What data do we mean?

Personal data is information about an identified or identifiable natural person. This primarily involves data which identifies you, including your name, contact details such as telephone number, email address and postal address, depending on which channel you use to contact us or we use to contact you.

Personal Data Controller

KRUK S.A. with its registered office in Wrocław (51-116), ul. Wołowska 8, is the controller of your personal data. 

You may address your query to any of the above-mentioned Controllers by sending it to KRUK S.A., ul. Wołowska 8, 51-116 Wrocław, or to the e-mail address info@kruksa.pl.

Data Protection Officer

We have appointed a Data Protection Officer whom you may reach for all matters concerning the processing of your personal data and your rights in this regard. You may write to him at the following address: Data Protection Officer, KRUK S.A. ul. Wołowska 8, 51-116 Wrocław, or contact by e-mail: dpo@kruksa.pl. 

Why and on what basis do we process your personal data?

Depending on the context of your contact with us, your personal data may be processed by us, for example, on the basis of:

• Article 6(1)(f) GDPR and the Controller's legitimate interest to contact our Customer. Sometimes we have old, outdated or inaccurate contact details for our customers and we contact you without being aware of this. It may also happen that our customer gives us your telephone number or postal address as a contact for him. 
• Article 6(1)(f) GDPR in order to conduct correspondence and handle inquiries or settle the matter to which this correspondence relates and in order to possibly establish or pursue claims or defend against claims based on the legitimate interest of the administrator consisting in conducting correspondence and settling reported matters.
• Article 6(1)(c) GDPR in order to fulfil a legal obligation of the Controller. This happens if you have contacted us with a query or a request under Article 15 et seq. GDPR. We are then obliged to provide you with information and we process your personal data for this purpose. 

How long do we keep your personal data?

The duration of the Controller's processing of your personal data depends on the purpose of the processing. In the case of enquiries or complaints and requests pursuant to Article 15 et seq. GDPR, this period is subject to the limitation period for claims under the general regulations and the limitation period for breaches of the GDPR provisions. If you are contacted by mistake, your personal data will be deleted as soon as possible and we will process them possibly in the form of a blacklist to avoid repeated contact. Your data will be processed for the period of correspondence and settlement of the matter to which it relates.

To whom may we pass your personal data?

Your data may be passed on to entities that we will need to involve in handling your enquiry or request, for example. Therefore, your data may be transferred to our IT, ICT and cloud service providers.

Do you have to give us your personal information?

Your provision of personal data is voluntary. Insofar as the processing of your personal data is carried out for the purpose of deletion in our database, failure to do so will result in your person not being identifiable and thus in the fulfilment of your request under Article 15 et seq. GDPR or your complaint. In order to conduct correspondence, providing personal data is required. Failure to provide personal data required by the Administrator will result in the inability to conduct correspondence and settle the matter.

From whom may we receive your data?

In principle, we receive your data directly from you as a result of you contacting us. In some situations, we obtain your personal data in ways other than directly from you, e.g. the customer has provided your contact details as a contact for himself, our customer has concluded a contract with a mobile phone operator for a number you use, the customer has provided your home address as his own, the customer has provided your address as the delivery address for the goods. 

Profiling and automated decision making

Please be informed that in the course of our activities your data will be processed by automated means, including profiling. We do not make automated decisions in relation to you. 

Transfer of your personal data outside the European Economic Area (EEA)

We use suppliers and partners outside the EEA and it is therefore possible to transfer personal data to countries outside the EEA. Such transfer of personal data may take place on the basis of a decision stating the appropriate level of protection or subject to appropriate safeguards, Art. 45, 46 GDPR.  Information on the EU Commission's adequacy decisions is available here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

What rights do you have in relation to your data and how can you exercise them?

In our business, we ensure that you can exercise your rights under the GDPR. 

Under the GDPR you have the right to:

• Receive information about our processing of your personal data and a copy of it.  
• Transfer the personal data provided by you in connection with the conclusion of a contract or processed by us on the basis of your consent. 
• Object to the processing of your personal data (request to stop processing your personal data), in particular on grounds relating to your particular situation. Exercising the right to object generally prevents the processing of your data. Please note, however, that this effect will not occur where we demonstrate that there are valid, legitimate grounds for their processing overriding the grounds for objection, or we demonstrate that there are grounds for establishing, asserting or defending our claims that we have against you.

You can also request: 

• Correction of your data if we have incorrect data, e.g. outdated or incomplete data.
• Erasure of your data ("right to be forgotten") when: the data are no longer necessary for the purposes for which they were collected or otherwise processed; the data will be unlawfully processed; the obligation to erase your data arises from the provisions of the law; you object to the processing of your data; you withdraw your consent to the processing of your data.
• Restriction of the processing of your personal data, i.e. mark your stored personal data to limit future processing, where: you question the accuracy of your personal data - for a period of time to allow us to check the accuracy of the data; the processing is unlawful but you do not want it deleted; you no longer need the data but need it to defend or assert your claims; you object to the processing of your data - until it is determined whether the legitimate grounds for processing override the reasons for the objection. 

Please note that, in accordance with the GDPR, we will not delete your personal data to the extent that its processing is necessary for us to establish, assert or defend our claims, e.g. a request for payment of a debt, or we have a legal obligation to process it, e.g. an obligation to keep accounting documents. If, on the other hand, we restrict the processing of your data at your request, we will still be able to process your data to establish, assert or defend our claims. 

Where your consent is the basis for the processing of your personal data, you may withdraw it at any time. However, this will not affect the lawfulness of the Company's use of your data prior to the withdrawal of such consent.

If you wish to exercise the above rights, you may submit a request to us by: 

•    e-mail to: info@kruksa.pl
•    telephone by calling: 800 700 020
•    post to the following address: KRUK S.A., ul. Wołowska 8, 51-116 Wrocław
•    in person, when contacting our advisor or at KRUK S.A.'s registered office in Wrocław at ul. Wołowska 8.

You also have the right to lodge a complaint with the data protection supervisory authority, i.e. the President of the Office for Personal Data Protection.