Privacy Policy

This document describes the Privacy Policy of EPS Design S.A. with its registered office in Gdańsk (address: ul. Do Studzienki 63, 80-227 Gdańsk), entered into the register of entrepreneurs of the National Court Register, maintained by the District Court of Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register under KRS number: 0000876130, NIP: 9571129737 and REGON: 387885300, hereinafter referred to as the “Company”. Its purpose is to define the principles, method of processing and use of data and information from users of the website administered by the Company, including those contacting the Company through the contact indicated therein, and also contains information on the rights of natural persons in relation to the personal data provided by them. Please read the content of this policy carefully. By accessing or using this site, sending us any personal data or contacting us using the telephone number or email address provided on the Company website, you accept the terms of this Privacy Policy. Please note that by leaving the Company website (e.g. by going to a page on another domain using a link), you are entering an area where this Privacy Policy does not apply. The Company is not responsible for the privacy policies of websites operated by other entities.

The Company is the Administrator of personal data provided by users on the Company’s website: https://epsdesign.pl/
The Company takes special care to ensure that all personal data is processed in accordance with the purpose for which it was collected and used in accordance with the premises and categories of data processed permitted by law.

In all matters related to data protection and the processing of personal data from users of the website administered by the Company, as well as those contacting the Company via the telephone number or e-mail address indicated on the Company’s website, you can contact us via e-mail: biuro@epsdesign.pl or in writing at the Company’s address indicated in point 1.1. of the General Provisions.

1. The Company ensures the security of personal data through appropriate technical and organizational measures aimed at preventing unlawful processing of data and their accidental loss, destruction and damage. The Company’s website and the contact form on the Company’s website are encrypted.

   The Company takes special care to ensure that personal information is processed in accordance with the principles of personal data processing specified in the GDPR, i.e.:
   processed in accordance with the law, reliably and in a transparent manner for the data subject (principle of lawfulness, reliability and transparency);

   collected for specific, explicit and legally justified purposes and not further processed in a manner inconsistent with these purposes (principle of purpose limitation);

   adequate, relevant and limited to what is necessary for the purposes for which they are processed (principle of data minimization);
   correct and, where necessary, updated; personal data that are incorrect in light of the purposes of their processing will be immediately deleted or corrected (principle of accuracy);
   stored in a form which enables the identification of the data subject for no longer than is necessary for the purposes for which the data is processed (processing limitation principle); processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality principle).

The Company examines whether personal data processed by it is not processed for a period longer than necessary for the purposes for which the data is processed.
Personal data processed on the basis of the consent granted will be processed until it is withdrawn or the purpose for which the data was collected ceases to exist. The consent granted may be withdrawn at any time without affecting the lawfulness of the processing carried out on the basis of the consent before its withdrawal.
Data provided using the contact form or during telephone contact, via e-mail, will be processed for the duration of the reported request, e.g. presentation of an offer, provision of information, but no longer than 2 years in order to maintain the principle of accountability.
Data processed in connection with the presentation of an offer, provision of a service, conclusion and implementation of a contract, will be processed in accordance with applicable regulations, but no longer than until the expiry of the period in which the Company or the data subject may pursue claims related to it.
Data processed for the purpose of direct marketing will be processed until the consent is withdrawn or an objection is filed.

The Company is responsible for the implementation of the rights of persons whose data it processes, in accordance with applicable law. In the event of any questions and requests regarding the scope and implementation of rights, as well as to contact us in order to exercise a specific right in the field of personal data protection, please contact us at the e-mail address: biuro@epsdesign.pl. The Company reserves the right to implement the following rights after positive verification of the identity of the person applying for the performance of a given activity.
Access to personal data. Individuals have the right to access the data stored by the Company.
Change of personal data. Individuals have the right to change, including updating their personal data processed by the Company.
Withdrawal of consent. In the case of processing personal data based on consent, individuals have the right to withdraw this consent at any time.
The right to limit the processing or to object to the processing of personal data. Individuals have the right to limit the processing or to object to the processing of their personal data at any time, due to their special situation, unless processing is required by law.
The right to request the deletion of data and the right to transfer data. Individuals have the right to request the deletion of data when it is no longer necessary for the purposes for which it was collected, in the event of withdrawal of consent, objection to processing or when the processing is unlawful. In turn, the right to data portability is granted when the processing of a person’s data is based on consent or a contract and when the processing is carried out automatically. In such a case, the Company issues or transfers to the indicated entity the data of the person who requests it, in a structured, commonly used machine-readable format.

The Company informs that it is not obliged to delete data in the event that the processing is necessary for: fulfilling a legal obligation to process under EU or Polish law, or performing a task carried out in the public interest or to establish, pursue or defend claims.

In each case it is recognized that the rights of an individual resulting from the provisions of the law and this Privacy Policy are violated, the individual has the right to lodge a complaint with the President of the Office for Personal Data Protection.

The Company declares that it does not sell, share or transfer personal data collected for processing to other persons or institutions, unless this is done with the express consent or at the request of such person or at the request of state authorities authorized under the law for the purposes of proceedings conducted by them.

The Company informs that personal data processed by the Company are for marketing purposes. The legal basis for the above is Article 6 paragraph 1 letter f) of the GDPR (and recital 48 of the GDPR), and therefore such processing of personal data will take place when it is necessary for the purposes resulting from the legitimate interests pursued by the Company, except for situations in which the interests or fundamental rights and freedoms of the data subject, requiring the protection of personal data, take precedence over these interests, in particular when the data subject is a child.

The Company informs that personal data processed by the Company, including data processed for marketing purposes, may be made available to other entities only when permitted by law. In such a case, in the relevant agreement concluded with the third party, the Company provides for security provisions and mechanisms to protect the data and maintain the Company’s standards in the field of data protection, confidentiality and security. Such agreements are called personal data processing agreements, and the Company has control over how and to what extent the entity to which the Company has entrusted the processing of certain categories of personal data processes such data. In connection with the above, we indicate that the recipients of personal data that the Company processes as a controller of personal data may be entities processing personal data under personal data processing agreements concluded with the Company, including financial institutions, and the Company transfers personal data to such entities only to the extent that it is actually necessary to achieve the purpose of concluding and performing an agreement with the data subject.

The Company claims that personal data used by the Company is not available outside the EEA (European Economic Area).

The Company undertakes to regularly review this Privacy Policy and change it when it proves necessary due to: new legal regulations, new guidelines from authorities responsible for supervising personal data protection processes, practices used in the area of ​​personal data protection. The Company also reserves the right to change this Privacy Policy in the event of changes in the technology by which it processes personal data (if the change affects the wording of this document), as well as in the event of changes in the methods, purposes or legal basis for processing personal data by the Company.