Personal data protection

NOTICE
on processing of your personal data
(applies to the citizens of the EU member states)

You are hereby notified that we process your personal data. The details of the processing can be found below.

I. Personal data controller
We, the company of Nova Trading SA seated in Toruń at 5 Starotoruńska Street, Poland, are the Controller of your personal data.

II. Data Protection Officer
We have appointed a Data Protection Officer whom you may contact about any issues related to the protection of your personal data and the use of your rights by emailing us at iodo@ntsa.pl or calling us to +48 609 690 125 or writing to us to the address of our registered office stated under point I.

III. Purposes and grounds of processing
We process your data for one or several of the purposes listed below:

1. in order to sign a commercial contract based on your interest in our offer (pursuant to point b of Article 6(1) of the General Data Protection Regulation);
2. in order to perform the contract you signed with us and based on that contract (pursuant to point b of Article 6(1) of the General Data Protection Regulation);
3. for analytical purposes in order to optimize the service processes based on the course of sale and after-sales service processes, including complaints, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);
4. for archiving (evidence) purposes to secure information in case it is necessary for legal reasons to prove facts, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);
5. in order to establish, exercise or defend against any claim, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);
6. in order to survey customer satisfaction and determine the quality of our services, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);
7. for marketing purposes when organizing business and promotion meetings for our company, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);
8. in order to assess the financial standing and/or payment morality, which is our legitimate interest (pursuant to point f of Article 6(1) of the General Data Protection Regulation);

IV. Data recipient
We may disclose your personal data to the following categories of entities:

1. subcontractors, which are entities we use when processing the data:  IT services providers, claims adjusters,
2. other independent recipients: hotels if booking accommodation, restaurants, marketing agencies if drafting a list of guests, an insurer providing coverage for our receivables in order to secure payment of the price for the goods sold.

V. Data transfer to third countries and international organisations
We do not transfer your data outside the territory of the European Economic Area.

VI. Data storage period

1. Your data we acquired in order to sign a commercial contract will be stored for the duration of the contract negotiation and until the end of the calendar year following the year in which you last contacted us about signing the contract.
2. Your data we acquired in connection with the commercial contract signed will be processed until the end of the period of limitation for any claims under the contract.
3. Your basic contact data will be stored for purpose of direct marketing of our products and services until you object to such processing for direct marketing purposes, withdraw your consent, if the data have been processed under the so-called marketing consent, or if we establish ourselves that the data are out of date.
4. Your payment morality data will be stored for a reasonable period necessary for the assessment of the payment morality, but not longer than for 30 years.

VII. Your rights:

1. The right of access to your data and the right to obtain a copy of the data.
2. The right to rectification (correction) of your data.
3. The right to erasure of the data:
   If you believe there are no grounds for us to process your data, you may request we erase the data.
4. The right to restriction of processing of the data:
   You may request we restrict the processing of your personal data only to data storage or performance of any activities agreed with you, if you believe your personal data we have are incorrect or if we process the same without reason; or you do not want us to erase the data, because you need them to establish, exercise or defend any claims; or for the duration of your objection to personal data processing.
5. The right to object to personal data processing:
   A “marketing” objection. You have the right to object to any processing of your data for direct marketing purposes (provided we conduct any direct marketing in your case). If you use this right, we will refrain from data processing for such purposes.
   An objection on grounds relating to your particular situation. You also have the right to object to any processing of your data on grounds of legitimate interest. In such case, you should specify the particular situation to us which in your opinion is the reason why we should stop the processing covered by the objection. We will no longer process your data for such purposes, unless we demonstrate that the grounds on which we process your data override your rights or that your data are necessary for us to establish, exercise or defend any claim.
6. The right to data portability:
   You have the right to obtain from us, in a structured, commonly used and machine-readable format (e.g. ".csv" format) the personal data concerning you, which you provided to us under a contract or based on your consent. You may also have the data transmitted by us directly to another entity.
7. The right to lodge a complaint with a supervisory authority:
   If you believe we process your data unlawfully, you may lodge a complaint about it to the President of the Personal Data Protection Office or other competent supervisory authority.
8. The right to withdraw consent to personal data processing:
   You have the right to withdraw consent to personal data processing at any time with regard to the data we process based on your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In order to use your rights contact our Data Protection Officer as specified under point II.
Remember, before you exercise your rights we will have to identify you properly to make sure that you are who you claim to be.

VIII. Notice on the grounds on which personal data are provided
The data are provided freely, but it is necessary to provide them in order to sign a contract.
If you do not provide your data, we will not be able to sign a contract to provide our services or perform the offer.