Information obligation for contractors.
Since May 25, 2018, we have been applying the provisions of the General Data Protection Regulation (GDPR), or Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, in the European Union. The application of the provisions of the GDPR is an opportunity to inform you about how we protect and process your personal data and what rights you have in relation to it. Changes made under the GDPR do not require you to make any contact with Corleonis S.A. Instead, please read the following information.
How do we process your personal data?
As Corleonis S.A. according to the regulations we are the administrator of your personal data as our contractors. This means that we are responsible for using your data in a secure manner, in accordance with the contract and the applicable regulations.
We use your personal data obtained at the conclusion of the contract and during its duration for the following purposes:
1. the valuation, conclusion and performance of the contract between us, including ensuring the correct quality of performance of the services - for the duration of the contract and billing after its completion (legal basis: Article 6(1) b GDPR, we will refer to this basis as "performance of the contract" for short),
2. to comply with our legal obligations, such as:
- issuing and retaining invoices and accounting documents,
- responding to complaints within the period and in the form prescribed by law
3. for archiving purposes
• We will use the data needed to comply with our legal obligations:
- for the duration of the performance of obligations, e.g. invoicing (legal basis: Article 6(1) c GDPR; we will refer to this basis as "legal obligation"),
- for as long as we are obliged by law to retain the data, e.g. in connection with tax legislation (legal basis: legal obligation), or
- for as long as we may face legal consequences for failing to comply with an obligation, such as receiving a financial penalty from government authorities (legal basis: Article 6(1) f GDPR, we will refer to this basis as "our legitimate interest").
3. the detection and prevention of fraud - for the duration of the contract (legal basis: performance of the contract), and thereafter for the period after which claims arising from the contract between us become time-barred, and in the event of us pursuing claims or notifying the competent authorities - for the duration of such proceedings (legal basis: our legitimate interest),
4. the establishment of the defence and the assertion of claims, which includes, among other things, the sale of our contractual claims to another entity - for the period after which the contractual claims become time-barred (legal basis: our legitimate interest),
5. direct marketing - for the duration of the contract (legal basis: your voluntary consent)
6. creation of compilations, analyses, statistics for our internal needs, this includes, in particular, reporting, marketing research, planning of the development of services or networks, development of information systems, creation of statistical models (e.g. for revenue protection) - for the duration of the contract and then for archiving purposes.
7. service support, including by informing you about failures, adjusting the service based on, among other things, data about the offer you are using or about complaints submitted so far - for the duration of the contract between us (legal basis: our legitimate interest).
Which data should we be given?
In order to conclude a contract we require your data to be given to the employees of the Office (if you do not give them, we will not conclude the contract). For your convenience, contact with the Bureau is possible via hotline, email, and in person. Additionally, we can ask for optional contact data, which do not influence conclusion of a contract (if we do not receive them, we cannot, for example, call a contact number). The provision of data at the conclusion of a contract is not a statutory requirement. To fulfil this obligation, we will use the data you provide in the contract form. Without your registration, we would not be able to perform the contractual services.
Additional information about personal data.
For example, you may order additional services or goods or make use of features not yet covered by the contract at the time the contract is concluded or during its term. If this requires the use of your data in a manner different from that described in this document, we will complete and submit the missing information, if possible, before obtaining the data. For the rest, the information on data processing contained in this document will remain valid. To whom we transfer your data.
• To entities that process data on our behalf, participating in the performance of our activities, e.g. the operation of our ICT systems, entities that act as intermediaries in the sale of our services, subcontractors that support us or others ordered by you, handling correspondence or in the customer service process
• to other data controllers processing your data on their own behalf:
- entities running postal or courier services,
- entities conducting payment activities (banks, payment institutions), in order to make refunds to you or to ensure the operation of the instant transfer service,
- debt collectors if you do not pay our bills on time,
- entities cooperating with us in handling accounting, tax and legal issues - to the extent that they become data controllers,
Data from other sources.
• When concluding, renewing or extending the scope of the agreement for the duration of such action, we will use the information concerning you from the register of entrepreneurs (currently: Central Register and Information on Business Activity) and from the database of the Central Statistical Office to the extent published therein.
• During the term of the contract we may obtain data from public registers (register of entrepreneurs, CSO database) and from private entities collecting or analysing information on entrepreneurs in order to create compilations and analyses (basis: our legitimate interest) for the term of the contract and for the period after which the claims under the contract between us become time-barred,
• If you pay via a bank or payment institution, for example, we will know from which account and with which institution the payment was made. We will process this data to check whether you have made the correct payment and, if necessary, to make refunds (basis: performance of the contract), to establish, assert and defend claims and for the creation of statistics and analyses (basis: our legitimate interest).
Your entitlements.
You may make a request to us (relating to your personal data) to:
• rectification (amendment) of data,
• erasure of data processed unjustifiably or posted on our websites,
• restriction of processing (withholding of data operations or not deleting data - according to the request),
• access to data (to request information about the data we process and a copy of the data),
• transfer of data to another data controller or to you (to the extent set out in Article 20 of the GDPR). You may exercise these rights by submitting a request by emailing: info@corleonis.pl To ensure that you are eligible to make a request, we may ask you to provide additional information to allow us to authenticate you. The scope of each of these rights, and the situations in which you may exercise them, is determined by law. Which right you may exercise will depend, for example, on the legal basis on which we use your data and the purpose of the processing.
Right to object.
Notwithstanding the rights mentioned above, you may object at any time to the processing of your data for direct marketing purposes. Once we have accepted your request, we are obliged to cease processing your data for this purpose. In specific situations, you may object to our processing of your personal data at any time if the use is based on our legitimate interest or public interest. In this situation, once we have considered your request, we will no longer be able to process the personal data objected to on that basis unless we can demonstrate that it exists:
• valid legitimate grounds for processing which are deemed by law to override your interests, rights and freedoms, or
• grounds for determining, asserting or defending claims.
Consent to data processing.
Where our use of your data is not necessary for the performance of a contract, performance of a legal obligation or is not in our legitimate interests, we may ask you to consent to certain uses of your data. For example, your consent may allow us to share your data with third parties for their promotional activities or to make automated decisions based on your data at your request. You may withdraw your consent at any time (this will not affect the lawfulness of the use of your data prior to withdrawal of such consent).
Complaint.
You have the right to lodge a complaint to the President of the Office for Personal Data Protection, if you believe that the processing of your personal data violates the law