GDPR notice

Dear Ladies and Gentlemen,
I kindly inform you that ANDREX-VG, as part of its business activity, processes information which, pursuant to the Regulation of the Parliament
of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ( hereinafter referred to as “GDPR”), have the nature of personal data. These data concern entrepreneurs and are obtained from public sources, such as CEIDG, KRS, REGON register or VAT register.
In connection with the above, in accordance with the applicable provisions on the protection of personal
data, ANDREX-VG is obliged to provide information regarding
processing of personal data, specified in art. 13 or 14 GDPR.
In the light of the above, we inform you that:

1. Personal data administrator

The administrator of your personal data in accordance with the GDPR is the company ANDREX-VG
conducting business activity at the address:
ANDREX-VG Spółka z ograniczoną odpowiedzialnością Sp. K.
NIP: 817-217-33-57 REGON: 180930475

2. Administrator’s contact details

In matters related to the processing of personal data, you can contact
the Administrator at the phone number +48 17 785-28-93, address biuro@andrex-vg.com
or to the correspondence address: Brzyście 35 near Mielec 39-307 Gawłuszowice

3. Purposes of personal data processing

Your personal data is or may be processed by the Administrator for the following
purposes:

1. running a business consisting in creating packages
   data on entrepreneurs and providing such prepared
   business information to the Administrator’s customers, in accordance with the received order and offer.
   The packages developed are aimed at increasing the security of economic transactions and improving communication between the client and the recipients of his
   goods or services.
   The legal basis for the processing of personal data is the legitimate interest
   Administrator (Article 6(1)(f) of the GDPR). This interest consists in developing
   packages of economic information and offering customers services related to these
   packages, in accordance with the subject of activity of ANDREX-VG.
   As part of the legitimate interest, the administrator processes the following
   categories of personal data: name and surname, entrepreneur’s name, registered office address, correspondence address, business addresses, NIP, e-mail,
   br />telephone, date of establishment, information whether the company is a VAT payer, birthday
   of the owner, industry. The administrator may also process data on the location of
   the company in the form of a link to Google maps, a link to the Skype account and statistical data
   in the form of the estimated population of the region in which the entrepreneur conducts
   activity;
2. performance of the legal obligation, which is to ensure the implementation of the rights of
   data subjects, including the right to access personal data, the right to request
   rectification of data personal data, the right to request deletion of personal data,
   the right to request processing restrictions, the right to transfer data,
   the right to object to processing.
   The legal basis for processing is art. 6 sec. 1 lit. c GDPR, i.e. the implementation of the
   legal obligation imposed on the administrator. The administrator processes data in the above
   scope also as part of its legitimate interest (pursuant to
   Article 6(1)(f) of the GDPR), consisting in ensuring compliance with the law and
   accountability of processing;
3. verification whether in relation to the acquired personal data
   a specific person has not been objected to processing.
   The administrator respects the right of persons whose data concern the right to object
   to processing. After accepting the objection, the Administrator removes this data from its databases. The administrator makes efforts to ensure that the data in relation to which an objection has been lodged are not re-downloaded and made available as part of the data package. In connection with the above, the Administrator stores a copy of the data of persons deleted from the databases.
   The basis for data processing within the above purpose is the legitimate
   interest of the Administrator (Article 6(1)(f) of the GDPR), consisting in ensuring
   correct implementation of the right to object to processing. li>
4. correspondence or other form of communication. Your data may be processed by the Administrator for the purpose of written, telephone or electronic contact, correspondence or communication. The basis for processing
   in this situation is the legitimate interest of the Data Administrator consisting in
   care for positive relations with persons with whom the Administrator maintains contacts within
   as part of its business (Article 6(1)(f) of the GDPR). f GDPR). If you
   initiated the conversation, your personal data will be processed on the basis of
   consent resulting from the initiation of contact (Article 6(1)(a) of the GDPR);
5. defense against claims and for archival and evidentiary purposes.
   Your data may be processed for archival and evidentiary purposes, for
   the need to secure information that can be used to prove facts, which constitutes
   the Administrator’s legitimate interest (Article 6(1)(f) of the GDPR). Data archived
   in this way may be used for possible determination, investigation or
   defense against claims or allegations.

4. Period of personal data storage

Your personal data will be processed for a different period of time, depending on the purpose for which
personal data is processed:

1. data processed in order to implement the legitimate interest of the
   Administrator related to running a business –
   for the duration of the legitimate interest of the Administrator or until
   to raise an effective objection to processing, depending on which
   event occurs first;
2. data processed in order to verify whether an objection to the processing has not been raised with regard to the obtained
   data – for the duration of
   the existence of a legitimate interest Administrator;
3. data processed for the purpose of correspondence or other form of
   communication – for the duration of correspondence and after its completion, for
   the period of existence of a legally justified the interest of the Administrator, but no longer than
   until the limitation period for any claims related to correspondence;
4. data processed in order to fulfill the obligations imposed by law
   obligations – for the period of storage of evidence confirming the fulfillment of these obligations, but no longer until the expiry of these obligations or
   expiration of any claims arising from them;
5. data processed for archival and evidentiary purposes – until the
   expiration of any claims or for the time required by
   document archiving – depending on which of the events will last longer.

5. Sources of obtaining personal data

Dane osobowe, które posiada Administrator pochodzą przede wszystkim z rejestrów i
ewidencji, w odniesieniu do których na mocy powszechnie obowiązujących przepisów jest
zapewniona jawność i powszechny dostęp, w tym z:
1) Krajowego Rejestru Sądowego (KRS),
2) Centralnej Ewidencji i Informacji o Działalności Gospodarczej (CEIDG),
3) rejestru REGON,
4) wyszukiwarki podatników VAT,
Administrator może ponadto uzyskiwać Państwa dane osobowe:
1) z powszechnie dostępnych stron internetowych,
2) od innych przedsiębiorców,
3) od Państwa, w zakresie, dane zostały przez Państwa upublicznione lub podane w
kontakcie z Administratorem.
Administrator nie pozyskuje i nie przetwarza szczególnych kategorii danych osobowych ani
danych osobowych dotyczących wyroków skazujących oraz naruszeń prawa lub powiązanych
środków bezpieczeństwa.

6. Odbiorcy danych osobowych

Odbiorcami Państwa danych osobowych są lub mogą być:

1. klienci Administratora prowadzący działalność gospodarczą,
2. upoważnieni współpracownicy Administratora (w celu i w zakresie, w jakim jest to
   niezbędne do realizacji ich obowiązków na zajmowanym stanowisku),
3. instytucje państwowe, w przypadku jeżeli wymagają tego wiążące Administratora
   przepisy prawa;
4. podmioty świadczące usługi pocztowe i kurierskie – w razie konieczności przesłania do
   Państwa korespondencji pocztowej;
5. podmioty przetwarzające dane osobowe na zlecenie Administratora: podmioty, które
   mogą uzyskać dostęp do Państwa danych osobowych podczas świadczenia na rzecz
   Administratora usług hostingu, dostarczania poczty elektronicznej i innych
   elektronicznych środków komunikacji, podmiotów obsługujących wykorzystywane
   przez Administratora bazy danych i systemy informatyczne. Administrator nie udostępnia swoim klientom danych osobowych w celach marketingowych.
   Po przekazaniu danych przez Administratora, klienci mogą uzyskać własne, niezależne
   podstawy prawne do przetwarzania danych osobowych w celach marketingowych.

7. Prawa, które przysługują w związku z przetwarzaniem danych osobowych

On the basis of the GDPR, you have the following rights related to
processing of personal data

1. the right to request access to your personal data
2. the right to request rectification of personal data,
3. the right to request the deletion of personal data (the right to be forgotten),
4. the right to request restriction of processing,
5. the right to transfer data,
6. the right to object to the processing of personal data for purposes

If you object to the processing, the Administrator will delete
your data from its databases and stop sharing this data with its
contractors.
If processing is based on consent, you can also withdraw your consent at any time, without giving any reason, in any form, in particular by sending an e-mail to the Data Administrator. Withdrawal of consent does not affect
the lawfulness of processing based on consent before its
withdrawal.
Not all of the rights referred to above will be available to you in relation to
each processing case. This depends on the type of processing and its
legal basis.
If you consider that the processing of your data by the Administrator
infringes the law, you also have the right to lodge a complaint with the President of the
Office for Personal Data Protection.

8. Automated decision making

You may be subject to a decision based on automated processing of personal data, including profiling, if the Administrator is authorized to do so under applicable law or with your prior consent. However, the administrator does not
make decisions that are based solely on automated
processing and produce legal effects with respect to the data subject.