GDPR - INFORMATIVE CLAUSE

FOR CLIENTS AND CONTRACTORS

INFORMATION CLAUSE REGARDING THE PROCESSING OF PERSONAL DATA




In connection with the implementation of the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation "GDPR"), we inform you about the principles of processing your personal data for the purpose of concluding and performing contracts, to fulfill legal obligations, to pursue legitimate interests and based on granted consents, and we also inform you about the rights related to this.



The following principles apply from May 25, 2018 onwards.


The controller of your personal data is "INSTEP PLUS"
The company's headquarters are located in Opole at 30a 1 Maja Street.
The company's Tax Identification Number is: 7543351055.
Other contact details are:
Phone: +48 666 545 404
Email: instepplus@gmail.com
Website: https://instepplus.eu/




The legal basis for processing your personal data by us is the law, i.e., Article 6(1)(b) of the General Data Protection Regulation dated April 27, 2016 (GDPR). Your personal data will be processed by us only:
a) based on applicable legal provisions,
b) in accordance with concluded contracts,
c) for the purpose of pursuing the legitimate interests of the Controller, and
based on the consent provided.



4. Your personal data is processed for the following purposes:

a) to conclude and execute contracts with the Controller's contractors (legal basis: Article 6(1)(b) of the GDPR) - for the duration of the contract and settlement after its termination;

b) to fulfill the legal obligations of the Controller, e.g., issuing or storing invoices and other accounting documents, responding to complaints (legal basis: Article 6(1)(c) of the GDPR) - for the period prescribed by law;

c) to establish, defend, and pursue claims (legal basis: Article 6(1)(f) of the GDPR) - for the period until the claims expire;

d) to verify creditworthiness (legal basis: Article 6(1)(f) of the GDPR) - for the time necessary to assess creditworthiness when concluding, extending, or expanding the scope of the contract;

e) for direct marketing (legal basis: Article 6(1)(f) of the GDPR) - for the duration of the contract or until objection is raised;

f) to detect and prevent abuses (legal basis: Articles 6(1)(c) and 6(1)(f) of the GDPR) - for the duration of the contract, and then for the period until the claims expire or during the proceedings conducted by the relevant public authorities;

g) in other cases, your personal data is processed only based on the previously given consent, to the extent and for the purpose specified in the content of the consent (Article 6(1)(a) of the GDPR) - for the period from the granting of consent to its withdrawal.



5. In connection with the processing of data for the purposes described in point 4, recipients of your personal data may include entities from the following categories:

a) entities processing personal data on behalf of the Controller based on relevant agreements, e.g., providers of IT systems, subcontractors, advertising agencies, intermediaries, entities providing advisory, legal, debt collection, accounting, auditing services, as well as services for delivery of correspondence and parcels;

b) entities authorized to receive them under applicable law, e.g., courts and state authorities.


6. Currently, we do not plan to transfer your personal data outside the EEA (European Economic Area), which includes the European Union, Norway, Liechtenstein, and Iceland.



7. In connection with the processing of your personal data, you have the following rights:

a) the right to access personal data, including the right to obtain a copy of this data;

b) the right to request correction (rectification) of personal data - if the data is incorrect or incomplete;

c) the right to request deletion of personal data (the so-called right to be forgotten), if:

• - the data are no longer necessary for the purposes for which they were collected or otherwise processed,
• - the data subject has objected to the processing of personal data,
• - the data subject has withdrawn consent for processing personal data, which is the basis for data processing and there is no other legal basis for processing data,
• - personal data are processed unlawfully,
• - personal data must be deleted in order to comply with a legal obligation;

d) the right to request restriction of processing personal data - in cases where:

• - the data subject disputes the accuracy of personal data,
• - data processing is unlawful and the data subject opposes the deletion of data, requesting instead the restriction of their processing,
• - the Controller no longer needs the data for its purposes, but the data subject needs them to establish, defend, or pursue claims,
• - the data subject has objected to the processing of data until it is determined whether the legitimate grounds on the part of the Controller override the grounds for objection;

e) the right to data portability - if data processing is based on a contract concluded with the data subject or on consent given by the data subject,

f) the right to object to the processing of data in cases where there are reasons related to your particular situation, and the processing is based on the necessity for the purposes arising from the legitimate interests pursued by the Controller or by a third party (Article 6(1)(f) of the GDPR), except where the Controller:

• - demonstrates the existence of compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, requiring the protection of personal data, in particular where the data subject is a child, or
• - demonstrates the grounds for establishing, investigating, or defending claims.

However, if data is processed for direct marketing purposes (including profiling), you have the right to object at any time, and the Controller will no longer be allowed to process data for these purposes.



8. If personal data processing is based on the consent of the data subject (Article 6(1)(a) of the GDPR), you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal, in accordance with applicable law.

9. If you become aware of unlawful processing of your personal data by the Controller, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.

10. In situations where the processing of personal data is based on the consent of the data subject, providing your personal data to the Controller is voluntary. However, in the case of entering into a contract, providing personal data is voluntary but necessary for the conclusion and performance of the contract.

11. Your personal data will not be processed in an automated manner.