Information Clause for Newsletter Recipients

Personal data processing

We process personal data:

1. in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”;
2. in accordance with the rules specified in this document, hereinafter the “Information Clause”.

All the rules for our processing of personal data are comprehensively described in our Privacy Policy.

The Controller

We are responsible for the purpose and manner of our use of your personal data. The entity responsible (hereinafter referred to as the “Controller”) for personal data processing is:

Winderen Sp. z o.o.
ul. Młyńska 27, 22-400 Zamość
Poland
Tel. no. +48 (84) 538 75 84

Contact details for matters connected with personal data

In the matters connected with personal data processing you can contact us using the following details:

Winderen Sp. z o.o.
ul. Młyńska 27, 22-400 Zamość
Poland
[email protected]

Purpose and legal basis of the processing

By subscribing to the newsletter, you voluntarily consent to commercial information being sent to the e-mail address you have provided. We will process the data you provide for the purposes and on the grounds described below:

1. promotion of products and services, via newsletters, direct mail etc. – your consent to the processing;
2. handling and recording correspondence – our legitimate interest connected with the organisation of our business processes, documenting the circumstances of contract execution and making it possible to pursue or defend any claims;
3. making it possible to pursue or defend any claims – our legitimate interest.

Recipient categories

We make available or entrust the processing of your personal data to partners (persons or entities) and other data recipients only in cases justified by the performance of a contract, legal obligation, our legitimate interest or with your express consent. Every recipient receives only as much data as necessary for fulfilling a given processing purpose.

Your personal data is made available to other data controllers:

1. telecommunications operators and other entities providing telecommunications services delivered by electronic means – in connection with handling and registration of correspondence;
2. public bodies and entities (courts, revenue authorities, customs, police etc.) – e.g. in connection with pursuing or defending claims;

We entrust the processing of your personal data to the following processing entities:

1. IT service providers (entities which operate our information systems or provide us with technical support services, entities which provide data communication tools, including statistical and marketing tools, telecommunications operators, cloud service providers) – such as Google Ireland Limited, Apple Distribution International Limited in Ireland, Microsoft Ireland Operations Limited;
2. subcontractors (e.g. our advisers, consultants, auditors, legal, tax, accounting assistance, tax representatives) – for the purpose of subcontracting certain services and work on the basis of relevant personal data processing agreements;
3. Klaviyo, Inc. – for the purpose of maintaining a business relationship;

Some data may be transferred to a third country (outside the European Economic Area). We transfer data to the following entities: Google Ireland Limited, Apple Distribution International Limited w Irlandii, Microsoft Ireland Operations Limited, Klaviyo Inc., which may process data at their data processing centres located in the United States of America and possibly other countries based on:

1. the legal mechanisms and standard contractual clauses used by IT service providers to ensure adequate protection of data when it is transferred outside the EEA;
2. a finding by the European Commission that third countries ensure an adequate level of protection of personal data;
3. the so-called Privacy Shield standard.

Period of data processing

Your personal data will be processed for a period no longer than necessary for the purposes of the processing:

1. promotion of products and services – until you withdraw your consent to processing, up to a maximum of one month from the date of the withdrawal;
2. handling and recording correspondence, making it possible to pursue or defend claims – up to 10 years from the occurrence of the last event;

If your personal data is used as evidence in legal proceedings – it may be stored for longer than indicated above, until the legal conclusion of those proceedings.

Your rights

According to the GDPR, you have the right to the protection of your personal data, in particular you have the right to:

1. make a request to the Controller to provide you with access to your personal data;
2. rectification of your personal data;
3. delete your personal data;
4. restrict the processing of your personal data;
5. object to the processing of your personal data, including processing for the purpose of maintaining business relations and direct marketing (once the objection is raised, the data will not be processed to the extent of the objection);
6. transfer your personal data;
7. withdraw your consent to the processing of your personal data at any time, provided that the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of your consent before its withdrawal;
8. lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office;

If you wish to withdraw your consent to the promotion of products and services (receiving newsletters) – there is a link for cancelling the subscription in every newsletter. Click on the link and confirm the cancellation of your subscription.

You can also exercise your rights by contacting us as described in section 3.