STEKOP S.A. with its registered office in Warsaw (02-127), ul. Mołdawska 9, performing its obligations arising out of the applicable legal provisions on personal data protection, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), hereby presents you information concerning the processing and protection of your personal data.

Information included in the Privacy Policy will help you understand which personal data STEKOP S.A. with its registered office in Warsaw collects and processes, for which purpose they are used and which rights you are entitled to in connection with personal data protection.

In the subject Privacy Policy you will find information concerning the processing of personal data pertaining to:

business partners
employees/co-employees/ persons acting on behalf of contractors
potential business partners
persons contacting via telephone, by means of electronic mail, through the contact form available on www.stekopsa.pl ;

DETAILS OF DATA CONTROLLER:

The controller of your personal data is STEKOP S.A. with its registered office in Warsaw (02-127), ul. Mołdawska 9, entered in the register of businesses of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 12^th Commercial Division of the National Court Register under KRS number 0000046053, with a share capital of PLN 1,764,000, NIP (Tax ID): 5421023917, REGON (Statistical ID): 050357134, hereinafter referred to as STEKOP S.A. or DC (Data Controller).

CONTACT WITH DATA CONTROLLER:

You can contact the DC by means of:

Telephone number: 85 7489 015
Email address: stekop@stekopsa.pl
Postal address: Kol. Porosły 52, 16-070 Choroszcz

DATA PROTECTION OFFICER:

The DC has appointed a Data Protection Officer to be contacted by means of:

Telephone number: 85 7489 015
Email address: daneosobowe@stekopsa.pl
Postal address: Kol. Porosły 52, 16-070 Choroszcz

TYPE OF COLLECTED DATA:

Depending on the purpose and legal basis for collecting and processing of personal data, the DC may collect and process e.g. the following data:

basic identification data, including but not limited to: first name, surname, company name, tax ID number;
address and contact details, including but not limited to: address, telephone number, email address;
Internet data collected during your use of websites administered by the DC based on cookies (additional information on the use of cookies can be found in the Cookies Policy).

PURPOSE, LEGAL BASIS OF DATA PROCESSING AND PERIOD OF PERSONAL DATA STORAGE.

I. Information dedicated to business partners:

If you entered into a contract wit the DC, e.g. cooperation agreement, contract for service provision in the scope of physical protection, contract for service provision in the scope of surveillance or maintenance of an alarm/fire protection system, installation of an intrusion and robbery signalling system, the DC will process your data for the purpose, on the legal basis and for the period indicated below:

Purpose of data processing	Legal basis for data processing	Period of storage/ processing of personal data
Performing the contract or taking steps prior to its conclusion at your request	Art. 6 item 1 letter b of GDPR	Term of the contract
Fulfilment of obligations provided for by the law, in particular tax and accounting regulations, including keeping books of account and tax documentation	Art. 6 item 1 letter c of GDPR in connection with Art. 74 item 2 of the Accountancy Act and other special provisions	Period of storing accounting and tax documentation resulting from legal provisions
Pursuing claims and defending against business claims, which constitutes a legitimate interest in data processing by the DC	Art. 6 item 1 letter f of GDPR	Period necessary to pursue claims and defend against claims, taking into account periods of limitation laid down in generally applicable law
Storage after the end of the contract in case of your possible renewed interest in our offer in the future, which constitutes a legitimate interest of the DC	Art. 6 item 1 letter f of GDPR	Period of achieving the purpose in the form of storage after the end of contract in case of your possible renewed interest in our offer in the future or until the filing of an effective objection to data processing for this purpose, depending on which event occurs earlier, but no longer than for the period of data storage for other purposes
Marketing purposes, which constitutes a legitimate interest of the DC	Art. 6 item 1 letter a of GDPR in connection with Art. 10 item 1 of the Act on the Electronic Provision of Services and Art. 172 of the Telecommunications Act; Art. 6 item 1 letter f of GDPR	Period necessary to achieve the purpose, however no longer than until the withdrawal of consent or the filing of an effective objection to data processing

II. Information dedicated to employees/co-employees/persons acting on behalf of the business partner:

If you are an employee/co-employee of the DC’s business partner, e.g. you act as a representative of the DC’s business partner, as a person designated for contact or a person authorised to perform specific acts on behalf of the business partner, including acts arising out of the contract signed with the DC, the DC will process your data for the purpose, on the legal basis and for the period indicated below:

Purpose of data processing	Legal basis for data processing	Period of storage/ processing of personal data
Performing the contract signed with the DC with the entity on whose behalf and for whose benefit you act or taking steps prior to its conclusion at the request of the above entity, which also constitutes a legitimate interest of the DC	Art. 6 item 1 letter a of GDPR – consent of the data subject (in cases where the legal basis for personal data processing may be a consent) Art. 6 item 1 letter b, f of GDPR	Period necessary to achieve the purpose, however no longer than until the withdrawal of consent for a specific purpose. Term of the contract for which you act on behalf of or for the benefit of the entity that signed a contract with the DC or until the filing of an effective objection to the processing of your data
Performing obligations provided for by the law, in particular tax and accounting regulations, including keeping books of account and tax documentation if your data were given in the contract or other documents related to the DC’s performance of his obligations under the law	Art. 6 item 1 letter c of GDPR in connection with Art. 74 item 2 of the Accountancy Act and other special provisions	Period of storing accounting and tax documentation resulting from legal provisions
Pursuing claims and defending against business claims, which constitutes a legitimate interest of data processing by the DC	Art. 6 item 1 letter f of GDPR	Period necessary to pursue claims and defend against claims, taking into account periods of limitation laid down in generally applicable law
Storage after the end of the contract concluded by the DC with the entity on whose behalf and for whose benefit you act in case of possible renewed interest of the above entity in our offer in the future, which constitutes a legitimate interest of the DC	Art. 6 item 1 letter f of GDPR	Period necessary to achieve the purpose of storage upon the end of the contract concluded by the DC and the entity on whose behalf and for whose benefit you act in case of possible renewed interest of the above entity in our offer in the future or until the filing of an effective objection to data processing for this purpose, depending on which of these events takes place earlier, however no longer than for the period of data storage for other purposes
Marketing purposes, which constitutes a legitimate interest of the DC	Art. 6 item 1 letter a of GDPR in connection with Art. 10 item 1 of the Act on the Electronic Provision of Services and Art. 172 of the Telecommunications Act; Art. 6 item 1 letter f of GDPR	Period necessary to achieve the purpose, however no longer than until the withdrawal of consent or the filing of an effective objection to data processing

III. Information dedicated to potential business partners.

If you are interested in the DC’s offer or the entity on whose behalf or for whose benefit you act is interested in the DC’s offer, the DC will process your data for the purpose, on the legal basis and for the period indicated below:

Purpose of data processing	Legal basis for data processing	Period of storage/ processing of personal data
Presentation of the ordered offer and conducting correspondence/talks related to the ordered offer	Art. 6 item 1 letter a of GDPR – consent for data processing for the purpose of presenting a specific, ordered offer Art. 6 item 1 letter b of GDPR – taking steps prior to contract conclusion at your request or at the request of the entity on whose behalf or for whose benefit you act Art. 6 item 1 letter f of GDPR – legitimate interest of the DC consisting in the presentation of your ordered offer	1) Period necessary for presenting the offer and conducting correspondence/talks related to the presented offer, however no longer than until the withdrawal of the consent for data processing or filing an effective objection to data processing for this purpose (in case of personal data processing – under Art. 6 item 1 letter a or f of GDPR); 2) Period necessary to take steps related to the request prior to contract conclusion (in case of personal data processing – under Art. 6 item 1 letter b of GDPR)
Pursuing claims and defending against business claims, which constitutes a legitimate interest in data processing by the DC	Art. 6 item 1 letter f of GDPR	Period necessary to pursue claims and defend against claims, taking into account periods of limitation laid down in generally applicable law

If the DC sends you enquiries on offer presentation or presents/sends offers or presents/sends offers, the DC will process your data for the purpose, on the legal basis and for the period indicated below:

Purpose of data processing	Legal basis for data processing	Period of storage/ processing of personal data
Sending enquiries on the presentation of the offer or sending offers, information on goods, services – within the legitimate interest of the DC or your expressed consent	Art. 6 item 1 letter f of GDPR, which constitutes a legitimate interest of the DC consisting in establishing commercial relations as well as marketing of goods and services Art. 6 item 1 letter a of GDPR, Art. 10 item 2 of the Act on the Electronic Provision of Services and Art. 172 of the Telecommunications Act	Period necessary to achieve the purpose, however no longer than until: 1) your filing of an objection to the processing of personal data for this purpose or 2) if you expressed marketing consents – until the withdrawal of the expressed consent
Pursuing claims and defending against business claims, which constitutes a legitimate interest in data processing by the DC	Art. 6 item 1 letter f of GDPR	Period necessary to pursue claims and defend against claims, taking into account periods of limitation laid down in generally applicable law

IV. Information dedicated to persons contacting the DC via telephone, by means of electronic mail or through the contact form available on www.stekopsa.pl .

If you contact the DC or persons acting on behalf of the DC via telephone, by means of electronic mail or through the contact form available on www.stekopsa.pl, the DC will process your data for the purpose, on the legal basis and for the period indicated below:

Purpose of data processing	Legal basis for data processing	Period of storage/ processing of personal data
Contact in connection with an enquiry/request placed via telephone, by means of electronic mail or through a contact form	Art. 6 item 1 letter a of GDPR – consent for data processing for the purpose of a reply to the enquiry/request Art. 6 item 1 letter b of GDPR – performance of a contract or taking steps prior to contract conclusion at your request or at the request of the entity on whose behalf or for whose benefit you act Art. 6 item 1 letter f of GDPR – legitimate interest of the DC consisting in a reply to your enquiry/request	1) Period necessary to conduct correspondence/talks related to the enquiry/request, however no longer than until the withdrawal of the consent for data processing or filing of an effective objection to data processing for this purpose (in case of personal data processing – under Art. 6 item 1 letter a or f of GDPR); 2) Period necessary to take steps related to contract conclusion or its request prior to contract conclusion (in case of personal data processing – under Art. 6 item 1 letter b of GDPR)
Pursuing claims and defending against business claims, which constitutes a legitimate interest of data processing by the DC	Art. 6 item 1 letter f of GDPR	Period necessary to pursue claims and defend against claims, taking into account periods of limitation laid down in generally applicable law

METHOD OF DATA PROVISION:

In most cases the DC acquires your personal data directly from you. In specific cases the DC may acquire your data:

from the entity on whose behalf or for whose benefit you act (this in particular concerns employees/co-employees of the DC’s business partners – the provided data most frequently contain: first name, surname, position, email address, telephone number;
automatically in the course of using websites held by the DC by means of cookies files (additional information on the use of cookies can be found in the Cookies Policy);
from publicly available sources; in this case the DC may collect such personal data as: first name, surname, company name, email address, telephone number, position.

If you provide your data directly to the DC, such provision is voluntary. The effects of non-provision of data are described below:

Business partners: (signers of contracts with the DC)	The provision of your data is necessary for the conclusion and performance of the contract. Refusal to provide data may result in the impossibility to conclude a contract or its performance.
Employees/co-employees/persons acting on behalf of the DC	Data provision is necessary for the DC to perform the contract for the benefit of the entity on whose behalf you act. If you do not provide data, contract execution may be hindered.
Potential business partners	Your provision of data necessary to present an offer is a condition for presenting you with an offer and conducting communication/talks related to the presented offer. Failure to provide the data will result in the impossibility to present the offer.
Persons contacting via telephone, by means of electronic mail or through the contact form	Your provision of data is obligatory for us to provide you with a reply to your request/enquiry. Failure to provide data will result in the impossibility to reply to the request/enquiry.

ENTITIES TO WHICH DATA CAN BE TRANSFERRED:

Access to your personal data is only allowed to:

persons authorised by the DC to process your personal data at the request of the DC
entities, whom the DC entrusted with personal data processing, including:
providers of technical and organisational services (in particular providers of ICT services, entities providing postal and courier services, electronic payment services);
legal and advisory services providers, including in case of pursuing claims related to the DC’s business activities and defending against claims;
other entities/persons/bodies within the scope and under principles laid down by the law

on the condition that your data is provided to the above mentioned entities in accordance with the applicable law and in compliance with full principles related to their security.

TRANSFER OF DATA TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA (COUNTRIES OTHER THAN THE EUROPEAN UNION AND ICELAND, NORWAY AND LIECHTENSTEIN) AND INTERNATIONAL ORGANISATIONS.

The DC does not intend to transfer your personal data to a country outside the European Economic Area and international organisations.

RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA

In connection with personal data processing by the DC, you have:

the right to access your personal data (Art. 15 of GDPR);
the right to rectify your personal data (Art. 16 of GDPR);
the right to obtain the erasure of your personal data in cases specified in Art. 17 item 1 subject to the exceptions specified in Art. 17 item 3 of GDPR;
the right to obtain the restriction of your personal data processing in cases specified in Art. 18 of GDPR;
the right to transfer your personal data in cases specified in Art. 20 of GDPR.

If you wish to use any of these rights, you may contact the DC:

via electronic mail: daneosobowe@stekopsa.pl
via traditional mail: 16-070 Choroszcz, Kol. Porosły 52

You also have the right to:

lodge a complaint with the data protection supervisory authority if, while processing your personal data, the DC violates data protection provisions;
withdraw the consent to data processing at any time, without affecting the validity of the processing that was carried out on the basis of the consent before its withdrawal – if the DC processes data on the basis of such a consent.

You may withdraw your consent, among other things:

via electronic mail: daneosobowe@stekopsa.pl
via traditional mail: 16-070 Choroszcz, Kol. Porosły 52

MAKING AUTOMATED DECISIONS

No automated decisions will be made against you (decisions without human intervention), neither your personal data will be profiled.

RIGHT TO OBJECTION

Since your personal data may be processed by the DC for the purposes of the DC’s legitimate interest, you have the right to object to the processing of your personal data for the aforementioned purpose for reasons related to your special situation.

After lodging an objection, the DC will not be able to process personal data on the basis of the above-mentioned grounds for processing unless it demonstrates that there are important legitimate grounds for data processing overriding interests, rights and freedoms of the data subject or grounds for establishing, pursuing and defending claims.

If the DC processes your data for direct marketing purposes, you have the right to object to the processing of your data by the DC for direct marketing purposes.

SECURITY OF PERSONAL DATA

The DC applies appropriate technical and organisational measures to keep your personal data safe, including protecting your personal data from unauthorised access, loss or destruction. In order to ensure the security of your personal data, the DC has implemented appropriate personal, organisational, technical (IT) and physical security measures.

PRIVACY POLICY