1. The Data Controller of your personal data is Marshal Lion Group Sp. z o.o. with its registered seat in Warsaw, ul. L. Narbutta 30, 02-541 Warsaw, entered into the Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, under the KRS number 0000750861, REGON 381416403, NIP 7010868821, with a share capital of PLN 200,000.00 (paid up in full), as defined by the GDPR, i.e. the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
2. The Data Controller will collect and process your personal data within the scope indicated in the online contact us form.
3.Your personal data will be processed by the Data Controller only pursuant to voluntary consent, in accordance with Article 6(1)(a) of the GDPR, to be able to provide the best service on the Internet, as well as to the extent and in order to:
a) perform the Contract for the provision of electronic services (online contact us form), hereinafter referred to as the “Contract”, in accordance with Article 6(1)(b) of the GDPR;
b) conduct direct marketing, including profiling by adapting the Data Controller’s products and services to your needs, to implement the legitimate interest of the Data Controller in accordance with Article 6(1)(f) of the GDPR;
c)send commercial information by electronic means in the form of e-mail and use the provided e-mail address and phone number to conduct direct marketing via e-mail and telephone, i.e. to implement the legitimate interest of the Data Controller in accordance with Article 6(1)(f) of the GDPR;
d) fulfil the Data Controller’s legal obligations to maintain compliance with the Polish law, in accordance with Article 6(1)(c) of the GDPR;
e) for analytical or statistical purposes – the legal grounds for processing is the legitimate interest of the Data Controller in accordance with Article 6(1)(f) of the GDPR, consisting in the use of financial and sales analyses for internal reporting and determining the optimal development directions for the Data Controller;
f) conduct satisfaction surveys concerning the provision of services – because the processing of personal data for this purpose is necessary to implement the legitimate interest of the Data Controller in accordance with Article 6(1)(f) , which is conducting satisfaction surveys regarding the services provided by the Data Controller;
g) determine, investigate or defend against claims related to the provision of services or the processing of personal data – the processing of data is necessary to implement the legitimate interest of the Data Controller in accordance with Article 6(1)(f) of the GDPR, which consists in being able to establish, investigate or defend against claims.
4. Your data will be processed in an automated manner, including in the form of profiling. Profiling will involve offering you a product or service best suited to your needs, however no decision binding for you and/or the Data Controller will be taken in an automated manner.
5. The following entities may be recipients of your personal data:
a) entities authorized to receive them pursuant to applicable laws, e.g. tax authorities and other authorized government administration authorities and self-government units, as well as judicial authorities and other authorized institutions (e.g. financial supervision authorities, insurance companies in the scope of claims settlement),
b) public officials, e.g. notary public, court enforcement officer, receiver, probation officer,
c) entities authorized to receive them pursuant to separate documents, e.g. contracts, such as subcontractors and external entities providing services to the Data Controller, such as: correspondence and parcel delivery, including also postal service providers and currier companies, printing and archiving, IT and telecommunication services, accounting and tax, legal, brokerage and claim settlement services, debt collection and security, advisory, audit and control services.
6. The Data Controller will share your personal data with the entities indicated in section 5 above, only if it is necessary to perform the obligations and rights of the Data Controller resulting, inter alia, from applicable legal regulations.
7. Providing personal data is voluntary, however the failure to provide necessary data will prevent the Data Controller from performing activities requested by you.
8. Your personal data will be processed for the period necessary to achieve the purpose of processing, i.e. in the scope of:
a) performing the Contract – until termination of the Contract, performance of all the obligations arising from the Contract by both parties, including until the completion of complaint proceedings or until you submit an objection;
b) conducting direct marketing, including related profiling by adapting products and services to your needs – until you submit an objection;
c) sending commercial information in an electronic form by e-mail and using the e-mail address and telephone number provided to conduct direct marketing via e-mail and telephone – until you submit an objection;
d) fulfilling legal obligations of the Data Controller – until the expiry of the obligations to process data resulting from the provisions of law or until you submit an objection;
e) analytical or statistical – until a summary of the analytical or statistical research has been drafted or until you submit an objection;
f) conducting surveys of satisfaction with the services provided – until you submit an objection;
g) establishing, investigating or defending against claims – until the time when the claims related to the provision of services under the Contract or claims related to the processing of personal data are time-barred, or until you submit an objection.
9. The Data Controller represents that in order to protect personal data, they apply security measures that meet the requirements of applicable law, including the requirements set out in the GDPR.
10. The Data Controller represents that they will not share, sell, rent or disclose your personal data in a different way than described in this paragraph, unless such obligation will result from the applicable legal regulations.
11. Due to the fact that your personal data may be transmitted via e-mail, the Data Controller informs about a possible intention to transfer personal data to a third country (outside the European Economic Area – EEA) in a situation where the e-mail server is located outside the European Union.
12. In case of processing your data outside of the EEA, the Data Controller will secure cross-border data processing using appropriate security measures.
13. The Data Controller agrees to:
a) protect your personal data through the use of appropriate technical and organizational measures ensuring an adequate level of security corresponding to the risks associated with the processing of your personal data mentioned under Articles 32-36 of the GDPR;
b) exercise due diligence in the processing of the entrusted personal data. 14. The Data Controller will document any personal data breaches, including the circumstances of a personal data breach, its effects and the remedial actions taken to counter any further violations.
14. Administrator będzie dokumentował wszelkie naruszenia ochrony danych osobowych, w tym okoliczności naruszenia ochrony danych osobowych, jego skutki oraz podjęte działania zaradcze mające na celu przeciwdziałanie ewentualnym dalszym naruszeniom.
15. The Data Controller agrees to inform you about any personal data protection breach, if the personal data protection breach could cause a risk of violating their rights and/or freedoms.
16. After withdrawing consent to the processing of personal data or after you have filed an objection, the Data Controller undertakes to remove or return all personal data entrusted to them without retaining any copies. This obligation does not apply to copies of documents covered by proceedings pending before law enforcement and judicial authorities and will not apply if the generally applicable provisions of law impose on the Data Controller an obligation to further process such personal data.
17. You have the right to:
a) access and rectify your data,
b) request us to delete your data or limit their processing,
c) transfer your data,
d) submit an objection against personal data processing,
e) withdraw your consent at any time, without affecting the lawfulness of the processing (based on the consent granted) carried out prior to the withdrawal.
f) lodge a complaint with the President of the Office for Personal Data Protection (address: ul. Stawki 2, 00-193 Warsaw).