In connection with the processing of your personal data, we provide this information in accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “General Data Protection Regulation” or “GDPR”).

I. Controller of personal data

The Controller of your personal data is NODER P.S.A., with its registered office in Kraków. You may contact the Controller:

• in writing, at: ul. Olszańska 5H, 31-513 Kraków;
• by email: ;
• by telephone: +48 12 393 58 00.

II. Data Protection Officer

The Controller has appointed a Data Protection Officer.

You may contact the Data Protection Officer:

• by email: ;
• in writing, at the Controller’s registered office: ul. Olszańska 5H, 31-513 Kraków.

III. Purposes and legal bases for processing personal data

Your personal data may be processed for the following purposes:

1. Taking steps prior to entering into a contract and entering into and performing a contract

Data will be processed for the purpose of:

• taking steps at your request prior to entering into a contract;
• entering into and performing a contract;
• communicating with you in matters related to the contract;
• ensuring the proper performance of services.

The legal basis for processing is Article 6(1)(b) GDPR where you are a party to the contract or request that steps be taken prior to entering into it.

If the data provided concern a contact person designated by the customer who is not a party to the contract, the legal basis for processing is Article 6(1)(f) GDPR. The Controller’s legitimate interest is to ensure proper communication and performance of the contract.

2. Settlements and payment processing

Data will be processed for the purpose of:

• settling accounts for services;
• issuing and retaining accounting documents;
• processing payments;
• clarifying discrepancies or disputes concerning payments.

The legal basis for processing is:

• Article 6(1)(b) GDPR – to the extent that processing is necessary for the performance of the contract;
• Article 6(1)(c) GDPR – to the extent that processing is necessary for compliance with legal obligations imposed on the Controller;
• Article 6(1)(f) GDPR – in connection with pursuing or defending claims related to settlements.

3. Performance of legal obligations

Data will be processed for the purpose of performing obligations arising from legal provisions, in particular tax, accounting and record-retention obligations.

The legal basis for processing is Article 6(1)(c) GDPR.

4. Establishment, pursuit or defence of claims

Data will be processed for the purpose of establishing, pursuing or defending claims, including in judicial, administrative or out-of-court proceedings.

The legal basis for processing is Article 6(1)(f) GDPR. The Controller’s legitimate interest is the protection of its rights and interests and the possibility of establishing, pursuing or defending claims.

5. Sending commercial information

If you give separate consent, your data may be processed for the purpose of sending commercial information concerning products or services offered by the Controller.

The legal basis for processing is Article 6(1)(a) GDPR, namely your consent.

You may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Withdrawal of consent also does not affect the possibility of processing data on other legal bases where such bases apply.

In the context of electronic communications, commercial information will be sent exclusively in the manner and on the terms specified in the applicable laws.

IV. Categories of data processed

The Controller may process, in particular:

• identification data;
• contact data, such as an email address and telephone number;
• data concerning the customer’s representation or business contact;
• data concerning the contract entered into and the services provided;
• data concerning settlements and payments;
• data contained in correspondence conducted with the Controller;
• data necessary for establishing, pursuing or defending claims.

The Controller processes only data that are adequate, relevant and limited to what is necessary for the fulfilment of the specified purposes.

V. Is the provision of data mandatory?

The provision of personal data is voluntary; however, the provision of data necessary for:

• taking steps prior to entering into a contract;
• entering into or performing a contract;
• providing services;
• conducting correspondence;
• issuing accounting documents;

may be necessary to achieve the relevant purpose.

Refusal to provide data necessary for entering into or performing a contract may make it impossible to take steps at your request, enter into a contract, provide services or conduct correspondence.

The provision of data necessary to issue an invoice may be required under tax law.

The provision of data for the purpose of receiving commercial information is voluntary. Refusal to provide such data or withdrawal of consent does not affect the possibility of entering into or performing a contract.

VI. Recipients of personal data

Your personal data may be disclosed to the following categories of recipients:

• public authorities and other entities authorised to receive data under legal provisions;
• banks and payment service providers where this is necessary to process or settle payments;
• providers of IT and telecommunications services;
• entities providing the Controller with accounting, legal, advisory or archiving services;
• entities providing debt-collection services where this is necessary to pursue receivables;
• other entities processing data on behalf of the Controller, acting under a contract and exclusively in accordance with the Controller’s documented instructions;
• the Controller’s business partners where disclosure of the data is necessary to fulfil a specific purpose and takes place on an appropriate legal basis.

If a business partner processes data for its own purposes, it will act as a separate Controller. If it processes data exclusively on behalf of and on the documented instructions of the Controller, it will act as a processor.

Data may also be disclosed to tax authorities, inspection authorities and other public authorities where the obligation to disclose it arises from legal provisions.

VII. Retention period

Personal data will be retained for no longer than is necessary to fulfil the purposes for which they were collected, taking into account the Controller’s legal obligations and the possibility of establishing, pursuing or defending claims.

In particular:

• data processed for the purpose of entering into and performing a contract will be retained for the duration of the contract and subsequently for the period necessary to settle the cooperation;
• documents and data required under tax or accounting regulations will be retained for the period resulting from the relevant legal provisions, as a rule for 5 years calculated from the end of the calendar year in which the tax payment deadline expired;
• data processed for the purpose of establishing, pursuing or defending claims will be retained until the expiry of the applicable limitation period for the claims;
• if proceedings are initiated, data will be retained until their final conclusion and until the expiry of the limitation period for claims related to those proceedings;
• data processed on the basis of consent will be retained until the consent is withdrawn, unless further retention is justified by another legal basis.

After the specified periods have expired, the data will be deleted or anonymised, unless further retention is required or permitted under legal provisions.

VIII. Rights of the data subject

In connection with the processing of personal data, you have, under the terms and in the cases specified in the GDPR, the right to:

• access your personal data and obtain a copy thereof;
• rectification of inaccurate data;
• completion of incomplete data;
• erasure of data;
• restriction of processing;
• data portability where the conditions specified in the GDPR are met;
• object to processing of data based on Article 6(1)(e) or (f) GDPR;
• withdraw your consent at any time where processing is based on consent;
• not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, where such processing takes place.

A request concerning the exercise of your rights may be sent:

• by email to: ;
• by post to: ul. Olszańska 5H, 31-513 Kraków.

Before fulfilling a request, the Controller may take steps to verify the identity of the person submitting the request where this is necessary to protect personal data.

IX. Right to lodge a complaint

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office, as the supervisory authority.

The right to lodge a complaint does not exclude other legal remedies available under legal provisions.

X. Automated decision-making and profiling

Your personal data will not be used to make decisions based solely on automated processing, including profiling.

XI. Transfers of data outside the European Economic Area

Your personal data will not be transferred to countries outside the European Economic Area or to international organisations.

If such a transfer takes place in the future, the Controller will inform you of it and ensure that the appropriate safeguards required by the GDPR are applied.