The following notice provides a concise, clear and transparent summary of the information contained in our Privacy Policy regarding the data controller, the purposes and methods of processing personal data, and your rights in relation to such processing. It is intended to fulfil the information obligations under the General Data Protection Regulation (GDPR). Further details about data processing and the entities involved are available in the Privacy Policy.
Who is the data controller?
The controller of personal data (hereinafter referred to as the “Controller”) is Atlantis Hero Sp. z o.o., operating at Obrzeżna 5, 02-691 Warsaw, Poland, registered under Tax Identification Number (NIP): 5214134887 and National Court Register (KRS) number: 0001196771. The company provides electronic services through this website.
How can you contact the data controller?
You can contact the Controller using any of the following methods:
- Postal address: Atlantis Hero Sp. z o.o., Obrzeżna 5, 02-691 Warsaw, Poland
- Email: rejestracja@smartchoice.pl
- Telephone: +48 573 588 392
- Contact form: available at https://smartchoice.pl/en/contact/
Has the Controller appointed a Data Protection Officer?
Pursuant to Article 37 of the GDPR, the Controller has not appointed a Data Protection Officer (DPO).
For matters relating to data processing, including personal data, please contact the Controller directly.
Where do we obtain personal data, and what are its sources?
Personal data is obtained from the following source:
- Directly from the individuals to whom the data relates.
What categories of personal data do we process?
This website processes the following categories of data:
- Non-sensitive personal data, voluntarily provided by the individuals concerned, such as first and last name, login details, email address, telephone number and IP address.
- Sensitive personal data, voluntarily provided by the individuals concerned.
The detailed scope of the personal data processed is set out in the Privacy Policy.
For what purposes do we process personal data?
Personal data voluntarily provided by users is processed for one or more of the following purposes:
- Providing electronic services.
- Enabling the Controller to communicate with users about matters relating to the website and data protection.
- Pursuing the Controller’s legitimate interests.
What are the legal bases for processing personal data?
The website collects and processes users’ personal data on the basis of:
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — GDPR), in particular:
- Article 6(1)(a): the data subject has given consent to the processing of their personal data for one or more specific purposes.
- Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
- Article 6(1)(d): processing is necessary to protect the vital interests of the data subject or of another natural person.
- Article 6(1)(f): processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party.
- The Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2018, item 1000).
- The Polish Telecommunications Law of 16 July 2004 (Journal of Laws of 2004, No. 171, item 1800).
- The Polish Act of 4 February 1994 on Copyright and Related Rights (Journal of Laws of 1994, No. 24, item 83).
What legitimate interests does the Controller pursue?
The Controller’s legitimate interests include:
- Establishing, pursuing or defending legal claims, in order to protect the Controller’s rights, pursuant to Article 6(1)(f) of the GDPR.
- Assessing the risk associated with potential customers.
- Evaluating planned marketing campaigns.
- Conducting direct marketing.
How long do we retain personal data?
As a general rule, personal data is retained only for as long as the Controller provides the relevant service through the website. The data is deleted or anonymised within 30 days of the service ending, for example, when a user account is deleted or a user unsubscribes from the newsletter.
In exceptional circumstances, the retention period may be extended to protect the Controller’s legitimate interests. In cases involving a breach, or suspected breach, of the website’s terms and conditions by the individual concerned, the data may be retained for up to three years from the date on which the user requests its deletion.
Who receives personal data?
As a general rule, the Controller is the sole recipient of personal data.
However, the processing of personal data may be entrusted to other entities providing services to the Controller to maintain the operation of the website. These may include:
- Hosting providers and providers of related services.
- IT maintenance and support companies responsible for maintaining the IT infrastructure.
- Online payment service providers, where purchases of goods or services are made through the website.
Will your personal data be transferred outside the European Union?
Personal data will not be transferred outside the European Union, unless it is made publicly available as a result of an individual action by a user, such as posting a comment or entry, in which case the data may be accessible to anyone visiting the website.
Will personal data be used for automated decision-making?
Personal data will not be used for automated decision-making, including profiling.
What rights do you have in relation to the processing of your personal data?
- Right of access
You have the right to obtain access to your personal data by submitting a request to the Controller. - Right to rectification
You have the right to request that the Controller promptly correct inaccurate personal data or complete incomplete personal data. - Right to erasure
You have the right to request that the Controller promptly erase your personal data.
For user accounts, erasure involves anonymising data that could identify the user. Newsletter subscribers can also remove their personal data themselves by using the link provided in each email.
- Right to restriction of processing
You have the right to request restriction of processing in the circumstances specified in Article 18 of the GDPR, including where you contest the accuracy of your personal data. - Right to data portability
You have the right to receive your personal data from the Controller in a structured, commonly used and machine-readable format. - Right to object
You have the right to object to the processing of your personal data in the circumstances specified in Article 21 of the GDPR. - Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority responsible for personal data protection.