Personal data protection policy (RODO)

We want to provide you with detailed information on personal data protection policy: how we collect your personal information, for what purposes and how we use it, who we are and what your rights are.

This policy serves to provide you with the information referred to in art. 13 para. 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (general data protection), hereinafter referred to as “RODO”, which has been in force since May 25, 2018. The information provided below is very important, therefore we ask you to carefully read their content.

Who is the Administrator of your data and contact details:

The administrator, that is the entity deciding how your personal data will be used, is CSI INVEST Sp. z o.o., entered into the Register of Entrepreneurs kept by the District Court in Bydgoszcz, 13th Commercial Department of the National Court Register under the number KRS 0000733474, NIP number 5542966090, REGON number 380308404.

You can contact us:

• Lists to the following address: CSI INVEST Sp. z o.o., ul. Berberysowa 11, 86-005 BIALE BLOTA

• By e-mail, to the following address: csi@csi-invest.pl

Personal data inspector and his contact details:

We have established the Personal Data Protection Inspector, which you can contact with any question or request in all matters relating to personal data. You can do it:

• By mail, to the following address: CSI INVEST Sp. z o.o., ul. Berberysowa 11, 86-005 BIALE BLOTA

• By e-mail, to the following address: csi@csi-invest.pl

Details on the use of your data, the rights and conditions of using them are also available at www.csi-invest.pl.

For what purpose and on what basis do we use your personal data?

We use your personal information obtained during the conclusion of the contract and during its term for the following purposes:

1. Conclusion and execution of the contract that connects us – (legal basis: Article 6 paragraph 1 b) GDPR, e.g.:

• as part of the contract,

• handling complaints,

• providing a guarantee,

• performance of product valuations,

• ensuring the correct quality of services,

• handling requests directed to us,

• handling your inquiries, which are addressed to us in connection with the implementation of the contract.

2. Implementation of the obligation necessary to fulfill the legal obligation imposed on the administrator (legal basis: art6, paragraph 1 c), the GDPR, e.g.:

• transfer of data at the request of the court, police.

3. Implementation of our so-called legitimate interests (legal basis: Article 6 (1) (f) GDRP, e.g.:

• providing services for payment services,

• handling your inquiries which are sent to us in connection with the performance of the contract,

• debt collection: conducting court, arbitration and mediation proceedings,

• storage of data for archival purposes (compliance with our obligations under the law),

• detection and prevention of fraud,

• verification of payment credibility.

Do you need to provide us with your personal details?

Providing personal data by you is fully voluntary. We require you to provide the data necessary to enter into and perform the contract in connection with each transaction. If we do not provide us with the necessary personal data, unfortunately we will not be able to conclude an agreement with you and, as a consequence, start cooperation. If it is required by law, we may require you to provide other necessary data, e.g. for tax reasons.

Who can we transfer your data to?

1. Our employees and associates who must have access to the data to be able to fulfill our obligations.

2. Entities processing data on our behalf, participating in the performance of our activities:

a. other intermediaries in the sale of our services,

b. servicing our ICT systems or providing teleinformation tools to us,

c. subcontractors who support us in carrying out the contract that connects us with you, e.g. in handling correspondence,

d. entities that provide us with consulting, consulting, auditing, legal, tax and accounting assistance.

3. Other data controllers that process data on their own behalf:

a. to cooperating entities,

b. entities operating postal or courier,

c. entities purchasing receivables,

d. entities conducting payment activity (banks, payment institutions),

e. entities cooperating with us in servicing accounting, tax and legal matters – to the extent they become data controllers.

4. State authorities, e.g. courts, the prosecutor’s office, tax authorities.

How long can we store your data?

In transactions related to the performance of the contract for the period of their implementation and the time in which it is possible to pursue claims in connection with the performance of the contract concluded as a result of the transaction, from the date of these transactions or until the judgment becomes legally valid.

Due to the implementation of the law, your personal data will be stored for periods specified in the tax, e.g.

In the period in which we may incur legal consequences of non-performance, we will store your personal information for this period.

What are your rights?

You have the following rights related to the processing of your data by us:

• the right to access your personal data, including the right to information about your personal data and to obtain a copy of your personal data,

• the right to rectify personal data if it is incorrect and the right to supplement incomplete data,

• the right to delete personal data,

• the right to limit the processing of personal data,

• the right to transfer personal data,

• the right to lodge a complaint with the data protection authority, ie the President of the Office for Personal Data Protection (address: Stawki 2, 00-193 Warsaw) in case of illegal processing of your personal data,

• the right to withdraw at any time, any consent, if you give it to us without giving reasons,

• the right to object to:

• we process your data for marketing purposes, if you give us such permission in the future, including the so-called profiling
• we process your personal data for purposes arising from the so-called legitimate interests we have pursued – for reasons related to your particular situation.

You can implement your rights listed above at any time with the appropriate request. With the requests described above, you can apply to our Personal Data Inspector in accordance with the contact information provided.

We have an obligation to provide you with information about the actions taken in connection with the requests, without undue delay, and in any case within one month of receipt of the request.

If necessary, the deadline referred to above can be extended by another two months due to the complexity of the request or the number of requests. Within one month of receiving your request, however, we must inform you about the extension of the deadline together with the reasons for it.

If we do not take action in relation to your requests, we will inform you immediately, no later than one month after receiving your request, of the reasons for not taking action and the possibility of lodging a complaint to the President of the Office for Personal Data Protection and taking legal protection before the Court.

We will provide you with the information referred to above in writing, at our option:

• by registered mail to the mailing address provided by you or

• electronically to the e-mail address provided by you.

All communications and actions taken by us in connection with your requests referred to above are free of charge. However, if your requests are clearly unjustified or excessive, e.g. due to the constant nature, we will be able to:

• to charge a reasonable fee, taking into account the administrative costs of providing information, communication or taking the action requested, or

• refuse to take action in connection with the request.

We will notify you of rectifying or supplementing or deleting or limiting the processing of your personal data that we have made in the execution of your request, each recipient to whom we have disclosed it. We will not have to provide such information only when it turns out to be impossible (eg liquidation of the Company) or it will require a disproportionately large effort (the data was revealed many years ago and despite attempts made it was impossible to contact the recipient). At your request, we will inform you of the recipients to whom we have provided information about rectification or removal or limitation of your personal data processing, as well as about recipients we have not been able to notify.

Your personal data will not be transferred to a third country or an international organization.

Your personal data will not be subject to profiling or automated decision making.