Complete GDPR Information: Privacy Policy

This consent complements the short clause provided for the online contact form.

Information Clause for the Service Provided Electronically – Online Contact Form

I. [Data Administrator]

The Controller of the website users’ data is:
Galeria Lagos
(NIP: __________).

Contact the data administrator by:

• traditional mail: [Insert address];
• email: [Insert email address].

II. [Purposes, Legal Bases, and Duration of Data Processing]

1. Responding and Handling Requests
   • The content of correspondence and contact details are processed for the time necessary to address the user’s query, including sending marketing information about selected products or services. Data is retained for no longer than 3 months after the query has been resolved, for archiving purposes, in case it is needed to defend against potential claims.
   • These data are processed to fill in the online contact form for service provided electronically, in accordance with the terms available in the Privacy Policy (Article 6(1)(b) GDPR).
   • For sending marketing communications via electronic means or direct marketing using telecommunication devices, data is processed based on the user’s explicit consent (Article 6(1)(a) in connection with Article 4(11) GDPR), confirmed by completing the relevant field for entering an email address or phone number.
2. Claims
   • If it becomes necessary for the administrator to pursue claims or defend against them, the administrator may process personal data provided in the online contact form until the conclusion of the proceedings and until the statute of limitations expires. The typical statute of limitations is 3 years, according to Article 118 of Polish Civil Code, but may be longer in specific cases outlined by law.
   • These data are processed based on the administrator’s legitimate interest (Article 6(1)(f) GDPR), which involves asserting claims against the user or defending against claims. The administrator’s legitimate interest in such cases overrides the rights and freedoms of the service user.
3. Service Usage Statistics
   • To improve the quality of services, the administrator processes statistical data about the use of the online contact form. This is achieved through cookies or similar technologies. Detailed information on the use of cookies is available in the Cookie Policy.
   • These data are processed under the administrator’s legitimate interest (Article 6(1)(f) GDPR) to facilitate service use and improve the quality and functionality of services. Data processing does not infringe upon users’ rights and freedoms.
   • Data is processed for up to 60 days after receipt. Beyond this period, the administrator may process only anonymized statistical data without identifying individual users.

III. [Recipients of User Data]

Personal data provided in the online contact form is disclosed exclusively to entities processing the data on behalf of the administrator under a written data processing agreement. These entities provide services such as hosting, website management, IT support, marketing, and PR services.

IV. [Rights of Data Subjects]

Every individual whose data is processed has the right to:

1. Access: Obtain confirmation from the administrator as to whether their personal data is being processed. If data is processed, the individual is entitled to access it and receive information on processing purposes, categories of personal data, recipients, storage periods, and their rights, including the right to object (Article 15 GDPR).
2. Obtain a Copy: Receive a copy of their processed data. The first copy is free of charge, while subsequent copies may incur a reasonable fee (Article 15(3) GDPR).
3. Rectification: Request correction of inaccurate personal data or completion of incomplete data (Article 16 GDPR).
4. Erasure: Request the deletion of personal data if the administrator no longer has a legal basis for processing it or if the data is no longer necessary (Article 17 GDPR).
5. Restriction of Processing: Request restriction of data processing (Article 18 GDPR) in cases such as:
   • Contesting the accuracy of data – for a period allowing the administrator to verify it.
   • Processing is unlawful, but the individual opposes data deletion and requests its restricted use.
   • The administrator no longer needs the data, but the individual requires it for claims or defense.
   • Objection to processing – pending verification of whether the administrator’s legitimate grounds override the user’s.
6. Data Portability: Receive their personal data in a structured, commonly used, machine-readable format or request its transfer to another data controller if processing is based on consent or a contract (Article 20 GDPR).
7. Object to Processing: Object to the processing of their personal data for legitimate purposes due to their specific situation, including profiling (Article 21 GDPR). If the objection is justified, the administrator will cease processing the data.
8. Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, individuals should contact the administrator using the provided contact details and specify the right and scope they wish to exercise.

V. [Personal Data Protection Authority]

Individuals may file a complaint with the supervisory authority in Poland:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych):

• Address: ul. Stawki 2, 00-193 Warsaw, Poland.
• Website: https://www.uodo.gov.pl/pl/p/kontakt
• Phone: (22) 531 03 00.

VI. [Data Protection Officer]

For any inquiries, individuals may contact the administrator’s Data Protection Officer:

• Email: [Insert email address].
• Traditional mail: With the note “Data Protection Officer.”

VII. [Legal References]

• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• Article 118 and subsequent provisions of the Civil Code (Act of April 23, 1964).

Legal Note:
This Privacy Policy and Information Clause comply with current legal standards. For inquiries, please contact the Rationis Legal Office via email at rationis@op.pl or visit kancelariaprawna.pila.pl.