GDPR information notice

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), we hereby inform you that:

1. Personal data controller
   The controller of your personal data is IHAS Sp. z o.o., with its registered office at ul. Wandy 16Ł, 40-322 Katowice (hereinafter: Company).
2. Purposes and legal basis for processing
   Your personal data are processed for commercial and marketing purposes related to the Company’s business activities, in particular in connection with the Company’s own products and services, on the basis of Article 6(1)(a), (b), (c) and (f) of the GDPR.
3. Recipients of data
   Your personal data may be disclosed solely to authorised entities, in accordance with applicable legal provisions and GDPR rules governing the entrustment of personal data processing.
4. Data retention period
   Your personal data will be processed for as long as necessary to fulfil the purposes referred to in item 2, namely:
   (a) for the duration of the granted consent – until it is withdrawn,
   (b) for the performance of a concluded contract – until its completion,
   (c) for the period required by law (including tax and accounting regulations),
   (d) for the duration of the Company’s legitimate interests, including marketing activities, and until the expiry of limitation periods for potential claims.
5. Rights of the data subject
   You have the right to:
   – access your personal data,
   – rectification, erasure or restriction of processing,
   – data portability,
   – object to the processing of personal data.
6. Right to lodge a complaint
   You have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of your personal data infringes the GDPR.
7. Profiling
   Your personal data are not subject to profiling or automated decision-making producing legal effects.
8. Contact regarding personal data
   The controller has not appointed a Data Protection Officer. If you have questions regarding the processing of personal data, please contact us at info@ihas.com.pl or in writing at the correspondence address indicated in item 1.
9. Transfer of data outside the EEA
   Your personal data are not transferred outside Poland, the European Union or the European Economic Area (EEA).
   If a transfer outside the EEA becomes necessary—only to the extent permitted by law—data will be transferred exclusively to countries ensuring an adequate level of personal data protection. You will be informed of such a transfer by email or telephone.
10. Transfer to a third country without an adequacy decision
    If it becomes necessary to transfer data to a third country not recognised by the European Commission as providing an adequate level of protection, the Company will obtain your explicit consent and inform you of the associated potential risks, in accordance with Article 49(1)(a) of the GDPR.
11. Voluntary provision of data
    Providing personal data is voluntary; however, failure to provide such data may prevent the conclusion or performance of a contract or order within the scope of the Company’s activities. You have the right to withdraw any consent granted for the processing of personal data. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.