Privacy policy
Privacy policy
Data confidentiality and the protection of our clients' privacy is a priority for us. Therefore, out of concern for the security of your personal data, a policy has been established at Pobyty.pl Sp. z o.o., 4 Galczyńskiego St., 02-672 Warsaw, which sets out the rules on how we process your personal data.
We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter RODO).
Controller of your personal data
The Administrator of your personal data within the meaning of Article 4(7) of the RODO is Pobyty.pl Sp. z o.o., ul. Galczyńskiego 4, 02-672 Warsaw entered in the register of entrepreneurs kept by the District Court for the capital city of Warsaw XIII Economic Division of the National Court Register under the number 0000401029,(hereinafter the Administrator).
Contact with the Administrator
In all matters related to the processing of personal data you can contact the Administrator at the above mentioned registered office address or by email[SG1] dane@pobyty.pl.
Source of personal data acquisition
We obtain personal data directly from you or from third parties / entities, e.g. the entity on whose behalf you are acting or our Partners, as well as from other publicly available records. We also obtain information by completing a contact form or through cookies.
Scope of personal data processing
When you contact the Administrator by means of the service or contact details provided on the website, the Administrator processes the data you provide in order to make contact (as well as, inter alia, to make a reservation, to register the owner of the facility) including your name, surname, e-mail address or telephone number, the content of the question asked or issue raised and possibly other data you have provided. In connection with the use of cookies for statistical purposes, the Administrator may process the following data: IP address, duration of the respective session, frequency of site visits.
Purpose and legal basis of personal data processing
|
Purpose of data processing |
Legal basis |
|
Actions to conclude, and conclusion and performance of a contract - where you are a party to the contract. |
The processing is necessary for the conclusion and performance of the contract - Article 6(1)(b) of the DPA. |
|
To provide the contacts necessary for the handling and performance of the contract entered into with the entity on whose behalf you are entering into the contract and to maintain business relationships. |
Legitimate legitimate interest of the Administrator - Article 6(1)(f) RODO. |
|
To carry out activities that make up the improvement and coordination of the Administrator's work, including the recording of correspondence. |
The legitimate interest of the Administrator - Article 6(1)(f) RODO. |
|
Dealing with potential complaints, as well as establishing, investigating and defending against claims. |
Legitimate interest of the Administrator - Article 6(1)(f) RODO. |
|
Fulfilment of legal obligations imposed on the Controller concerning, inter alia, bookkeeping and accounting records, as well as the exercise of data subjects' rights. |
Fulfilment of a legal obligation imposed on the Administrator - Article 6(1)(c) RODO. |
|
Sending marketing content in the form of a newsletter (containing, in particular, information on the company, current offerings, etc.) by email. |
Data processing is necessary for the conclusion and performance of the contract - Article 6(1)(b) RODO for the provision of the newsletter mailing service |
|
Conducting direct marketing activities. |
Legally legitimate interest of the Administrator - Article 6(1)(f) RODO. |
|
To carry out the recruitment process and select a suitable person for employment. |
To the extent arising from Article 22(1) of the Labour Code, the legal basis is the Administrator's legal obligation (Article 6(1)(c) RODO). This applies to data such as name(s), date of birth and contact details indicated by the job applicant. If this is necessary for a specific type of job or position, this also applies to information on education, professional qualifications and previous employment history. The legal obligation incumbent on the Administrator also covers those data the provision of which is necessary for the exercise of a right or the fulfilment of an obligation arising from a legal provision. In the event that a job candidate provides personal data in a broader scope than that specified in the employment legislation, the legal basis for their processing for the aforementioned purpose is the candidate's consent (Article 6(1)(a) RODO). This applies to any data provided by the job applicant in the curriculum vitae (CV), cover letter or provided during interviews. |
|
Gathering information on website traffic statistics. |
Legitimate interest of the Administrator - Article 6(1)(f) RODO |
|
Fulfilment of requests from individuals, processing of requests concerning personal data. |
Performing a legal obligation to process your request (Article 6(1)(c) RODO) |
|
Making a booking in the system |
The legal basis for the processing of your personal data in order to carry out the booking service is the necessity of their processing for the performance of the contract consisting in the provision by Pobyty.pl Sp. z o.o. electronically of the service in the form of the possibility to make a booking on the website (Article 6(1)(b) RODO). |
Profiling of personal data
Your personal data will not be used to make automated decisions, including profiling.
Recipients of your personal data
The recipients of your personal data will be:
(a) authorised personnel of the Controller,
b) entities processing personal data on behalf of the Administrator for the fulfilment of the purposes for which the data are collected (in particular, entities providing IT solutions and IT and technical support services). These entities must have access to the data in order to perform their duties. These entities will only have access to the personal data to the extent necessary to perform the tasks incumbent upon them.
(c) public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes that follow from the provisions of generally applicable law.[SG2]
[SG3] Your personal data may be transferred outside the European Economic Area?
As the Administrator uses the Google Analytics tool, personal data may be transferred outside the European Economic Area. In connection with the transfer of data outside the EEA, the Administrator has taken care to use only suppliers that offer guarantees of a high level of personal data protection. These guarantees derive in particular from the participation of suppliers in the Privacy Shield programme established under Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided by the EU-US Privacy Shield.
Period of retention of personal data
The duration of data processing is related to the purposes and grounds for processing, thus:
(a) data processed on the basis of statutory requirements will be processed for the period for which the law prescribes the retention of the data;
b) data processed for the purpose of entering into and performing a contract will be processed for the period necessary for the performance and settlement of the contract, which may be extended by the period of limitation of civil law claims, if applicable.
c) data processed on the basis of the legitimate interest of the Administrator shall be processed until an objection is successfully lodged or this interest ceases, e.g. data processed in order to assert or defend against claims shall be processed for a period equal to the period of limitation of these claims.
d) data processed on the basis of consent will be processed until consent is withdrawn.
(e) personal data processed for recruitment purposes will be stored until the recruitment in which you are taking part has ended. In the case of an additional consent to use the data for future recruitment purposes, your data will be stored for a period of 9 months.
f)
Is it your responsibility to provide your personal data?
Your provision of personal data is voluntary, but necessary for the purpose you wish to fulfil, including, for example, the use of the service, the conclusion of a contract, the response to your query or the issue you have raised.
The Administrator indicates that the provision of the personal data indicated in Article 22(1) of the Labour Code by the candidate is mandatory under the applicable labour legislation. Their failure to do so will result in the candidate's inability to participate in the ongoing recruitment process. The provision by the candidate of personal data in a broader scope than that indicated in Article 22(1) of the Labour Code is voluntary. The administrator declares that the failure to provide such data cannot be the basis for unfavourable treatment of the person applying for employment, nor can it cause any negative consequences towards him/her, in particular it cannot constitute a reason justifying the refusal of employment.
Your rights
You have the right to:
(a) to request access to your personal data, rectification, erasure or restriction of processing, as well as the right to data portability,
b) where the processing of your personal data is based on the legitimate interests of the Controller, the right to object at any time to the processing of your personal data on grounds relating to your particular situation,
c) where the legitimate interest consists in carrying out direct marketing activities, the right to object at any time to the processing of personal data for the purposes of carrying out marketing activities, without having to justify its decision,
(d) to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal,
e) to lodge a complaint to the supervisory authority, i.e. the President of the Office for Personal Data Protection.
A request to exercise your rights can be made to the contact details provided at the beginning.