Dear Users,

Due to the application of the General Data Protection Regulation (GDPR) (EU) 2016/679 since May 25, 2018, regarding the protection of individuals with regards to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, we are providing you with information regarding personal data.

This document outlines the principles on which personal data of individuals using services on the website located at https://appartme.pl/, functioning as an online store, is protected. The privacy policy describes the type of Personal Data collected from the Service User, the methods of its collection, use, storage, and possible sharing, as well as the rights you have in connection with the processing of personal data.

The Data Controller is committed to protecting the privacy of the Service Users. In this regard, the Data Controller makes every effort to ensure the protection of the personal data provided by the Service User in connection with their use of the Service and making purchases.

We inform you that the Data Controller of your personal data is S-Labs sp. z o.o., located in Krakow, Dworska 1A/1U, 31-358 Kraków, Poland, registered in the National Court Register by the District Court for Kraków – Śródmieście in Krakow, XI Commercial Division of the National Court Register, under KRS number 0000568209, NIP: 9452185706, REGON: 362085817.

OBJECTIVES AND BASIS OF PROCESSING

1. Contact form
   We process the data provided by you in the contact form to handle the notification and respond to the query, based on our legitimate interest (basis from Art. 6 para. 1 lit. f GDPR), which is to communicate with clients and respond to their questions.
2. Contract
   In the case of contact for the purpose of entering into a contract, your data is processed to take actions at your request before concluding a contract, e.g., conducting negotiations or presenting an offer (basis from Art. 6 para. 1 lit. b GDPR). Data will be processed for the period necessary to take action at your request. In the event of not concluding a contract after this period, the data will be deleted. However, in the case of entering into a contract, it will continue to be processed until the execution of the contract and the expiration of claims arising from the contract based on the legitimate interest of the Controller, which is the defense and pursuit of claims (Art. 6 para. 1 lit. b and f GDPR).

If you decide to use the services offered by the Administrator within the Service, the data provided by you will be processed:
a. to conclude and execute the contract under the terms specified in the Service regulations (basis Art. 6 para. 1 lit. b GDPR), and
b. to provide an electronic service, in particular, maintaining a customer account in the store (basis from Art. 6 para. 1 lit. b GDPR),
c. to carry out the complaint process and ensure proper customer service (basis from Art. 6 para. 1 lit. b GDPR),
d. for archival (evidential) purposes to secure information in case of a legal need to demonstrate facts, based on the legitimate interest of the Administrator (basis from Art. 6 para. 1 lit. f GDPR), which is archiving documentation,
e. for direct marketing of own products and services based on the legitimate interest of the Administrator (basis from Art. 6 para. 1 lit. f GDPR), which is direct marketing of own products and services,
f. to tailor the advertising offer to the needs of customers, presentation of ads based on your consent and the legitimate interest of the Administrator (basis from Art. 6 para. 1 lit. a and f GDPR), which is adapting the categories of offers or individual offers based on your activity.

If a contract is concluded with you, the data will be processed for the purpose of its conclusion and execution (including contact in connection with its execution, confirmation of payments) and on its basis (basis from Art. 6 para. 1 lit. b GDPR).

Your data is also processed for the purpose of pursuing or defending against claims, which constitutes the legitimate interest of the Administrator (basis Art. 6 para. 1 lit. f GDPR) based on the pursuit and defense against claims.

3. Commercial information
   If you have given your consent, your personal data will be processed for sending commercial information regarding products and services, promotions, and offers based on your consent and the legitimate interest of the Administrator, which is direct marketing of own products and services (basis from Art. 6 para. 1 lit. a and f GDPR).
4. Conducting traditional correspondence and via e-mail
   If you direct correspondence to the Administrator via email or traditional mail, not related to the provision of services or the performance of another contract, the personal data contained therein are processed to handle the request or the query reported in the correspondence.

The basis for processing in such a case is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR), which is conducting correspondence and handling requests and inquiries in connection with the conducted business activity. Providing personal data necessary to handle the request is mandatory.

5. Telephone contact
   In case of contact by telephone, in matters not related to the provision of services on your behalf or the performance of another contract, personal data provided by you are processed to handle the request or the query reported.

The basis for processing in such a case is the legitimate interest of the Administrator (Art. 6 para. 1 lit. f GDPR), which is handling requests and inquiries in connection with the conducted business activity. The Administrator may require the provision of data necessary to handle the request, in which case providing such data is mandatory to handle the request.

6. Contact of employees of the contractor or client
   In the case when you contact us by telephone or email in connection with a contract concluded with your employer or actions taken at its request before concluding a contract – the data obtained in this way are processed for the execution of the concluded contract and taking actions at its request before concluding a contract (basis from Art. 6 para. 1 lit. b GDPR), and also for pursuing, defending against claims, which constitutes the legitimate interest of the Administrator based on the protection of his rights (basis from Art. 6 para. 1 lit. f GDPR).

If you contact us in a matter other than the concluded contract, your data are processed to answer the asked question or resolve the issue you turn to us with. The basis for processing is the legitimate interest of the Administrator based on providing an answer to the asked question or solving the issue in connection with the conducted business activity (basis from Art. 6 para. 1 lit. f GDPR).

7. Monitoring
   In the case of a visit to the Administrator’s headquarters, the Administrator also processes personal data collected through video surveillance to maintain order, protect property, ensure safety, and detect crimes on the premises of the Administrator’s headquarters. The legal basis is the legitimate interest of the Administrator (basis Art. 6 para. 1 lit. f GDPR), which is to ensure the protection of property, safety, detecting crimes.
8. Other bases for processing
   Your data may also be processed
   a. to fulfill legal obligations incumbent on the Data Controller (basis Art. 6 para. 1 lit. c GDPR, including tax obligations, resulting from the provisions of the Civil Code, GDPR, issuing VAT invoices, handling complaints, fulfilling the information obligation),
   b. for analytical and statistical purposes for examining customer satisfaction, which constitutes the legitimate interest of the Administrator (basis Art. 6 para. 1 lit. f GDPR).

DATA RECIPIENTS

1. Entrusting data processing
   Your personal data may be shared with entities we use in their processing, e.g., accounting, legal, IT companies, companies dealing with document destruction, document archiving, providing access to email, postal operators.

Your personal data may be entrusted to entities we use in their processing, e.g., accounting, legal, IT companies, companies dealing with document destruction, document archiving, providing access to email, postal operators.

Your data will be entrusted to courier companies that handle the delivery of products ordered through the online store.

The Administrator will also share your data when it is necessary due to the obligation incumbent on him.

In the case when you express your willingness to conclude an Agreement for the delivery and installation of the Appartme System, as referred to in the Regulations, your personal data indicated in the Customer Account or in the order form will also be shared with the Developer indicated by you when placing the Order and may also be entrusted for processing to the Developer’s subcontractors – to the extent necessary to verify the Order, conclude and execute the Agreement, as well as mutual settlements between the Administrator and the Developer.

The Administrator may share data stored in cookies with Trusted Partners, in order to better recognize the attractiveness of ads and services for, improve the overall quality and effectiveness of the services provided. Sharing data stored in cookies is dependent on the User’s consent. The recipient of the information stored in cookies is Google Analytics.

2. Transferring data to third countries or international organizations
   The Administrator may entrust the processing of personal data to a third country, i.e., outside the European Economic Area, and send them to external entities cooperating with the Administrator acting on behalf of the Administrator for the purposes described above.

Your personal data will be transferred outside the European Economic Area to Google LLC based in Mountain View, in the United States, in connection with the use of the email system.

The Administrator may also store personal data in a location that is subject to a different jurisdiction than your place of residence or headquarters.

In addition, some of our Trusted Partners may store user data of the service outside the EEA (European Economic Area

).

Transferring data outside the EEA, e.g., to the USA, only occurs when the entity meets an adequate level of data security and protection, e.g., based on the European Commission’s decision of July 12, 2016, known as the Privacy Shield (Privacy Shield). This means that your data may only be transferred to entities that adhere to the principles set by the United States Department of Commerce under the EU-US Privacy Shield Framework programs regulating the collection, use, and storage of personal data appropriately from the member states of the European Union. Such data transfer only occurs when an agreement containing standard contractual clauses requiring a specific level of personal data protection has been concluded with the entity receiving the data.

DATA RETENTION PERIOD

The period for which we may process your personal data depends on the legal basis constituting a legal premise for processing personal data by the Administrator. We will never process personal data for longer than arises from the above legal bases. Accordingly, we inform you that:
a. in the case where the Administrator processes personal data based on consent, the processing period lasts until the moment of withdrawing this consent by you,
b. in the case where the Administrator processes your personal data obtained based on your request for the Administrator to take actions before concluding a contract, the processing period lasts for the time necessary to take actions at your request,
c. in the case where the Administrator processes personal data when it is necessary to perform a contract, the processing period lasts until the possibility of pursuing claims related to the contract by either party ceases,
d. in the case where the Administrator processes personal data based on the legitimate interest of the data controller, the processing period lasts until the cessation of this interest (e.g., the period of limitation of civil law claims) or until the moment the person to whom the data relate objects to such processing – in situations where such objection according to the provisions of law is due,
e. in the case where the Administrator processes personal data because it is necessary due to applicable legal provisions, the periods of data processing for this purpose are determined by these provisions,
f. data registered on video surveillance are processed for a maximum period of 1 week. The above processing periods may be extended for the time necessary to pursue or defend against claims. After this period, personal data will be anonymized or deleted.

YOUR RIGHTS

We inform you that you have the right to:
a. access your data and receive their copy,
b. rectify (correct) your data,
c. delete data.
If you believe that there is no basis for us to process your data, you can request that we delete them.
d. limit data processing
You can request that we limit the processing of your personal data only to storing them or carrying out actions agreed with you, if in your opinion we have incorrect data about you or we process them unjustifiably; or you do not want us to delete them because they are needed by you to establish, pursue or defend claims; or for the duration of your objection to data processing.
e. the right to object to data processing:
“Marketing” objection. You have the right to object to the processing of your data for direct marketing purposes. If you exercise this right – we will stop processing data for this purpose.
Objection due to a special situation. You have the right to object to the processing of your data based on a legitimate interest for purposes other than direct marketing, as well as when processing is necessary for us to perform a task carried out in the public interest or to exercise public authority entrusted to us. You should then indicate to us your special situation, which in your opinion justifies the cessation of the processing covered by the objection. We will stop processing your data for these purposes unless we demonstrate that the grounds for processing your data override your rights or that your data is necessary for us to establish, pursue or defend claims.
f. the right to data portability:
You have the right to receive from us in a structured, commonly used machine-readable format (e.g., “.csv” format) personal data concerning you that you have provided to us based on a contract or your consent. You may also commission us to send this data directly to another entity.
g. the right to lodge a complaint with a supervisory authority
If you believe that we process your data unlawfully, you can file a complaint about this matter with the President of the Personal Data Protection Office.
h. the right to withdraw consent to the processing of personal data
At any time, you have the right to withdraw consent to the processing of those personal data that we process based on your consent. Withdrawal of consent will not affect the lawfulness of processing, which was made based on your consent before its withdrawal.

At any time, you have the right to withdraw consent to the processing of those personal data, which we process based on your consent. Withdrawal of consent will not affect the lawfulness of processing, which was made based on your consent before its withdrawal.

If you believe that we process your data unlawfully, you can file a

complaint about this matter with the President of the Personal Data Protection Office.

If you wish to exercise the above rights, please contact us personally, via traditional mail or email using the following details:
S-Labs sp. z o.o. located in Krakow, Dworska 1A/1U, 31-358 Kraków
email: [email protected]
(from Monday to Friday between 8:00 AM and 4:00 PM)

VOLUNTARY PROVISION OF PERSONAL DATA

Providing data in connection with handling a request and submitted query, presented by telephone, via traditional correspondence or email correspondence, is necessary to handle the question and answer it and to resolve the issue, and their non-provision will result in the inability to send a response or deal with the issue.

When contacting us to ask a question or indicate an issue to be resolved, providing your data enabling us to contact you back is voluntary, but necessary to provide an answer to the question or resolve the presented issue.

Providing data indicated in the contact form as mandatory is necessary to handle the question and answer it, and their non-provision will result in the inability to send a query.

Providing data in connection with the conclusion, realization, and execution of a contract based on the Regulations is voluntary but necessary for the proper realization of the service and execution of the contract. The consequence of not providing these data will be the inability to conclude a contract with the Administrator.

We may also require the provision of your data if it is necessary to fulfill legal obligations incumbent on us. In this case, providing data is mandatory.

Providing data necessary to send commercial information regarding products and services, promotions, and offers is voluntary but necessary to send such information. Their non-provision prevents the sending of commercial information regarding products and services, promotions, and offers.

AUTOMATED DECISION MAKING

The information we collect in connection with the use of our Services may be processed in an automated manner (including in the form of profiling), to the extent necessary for the realization of advertising and marketing services and making decisions about granting you a discount. However, this will not cause any legal effects for you or similarly significantly affect your situation.

We pay special attention to profiling issues and indicate that for profiling purposes: we do not process any specially protected data, we use typical data for this purpose: email address and IP or cookies, we profile to analyze or predict personal preferences and interests of people using our Services or products or services and adjusting the content found in our Services or products to these preferences. We profile for marketing purposes, i.e., adjusting the marketing offer to the above preferences. Profiling also allows us to grant an appropriate discount, the granting and amount of which depend in particular on the collected and processed data concerning your person.

Our Partners may use targeting and profiling, i.e., automated processing of personal data, which involves, among other things, using personal data to analyze or predict personal preferences, interests, location, behavior. The use of profiling process enables our Partners to more detailed personalization of ads presented to you. In this process, our Partners’ Cookies are used, thus such processing requires your consent, which you can withdraw at any time on our site as well as on our Partners’ pages.