Administrator
From 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC is applicable. (general data protection regulation) ("GDPR"), which grants you a number of new rights related to the processing of your personal data. Below we present the most important rules on which we process your personal data:
1. The administrator of your personal data is BFF Investments Polska Sp. z o.o., address of the registered office: ul. Strzegomska 46-56, 53-611 Wrocław, entered into the Register of Entrepreneurs under the number KRS 0000270469, REGON 020429957, NIP 894-28-88-188, tel. (+48) 71 345 10 35, e-mail address biuro@bff.com.pl, share capital of PLN 50,000, - PLN.
2. In case of questions related to the processing of your personal data and making requests regarding the will to exercise your rights, please contact us at the following e-mail address: rodo@bff.com.pl
3. We take special care to protect the interests of the data subjects, and in particular we ensure that the data we collect are:
a. processed in accordance with the law;
b. collected for specified, legitimate purposes and not subject to further processing incompatible with these purposes;
c. Substantially correct and adequate in relation to the purposes for which they are processed and stored in a form allowing identification of persons they concern, no longer than it is necessary to achieve the purpose of processing.
4. The main activity of BFF Investments Polska Sp. z o.o. is the rental of commercial space. As part of our operations, we process personal data, in particular for the purposes of concluding rental agreements, contracts with contractors and clients, for promotional purposes: marketing and commercial communication (regarding own services and entities cooperating with us), employment of employees and co-workers for the purposes of our company. We process your personal data on the basis of applicable laws, concluded agreements and on the basis of granted consent.
5. The use of our services is voluntary, providing data in connection with the services we provide is necessary in order to conclude a contract, which is necessary if the applicable law (statutory requirement) is the basis. In the situation where the processing of personal data takes place on the basis of consent, the provision of personal data is voluntary.
Your data
6. We collect data directly from the person to whom they relate, except for the situation in which our tenant, contractor, client, entity cooperating with us in order to properly implement the contract and agreed principles of cooperation will appoint persons performing tasks on their behalf (among their employees or colleagues) or our employee will provide details of his family member or other person to fulfill his or her rights.
7. The basics of data processing will depend on the purposes for which data is collected:
1) Conclusion of contracts, ie taking action before the conclusion of the contract, or performance of the contract, to which the person to whom the data pertains to Art. 6 sec. 1 lit. b GDPR, in relation to the data of persons appointed to contact or designated for the implementation of the contract - the basis for processing these data will be a legitimate interest pursued by the administrator or by a third party (ie Article 6 paragraph 1 letter f).
2) Fulfilling the legal obligation incumbent on the Administrator, in particular issuing invoices and accounting and tax documents (6 (1) (c) of the GDPR).
3) On the basis of the legally justified interest of the Administrator, i.e. marketing of own services, investigation or securing of claims, creation of statements, analysis of statistics for our internal needs (Article 6 (1) (f) of the GDPR).
4) On the basis of consent in cases where you voluntarily express your consent, we will be able to process your personal data on this basis, e.g. for the purpose of sending commercial information by email, newsletter, promotional materials regarding our activity and the activities of entities cooperating with us.
5) In terms of e-mail and correspondence using e-mail, and in a traditional way: for this purpose, we process your data based on our legitimate interest and the interest of the sender, i.e. art. 6 par. 1 letter f GDPR, this applies to incidental correspondence consisting in allowing contact with the Administrator. It will also be processed on the basis of art. 6 par. lit b GDPR - indispensability to implement the provisions of the contract concluded with our clients or contractors in the scope of correspondence carried out in order to perform the contract. When you agree to send commercial information via this communication channel, including promotional and commercial information of entities cooperating with us, the basis for data processing will be your consent art. 6 par. 1 liters and GDPR. The basis for the processing will also be your consent in the case of the inclusion of a particular category in the correspondence, in order to be able to store such data in the sent correspondence should be your consent, if you will not be asked to supplement it, the basis for processing will then be Art. 9 par. 2 liters and GDPR (concerns data of a specific category, e.g. in correspondence related to candidates for work or employment).
6) In connection with the employment of our employees, the conclusion of the contract is voluntary, providing the data in order to conclude the contract is necessary for its conclusion. We collect data directly from people you concern. Depending on the form of our cooperation, we rely on the following provisions:
a. Civil Code provisions - civil law contracts, including cooperation agreements - the basis for processing will be a contract or actions to conclude it (Article 6 paragraph 1 letter b) of the GDPR), as well as obligations arising from the law: on accounting, tax law, fulfillment of obligations towards ZUS (Social Insurance Institution) when applicable (Article 6.1 (c) of the GDPR);
b. the provisions of the Labor Code (employment contracts) in the case of recruitment and employment of labor law provisions oblige us to collect data from you according to the catalog listed in the Act of 26 June 1974. The Labor Code, including provisions, among others: Accounting Act , tax law, fulfilling duties to ZUS. The basis for processing will be fulfilling the legal obligation, i.e. art. 6 par. 1 lit. c GDPR in relation to ordinary data, and in relation to the data of a particular category it will be art. 9 (2) b. GDPR, ie processing is necessary to fulfill the obligations and exercise specific rights by the controller or data subject in the field of labor law, social security and social protection;
c. In addition, in connection with employment and applying for employment (both on a civil law contract or contract of employment) in relation to other data, we will process your data with your consent, when you provide us with additional data contained in the application documents, in the course of a contract that connects us (providing data on your initiative), in particular when it is a particular category, we will require your written consent. The basis for processing will be your consent, i.e. art. 6 par. 1 liters and GDPR, in relation to ordinary data and art. 9, 2 liters and GDPR in relation to data of a specific category (by specific category data we mean: data revealing racial or ethnic origin, political views, religious or ideological beliefs, trade union membership and processing of genetic data, biometric data to uniquely identify a natural person or data concerning a person's health, sexuality or sexual orientation).
Rights
8. Rights that you have in relation to the personal data we process:
1) the right to withdraw your consent, that is at any time, you may withdraw your consent to the processing of your personal data by us, if they are processed on the basis of your consent. At the same time, the withdrawal of consent does not affect the lawfulness of the processing which was carried out before that withdrawal;
2) access to personal data, that is, receiving information about what data we process;
3) correcting personal data, if the data is incorrect or incomplete, you may request that it be corrected or supplemented;
4) deletion of personal data ("the right to be forgotten"), you have the right to request the removal of your personal data, in particular if any of the following occurs:
• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• when you withdraw the consent on which the processing is based and there is no other legal ground for processing;
• when you object, for reasons related to your particular situation - in the processing which is based on our legitimate interest and there are no overarching, legitimate grounds for further processing that override your interests, rights and freedoms or are not necessary as a basis for establishing, investigating or defending claims.
• in the case of direct marketing after filing an objection, we will no longer process your data for this purpose;
• when your personal data have been processed unlawfully;
• when your personal data needs to be removed in order to comply with a legal obligation provided for in Union law or in Polish law.
5) the right to object to the processing, you can object at any time to the processing of your data for the purposes of direct marketing. In addition, at any time you may object to the processing of your personal data for reasons related to your particular situation - in the face of processing which is based on our legitimate interest and there are no overriding, legitimate grounds for further processing overriding your interests, rights and freedoms or they are not necessary as a basis for establishing, investigating or defending claims.
6) limiting the processing of personal data (eg stopping operations on data or not deleting data due to certain circumstances). You can use this right if:
• you question the accuracy of your personal data;
• data processing is unlawful and you object to the deletion of data, demanding their limitation instead;
• we no longer need your data for your purposes, but you need them to identify, defend or pursue claims;
• You objected to the processing of your personal data, pending determination of whether the legitimate grounds for processing on our side are overriding the basis of your objection.
7) transfer of personal data, i.e., receiving a copy of the data that you have provided to us and you have the right to send this personal data to another administrator. The right to transfer your data also applies to the possibility of requesting us to transfer this data to another administrator, indicated by you as far as technically feasible. The right to data transfer concerns a situation where the legal basis for processing is the contract or your consent that connects us, and the processing takes place in an automated manner;
8) the right to lodge a complaint to the supervisory body - the President of the Office for Personal Data Protection (address: Office for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw).
9. You are not profiled by us, which means that your data is not processed in an automated way to determine your needs or personality traits. We also do not take automated decisions in individual cases, including those based on profiling.
10. We do not send personal data to a third country within the meaning of the GDPR (outside the borders of the European Economic Area) and are not transferred to international organizations.
11. We declare that the recipients of data may only be entities authorized to receive them on the basis of legal provisions (public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for purposes that result from the provisions of generally applicable law), and trusted recipients who provide services to us, ie our host provider, IT service providers, law firms, personal data protection services (based on relevant agreements). We also agreed on co-administering a joint website and promotional and marketing activities, sending commercial information and sending a joint newsletter (marketing and commercial information of both companies as well as cooperating companies), conducting free trainings within Wrocław Business Parks with DEVCO Sp. z o.o. - for more information, please visit www.wpb.pl/gdpr.
12. The storage period of your data:
1) Your personal data will be stored for a period of time resulting from the purposes of processing, as defined in our retention policy.
2) In connection with the contracts we have concluded for the duration of the contract and the period resulting from the limitation of claims under the contract, as well as for a period resulting from legal provisions, in particular the Accounting Act, tax regulations.
3) Data collected in connection with the implementation of our legitimate interests or interests of a third party will be stored for the time necessary to implement legally justified our interest, in this respect, however, not longer than until considered justified by the specific situation of your objection, in the case of direct marketing pending raise objections (unconditionally).
4) Data collected on the basis of consent will be stored until the consent is withdrawn or until we deem it unnecessary (termination of the purpose of processing).
5) Data related to the employment of employees based on the codec of the Labor Code for the period of employment and for the period provided for in the law on the storage of specific documents, employees (personal files for the period of employment, then for 10 years for archival purposes / employment before January 1, 2019). 50 years). In the case of recruitment, after its completion, we will delete your data unless you agree to its further processing in order to participate in the next recruitment for the period specified in the consent form.
Monitoring
INFORMATION CLAUSE
concerning video monitoring with image registration in the Wrocław Business Park - Bierutowska Park, ul. Bierutowska 57-59, 51-317 Wrocław
in accordance with art. 13 para. 1 and par. 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and the repeal of Directive 95/46 / EC (RODO), we would like to inform you that:
1) The administrator of your personal data coming from video monitoring is BFF Investments Polska spółka z o.o. , ul. Strzegomska 46-56, 53-611 Wrocław NIP 894-28-88-188, Tel: 71 345 10 35 biuro@bff.com.pl, regarding the processing of personal data: email address rodo@bff.com.pl,
2) Your personal data will be processed in order to ensure security and protection of property in buildings and the area around buildings as well as external car parks in the Wrocław Business Park at ul. Bierutowska 57-59, in Wrocław, based on the legitimate interest of the administrator, i.e. art. 6 par. 1 lit. f RODO and employee safety of BFF Investments Polska spółka z o.o. art.22² § 1 of the Act of June 26, 1974 - Labor Code,
3) Your personal data will not be made available to third parties, they may be made available only to authorities authorized under separate law, and also entrusted to processing for IT company that supports monitoring recordings and the company providing facility protection (meeting the requirements set out in Article 28 of the RODO),
4) the data will not be transferred to a third country (outside the European economic area) or an international organization,
5) Your personal data will be registered in electronic form in the form of a video image recorded continuously, (at the entrance to the park with a license plate recognition system) and stored for a period not longer than 14 days, and in the case where the recording it is or may be evidence in proceedings conducted under the law - until the final conclusion of the proceedings,
6) you have the right
• access to recordings in justified cases;
• the right to object to the processing of your personal data, as well as the right to demand their rectification;
• the right to anonymize the image on registered images and / or remove personal data concerning it;
• the right to limit processing;
• the right to submit a complaint to the supervisory body when you feel that the processing of your personal data violates the provisions of the GDPR. The supervisory body is the President of the Office for Personal Data Protection,
7) on the basis of personal data processed in this way, the Personal Data Administrator will not make automated decisions, including decisions resulting from profiling.