GDPR and privacy policy.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation; hereinafter referred to as GDPR), the Controller of your personal data shall be: THALE sp. z o. o. sp.k., Wilimowo 2, 11-041 Olsztyn, Polska hereinafter referred to: the Company.

The Data Protection Officer shall be Mr. Michał Cupiał, who can be contacted via e-mail: iod@niczuk.pl or conventional correspondence to the address above.

1. We process personal data:
1.1. When you use the contact form
By using the forms you agree to the processing of all the information contained therein in order to answer your questions or comments placed in the form. The provision of this data is voluntary and the consent can be withdrawn at any time. The withdrawal of consent does not affect the compatibility with the processing that the Company has carried out before the withdrawal. In this regard, your personal data will be processed until we make contact with you or until you withdraw your consent.

1.2. When we process your orders
When we conclude an agreement with you for the manufacture or delivery of products offered by us, your personal data will be processed for the performance and settlement of the concluded agreement, as well as the organization of the transport of goods. In this case, the provision of the requested personal data is mandatory. Data concerning the concluded agreement and data collected for the purpose of its settlement shall be processed for the period required by law, at least for 5 years, counting from the first day of the year following the year in which the agreement was settled. This period may be prolonged in case of a possible claim by one of the parties to the agreement.

1.3. When we handle lodged complaints
If you lodge a complaint about our products or services, your personal data will be processed for the purpose of handling the complaint. In this case, the provision of the requested personal data is mandatory. Data regarding the lodged complaint will be kept for 1 year after the complaint has been processed. This period may be prolonged in case of a possible claim by one of the parties.

1.4. Conducting video surveillance
Surveillance is conducted in accordance with the provisions of the Labor Code, which is the Company's legitimate interest, and the recordings shall be stored for a maximum of 1 month from the date of recording.

1.5. Organizing or co-organizing industry training courses
In the case of handling your applications for participation in training courses organized by the Company, data processing shall be carried out on the basis of consent to the processing of personal data, while from the moment of confirmation of participation in a given training course, processing shall be carried out in connection with the execution of the agreement the subject of which is the provision of training services. Provision of data is necessary for the aforementioned purposes.

We store data related to the completed training services until the statute of limitations for potential claims and taking into account the periods required by tax regulations. As a rule, this period is 5 years after the year in which the settlement was completed. Whereas, in the case of resignation from the training prior to confirmation of participation, the data shall be stored until the consent to the processing of personal data is withdrawn. The withdrawal can only take place until the Company incurs costs related to the training service provided. Withdrawal of consent shall result in removal of personal data from the list of persons willing to participate in the training.

1.6. Informing about professional training courses
If you consent to receive information about upcoming trainings, we shall process your personal data collected in this manner on the basis of your consent. Both granting consent and providing personal data in this regard are voluntary. The collected data shall be stored until you withdraw your consent.

1.7. Handling correspondence via post or e-mail
When we contact you or respond to your inquiries, via post or e-mail, including in the context of the contracts we execute, we process the personal data contained in the correspondence solely for the purpose of communication, resolution of the matter or execution of the agreement.  
The legal basis for the processing is our legitimate interest, i.e., handling correspondence addressed to the Company in connection with its business activities (Article 6(1)(f) GDPR).  
Provision of data is necessary to enable us to identify persons with whom we are contacting or whose case we are to resolve. We shall process the data for the time necessary to settle the case, but no longer than 6 years from the date of receipt of the last correspondence.

1.8. During telephone contact
In case of telephone contact, we shall ask you to provide personal data when your case necessitates it. The legal basis for the processing is our legitimate interest, which is to be able to identify the person whose case we are handling (Article 6(1)(f) GDPR). Provision of data is necessary for the aforementioned processing purposes. The data shall be stored for the time necessary to handle the case. However, no longer than 6 years.

1.9. Managing our LinkedIn profile
We process your personal data on our LinkedIn profile (URL: https://www.linkedin.com/company/niczuk-eu/), e.g., if you visit our profile and leave comments and posts on it.  
The legal basis for the processing is our legitimate interest, i.e., promoting the Company's activities by informing you about events, services and products, as well as publishing posts on our activities (Article 6(1)(f) GDPR).

Provision of data is necessary for the aforementioned purposes.  
In this case, your personal data may be processed by LinkedIn Ireland Unlimited Company outside the EEA countries. Details of the security measures provided by LinkedIn in this regard can be found at: https://pl.linkedin.com/legal/privacy-policy?_l=pl_PL. LinkedIn ensures that it applies the European Commission-approved Standard Contractual Clauses, which are legal mechanisms for the transfer of data out of the EU. Details can be found at: https://www.linkedin.com/help/linkedin/answer/a1343190?trk=microsites-frontend_legal_privacy-policy&lang=pl . We shall store your personal data for the duration of its publication on our LinkedIn profile.  
Your rights:  
- request access to your personal data as well as rectification and restriction of processing of your personal data,  
- object to data processing.

1.10. Managing our Instagram profile
We process your personal data on our Instagram profile (URL: https://www.instagram.com/niczuk/), e.g., if you visit our profile, follow it and leave likes and comments on it.  
The legal basis for the processing is our legitimate interest, i.e., promoting the Company's activities by informing you about events, services and products, as well as publishing posts on our activities (Article 6(1)(f) GDPR).  

Provision of data is necessary for the aforementioned purposes.  
In this case, your personal data may be processed by META outside of the EEA countries. More details on the security measures provided by Instagram and Facebook in this regard can be found at https://pl-pl.facebook.com/help/instagram/519522125107875/?helpref=uf_share and https://pl-pl.facebook.com/business/gdpr.

1.11. We shall store your personal data for the duration of its publication on our Instagram profile
Requests regarding the exercise of your rights can be submitted:   
- in writing to the address: THALE sp. z o. o. sp. k. (NICZUK brand owner), Wilimowo 2, 11-041 Olsztyn,   
- via e-mail to: iod@niczuk.pl

2. Withdrawal of consent for the processing of personal data
You have the right to withdraw your consent for processing of personal data by sending an e-mail to: iod@niczuk.pl with the following content:

“I hereby withdraw my consent to the processing of personal data regarding my e-mail address (please provide your e-mail address)” or in person at the Company’s registered office. Withdrawal of consent can only be made by the personal data subject. The Company reserves the right to verify the identity of the person withdrawing consent in order to ensure proper exercise of rights.

3. Sharing personal data
Collected personal data may be shared:
with providers of information systems and cooperating entities in order to perform technical activities aimed at ensuring the security of these systems;
entities providing postal services in accordance with the postal law in order to conduct traditional correspondence;
banks in case of the need to make settlements;
entities with which the Company cooperates in order to organize training courses.

Any disclosure of personal data shall be carried out in accordance with applicable law and only when it is necessary for the performance and settlement of services provided, while ensuring the confidentiality of processed personal data.

4. Rights of personal data subject
In connection with the processing carried out, you have the right to request:
access to and rectification of your personal data in accordance with the provisions of the GDPR,
restriction of processing of your personal data,
erasure of your personal data in the case of data processed on the basis of your consent.

You also have the right to lodge a complaint with the President of the Office for the Protection of Personal Data.

5. Transfer of personal data to third countries
The personal data we collect is stored on servers located in the European Union. However, some of the processed data, including data transferred via e-mail, is processed by us using cloud services provided by Microsoft and may therefore be transferred under standard contractual clauses to a third country. The security rules for the transfer of data under the standard contractual clauses and applied by Microsoft are described here: https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?lang=23