Information on the processing of personal data
in connection with cooperation with Specialists and Clinic Owners
In accordance with Articles 13 and 14(1) and (2) GDPR, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, "GDPR"), we inform you that:
1.
The controller of your personal data is NutriLogic spółka z o.o. with its registered office in Łódź, ul. Piotrowska 148/150, 90-063 Łódź, KRS 0001237862, NIP 7252366419, share capital PLN 5,000.
2.
For data protection matters you may contact us by e-mail at service@nutrilogic.io or by post at the controller's registered office.
3.
Your personal data will be processed:
-
a)
To perform a contract where processing is necessary for pre-contractual measures or performance of a cooperation agreement. This concerns representatives or attorneys who are natural persons (Art. 6(1)(b) GDPR).
-
b)
On the basis of the Controller's legitimate interest for staff who are not a party to the contract where processing does not follow directly from law. The interest is cooperation under the agreement (Art. 6(1)(f) GDPR).
-
c)
To comply with legal obligations, in particular under VAT law, tax ordinance law and CIT law (Art. 6(1)(c) GDPR).
-
d)
For legitimate interests that do not follow directly from law and are not necessary to conclude or perform the contract, such as security and property protection on the Controller's premises and contact with persons indicated to perform the contract.
4.
Processing in this respect is necessary for those purposes (Art. 6(1)(f) GDPR).
-
a)
For legitimate interests including pursuing claims, defending rights and handling complaints related to the contract. This is not the main purpose but data may be used if needed (Art. 6(1)(f) GDPR).
5.
Retention periods:
-
a)
Tax-related data: 5 years from the end of the calendar year in which the tax payment deadline expired, under tax ordinance rules.
-
b)
KSeF-related tax data: 10 years from the end of the year of issue under VAT law.
-
c)
Cooperation data: for the duration of the cooperation agreement; may be extended where required by law.
-
d)
Data for pursuing or defending claims: legitimate interest (Art. 6(1)(f) GDPR), generally not longer than 3 years unless a shorter period applies; may be shortened if you object under Art. 21(1) GDPR.
-
e)
Data for supervisory audits and for administrative or out-of-court proceedings: up to 5 years where applicable under administrative procedure rules.
6.
We obtain data from:
-
a)
The data subject directly.
-
b)
Contracting parties with whom the Controller cooperates.
7.
Personal data may be disclosed to:
-
a)
Authorised persons under appropriate authorisations.
-
b)
Public authorities where required by law, including law enforcement and tax authorities.
-
c)
Cooperation partners for performing agreements and mutual obligations.
8.
Disclosure is limited to what is necessary under contracts or law, with appropriate safeguards.
9.
The Controller does not intend to transfer personal data outside the EEA unless necessary. Any transfer will follow applicable law, including adequacy decisions, standard contractual clauses or explicit consent. Details are available from the DPO office referred to in point 3.
10.
You will not be subject to decisions based solely on automated processing, including profiling, which produce legal or similarly significant effects.
11.
You have the right to:
-
a)
Access your data and obtain a copy.
-
b)
Rectify inaccurate data.
-
c)
Erasure where permitted under Art. 17 GDPR.
-
d)
Restrict processing under Art. 18 GDPR, including for pursuing your claims.
-
e)
Object on grounds relating to your particular situation where processing is based on legitimate interests.
12.
Lodge a complaint with a supervisory authority if you consider processing infringes the GDPR.
13.
To exercise your rights, contact the Data Protection Officer using the details in point 3.