GDPR

Information on personal data processing

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), we inform you:

1. Personal data controller

The controller of your personal data is noble-fern with its registered office in Warsaw, ul. Nowogrodzka 42/15, 00-695 Warsaw, Poland.

2. Contact for data protection matters

In matters related to the processing of personal data, you can contact us at the e-mail address: [email protected].

3. Purposes and legal bases of processing

Your personal data is processed for the purpose of:

• Responding to inquiries sent via the contact form (Article 6(1)(b) GDPR - performance of a contract or taking steps prior to entering into a contract)
• Providing services covered by the contract (Article 6(1)(b) GDPR)
• Fulfilling legal obligations, including tax and accounting obligations (Article 6(1)(c) GDPR)
• Establishing, exercising or defending against legal claims (Article 6(1)(f) GDPR - legitimate interest of the controller)
• Direct marketing of our own services (Article 6(1)(f) GDPR - with your consent)

4. Data recipients

Your data may be transferred to:

• Entities providing hosting and IT services
• Entities providing accounting and legal services
• State authorities, if required by applicable law

5. Transfer of data to third countries

Your personal data is not transferred to third countries (outside the European Economic Area) or international organizations.

6. Data retention period

We store personal data for the period:

• Necessary for the performance of the contract and claiming rights - a maximum of 6 years from the end of the contract
• Required by tax and accounting law - 5 years from the end of the year in which the tax obligation arose
• Until consent is withdrawn - in the case of processing based on consent
• Until a valid objection is raised - in the case of direct marketing

7. Your rights

In connection with the processing of personal data, you have the right to:

Right of access to data (Article 15 GDPR)

You have the right to obtain confirmation as to whether or not your personal data is being processed, and where that is the case, access to the personal data and a copy of the data.

Right to rectification of data (Article 16 GDPR)

You have the right to request the immediate rectification of inaccurate data or the completion of incomplete data.

Right to erasure of data (Article 17 GDPR)

You have the right to request the erasure of personal data where the data is no longer necessary for the purposes for which it was collected, you withdraw consent and there is no other legal basis for processing, you object to the processing, or the data has been unlawfully processed.

Right to restriction of processing (Article 18 GDPR)

You have the right to request the restriction of processing of data in certain cases provided for by the GDPR.

Right to data portability (Article 20 GDPR)

You have the right to receive the personal data you have provided to us in a structured format and to transmit that data to another controller.

Right to object (Article 21 GDPR)

You have the right to object to the processing of data based on legitimate interest, including profiling. In the case of direct marketing, an objection is always effective.

Right to withdraw consent

If processing is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

8. Information on the requirement to provide data

Providing personal data is voluntary, but necessary to respond to inquiries and provide services. Failure to provide data will make it impossible to contact you and conclude a contract.

9. Automated decision making

Your personal data is not used for automated decision-making, including profiling.

Last updated: January 2024