INFORMATION ON THE PROCESSING OF PERSONAL DATA
1. The administrator of the personal data provided to us is the entrepreneur Norbert Czarnecki running a business at the following address: Osiedle Oświecenia No. 21, lok. 10, 31-635 Kraków, NIP: 8681189875, (hereinafter referred to as the “Administrator”). In all matters regarding the processing of personal data, you can contact the company in writing or via the e-mail address: info@thaimaliwan.pl
2. Purposes of processing and the legal basis for processing.
a) in order to conclude and perform a massage service contract – the legal basis is the need to process data to take action at the request of the data subject, necessary to conclude and perform the contract in accordance with art. 6 sec. 1 point b) GDPR.
b) in order to fulfill the obligations arising from legal provisions, in particular the Accounting Act – the legal basis for data processing is the necessity of processing to fulfill the legal obligation incumbent on the Administrator in accordance with art. 6 sec. 1 point c) GDPR.
c) for direct marketing purposes – the basis for processing is the voluntary consent to the processing of your personal data within the meaning of art. 6 sec. 1 point a) of the GDPR,
d) monitoring – the legal basis for processing is the protection of your vital interests, as well as the legitimate purpose of the administrator – protection of persons and property.
3. Categories of personal data processed by the Administrator – basic identification, address, contact data and data provided by the Customer to the extent necessary to perform the contract, including information obtained as a result of using websites (IP address, etc.).
4. Data recipients. As regards the performance of the contract by the Administrator, there may be a need to provide data to external entities whose services are used by the Administrator, in particular in the field of electronic payments, payment cards, IT, accounting and legal service providers, while the Administrator uses only the services of processing entities that provide sufficient guarantees of the implementation of appropriate technical and organizational measures so that the processing meets the legal requirements and protects the interest of the data subject. The transfer of data does not take place in every case and not to all the recipients mentioned, but only when it is necessary to achieve a given purpose of personal data processing and only to the extent necessary to achieve it. For this purpose, the Administrator concludes appropriate contracts for entrusting the processing of personal data. Personal data may be made available to public entities authorized to obtain them on the basis of law. Personal data may be made available for marketing purposes if you give your consent. The collected personal data will not be transferred to recipients located in third countries.
5. Personal data will be stored until the claims under the contract are time-barred or until the obligation to store data resulting from legal provisions expires, in particular the obligation to store accounting documents regarding the contract. Where personal data is processed on the basis of a legitimate interest, personal data will not be processed for a specific purpose if you object to such processing. If personal data is processed based on consent, this data will be processed until it is withdrawn. Personal data obtained in connection with the use of monitoring may be processed up to 30 days from recording, and then will be permanently deleted.
6. You have the right to access your personal data, request rectification (correction), deletion, processing restrictions, objection to processing, the right to withdraw consent to the processing of your personal data – to the extent that consent is the basis for processing. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of consent before its withdrawal. You have the right to transfer your personal data – to the extent that they are processed for the purpose of performing the contract or processed on the basis of consent. You have the right to lodge a complaint with the supervisory body dealing with the protection of personal data.
7. Providing personal data in connection with the concluded contract is voluntary, but it may be necessary to conclude and perform the contract – without providing personal data it is not possible, for example, to issue an invoice, determine the place of service, confirm the meeting by telephone, e-mail, etc. Providing data for marketing purposes is always voluntary.
8. The administrator does not make decisions in an automated manner (no profiling).
