is an appropriate legal basis for doing so.
In this regard, the controller informs that:
(1) Your personal data may be processed for the purposes necessary for: (i) performance of an agreement to which you are a party or (ii) to take action at your request before entering into an agreement or (iii) fulfil a legal obligation incumbent on the Administrator or (iv) purposes arising from legitimate interests pursued by the Administrator, and (v) based on your consent - for purposes consistent with the consent given;
In particular, if you are:
1.1. a customer of the online store www.vistula.pl or www.wolczanka.pl (hereinafter: "e-Store"), we process your data for purposes related to transactions made within the E-Store and for purposes resulting from legally justified interests pursued by the Administrator;
1.2. a participant in the program: "The men`s world club" ( hereinafter: "Loyalty Program"), we process your data for purposes related to participation in the Loyalty Program, for purposes resulting from legitimate interests pursued by the Administrator;
1.3. the subscriber of the newsletter, the mailing of which is organized by the Administrator (hereinafter: "Newsletter"), we process your data for the purposes related to the subscription and mailing of the Newsletter;
1.4. a customer of the customer service office (hereinafter: "BOK"), we process your data for the purpose of contacting you in matters with which you have turned to BOK, including in particular those related to transactions carried out within the E-Shop or participation in the Loyalty Program or for the purpose of taking actions at your request before concluding an agreement or for purposes resulting from legally justified interests carried out by the Administrator.
2. data provided may be processed pursuant to Art. 6 para. 1 lit. a), b), c) and lit. f) of GDPR;
3. Personal data may be stored for the period necessary to perform the above mentioned purposes. In the event of processing based on one’s consent – data storage will take place until the withdrawal of the consent.
In particular, if you are:
3.1. e-Store client – personal data will be stored within the period necessary to perform the transaction in e-Store and of the processing of complaints, and for the period of holding an account in e-Shop, no longer than for the period of 3 years from the liquidation of an account in e-Shop. If the transaction is performed without creating an account in e-Shop, the data is stored for a period of 3 years from the day of transaction;
3.2. Loyalty Program member – personal data will be stored for the period of participation in the Loyalty Program, and after the end of participation in the Loyalty Program, for a period consistent with the law;
3.3. Newsletter subscriber - personal data will be stored for the period of the Newsletter subscription – until the consent to is withdrawn;;
3.4. BOK customer - personal data will be stored for the period necessary for purposes of correspondence with you via BOK;
Where the provisions of the law provide for earlier cancellation of your data or its longer storage, the Administrator shall comply with such legal obligation.
4. you have the right to require from the Administrator access to personal data concerning you, their rectification, erasure or limitation of processing;
5. you have the right to withdraw your consent to data processing at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal;
6. you have the right to lodge a complaint with Inspector General for Personal Data Protection (and from the date of the creation of the new office – with the President of the Personal Data Protection Office), once you consider that the processing of personal data concerning you violates the law;
7. personal data have been collected from you (personal data is from the data subject);
8. providing data is voluntary; for specific purposes specified in the relevant regulations in force at the Administrator, providing data may be necessary for performing specific transactions or activities;
9. Your data may be processed in the form of analytical profiling in accordance with this Privacy Policy; however, this does not have any legal consequences for you. Binding decisions will not be automated;
10. From 25 May 2018 the contact details of the data protection officer of the controller shall be as follows: inspektorODO@vistulagroup.pl.