Data protection notice – ASPanel Sp.z o.o.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we inform you as follows:

The personal data controller is ASPanel Sp.z o.o., 80-297 Miszewko, Poland, hereinafter referred to as the “Controller” or “ASPanel Sp.z o.o.”.

The Controller may be contacted in writing by post at ASPanel Sp.z o.o., 80-297 Miszewko, or by email at [email protected].

a) Job applicants — personal data are processed for the purpose of conducting the recruitment process. Applicants’ personal data are processed on the basis of their consent. Providing personal data is voluntary; however, failure to provide them makes it impossible to take part in the recruitment process. Data necessary for recruitment comprise first name, surname, residential address, information about education and previous experience. Data retention period: up to 6 months. Where consent is given to processing data for subsequent recruitment processes: up to 24 months.

b) Persons contacting ASPanel — personal data are processed for the purpose of communicating with persons contacting ASPanel. The legal basis for processing personal data is the Controller’s legitimate interest in enabling communication, potentially establishing a relationship with the contacting person and providing necessary information. The personal data processed comprise first name, surname, email address, telephone number, correspondence address and other information supplied by the person contacting the Controller. Providing personal data is voluntary; however, failure to provide them may hinder or prevent communication. For enquiries seeking advice or information, or subscriptions to the company newsletter, data are retained until the contacting person requests deletion of their data and enquiry content from the database, or for as long as necessary to pursue the legitimate interests of the Controller or a third party. For complaints, data are retained until the complaints procedure is resolved or the warranty period for the purchased Product or Product covered by the complaint ends.

c) Business partners and their representatives — personal data are processed for the purpose of concluding and/or performing a contract. Personal data of business partners and persons designated by them, including their employees and associates, are processed for the conclusion or performance of a contract or on the basis of the Controller’s legitimate interest in enabling communication and performing the contract with the business partner. The personal data processed comprise first name, surname, email address, telephone number, workplace, position, business address, NIP, REGON, PESEL number and, in some cases, information concerning identity documents or passports. Where a contract is to be concluded with a natural person, providing personal data is necessary in order to conclude or perform the contract; for persons representing a legal entity, it is not necessary but enables contact. Data are retained for the term of the contract with the business partner and for the period necessary to enable the parties to pursue claims arising from that contract, but no shorter than the period required by law, or for as long as necessary to pursue the legitimate interests of the Controller or a third party.

d) Visitors to ASPanel — personal data are processed to identify and receive visitors on ASPanel’s premises and to ensure the safety of persons and property. Visitors’ personal data are processed on the basis of the Controller’s legitimate interest in receiving persons arriving at ASPanel and ensuring safety. The personal data processed comprise images captured by video surveillance, first name and surname. Data retention period: up to 3 months for surveillance images and up to 2 years for other data.

e) Participants in marketing projects such as promotions or purchase competitions — personal data are processed for the purpose of communicating with persons participating in ASPanel’s marketing projects. The legal basis for processing personal data is the Controller’s legitimate interest in enabling communication, potentially establishing a relationship with the applicant and providing necessary information, or the consent of the person participating in the competition. The personal data processed comprise first name, surname, email address, telephone number, correspondence address and other information supplied by the participant. Providing personal data is voluntary; however, failure to provide them may hinder or prevent the process. Data are retained until the promotion or competition has been completed or for as long as necessary to pursue the legitimate interests of the Controller or a third party.

Data may be disclosed to entities and authorities authorised to process such data under the law. Data may also be disclosed to third parties consisting of other companies in the ASPanel group, providers of technical and organisational services, such as IT service providers, and providers of legal and advisory services. Those entities process the data under a contract with the Controller and in accordance with the Controller’s instructions.

Personal data will not be processed by automated means for the purpose of making decisions, including profiling.

• requesting access to the personal data processed by the Controller;
• requesting rectification of personal data by the Controller;
• requesting erasure of personal data by the Controller;
• requesting restriction of the processing of personal data by the Controller;
• objecting to the processing of personal data;
• personal data portability;
• withdrawing consent to the processing of personal data, without affecting the lawfulness of processing based on consent before its withdrawal;
• lodging a complaint with the supervisory authority, the President of the Personal Data Protection Office.

If we have received personal data from entities other than the person to whom the data relate, this means that we obtained them from business partners, social media, the Internet or other publicly available sources.

The rules governing the data security and protection policy and the principles of data processing are available at the company’s registered office.