Personal data shall be processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free transfer of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR
The administrator of personal data is Toruńskie Zakłady Materiałów Opatrunkowych S.A., 20/26 Żółkiewskiego Street, 87-100 Toruń. With regard to personal data of the controller's contractors, personal data of persons employed or applying for employment by the controller (on the basis of a contract of employment or on the basis of another contract), the controllers (co-controllers) of personal data may also be subsidiaries of Zakłady Materiałów Opatrunkowych S.A. of Toruń, which are members of the TZMO Group. For current list of these entities, visit www.tzmo-global.com/RODO
In matters concerning the processing of personal data and the exercise of rights related to the processing of personal data, you can contact the Data Protection Officer. Mr. Jan Stemposz, TZMO S.A. ul. Żółkiewskiego 20/26, 87-100 Toruń, e-mail address: firstname.lastname@example.org.
The controllers process personal data, in particular:
on the basis of Article 6(1)(a) of the GDPR - the data subject has consented to the processing of his/her personal data for one or more specified purposes - in particular to maintain contact with the data subject; to make commercial information, other information or samples of products available or provided (also by e-mail); to organise, conduct and document events, including competitions, promotions and other marketing actions;
pursuant to Article 6(1)(b) of the GDPR - processing is necessary for the performance of a contract to which the data subject is a party or to take action at the request of the data subject prior to the conclusion of the contract - in particular for the performance of all rights and obligations arising from contracts concluded by the controller;
on the basis of Article 6(1)(c) of the GDPR - processing is necessary to fulfil the legal obligations incumbent on the controller - in particular in order to exercise the rights and obligations of the controller resulting from the applicable provisions of law, in particular in the field of tax law, labour law and social security;
under Article 6(1)(f) of the GDPR - processing is necessary for purposes arising from legitimate interests pursued by the controller - in particular for the purpose of pursuing claims.
The recipients of personal data are persons employed by the controller (on the basis of a contract of employment or on the basis of another contract) and trusted entities cooperating with the controller - to the extent necessary to achieve the purposes of processing; personal data may also be made available to public authorities and other entities authorised to do so on the basis of legal regulations, at their request.
The controller does not intend to transfer personal data to a third country or to international organisations.
Personal data is stored:
in the case of data processed pursuant to Article 6(1)(a) of the GDPR, until the purposes of the processing indicated in the consent have been achieved;
in the case of data processed under Article 6(1)(b) of the GDPR, until all obligations relating to the performance of the contract have been fulfilled by the contracting parties and then until the expiry of the expiration or limitation period of any claims relating to the contract;
in the case of data processed pursuant to Article 6(1)(c) of the GDPR, until the legal obligation incumbent on the controller, in particular the obligation to keep records, has been fulfilled;
in the case of data processed under Article 6(1)(f) of the GDPR, until the purposes of the processing have been achieved, in particular to satisfy, terminate or time-bar the claim.
The data subject shall have the right to request from the controller access to his or her personal data and, in the cases specified in the GDPR, to rectify, erase or limit the processing; he or she shall also have the right to transfer personal data.
A data subject has the right to lodge a complaint with the data protection supervisory authority provided for by law, if he believes that the processing of his personal data violates the provisions of the GDPR.
In the case of personal data processed under Article 6(1)(a) of the GDPR, the data subject shall have the right to withdraw consent to the processing of such data at any time without prejudice to the lawfulness of the processing carried out on the basis of consent prior to the withdrawal of consent. Withdrawal of consent may take place e.g. by sending an e-mail with a statement of withdrawal of consent to the e-mail address: email@example.com
In the case of personal data processed on the basis of Article 6(1)(a) of the GDPR, providing personal data is not a statutory or contractual requirement and is voluntary; however, failure to provide data may result in preventing or hindering the purposes of the processing, in particular the lack of contact with the controller; failure to provide commercial information, other information or product samples; inability to participate in events, including competitions, promotions and other marketing actions. In other cases, the provision of personal data may be a statutory or contractual requirement if this is provided for by law or by a contractual provision.
In connection with the processing of personal data by the controller, no automated decision making, including profiling, shall take place.