GDPR

Personal Data Administrator. Contact. The personal data administrator is Topacz Investments sp. z o.o. headquartered in Ślęza (55-040), ul. Templariuszy 1, registered in the National Court Register under number: 0000146720, NIP: 8961338394, REGON: 932880809, e-mail: ado@zamektopacz.pl, tel.: +48 71 771 99 99, hereinafter referred to as the "Administrator". The Administrator can also be contacted via the contact form available here. Purpose and basis for processing personal data by the Administrator. Your personal data is processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR). Processing personal data before entering into a contract is necessary to take actions at the request of the data subject (art. 6 lit. b GDPR), in particular to conduct discussions regarding planned reservations, and if a contract is concluded, processing personal data is necessary to perform that contract (art. 6 lit. b GDPR), including fulfilling legal obligations incumbent on the Administrator (art. 6 lit. c GDPR) or pursuing claims (art. 6 lit. f GDPR). Marketing activities carried out via your email or phone number (sending so-called unsolicited commercial information) are performed solely based on your consent, because although processing data in this scope could be justified under the legitimate interest of the Administrator (art. 6 lit. f GDPR), the legislator requires obtaining separate consents for the mentioned purpose. Voluntariness of providing personal data. Providing your personal data is voluntary; however, refusal to provide data may prevent you from using services provided by the Administrator or receiving answers to questions about the services or products offered. Please remember that if the only basis for processing your personal data is your consent – we cannot start processing your personal data without it. Similarly, if you expect the Administrator to take actions to conclude a contract, the contract could not be concluded without providing us with your personal data. The Administrator collects only such personal data from you that is necessary, including those required to be collected and processed by generally applicable law. Rights regarding the Administrator. Every data subject has the rights against the Administrator: the right to access personal data, rectify, delete or limit processing, the right to object to processing, the right to data portability and to withdraw previously given consent for processing, as well as the right to lodge a complaint with the President of the Personal Data Protection Office. The scope of respective rights and conditions for their fulfillment are specified by GDPR provisions. Duration of personal data storage. Your personal data is stored for the period necessary to perform actions at the request of the data subject, and after concluding a contract until the limitation period for claims (of the Client against the Administrator or of the Administrator against the Client) expires, as well as until the expiration of the document retention period related to the contract resulting from generally applicable law. If the basis for processing personal data is the consent of the data subject (e.g., marketing consents), withdrawal of consent (possible at any time) does not affect the lawfulness of processing carried out based on consent before its withdrawal. Personal data provided when expressing voluntary marketing consents is generally processed until the consent is withdrawn, although a shorter processing period for the mentioned purpose may be set. Recipients of data. Data will be disclosed only to the following recipients: persons authorized by the Administrator to process personal data and entities processing personal data on behalf of the Administrator based on contracts with the Administrator, including, among others, tax advisors, accounting offices, entities providing accounting, IT, or audit services to the Administrator. If such obligation results from generally applicable law, personal data may also be disclosed to state authorities or third parties. No automated data processing. Your personal data will not be processed in an automated manner (including profiling). Transfer of personal data to third countries or international organizations. The Administrator does not intend to transfer personal data to third countries or international organizations. Should such intention arise, you will be explicitly informed, and any such transfer will be carried out in full compliance with GDPR and based on appropriate legal safeguards, including standard contractual clauses approved by the European Commission.