Dear Sir/Madame,

Due to the fact that Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: the GDPR) took effect on 25 May 2018 and it is our desire to remain fully transparent, below you can find the information how your personal data are collected by the enterprise Group “Baltona” and how they will be processed in accordance with applicable statutory regulations and implementing provisions.

Below you can find general principles on which enterprise Group “Baltona” (hereinafter: the Personal Data Controller) processes personal data. The specific purpose and lawful grounds for the processing are always provided in a separate information clause addressed to the data subjects. If any of the following entries seem unclear to you or raises doubts, please contact the Personal Data Controller using the contact form available on the website: http://www.baltona.pl/kontakt,  by writing to the e-mail address: board.office@baltona.pl or by calling the phone number +48 22 519 20 12.

In matters related to the processing of personal data and the exercise of rights under the Regulation, you may also contact the person established pursuant to art. 37(1) of the Regulation by the Personal Data Controller by the Data Protection Officer, by writing to the e-mail address: rodo@baltona.pl or by calling: +48 694 227 605.

Data Protection Officer based on art. 38(5) of the GDPR is obliged to maintain secrecy or confidentiality as to the implementation of tasks performed – in accordance with the applicable law of the European Union or a Member State.

Personal Data Controller:

Enterprise Group “Baltona”, in particular Przedsiębiorstwo Handlu Zagranicznego “Baltona” S.A.* having its registered office in Warsaw, ul. Komitetu Obrony Robotników 49, 02-146 Warsaw, is your personal data controller.

Contact details:

You can contact your personal data controller via the contact form available at http://www.baltona.pl/kontakt, by calling +48 22 519 20 12 writing to e-mail address: board.office@baltona.pl or by writing to the address of the registered office of the Personal Data Controller.

*Enterprise Group “Baltona”

More information is available at: http://www.baltona.pl/index.php/firma/grupa-baltona/

Below you can find information concerning the purposes of processing and its lawful grounds. Your personal data will be processed in various business situations as well as those connected with the Personal Data Controller’s ongoing business operations. The specific purpose and lawful grounds for the processing are provided in separate information clauses addressed to the data subjects.

Conclusion and performance of a contract and provision of services under a contract.

Data processing is necessary for conclusion and performance of a contract.

Article 6 item 1b) of the GDPR

For the Controller’s marketing purposes, including analytical purposes.

Granted consent and in some cases (e.g. contact in order to acquire consent) also the Personal Data Controller’s legitimate interest (e.g. for a better choice of services for the needs of the customers, overall optimization of our products, optimization of service processes, building knowledge about our customers, financial analyses of the enterprise Group “Baltona”, etc.).

Article 6 item 1 a and f) of the GDPR

For the Controller’s marketing purposes, including third-party analytical purposes, including the purposes of the Controller’s partners.

Granted consent. If consent was not granted, personal data are not processed for those purposes.

Article 6 item 1 a) of the GDPR

Pursuing or defending claims, pursuing claims connected with the contract concluded with you or the services provided.

Personal data processing is necessary for the purposes of legitimate interests pursued by the Personal Data Controller; The Controller’s legitimate interest is its option to pursue or defend claims.

Article 6 item 1 f) of the GDPR

For evidence (archival) purposes connected the legal need to prove facts.

Personal data processing is necessary for the purposes of legitimate interests pursued by the Personal Data Controller; The possibility of a legal need to prove facts is the Controller’s legitimate interest.

Article 6 item 1 f) of the GDPR

For the purposes of customer satisfaction polls.

Personal data processing is necessary for the purposes of legitimate interests pursued by the Personal Data Controller; Collecting surveys from natural persons who agreed to provide answers is the Controller’s legitimate interest.

Article 6 item 1 f) of the GDPR

In order to fulfill the legal obligations incumbent on the Personal Data Controller.

Personal data processing is necessary (e.g. in connection with the fulfillment of tasks resulting from the status of a public company/issuer; issuing and storing VAT invoices, as well as other accounting documents; HR and payroll services for the enterprise Group “Baltona” employees) to perform obligations arising directly from applicable law.

Article 6 item 1 c) of the GDPR

In order to fulfill the information obligation towards proxies and persons representing contractors.

The necessity of the processing in connection with the performance of a contract or taking steps prior to entering into a contract; implementation of professional cooperation related to the subject of the contract; possible determination, investigation or defense of claims.

Article 6 item 1 b, c and f) of the GDPR

• • Information clause – contractors

Dear Sir/Madame,

Regardless of the lawful grounds on which we process your personal data, they will be stored until claims under the contract/provision of services are time-barred or until expiration of our obligation to store the data under applicable regulations of the law, in particular the obligation to store bookkeeping documents concerning the contract.

Your personal data processing based on the Personal Data Controller’s legitimate interests will be executed for the specific purpose until you object to such processing.

If personal data are processed on the basis of your consent, you have the right to revoke it anytime. If you do so, your personal data will be processed only until such revocation.

Your personal data can be shared:

·         public authorities and entities performing public tasks or acting on behalf of public authorities, in the scope and purposes arising directly from the provisions of national and EU law,

·         subsidiaries from the enterprise Group “Baltona”,

·         to our business partners under relevant agreements signed with the Personal Data Controller, i.e. companies with whom we cooperate (e.g. presenting, describing and combining their products or services) for the purposes referred to above (for marketing purposes, if they express You agree to specific marketing purposes for which personal data must be provided).

Moreover, your personal data can be shared with our subcontractors (processors), e.g. law firms, IT services providers, marketing agencies or courier firms, however such entities shall process them under personal data processing agreements, solely upon instruction from the Personal Data Controller.

You have the right to access your personal data, demand their rectification, erasure or restriction of processing. You can object against the processing of personal data if the personal data processing is carried out on the basis of the Controller’s legitimate interest. In particular, you have the right to object to data processing for the purposes of direct marketing, including for analytical purposes.

If your personal data are processed on the basis of your consent, you have the right to revoke it. However, withdrawal of consent does not affect legality of any processing done on the basis of the consent before its withdrawal.

In the scope in which your personal data are processed for the purposes of conclusion and execution of contract/provision of services or under voluntary consent, you also have the right to data portability. If you want to exercise that right, you will receive your personal data in a structured, commonly used and machine-readable format. You can send the personal data which you received to another data controller.

If you decide that the processing violations the General Data Protection Regulation, you also have the right to complain with the President of the Data Protection Office, ul. Stawki 2, 00-193.

Your rights (except for the right to lodge a complaint) can be exercised by submitting relevant applications/statements to the Personal Data Controller or Data Protection Officer, using the contact details indicated in the content of this information.

Your personal data is not transferred to third countries outside (i.e. countries not belonging to the European Economic Area) or to any international organization.