Privacy Policy (GDPR)
INFORMATION ON THE PROTECTION OF PERSONAL DATA
For what purpose do we send you information?
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/8 applies in Poland from 25 May 2018. 46 / EC, (hereinafter GDPR).
This information is intended to inform you how we protect and process personal data by the Innovation Center of the University of Agriculture in Krakow Ltd.
What is personal data?
In accordance with applicable regulations, personal data is such data that allows direct or indirect identification of a natural person, in particular on the basis of identifiers, such as: name, surname, PESEL number, e-mail address, correspondence address.
Who is the administrator of personal data?
The administrator of personal data is the Innovation Center of the University of Agriculture in Krakow Ltd. (hereinafter: Innovation Center of UAK Ltd. or administrator), based at Aleja A. Mickiewicza 21C/2, 31-120 Kraków. This means that the Innovation Center of UAK Ltd. is responsible for their use in a secure manner, in accordance with the contract and applicable law.
For what purpose do we process personal data?
The administrator processes the personal data provided when concluding the contract for water supply and / or sewage disposal (hereinafter the contract) and during its performance in order to:
– enabling the conclusion and performance of the contract between us (art.6 par.1 lit.b) GDPR),
– fulfilling legal obligations specified in art. 6 section 1 letter c) GDPR,
– establishing, investigating, enforcing, defending or protecting claims or rights related to the performance of the contract, which are our legitimate interest (Article 6 (1) (f) of the GDPR).
What is the legal basis for processing personal data?
The legal basis for processing personal data are:
a) 6 para. 1 lit. b) GDPR: “processing is necessary to perform a contract to which the data subject is a party, or to take action at the request of the data subject before concluding the contract”,
b) 6 para. 1 lit. c) GDPR: “processing is necessary to fulfill the legal obligation incumbent on the administrator”, in particular to:
– performing tasks specified in the Act of 7 June 2001 on collective water supply and collective sewage disposal,
– issuing and storing invoices and other accounting documents,
– performing obligations arising from archiving provisions,
– performing tasks in the public interest, to the extent resulting from applicable law
and
c) 6 para. 1 lit. f) GDPR: “processing is necessary for purposes arising from legitimate interests pursued by the administrator or by a third party, except for situations where the interests or fundamental rights and freedoms of the data subject, requiring data protection, prevail over these interests personal data, in particular if the data subject is a child. “
The legitimate interests of an administrator or a third party mean in particular:
– forwarding data to the subsidiaries of Innovation Center of UAK Ltd. for internal administrative purposes,
– implementation of complaint and tax and accounting activities,
– establishment, investigation, enforcement, defense or protection of claims or rights related to the performance of the contract.
Is data processing voluntary?
Yes. Providing personal data voluntarily, but this is a condition for the conclusion and performance of the contract. Failure to provide personal data will prevent the conclusion and implementation of the contract. To the extent that the Administrator processes personal data in order to pursue legitimate interests, providing data is voluntary and you can object to them, as indicated below.
Who is the recipient of personal data?
The recipients of personal data is the Innovation Center of UAK Ltd. and they are or may be: subsidiaries of the Innovation Center of UAK Ltd., entities responsible for the processing of personal data on the basis of a contract, postal operators and courier companies, banks, tax offices, local government authorities, competent authorities in matters of water management, competent regulatory authorities within the meaning of the Act on Collective Water Supply and Collective Disposal wastewater.
In justified cases, these may be debt collection companies, property owners and co-owners.
How long will we keep personal data?
The Innovation Center of UAK Ltd. will store personal data for the duration of the contract and for the period necessary to establish, pursue or defend claims, or to protect the rights of another natural or legal person, or because of the obligation to store data arising from legal provisions, or other important reasons of public interest.
What rights does the owner have regarding his personal data?
The owner of personal data has the right to request from the administrator:
a) access to your personal data and to receive it:
– at the request of the data subject, the administrator provides him with confirmation that he is processing data concerning him and a copy of the data;
b) rectify your personal data:
– at the request of the data subject, the controller corrects his data by correcting incorrect data or supplementing incomplete data taking into account the purposes being processed;
– the administrator without undue delay provides the data subject with information on actions taken in relation to his request;
– the administrator refuses to rectify data if he is not able to identify the data subject, is able to demonstrate their correctness or the data is excessive in relation to the purpose of processing;
c) delete your personal data (“right to be forgotten”):
– at the request of the data subject, the administrator deletes his data without undue delay, if one of the following circumstances applies:
1) personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
2) the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for the processing,
3) the data subject raises an objection based on his right to object to processing and there are no overriding, legitimate grounds for processing,
4) personal data was processed unlawfully,
5) personal data must be deleted in order to comply with the legal obligation provided for in European Union law or in the law of the Member State to which the controller is subject;
– if the request concerns previously publicly disclosed data, then taking into account available technology and implementation costs, the administrator shall take reasonable steps, including technical measures, to inform the controllers processing these data about the need to delete all copies thereof and links to them;
– “the right to be forgotten” does not apply to the extent that processing is necessary, including down:
1) compliance with a legal obligation requiring processing under Union or Member State law to which the controller is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the controller,
2) determination, investigation or defense of claims;
– exemptions from the obligation to exercise the “right to be forgotten” are described in art. 17 para. 3 GDPR;
d) limit the processing of your personal data:
– at the request of the data subject, the administrator limits the processing of his personal data when:
1) the data subject questions the correctness of personal data – for a period allowing the administrator to check the correctness of such data,
2) the processing is unlawful, and the data subject opposes the deletion of personal data, demanding instead the restriction of their use,
3) the administrator no longer needs personal data for the purposes of processing, but they are needed by the data subject to determine, pursue or defend claims,
4) the data subject has lodged an objection pursuant to art. 21 para. 1 GDPR towards processing – until it is determined whether the legitimate grounds on the part of the administrator prevail over the grounds of objection of the data subject;
5) before revoking the processing restriction, the administrator shall inform the person who requested the restriction;
6) the administrator limits the processing of personal data by temporarily transferring selected personal data to another processing system, preventing users from accessing selected data, and temporarily removing published data from the website. In automated data sets, processing is restricted by technical means in such a way that personal data cannot be further processed or changed; the fact of limiting the processing of personal data is clearly indicated in the system;
e) object to the processing of your personal data:
– if the data subject has objected – for reasons related to his particular situation – to the processing of his personal data based on Art. 6 para. 1 lit. e) or f) GDPR, the administrator stops processing this personal data, unless he is able to demonstrate the existence of valid, legally justified grounds for processing, overriding the interests, rights and freedoms of the data subject, or grounds for establishing, investigating or defending claims;
f) transfer your personal data:
– at the request of the data subject, the administrator transfers to him or another administrator indicated by him, if it is technically possible, personal data which he provided to the administrator in a structured, commonly used, machine-readable format, if:
1) processing takes place on the basis of consent or on the basis of a contract
and
2) processing takes place in an automated manner;
– this right does not apply to processing that is necessary for carrying out a task carried out in the public interest;
g) the owner of personal data has the right to lodge a complaint with the supervisory body, which is the President of the Office for Personal Data Protection.
Additional information
a) Entrusted personal data are not subject to automated decision making.
b) The administrator does not transfer or plan to transfer entrusted personal data to third countries or international organizations. Departure from the rule may be the case when a party to the contract changes his place of residence and is outside the territory of the European Union, and the formalities related to the termination of the contract and making final settlements require sending this data. In this case, it may be necessary to transfer data to a country for which the European Commission has not issued a decision establishing or lacking an adequate level of personal data protection. In such cases, the data will be transferred in accordance with generally applicable law with appropriate safeguards, based on standard data protection clauses adopted by the European Commission. You will be able to get a description of these protections or the Administrator will indicate the place of their sharing.
Contact
The Innovation Center of the University of Agriculture in Krakow Ltd., Al. A. Mickiewicza 21C/2, 31-120 Krakow
Contact details of the data protection officer: iod@innowacje-ur.pl