Newsletter

Fulfilling the obligations imposed by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in relation to the
relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“RODO“), the Joint Administrators provide the following information on the principles of processing of your personal data by the Joint Administrators, including the purposes of the processing, the legal basis for the processing, the storage period, the recipients of the personal data, as well as your rights in relation to the processing.

1. RESPONSIBILITIES OF THE JOINT CONTROLLERS
As part of the co-Management agreement between the Joint Controllers, the Joint Controllers have agreed on their respective responsibilities regarding the fulfilment of their obligations under the RODO, including in particular that:

• with regard to the fulfilment of the obligation to provide information to Data Subjects pursuant to the provisions of Articles 12 to 14 of the RODO, the Joint Controller who collects Personal Data or initiates the collection of Personal Data is responsible;
  – with regard to the fulfilment of the rights of Personal Data Subjects as set out in Article 7(3) and Articles 15-22 of the RODO, i.e. withdrawal of consent, exercise of the right of access to Personal Data, rectification, erasure, restriction of processing, portability of Personal Data, objection to the processing of Personal Data, the Joint Controller who received the request is responsible;
• with regard to the fulfilment by the Joint Controllers of their obligations concerning the management of personal data breaches, their notification to the supervisory authority (Art. 33 RODO) and to the personal data subject (Art. 34 RODO), the Joint Controller who first became aware of the breach shall be competent; in the event of simultaneous information about the breach, the Joint Controller on whose side the breach occurred shall be competent;
• if, on the basis of the above rules, it cannot be determined which Co-Administrator is responsible for fulfilling the obligations set out in these paragraphs, GWW Legal is responsible.

Notwithstanding the above arrangements, the data subject may exercise his or her rights under the RODO against any of the Joint Controllers.

2. CONTACT DETAILS

The Joint Controllers have designated a single point of contact for all requests and enquiries concerning the personal data they process:

• when contacted by post, by sending a letter to: Personal Data Coordinator: 4 Książęca Street, 00-498, Warsaw, marked “Personal Data”,
• in case of contact by e-mail, by sending an e-mail to: odo@gww.pl.

3. PURPOSE OF PERSONAL DATA PROCESSING AND LEGAL BASIS
In connection with signing up for the GWW Newsletter your personal data will be processed by the Joint Administrators:

• for the purpose of implementing the GWW Newsletter Service Terms and Conditions, including the provision of the GWW Newsletter service (legal basis from Article 6(1)(b) RODO);
• for purposes resulting from the legally justified interests pursued by the Joint Administrators or third parties (legal basis from Article 6(1)(f) RODO), which are: establishment, investigation or defence against claims; implementation of internal procedures (e.g. concerning protection of personal data, prevention of abuse);
• for other purposes on the basis of your separately given consent (legal basis in Article 6(1)(a) RODO).

The provision of personal data is voluntary however necessary for the purpose of providing the GWW Newsletter.

4. RECIPIENTS OF PERSONAL DATA
The Joint Administrators share personal data with other entities (recipients of personal data) only if they have a legal basis for doing so. If the Joint Administrators transfer personal data to recipients located outside the European Union or the European Economic Area (EEA), this is only done if an adequate level of data protection has been confirmed for that third country by the European Commission or an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses).

Your personal data may be made available to public authorities or other entities entitled to such access on the basis of the law.

Recipients of your personal data may also be: entities providing ICT services to the Joint Administrators, entities providing IT/technical/service support services, suppliers of software used by the Joint Administrators and other entities cooperating with the Joint Administrators in connection with the service provided to you.

The processing of personal data in ICT systems, may result in the transfer of such data to the servers of software and IT service providers, in connection with the Co-Administrators’ use of the services/software that the aforementioned providers provide. Some of these servers are located in the United States. The transfer of data to the United States is carried out using the so-called standard contractual clauses referred to above. You are entitled to obtain a copy of this personal data.

5. RETENTION PERIOD OF PERSONAL DATA
The Joint Administrators shall not keep your personal data longer than necessary to fulfil the purposes for which the data were collected.

Your personal data obtained in connection with the conclusion and execution of the agreement concerning the GWW Newsletter service (GWW Newsletter Service Regulations) will be processed for the period of subscription to the GWW Newsletter, while your personal data processed for the purpose of realization of legally justified interests realized by the Joint Administrators or third parties will be processed until the purpose of processing ceases or you raise an effective objection.

Personal data processed on the basis of your consent will be processed until the purpose of the processing ceases or your consent is withdrawn (whichever is earlier).

6. INFORMATION ON AUTOMATED DECISION-MAKING, INCLUDING PROFILING
Your personal data will not be processed in a purely automated manner (including profiling) which may produce legal effects against you or similarly significantly affect you.

7. RIGHTS OF PERSONAL DATA SUBJECTS
To the extent and in the cases stipulated by law, in particular the RODO, you have the right to obtain from the Joint Administrators information about the processing of your personal data and to obtain a copy of the processed data (right of access to the data), the right to request the rectification (amendment) of your data, the right to request the erasure of your personal data, the right to restrict the processing of your personal data, the right to data portability, as well as the right to withdraw your consent (if the processing of your personal data is carried out on the basis of your consent).
You also have the right to object to the processing of your personal data based, inter alia, on the Joint Administrators’ legitimate interests, including profiling, in which case the Joint Administrators will cease processing your data for these purposes unless you demonstrate the existence of compelling legitimate grounds for processing that override your interests, rights and freedoms or grounds for establishing, asserting or defending claims.

If the Joint Administrators process your personal data for direct marketing purposes, you have the right to object to the processing of personal data concerning you for such marketing, including profiling, to the extent that the processing is related to such direct marketing. The exercise of this right means that the Joint Controllers will not process your personal data for such purposes.

The Joint Controllers will exercise the above rights in accordance with the provisions of the RODO and other relevant legislation. To exercise your rights or to obtain further information regarding your rights, please contact the Joint Controllers (contact details are indicated in section 2).

8. RIGHT TO COMPLAIN
If you consider that the processing of your personal data by the Joint Administrators violates the provisions of the RODO or other generally applicable data protection legislation, you may lodge a complaint with the President of the Data Protection Authority.