Dear Sir or Madam,
We would like to inform you that on May 25, 2018, the new general data protection regulation, GDPR, came into force. It covers all the Member States of the European Union.
We make every effort to adapt our operations to the new legal requirements. All this in order to guarantee you the highest level of personal data security and to inform you about the processing of personal data, access to it, and other rights which are guaranteed by the regulation. As the administrator of your personal data, we operate according to the highest standards of data processing.
We will keep you informed on any changes to our services and documentation which may, in any way, affect you and your data.
Your data was made available to us by your Employer in connection with joining the Polish Council of Shopping Centres Association.
The administrator, i.e. The entity deciding how your personal data will be used, is the Polish Council of Shopping Centres Association with its registered office in Warsaw at ul. Nowogrodzka 50, 00-695 Warsaw, entered in the Register of associations and other social and professional organizations, foundations and public health care facilities of the National Court Register, kept by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under number 0000227312 (hereinafter "PRCH" or "Administrator").
The purpose and basis for processing:
We process your personal data for the purpose of marketing, related to the transmission to you of commercial and marketing information from the administrator and its partner, in connection with promotions and other forms of marketing actions carried out for the user. The basis for processing your personal data is your consent to the processing of personal data (Article 6(1)(a) of the GDPR) for the purpose of sending you direct marketing messages.
How to contact us for more information on how we process your personal data?
Data retention period:
Your personal data may be disclosed in the course of processing to the following categories of recipients: employees authorised by us, associates of our company, entities to whom we have entrusted the processing of your personal data for the purpose of providing services, and authorised persons employed at these entities.
Transfers of data to third countries or international organisations:
Processed personal data will not be transferred to recipients located in countries outside the European Economic Area (European Union countries, Iceland, Liechtenstein and Norway).
Rights of the data subject
We assure that all persons whose personal data are processed by us are entitled to appropriate rights resulting from GDPR, i.e.:
1. The right of access to personal data, including the right to obtain a copy of such data;
2. The right to demand the rectification (correction) of personal data in case the data are incorrect or incomplete;
3. The right to request the deletion of personal data (the so-called "right to be forgotten") where (i) the data are no longer necessary for the purposes for which they were collected or otherwise processed, (ii) the data subject has objected to the processing of personal data, (iii) the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for the processing, (iv) the data are unlawfully processed, (v) the data must be erased in order to fulfil an obligation under the provisions of the law;
4. The right to demand that the processing of personal data be restricted where: (i) the data subject questions the correctness of the personal data, (ii) the data processing is unlawful and the data subject objects to the erasure of the data, requesting their restriction instead, (iii) the administrator no longer needs the data for his or her own purposes but the data subject needs them for establishing, defending or pursuing a claim, (iv) the data subject has objected to the processing until it has been established that the administrator's legitimate interests override the ground for objection;
5. The right to transfer personal data where: (i) processing is carried out pursuant to a contract concluded with or with the consent of the data subject, and (ii) the processing is carried out by automated means;
To the extent that you have given us your consent for the processing of your personal data, you have the right to withdraw your consent for the processing of your personal data. The withdrawal of consent does not affect the legality of data processing which was carried out on the basis of the expressed consent before its withdrawal.
The right to lodge a complaint with a supervisory authority
In the event that you consider that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the relevant supervisory authority.
Information on voluntariness:
Your company has provided us with your personal data for the purpose of the proper implementation of the agreement between us. The transfer of your personal data to us is based on your obligations under a contract of employment or cooperation between you and your employer.
Profiling and automated decision making:
Your personal data will not be used for profiling or for making automated decisions concerning you.
Information on the data source:
Your data was made available to us by your employer in connection with the conclusion of a contract with us.
Categories of your data that we can process:
Name, e-mail address, profession and employment, telephone number, mailing address of your company, image (if you have provided us with your profile image).