Data Privacy Policy 

In accordance with Article 13 (1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation), we hereby inform you about the processing of your personal data by Kettler Polska Sp. z o.o. and the claims and rights you are due under data protection law.

1. The controller for processing of your personal data is Kettler Polska Sp. z o.o., ul Potrzebowicka 5, 64-730 Wieleń, which has acquired possession of your personal data in the conclusion and completion of contracts or within the scope of pre-contractual measures, in documentation of business cases (including issuing of invoices), within the scope of the correspondence conducted, processing of the requests, complaints, objections, and suggestions received by us, and in using video surveillance.
2. The designated data protection officer, Norbert Rataj, monitors compliance with the data protection principles. Our data protection officer can be reached at iod@kettler.pl.
3. We process your above data for the following purposes:

• for execution of pre-contractual measures that are taken upon the data subject’s request (legal basis: point (b) of Article 6 (1) GDPR);
• for purposes resulting from the provisions of the contracts entered into (legal basis: point (b) of Article 6 (1) GDPR);
• for documentation of the services rendered or the contracts, or for processing and completion of complaints based on the obligations from the Invoicing Act (Rechnungslegungsgesetz) and the provisions under tax law, as well as for compliance with other obligations from the statutory provisions (legal basis: point (c) of Article 6 (1) GDPR);
• for execution of marketing measures for own services and for promotion of activities of Kettler Polska Sp. z o.o. and its new initiatives among the contractually bound customers (legal basis: point (a) of Article 6 (1) GDPR, point (f) of Article 6 (1) GDPR, and the relevant provisions on electronic communication);
• for analysis purposes and for measuring customer satisfaction for adequate rendering of services for our customers, as well as for optimising the customer service processes; these purposes comprise a legitimate interest of the controller (legal basis: point (f) of Article 6 (1) GDPR);
• for updating and rectification of personal data of our customers and for contacting in order to process your requests within the scope of a legitimate interest of the controller (legal basis: point (f) of Article 6 (1) GDPR);
• as evidence within the scope of maintaining a legitimate interest of the controller in securing information for the case that facts need to be legally proven (legal basis: point (f) of Article 6 (1) GDPR);
• for any establishment and assertion of claims or protection of claims within the scope of maintaining a legitimate interest of the controller (legal basis: point (f) of Article 6 (1) GDPR);
• for ensuring security of persons and assets on the administrative property of Kettler Polska Sp. z o.o. by using video surveillance.

1. The following recipient categories may receive your personal data: authorities and offices that perform public tasks or that act on the authorities’ order in the scope and for the purpose resulting from the provisions of the generally applicable law, as well as subcontractors that are bound by contracts on processing activities with Kettler Polska Sp. z o.o., e.g. law firms, companies that render EDP services for Kettler Polska Sp. z o.o., security service providers, transport and courier companies.
2. Your personal data are not transmitted to any third countries.
3. Storage duration of your personal data:

• We store your personal data for as long as this is required for compliance with the contract, rendering of services, and assertion of claims or protection of claims, i.e. for a period of 6 years or until the claims have expired.
• In data processing for maintenance of a legitimate interest of the controller, personal data will be stored until the data subject has objected, subject to the necessity of processing activities until the end of the period required for establishing and assertion of claims or for protection against claims.
• If any data are processed based on the data subject’s consent, we shall cease to process personal data for the purposes named in the declaration of consent upon revocation of the consent by the data subject (in the absence of any other legal basis for processing activities) or following an objection. Beyond this, we shall keep the records on the consent given for a period of three years as evidence of facts in case any claims are raised due to improper processing activities concerning personal data.

1. You have the following rights in connection with processing activities concerning your personal data:

• Right to access your personal data and receive copies of such data,
• Right to rectification of your personal data,
• Right to erasure of your personal data (subject to the reasons named in Article 17 GDPR),
• Right of limitation of processing (subject to the prerequisites named in Article 18 GDPR),
• Right of data portability (subject to the prerequisites named in Article 20 GDPR),
• Right to objection against processing of your personal data (subject to the prerequisites named in Article 21 GDPR),
• Right to lodge a complaint with the supervisory authority; this is the president of the Data Protection Office.

1. There is no automated decision or profiling.