Based on which laws are or may your personal data be processed?
The rules concerning the protection of personal data (hereinafter referred to as DP) are laid down, inter alia, in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), the Personal Data Protection Act of 10 May 2018 and special laws (lex specialis) also in the national order.

Who is the personal data controller?
In accordance with Articles 12 and 13 of the GDPR, i.e. the right to be informed, we inform that the Controller of personal data is DECCO S.A. with its registered office in Warsaw, ul. V Poprzeczna 15, 04 – 611 Warsaw, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division under number 0000407150, Regon (Statistical Number): 790753957, NIP (Tax ID): 8442010057.

Contact details for the Data Controller
Please send your questions concerning data protection to rodo@decco.eu.

For what purposes may your personal data be processed?
We would like to inform you that the personal data provided are or may be processed for the following purposes:

• sending commercial information, including marketing information by electronic means or telephone in relation to own products and services, including in the form of Newsletter. The legal basis for the processing of personal data is the consent of the data subject (Article 6 section 1 f of the GDPR) or processing is necessary for the purposes of legitimate interests pursued by the controller (Article 6 section 1 a of the GDPR). A legitimate objective is considered to be a binding agreement or business relationship between the parties,
• sending commercial information, including marketing information by electronic means or telephone in relation to products and services provided by business partners, who are cooperating with the Data Controller. The legal basis for the processing of personal data is the consent of the data subject (Article 6 section 1 a of the GDPR),
• for contact purposes, i.e. in order to provide answers and feedback to your questions concerning matters related to our products or services. The legal basis for the processing of personal data is the consent of the data subject (Article 6 section 1 a of the GDPR) or a legitimate pursued by the controller (Article 6 section 1 f of the GDPR). The legitimate objective is thus considered to be providing the answer your questions,
• for the purposes related to preparing an offer. The legal basis for the processing of personal data is the consent of the data subject (Article 6 section 1 a of the GDPR) or it being an activity aiming at concluding an agreement between the parties (Article 6 section 1 b of the GDPR),
• for the purposes related to the conclusion and performance of the provisions of an agreement and the assertion of claims as a result of the performance of the provisions of an agreement, where the processing is necessary for the conclusion and performance of an agreement to which the data subject is a party or to take action at the request of the data subject prior to the conclusion of the agreement (Article 6 section 1 letter b and c of the GDPR) and the legitimate interest of the controller (Article 6 section 1 letter f of the GDPR), whereby the steps taken to assert claims as a result of the performance of the provisions of an agreement (e.g. debt recovery process) shall be considered as a legitimate interest,
• In order to prepare the requested quotation for the products offered on the website www.decco.eu (HST window calculators and roller shutter calculators), and to provide information and answers to your questions regarding the products and order fulfillment prior to placing an order,
• for recruitment purposes, i.e. in case of receiving a job application. The legal basis for the processing of personal data is the consent of the data subject (Article 6 section 1 a of the GDPR) or the processing being necessary to fulfil a legal obligation incumbent on the controller; (Article 6 section 1 c of the GDPR) – results from the provisions of the law in accordance with the Labor Code and the legitimate interest of the data controller (Article 6 section 1 f of the GDPR), whereby the right resulting from the Labor Code to undertake recruitment activities shall be considered the legitimate interest of the data controller.
  Disclosure, transmission, disclosure of personal data
  Please be advised that your personal data is or may be:
• disclosed (transmitted) to recipients of personal data – ‘recipient’ means any natural or legal person, public authority, entity or any other body to whom personal data are disclosed, whether or not it is a third party – the disclosure is made only under the currently binding legal regulations,
• disclosed (transmitted) to a third party – ‘third party’ means any natural or legal person, public authority, entity or body other than the data subject, the controller, the processor or persons who, under the authority of the controller or the processor, may process personal data. Personal data may be or are entrusted for processing under Article 28 of the GDPR (the controller entrusted processing of personal data – processing entity, also known as the processor). The controller shall cooperate only with the entities that meet the requirements of the GDPR and have implemented appropriate technical and organizational measures to secure the personal data entrusted to them,
• personal data may be disclosed to state authorities under the applicable provisions of law.

Transfer of your personal data to a third country (i.e. outside the EEA)
Please note that personal data is not transferred to a third country. In the case of transfer of personal data outside the European Economic Area, such transfer may take place only under the conditions laid down in Articles 46, 47 or 49 of the GDPR.

How long will your personal data be processed according to the time principle?
Please be advised that:

• in the case of sending commercial information, including marketing information by electronic means or telephone in relation to own products and services, for an indefinite period of time, until the withdrawal of the consent or objection to the processing of data for marketing purposes. We hereby advise bout the right to withdraw the consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent before it is withdrawn,
• in the case of sending commercial information, including marketing information by electronic means or telephone with regard to products and services provided by business partners cooperating with the Data Controller – for an indefinite period of time, until the withdrawal of the consent granted,
• for contact purposes, i.e. in order to provide answers and feedback to your questions concerning matters related to our products or services – for the time necessary to provide comprehensive information,
• for the purposes related to the preparation of the offer – for the period necessary to prepare and present our offer to you and for the period resulting from the currently binding legal regulations,
• for the purposes of concluding and implementing the provisions of the agreement – for the duration of the agreement and for the period resulting from the currently binding legal regulations,
• for the purposes related to the implementation of the provisions of the Regulations – for the period of validity of the Regulations and for the period resulting from the currently binding legal regulations,
• In case of the recruitment process, the period for which personal data will be processed is 3 months from the date of submitting an application.

What rights does the data subject have?
We inform about the right to request the Controller to provide access, rectify, delete or restrict the processing of personal data concerning the data subject, or to submit an objection to the processing, as well as about the right to transfer the data.

Who is the supervisory body?
We inform about the right to lodge a complaint with the supervisory body, i.e. the President of the Office for the Protection of Personal Data with the seat at ul. Stawki 2 in Warsaw, www.uodo.gov.pl (formerly GIODO).

Under what circumstances is the provision of data a requirement and when is it voluntary?
Please be informed that providing personal data is:

• in the case of sending commercial information, including marketing information by electronic means or telephone in respect of own products and services - voluntary. Failure to provide personal data may result in the inability to send commercial information, including marketing information about own products and services by telephone or electronic means,
• in the case of sending commercial information, including marketing information by electronic means or telephone in relation to products and services provided by business partners cooperating with the Data Controller - voluntary. Failure to provide personal data may result in the inability to send commercial and marketing information about products and services provided by business partners cooperating with the Data Controller by telephone or electronic means,
• for contact purposes, i.e. in order to provide answers and feedback to your questions concerning matters related to our products or services - voluntary. Failure to provide personal data will result in the inability to answer your questions,
• for the purposes of preparing an offer - voluntary. Failure to provide personal data will result in the inability to prepare and send an offer,
• for the purposes of concluding and implementing the provisions of the agreement - it is a contractual requirement. Failure to provide personal data will result in the inability to prepare and implement the provisions of the agreement,
• for the purposes of accepting and implementing the provisions of the Regulations - it is a contractual requirement. Failure to provide personal data will result in the inability to prepare and implement the provisions of the Regulations,
• In case of conducting the recruitment process, providing data is statutory (Labor Code) and voluntary. In order to participate in the recruitment process it is necessary to provide personal data concerning: name and surname, date of birth, contact details (telephone number, place of residence), education, course of previous employment and qualifications required for the applicable position. The provision of other data is voluntary.

Information on automated processing, including profiling
Please be advised that:

• when you access the Data Controller's website, you are not subject to automated decision making, including profiling, within the meaning of Article 22 of the GDPR,
• When accessing the Controller's website, a number of tools may be administered, such as cookies, used to monitor website traffic, optimize website navigation and for statistical purposes: Google Analytics tools (profiling information: https://www.google.com/analytics/terms/pl) or social media tools such as Facebook (https://www.facebook.com/about/privacy/cookies),

Cookie policy
Please be advised that: the Cookie Policy is defined by a separate document available on the website. decco.eu

Thank you
DECCO team