1. The controller of personal data is Giant Invest Spółka z o.o., with its registered office in Poznań at 151 Głogowska Street, entered in the Register of Entrepreneurs of the National Court Register under KRS No. 0000374561.
2. Whenever this Privacy Policy refers to:
1/ GDPR, this shall mean Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC,
2/ User, this shall mean any natural person using the website or the newsletter.
3. Pursuant to Article 4(1) GDPR, personal data means any information relating to an identified or identifiable natural person, referred to as the “data subject”. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data or an online identifier.
4. Personal data is processed by the Controller for the following purposes:
1/ the performance of sales agreements and orders for goods, on the basis of Article 6(1)(b) GDPR, meaning that processing is necessary in order to take steps prior to entering into a contract and for the performance of a contract between the Controller and the User. For the purposes of this Privacy Policy, the sale of goods also includes the provision of paid services,
2/ marketing the Controller’s goods or services by electronic means, on the basis of Article 6(1)(a) GDPR, i.e. the User’s consent to the processing of their personal data,
3/ the establishment, exercise or defence of legal claims, on the basis of Article 6(1)(f) GDPR.
5. Personal data will be processed by the Controller for the following periods:
1/ for the purposes of performing sales agreements and orders for goods, until any claims arising from the agreement become time-barred and until the expiry of the statutory period for retaining accounting records, whichever occurs later,
2/ for marketing purposes, until the User withdraws their consent,
3/ for the establishment, exercise or defence of legal claims, until such claims become time-barred.
6. The Controller processes personal data using appropriate technical and organisational measures designed to protect the data against unauthorised disclosure and processing in breach of applicable law.
7. Personal data may be disclosed by the Controller to other entities only where necessary for the performance of sales agreements or orders for goods. Such entities may include payment service providers, postal and courier service providers, and entities providing IT systems support services.
8. Personal data will not be subject to automated decision-making and will not be transferred to a third country or an international organisation.
9. A User whose personal data is processed has the following rights: the right of access to personal data, the right to rectification, the right to erasure, the right to restriction of processing, the right to data portability and the right to object to the processing of personal data.
10. If the User believes that their personal data is being processed unlawfully, they have the right to lodge a complaint with the President of the Personal Data Protection Office.
11. Requests concerning the exercise of the User’s rights in relation to the processing of their personal data may be submitted by post or by email to the Controller using the contact details specified in this Privacy Policy. The Controller will respond to the request within one month of its receipt.