General Information Clause

I. Data Controller

The controller of your personal data, determining the purposes and means of processing, is SkySnap sp. z o.o., with its registered office at al. Jerozolimskie 81, 02-001 Warsaw, Poland, Tax Identification Number (NIP): 5223040482, REGON: 362701268, National Court Register (KRS) No.: 0000579696.

The Data Controller may be contacted by post at the address of its registered office or by e-mail at: kontakt@skysnap.pl

II. Contact with the Data Protection Officer

In order to ensure an appropriate level of personal data protection, the Controller has appointed a Data Protection Officer, who may be contacted by e-mail at: iod@odokancelaria.pl or by post at the address of the Controller’s registered office.

III. Collection, Processing and Use of Personal Data

We process personal data for the following purposes and on the following legal bases:

• for the conclusion and performance of individual agreements, including settlement of cooperation between the parties, as well as communication with clients, contractors, their representatives, attorneys-in-fact, designated contact persons and persons authorised to conclude, perform or settle agreements (legal basis – Article 6(1)(b) of the GDPR, “performance of a contract”, with respect to the data of a party to the agreement, and with respect to representatives, attorneys-in-fact, contact persons and persons acting on behalf of a client or contractor – Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Controller consisting in the ability to conclude, properly perform, manage and settle an agreement and maintain business contact),
• for compliance with legal obligations arising from applicable law, in particular tax regulations, including the Tax Ordinance Act, the Value Added Tax Act and the Accounting Act (legal basis – Article 6(1)(c) of the GDPR, “legal obligation”),
• for the establishment, pursuit or defence of potential claims and the protection of the Controller’s rights, as well as for responding to enquiries, requests for contact and requests for an offer addressed to the Controller (legal basis – Article 6(1)(f) of the GDPR, i.e. the Controller’s legitimate interest referred to above),
• for compliance with obligations arising from the GDPR, for example with regard to exercising the rights of data subjects who have objected to processing or withdrawn their consent, and for maintaining the necessary registers or records (Article 6(1)(c) of the GDPR – legal obligation), as well as on the basis of the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in maintaining information on persons who have exercised the rights available to them.

We process the personal data provided for the period necessary to achieve the purposes described above. Depending on the applicable legal basis, this will be respectively:

• for the duration of cooperation between the parties and until final settlements have been completed,
• for the period required to comply with legal obligations, as specified by applicable law governing data retention periods, for example Article 70 of the Tax Ordinance Act,
• until the limitation period for any potential claims arising from the relevant legal basis for processing has expired, for example pursuant to Article 118 of the Civil Code,
• until the consent granted is withdrawn.

IV. Disclosure of Personal Data to Third Parties

1. Personal data may be transferred or disclosed to entities providing services to the Controller or supplying tools used in the course of its business activities, in particular providers of IT services, hosting services, e-mail services, communication systems, data storage services, administrative, accounting, legal, advisory or technical services.Personal data is transferred only to the extent necessary to achieve the relevant processing purposes and on the basis of appropriate legal grounds, including data processing agreements concluded in accordance with Article 28 of the GDPR or other appropriate arrangements governing the principles of processing, confidentiality and data security.

   The Controller uses only service providers that provide sufficient guarantees of implementing appropriate technical and organisational measures required under the GDPR.

2. As a rule, the Controller does not intend to transfer personal data outside the European Economic Area.However, where the use of particular tools, IT services or technology providers results in the transfer of personal data to a third country or an international organisation, such transfer will take place only on the basis of mechanisms provided for in Chapter V of the GDPR, including in particular an adequacy decision adopted by the European Commission, Standard Contractual Clauses, Binding Corporate Rules or other safeguards permitted by law.

   In such cases, the Controller ensures that personal data is transferred in compliance with the requirements of the GDPR and with appropriate safeguards for the rights and freedoms of data subjects.

V. Data Security

In order to ensure the confidentiality of personal data, the Controller has implemented procedures and organisational and technical measures that allow access to such data only by authorised persons who process it in connection with the tasks assigned to them.

The Controller also takes the necessary measures to ensure that subcontractors and other cooperating entities provide sufficient guarantees of applying appropriate security measures whenever they process personal data on the Controller’s instructions.

VI. Source of Data and Requirement to Provide Data

The personal data processed has been collected directly from the data subject or obtained from a client, contractor, their representative, attorney-in-fact or another person authorised to act on their behalf, in connection with the relevant purpose of processing, in particular in order to establish contact, present an offer, conclude, perform or settle an agreement.

The scope of the personal data processed may include, in particular, identification data, contact details, job title or function, scope of authorisation and other data necessary to confirm the authority to represent or communicate in matters relating to cooperation.

The Controller processes only personal data that is necessary for the selected purposes of processing, in accordance with the principle of data minimisation.

Providing personal data is voluntary; however, failure to provide such data may make it impossible to establish or continue cooperation, conclude or perform an agreement, maintain contact or comply with obligations arising from applicable law.

VII. Rights of the Data Subject

1. Every person whose personal data is held by the Controller has the right to:
   1. access their personal data;
   2. rectify their personal data;
   3. restrict the processing of their personal data;
   4. request the erasure of their personal data, unless specific legal provisions require the Controller to retain such data;
   5. withdraw consent to the processing of personal data at any time – withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
   6. data portability, where processing is based on a contract or consent and is carried out by automated means;
   7. object to the processing of personal data based on Article 6(1)(e) or (f) of the GDPR, including profiling – where an objection is made to the processing of personal data for direct marketing purposes, including profiling, the Controller shall cease processing personal data for such purposes;
   8. not to be subject to a decision based solely on automated processing, including profiling – the Controller states that it does not process personal data using automated decision-making.

2. If personal data is processed unlawfully or otherwise in breach of applicable data protection rules, you have the right to lodge a complaint with the competent national supervisory authority for data protection, namely the President of the Personal Data Protection Office.
3. If you wish to exercise any of the above rights, you may send an e-mail to iod@odokancelaria.pl or submit the relevant request to the address of the Controller’s registered office.