Obowiązek informacyjny

Since 25 May 2018, the data protection rules under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (GDPR) have been in force.

We would like to assure you that we exercise special care in processing your personal data, we act in accordance with the law and implement appropriate technical and organisational measures to ensure the security of personal data entrusted to us. We take care of personal data protection already while designing new activities.

PERSONAL DATA ADMINISTRATOR

one.bid sp z o. o. with his registered office at ul. Franciszka Klimczaka 17/107, 02-797 Warsaw, Poland, on the basis of the entry in KRS 0000914354, VAT id: PL7122494202 is the controller of personal data (hereinafter: the Administrator) of his employees, associates, clients, contractors and persons who have provided their data via a form on the website or via e-mail, as well as other entities that have given their consent to the processing of personal data.

LEGAL BASES AND PURPOSES OF PERSONAL DATA PROCESSING

The Administrator shall process personal data only if at least one of the following conditions is met:

  1. the data subject has given their consent to the processing of their personal data (Article 6(1)(a) of the GDPR);
  2. processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps prior to entering into a contract (Article 6(1)(b) of the GDPR),
  3. processing is necessary for compliance with a legal obligation to which the Administrator is subject (Article 6(1)(c) of the GDPR);
  4. processing is necessary in order to protect the vital interests of the data subject or of another natural person (Article 6(1)(d) of the GDPR);
  5. processing is necessary for the performance of a task carried out in the public interest (Article 6(1)(e) of the GDPR);
  6. processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party (Article 6(1)(f) of the GDPR).

PROCESSING OF PERSONAL DATA

Data of the data subjects shall be processed:

  1. for the purpose of performing a service contract;
  2. for information and marketing purposes on the basis of freely given consent.

Personal data collected for the purpose of performing a service contract shall be processed to the extent necessary for record keeping. Data processed for this purpose includes:

  1. surname and first name(s), 
  2. correspondence address,  
  3. telephone number,
  4. e-mail address.

Personal data processed for information and marketing purposes includes:

  1. first name and surname,
  2. telephone number,
  3. e-mail address.

Data provided to the Administrator via e-mail or a form on the website shall be processed under Article 6(1)(a), (b), (c) or (f) of the GDPR and shall include, but not be limited to, data such as first name, surname, e-mail address, telephone number and other data that will be provided in e-mail correspondence. This data shall be processed for the purpose for which it has been provided.

Data processed on the basis of consent (Article 6(1)(a) of the GDPR), in particular first name, surname, e-mail address and telephone number, shall be used for the purpose for which the consent has been given and shall be processed until the consent is withdrawn or until the purpose for which the consent has been granted is achieved.

Data processed in connection with entering into a contract under Article 6(1)(b) of the GDPR shall include, in particular, first name, surname, address, telephone number, e-mail address and shall be used to perform the contract.

Data of persons used by contractors to perform contracts entered into with the Administrator shall be processed pursuant to Article 6(1)(f) of the GDPR and shall include, among others, first name, surname, e-mail address and telephone number. This data shall be used for the purposes of the legitimate interests pursued by the Administrator or by a third party.

Data entrusted for processing by other controllers (first name, surname, contact details, e-mail address) shall be processed within the scope set out in a personal data processing agreement for the purpose and in the manner specified by the controller of the personal data transferred.

OBLIGATION TO PROVIDE DATA AND CONSEQUENCES OF FAILURE TO DO SO

The provision of data for the purposes of performing a contract shall be voluntary, but necessary for its performance. If data is not provided, the purpose of the contract cannot be achieved.

The provision of data for information and marketing purposes shall be voluntary. In the case of refusal to give the consent to data processing in this scope, the Administrator shall not be able to perform certain activities, in particular such as informing about current packages, promotions, a new range of services available from the Administrator.

The provision of personal data in connection with a contract, other than the provision of services, shall be voluntary, but necessary to enter into and perform the contract and to make the related financial settlements.

Giving consent to the processing of personal data for marketing or information purposes shall be voluntary, and the consent may be withdrawn at any time, without affecting the legality of the processing performed on the basis of such consent before its withdrawal.
The indication of the e-mail address and other data in e-mail correspondence shall be voluntary. Withdrawal of consent to data processing shall result in inability to conduct further e-mail correspondence.

PERSONAL DATA RETENTION PERIOD

Personal data obtained in order to perform a contract shall be stored until the expiry of the limitation period for claims related to the concluded contract or until the expiry of the obligation to store data resulting from legal regulations, in particular the obligation to store financial and accounting documents.

Where consent is the sole basis for processing, data shall be processed until the consent is withdrawn or until the purpose for which the consent has been given is achieved, with the proviso that withdrawal of the consent shall not affect the legality of the processing performed on the basis of such consent before its withdrawal.

Data provided to the Administrator via e-mail shall be processed for the purpose for which it has been provided and shall be erased once the purpose has been achieved.

Personal data entrusted for processing by other controllers shall be kept for the period indicated by the personal data controller.

RIGHTS OF DATA SUBJECTS

The data subject has the right to access the content of their personal data, the right to rectify it, to request its erasure, as well as the right to restrict its processing, the right to data portability and the right to object to the processing of personal data.

If the legal basis for the processing of personal data is consent, the data subject has the right to withdraw their consent at any time, without affecting the legality of the processing performed on the basis of such consent before its withdrawal.

In addition, if the processing of personal data is considered to violate the provisions the EU Regulation - GDPR, the data subject has the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office: https://uodo.gov.pl/en/484

RECIPIENTS OF PERSONAL DATA

Personal data may be made available to third parties with the consent of the data subject.

Moreover, personal data may be made available for the purpose of fulfilling the Administrator's obligations or if it is necessary for the purposes of the legitimate interests pursued by the Administrator.

The entities to which data may be made available include, depending on the category of data: subcontractors of the services covered by the contract, IT service providers, the entity providing accounting services, entities cooperating with the Administrator within the scope of the services provided, and other institutions authorised by law, such as the Tax Office, the Court or the Social Insurance Institution (ZUS).

Where personal data is processed on behalf of third parties, the Administrator shall act as a processor, and the data shall be made available in accordance with the rules laid down by the third party.

INFORMATION ON AUTOMATED DECISION-MAKING

The Administrator may automatically adjust certain content to the needs of the clients and persons who have provided their data via a form on the website or via e-mail, as well as other entities who have given their consent to the processing of personal data, i.e. carry out profiling, using the personal data provided by them.

Such profiling consists mainly in the automatic assessment of the products in which these persons may be interested, based on their previous online behaviour, including on the Administrator's websites, and displaying product advertisements profiled in this manner.

The profiling carried out by the Administrator shall not result in making decisions that produce specific legal effects with regard to those persons or affect them in a similarly significant manner.

CONTACT DETAILS

We can be contacted as follows:

  • by mail to the registered office address: ul. Franciszka Klimczaka 17/107, 02-797 Warsaw, Poland
  • via e-mail: