INFORMATION ON THE PROTECTION AND PROCESSING OF PERSONAL DATA

Under Article. Thirteen sec. 1, point 2, art. 14 subsection 1 and 3 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Journal UE L 119, p. 1) — hereinafter GDPR — we would like to inform you that:

1. The administrator of your personal data is:
   Ośrodek Wczasowy Dąbrówka 58-540 Karpacz, Słowackiego 2, NIP: 611 000
    6113 e-mail address: 
   dabrowka@wp.pltel +48 787619426
2. Purposes and grounds for processing your personal data:
   Your personal data will be processed for the purpose of:
   1. performance of the contract concluded with the Administrator, as well as taking action at your request before its conclusion, in particular answering inquiries regarding the services provided (basis: art. 6, section (of a law) 1 letter b of the GDPR),
   1. fulfillment of legal obligations incumbent on the Administrator, in particular those resulting from the Accounting Act – in order to fulfill reporting and accounting obligations (basis: art. 6, section (of a law) 1 letter c of the GDPR).
   1. resulting from the legitimate interests of the Administrator: conducting direct marketing of goods and to establish, defend and pursue claims (basis: art. 6, section (of a law) 1 lit. f GDPR), in other cases, your personal data will be processed only on the basis of previously granted consent for the purpose and scope resulting from the content of this consent.
3. Information on obtaining your personal data:
    The administrator receives your contact details directly from you (e.g., when using our services) or through other persons (e.g., other intermediaries in offering our services to whom you / The Lord shared your data). In the case of direct contact, you have full control over the scope of data made available to the Administrator. When data provide by another person, the Administrator usually collects only basic contact data, including name, surname, e-mail address, telephone number and possibly other data resulting from the contract or order in connection with which the personal data provides.
4. Information about the recipients of personal data:
   The recipients of your personal data may be the Administrator’s subcontractors, entities providing the Administrator with accounting, IT, advertising, marketing, auditing, consulting, legal, transport, and courier services.
5. The period for which the data will be stored:
    Your personal data will be processed for the period necessary to perform the contract, as well as for the period in which claims related to this contract may disclose and for the period required by applicable law in connection with the necessity to perform our tax obligations.
6. Information about your rights:
   You have the right to:
   1. request accession to your personal data (including obtaining a copy),
   2. the right to request rectification / correction of personal data if the data is incorrect or incomplete,
   3. request the deletion of your personal data (“the right to be forgotten”) if one of the following circumstances occurs:
      1. the date is not necessary for the purposes for which it was collected or otherwise processed,
      2. the data subject withdraws consent on which the processing base and where there is no other legal ground for the processing,
      3. The data subject has objected to the processing,
      4. data processes unlawfully,
      5. data must be deleted in order to fulfill the bond, resulting from legal provisions,
   4. request to limit the processing of your personal data if one of the following circumstances occurs:
      1. the data subject questions the correctness of personal data,
      2. the processing of data is unlawful, and the data subject opposes the deletion of data, requesting instead to limit their use,
      3. The administrator no longer needs the data for his purposes, but the data subject needs them to establish, defend or pursue claims,
      4. the data subject has objected to the processing of data until it is determined whether the legitimate grounds on the part of the Administrator override the grounds of objection;
   5. to transfer your personal data if:
      1. processing takes place on the basis of the consent of the data subject or on the basis of a contract concluded with such a person,
      2. the processing carries out by automated means.
   6. to object to the processing of your personal data, if:
      1. there are reasons related to your particular situation,
      2. the data is processed on the basis of art. 6, section (of a law)One f, i.e., necessity for purposes resulting from the legitimate interests pursued by
         
          the administrator, which was made on its basis before the withdrawal.
   7. Information on the right to lodge a complaint with the supervisory authority:
      You have the right to lodge a complaint with the supervisory authority (i.e. to the President of the Personal Data Protection Office) if, in your opinion, the processing of personal data violates the provisions of the GDPR.
   8. Information whether providing data is a statutory/contractual requirement /
      a condition for concluding a contract / a bond to provide data:
      Providing data is voluntary, however, failure to provide your data will be an obstacle to concluding a contract and providing you with the service.
   9. Transferring data to a third country (i.e., outside the European Economic Area) / international organization:
      Your personal data will not be transferred to a third country (i.e., outside the European Economic Area) or an international organization.
   10. Information on automated decision-making:
        Your personal data is not subject to automated decision-making, including profiling.