Information notice — Facebook page

On 25 May 2018 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (known as the “GDPR” or the “General Data Protection Regulation”), came into force. We would therefore like to inform you about the processing of your data and the rules under which it takes place.

Your personal data provided on the Facebook page will be processed in order to administer the page, communicate with you, interact with you, direct marketing content to you and build the page's community.

This concerns your personal data such as your first name, surname or general information that you make public on your profile. The processing of other personal data is carried out by the Facebook social network on the terms set out in its regulations.

The controller of your data is P.P.H.U. BIX Beata Misztal, Rybitwy 10/4, 88-170 Pakość, Poland, tax ID (NIP) 556-207-50-69, tel. +48 510 050 908, e-mail: kontakt@sunrise-sarbinowo.pl.

Your personal data will be processed in order to:

present you with content related to our company's activities on the basis of your consent (Art. 6(1)(a) GDPR);

send you an offer on the basis of consent (Art. 6(1)(a) GDPR); you have the right to withdraw your consent at any time, but withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;

offer our products and services directly (direct marketing), including tailoring them to your needs, i.e. profiling, which is the pursuit of our legitimate interest (Art. 6(1)(f) GDPR);

directly offer products and services of companies cooperating with us (our partners), including tailoring them to your needs, i.e. profiling, which is the pursuit of our and our partners' legitimate interest (Art. 6(1)(f) GDPR).

Your personal data will be stored for the period required by law, in particular for the period indicated in tax and accounting regulations and regulations on counteracting money laundering and terrorist financing.

Data is disclosed to external entities only within the limits permitted by law.

User data may be transferred outside the European Union — to third countries. Because the Controller uses external providers of various services, e.g. Facebook and its subsidiaries, Google, Microsoft, Apple etc., user data may be transferred to the United States of America (USA) in connection with its storage on US servers (in whole or in part). Google and Facebook apply the compliance mechanisms provided for by the GDPR (e.g. certifications) or standard contractual clauses in relation to their services.

Data will be transferred only to recipients who guarantee the highest protection and security of data, including by: a) cooperating with processors in countries for which an appropriate European Commission adequacy decision has been issued; b) applying standard contractual clauses issued by the European Commission (as is the case, for example, with Google); c) applying binding corporate rules approved by the competent supervisory authority; d) or to those to whom the user has consented to the transfer of personal data.

Detailed information is available in the privacy policies of each of these service providers on their websites, e.g. Apple: apple.com/legal/privacy, Google LLC: policies.google.com/privacy, Meta Platforms Ireland Ltd.: facebook.com/privacy/policy. Currently the services offered by Google and Facebook are mainly provided by entities located in the European Union. However, you should always read the privacy policy of these providers for up-to-date information on data protection.

Personal data is processed in accordance with applicable law: for purpose a) on the basis of Art. 6(1)(a) of the General Data Protection Regulation of 27 April 2016 (the data subject has given consent to the processing of their personal data for one or more specific purposes); for purpose b) on the basis of Art. 6(1)(f) of the General Data Protection Regulation of 27 April 2016 (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child).

In the event of a personal data breach, the competent authorities are notified in accordance with applicable law.

We process your personal data for as long as necessary to achieve the intended purpose or until you withdraw your consent.

To protect your personal data we have implemented a Personal Data Protection Policy compliant with the GDPR, applied in our company according to the following rules and standards.

Rule of adequacy — we process only the data necessary to achieve the given purpose of processing.

Rule of transparency — you should know exactly what happens to your data. This document, in which we try to give you full information about the rules under which we process your personal data, is an expression of that.

Rule of accuracy — we try to keep your personal data in our systems up to date and correct. If you find that in some area your personal data has not been updated by us or is incorrect, please contact us: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl.

Rule of integrity and confidentiality — we apply the necessary measures to protect the confidentiality and integrity of your personal data. We improve them all the time, along with the changing environment and technological progress. The safeguards include physical and technological measures restricting access to your data, as well as appropriate measures protecting against the loss of your data.

Rule of accountability — we want to be able to account for every action we take on personal data, so that at your request we can give you full and reliable information about what we did with your data.

Data protection law gives you a number of rights that you may exercise at any time. As long as you do not abuse these rights (e.g. by unjustified daily requests for information), exercising them is free of charge for you and should be easy.

Right of access to your personal data — you may ask us to export the information we hold about you from our databases and send it to you in one of the commonly used formats.

Right to rectification — if you learn that the data we process is incorrect, you have the right to ask us to correct it and we will be obliged to do so. In that case we may ask you to present a document or other evidence of the change.

Right to restriction of processing — if, despite our compliance with the rule of adequacy, you consider that for a given process we are processing too broad a range of your personal data, you have the right to demand that we limit the scope of processing. As long as your request does not conflict with the requirements imposed on us by applicable law or make it impossible to perform the contract, we will comply.

Right to erasure — also known as the right to be forgotten, this is your right to demand that we delete from our database systems and our documentation all information containing your personal data. Please remember that we will not be able to do so if we are legally obliged to process your data.

Right to data portability — under the General Data Protection Regulation you may ask us to export the data you provided in the course of all our contacts and cooperation to a separate file, for transfer to another data controller.

You may exercise the rights described above by contacting us: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl. You may also contact us at these details whenever any of our actions raises your concern that it may infringe your rights or freedoms.

If you consider that we have in any way breached the rules of processing your personal data, you have the right to lodge a complaint directly with the supervisory authority — the President of the Personal Data Protection Office (UODO). When exercising this right you should give a full description of the situation and indicate which action you consider to infringe your rights or freedoms. The complaint should be lodged directly with the supervisory authority at: ul. Stawki 2, 00-193 Warsaw, Poland.

Right to object — you also have the right to object to the processing of your personal data. You lodge an objection when you do not want us to process your personal data for a specific purpose. In that case we will continue to process your data for other processes (other purposes), but no longer for the purpose you objected to, unless your request conflicts with obligations imposed on us by law. You may lodge an objection at: tel. +48 510 050 908, e-mail kontakt@sunrise-sarbinowo.pl.