I. Personal data controller
The Controller of your personal data is Przedsiębiorstwo Handlu Zagranicznego “Baltona” S.A. with its registered office in Warsaw, 49 Komitetu Obrony Robotników Street, 02-146 Warsaw (hereinafter: the Controller). You can contact the Controller or the Data Protection Officer (hereinafter: DPO) by writing to
rodo@baltona.pl.
II. Purpose, scope, legal basis and duration of processing
The personal data provided by you in the complaint form will be processed
1. in order to properly handle and process the complaint submitted (Article 6(1)(f) of the GDPR),
2. for the performance of the contract tied to the complaint (Article 6(1)(b) of the GDPR – if you are a party to the contract),
3. for billing, accounting and financial reporting purposes (Article 6(1)(c) and (f) of the GDPR),
4. in order to refund money arising from positively considered complaint (Article 6(1)(c) of the GDPR - if you are a party to the contract, Article 6 (1)(f) of the GDPR – if you are the bank account holder to which a refund will be made and nevertheless a person other than a party to the contract), And also in connection with the pursuit of the legitimate interests of the Controller (Article 6(1)(f) of the GDPR):
5. for the establishment, investigation and defence of claims,
6. for statistical purposes related to improving the efficiency of work, the quality of the Services provided and customising them for the recipients.
Your personal data will be stored until the implementation of lodging the complaint and the expiry of the claims limitation period.
As a general rule, we process the data you provide i.e. name, surname, email address, bank account number, the first four and last four digits of the payment card. If you did not provide us with your data, they came from the person who included your data in their submission as an account holder to which a refund will be made due to the positively considered complaint. Personal data obtained insofar include given name and surname, email address, the first four and last four digits of the payment card, bank account number.
III. Information on data recipients
In connection with the processing of your personal data for purposes referred to in section II, their recipients may include a) subcontractors and suppliers with whom we cooperate,
b) IT service providers,
c) archiving companies,
d) banks and other financial institutions,
e) public authorities receiving data in connection with the implementation of the Controller’s legal obligations, f) courier and postal operators.
Your personal data will not be transferred to third countries (i.e. countries outside EU/EEA) or multinational organisations.
IV. Rights in relation to the processing of personal data
In connection with processing of your personal data, you have the following rights:
• the right to access your data and receive a copy thereof,
• the right to rectify (amend) your data,
• the right to have your data removed,
• the right to have the processing of your data restricted,
• the right to have your data ported - where the processing is based on consent (Article 6(1)(a) or Article 9(2)(a) of the GDPR) or contract (Article 6(1)(b) of the GDPR),
• the right to object to the processing of your personal data - where the processing is based on a legitimate interest (Article 6(1)(f) of the GDPR).
• the right to withdraw your consent at any time with no effect on the legality of any processing done on the basis of the consent before its withdrawal.
For more information on your rights, please refer to
Articles 12–23 of the GDPR.
Moreover, data subjects also have the right to complain to the supervisory body, i.e. the President of the Personal Data Protection Office. For more information, please visit
https://uodo.gov.pl
V. Obligation to provide data
The provision of your personal data is voluntary but necessary to meet the purpose set out in section II. If you do not provide your data, we will not be able to process your complaint.
VI. Profiling
Your personal data are not and will not be used by the Controller for automated decision-making, nor are and will they be subjected to profiling operations in the future.