1. Data controller
The controller of your personal data is Grupa Znatury spółka z ograniczoną odpowiedzialnością, with its registered office at al. Wojciecha Korfantego 138A, 40-156 Katowice, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000347353, tax identification number (NIP) 2220872890, statistical number (REGON) 241472991 (the "Controller").
Velesan is a brand owned by the Controller.
Contact for data protection matters: contact@velesan.com.
The Controller has not appointed a Data Protection Officer. For all matters concerning the processing of personal data, please use the contact address above.
2. Scope of data collected
This website does not contain forms that collect personal data. We process personal data only in the following situations:
a) Email correspondence. If you write to us at the address shown on the website, we process the data contained in your message: email address, name, contact details, the name of the entity you represent, and any other information you choose to include.
b) Server logs. The server hosting this website automatically records technical data: IP address, date and time of the request, browser and operating system type, and referring page. This data is used to ensure the security and correct operation of the website.
3. Purposes and legal bases of processing
- Handling correspondence and responding to enquiries
- Art. 6(1)(f) GDPR — legitimate interest of the Controller in communicating with those who contact it
- Taking steps prior to entering into a contract and performing a contract
- Art. 6(1)(b) GDPR — where the contact is aimed at concluding or performing a contract
- Ensuring the security and correct operation of the website
- Art. 6(1)(f) GDPR — legitimate interest of the Controller
- Compliance with legal obligations, including tax and accounting obligations
- Art. 6(1)(c) GDPR
- Establishing, exercising or defending legal claims
- Art. 6(1)(f) GDPR — legitimate interest of the Controller
4. Retention periods
Email correspondence — for as long as necessary to handle the matter, and thereafter for the limitation period applicable to potential claims, and no longer than 3 years from the last contact.
Server logs — for 12 months.
Data processed in connection with a concluded contract — for the term of the contract and for the period required by accounting and tax legislation.
5. Recipients of data
Data may be disclosed to the following categories of recipients, only to the extent necessary for the purposes set out above:
- providers of hosting and IT infrastructure maintenance services,
- providers of email services and office software,
- providers of IT systems supporting correspondence and customer relationship management,
- providers of legal, accounting and advisory services to the Controller,
- public authorities — only in cases provided for by law.
Data processing agreements are in place with entities processing data on the Controller's behalf.
6. Transfers outside the European Economic Area
As a result of using providers whose infrastructure may be located outside the European Economic Area, personal data may be transferred to third countries. Any such transfer takes place solely under the safeguards provided for in Chapter V GDPR, in particular on the basis of an adequacy decision of the European Commission or Standard Contractual Clauses approved by the European Commission. A copy of the safeguards applied is available on request from the Controller.
8. Your rights
Subject to the conditions set out in the GDPR, you have the following rights:
- access your data and obtain a copy of it,
- rectify your data,
- erase your data,
- restrict processing,
- data portability,
- object to processing based on the Controller's legitimate interest,
- lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland.
To exercise these rights, please contact the Controller at the address given in section 1.
9. Voluntary nature of providing data
Providing personal data is voluntary. However, failure to provide the data necessary to respond will make it impossible for us to handle your enquiry.
10. Automated decision-making
Personal data is not used for automated decision-making, including profiling.
11. Changes to this policy
The Controller reserves the right to amend this privacy policy. The current version is always available on the website, together with the date of the last update.