Information regarding the processing of personal data
1. The administrator of the personal data provided to us is the entrepreneur Norbert Czarnecki conducting business activity at Osiedle Oświecenia No. 21, loc. 10, 31-635 Kraków, NIP: 8681189875, (hereinafter referred to as the "Administrator"). In all matters relating to the processing of personal data, you may contact us in writing at the company's address or via e-mail: info@thaimaliwan.pl
2. The purposes of processing and the legal basis for processing.
a) to conclude and perform a massage service contract - the legal basis is the need to process data to take action at the request of the data subject, necessary to conclude and perform the contract according to Article. 6 par. 1 point b) GDPR.
b) to fulfil obligations resulting from legal regulations, in particular, the Accounting Act - the legal basis for data processing is the necessity of processing to fulfil the legal obligation imposed on the Administrator according to art. 6 par. 1 point c) GDPR.
c) for direct marketing purposes - the basis for processing is voluntary consent to the processing of your data within the meaning of art. 6 par. 1 point a) GDPR
d) monitoring - the legal basis for processing is the protection of your vital interests as well as the justified purpose of the administrator - protection of persons and property.
3. Categories of personal data processed by the Administrator - basic identification, address, contact details and data provided by the Customer to the extent necessary to perform the contract, including information obtained through the use of websites (IP address, etc.).
4. Data recipients. In the scope of performance of the contract by the Administrator, there may be a need to disclose data to external entities whose services are used by the Administrator, in particular in the field of electronic payments, payment cards, IT, accounting and legal service providers, where the Administrator only uses the services of processors ensuring sufficient guarantees of implementation of appropriate technical and organizational measures so that the processing meets the legal requirements and protects the data subject's interest. The transfer of data does not take place in each case and not to all recipients listed, but only when it is necessary to perform a given purpose of personal data processing and only to the extent necessary to carry it out. For this purpose, the Administrator enters into appropriate contracts for entrusting the processing of personal data. Personal data may be made available to public entities entitled to obtain it based on law. Personal data may be made available for marketing purposes if you agree to it. The collected personal data will not be transferred to recipients located in third countries.
5.Personal data will be kept until the claims under the contract are time-barred or until the obligation to store data resulting from legal provisions expires, in particular, the obligation to keep accounting documents regarding the contract. Where personal data are processed based on an excused interest, personal data will not be processed for a particular purpose if you object to such processing. If personal data are processed based on consent, the data will be processed until it is withdrawn. Personal data obtained in connection with the use of monitoring can be processed up to 30 days after their fixation, and then they will be permanently deleted.
6. You have the right to access your data, requests for rectification (correction), deletion, processing restrictions, objection to processing, the right to withdraw consent to the processing of your data - to the extent that consent is the basis for processing. Withdrawal of consent does not affect the legality of the processing, which was made based on consent before its withdrawal. You have the right to transfer your data - to the extent that they are processed to perform the contract or processed based on consent. You have the right to complain of the supervisory body dealing with the protection of personal data.
7. Providing personal data in connection with the contract is voluntary, but it may be necessary to conclude and perform the contract - without providing personal data, it is not possible to issue an invoice, determine the place of service, confirm the appointment by phone, e-mail etc. Providing data for marketing purposes is always voluntary.
8. The administrator does not make decisions in an automated way (no profiling).