PERSONAL DATA PROCESSING NOTICE

Golden Submarine spółka z ograniczoną odpowiedzialnością sp. k. spares no effort to ensure the security of your personal data and it warrants what they are processed in compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general personal data protection regulation, hereinafter referred to as “GDPR”).

Who is the controller of your personal data?

GoldenSubmarine spółka z ograniczoną odpowiedzialnością sp. k. based in Poznań (61-626), at: ul. Szelągowska 18, entered into the Business Register of the National Court Register maintained by the District Court in Poznań Nowe Miasto i Wilda in Poznań, 8th Economic Division of the National Court Register under KRS No. 0000489569, NIP: 779-232-38-33, REGON: 300684897 (hereinafter: “We”).

Whom can you contact on matters concerning the protection of your personal data?

To this aim, we have appointed a Data Protection Officer, Ms Julia Cieślik and a Deputy Data Protection Officer, Mr Tomasz Grzybowski, who can be contacted by email at: iod@goldensubmarine.com, or by regular post (to the address as stated above).

For what purpose and on what legal basis do we process your personal data?

We can process your personal data for the following purposes:

• 1) to start cooperation, enter into and perform a contract, which justifies the collecting and processing of your data (and the data of the persons you cooperate with), under Article 6 (1)(b) of GDPR;
• 2) to run a website and a blog, including the use of cookies and running a bulletin based on a consent referred to in Article 6 (1)(a) of GDPR;
• 3) to pursue marketing activities, which is our legitimate interest under Article 6 (1)(f) of GDPR;
• 4) to meet accounting and regulatory obligations under Article 6 (1)(c) of GDPR;
• 5) to collect debts, which is our legitimate interest involving the maintenance of financial liquidity and pursuing claims, under Article 6 (1)(f) of GDPR;
• 6) to provide security, to protect property and keep secret information the disclosure of which could be to our detriment, which is our legitimate interest under Article 6 (1)(f) of GDPR;
• 7) to defend the interests and to pursue claims, if any, related to a contract entered into and in order to identify the Client’s representatives and the contact persons to perform the contract, which is our legitimate interest under Article 6 (1)(f) of GDPR.

Your personal data may be subject to automated decision making, including profiling.

How long do we keep your personal data?

Your personal data will be kept until the expiry of the deadline to report claims related to data processing for the above-mentioned purposes and/or until the expiry of the legal deadlines.

What type of personal data do we process?

The scope of data we process includes, in particular, such data as: name, surname, business name, address of residence, the registered address, contact data such as e-mail and telephone no. Typically, providing personal data is voluntary, yet a refusal to provide them may, for instance, render the entering into and performing a cooperation contract impossible.

From what source have we derived your personal data?

We received the data from you directly (including, during a telephone talk, via e-mail, orally) or from the public domain (e.g., websites, records and registers).

To whom will we provide your personal data?

• 1) to our subcontractors, e.g., to IT services’ providers, and to accounting and book keeping entities;
• 2) to other data controllers providing us with legal services as far they are data controllers, as well as to entities handling payments, banks, insurers, tax bodies;
• 3) to public authorities - as far as they are entitled to receive them under the law.

Typically, we do not transmit personal data outside the European Economic Zone, However, we may have certain services rendered by subcontractors outside the European Economic Zone, e.g., as regards using IT services. In such a case, your personal data will be transferred to a third country for which an adequate level of data protection has been ascertained under a decision of the European Commission or with the use standard contractual clauses approved by the European Commission.

What rights do you hold as regards our processing of your personal data?

With respect to data processing and in keeping with GDPR principles, you hold the following rights:

• 1) to demand access to the personal data and their rectification;
• 2) to demand that the personal data be erased;
• 3) to demand that personal data processing be restricted;
• 4) to object;
• 5) to withdraw the consent to personal data processing provided that such a withdrawal does not affect the lawfulness of the consent-based processing before the consent was withdrawn.

In the event you find your data are not lawfully processed, you are entitled to lodge a complaint with the supervisory authority, which is, the President of Personal Data Protection Office (at: ul. Stawki 2, 00-193 Warsaw).