INFORMATION BY POLKOMTEL SP. Z O.O. ABOUT PROCESSING OF PERSONAL DATA OF A CUSTOMER / A SUBSCRIBER / A BUYER
Who will process the personal data and how to contact the entity
1. POLKOMTEL sp. z o. o., address: ul. Konstruktorska 4, 02-673 Warsaw, is the controller of personal data within the meaning of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”). Requests, declarations and any correspondence regarding personal data shall be addressed by phone to the Customer Service Department (phone no. 601102601), or in writing to the following address: Polkomtel sp. z o.o. - Reklamacje, ul. Konstruktorska 4, 02-673 Warszawa, by e-mail to: bok@plus.pl, as well as in writing or orally for the record at a Point of Sale (Service).
2. The controller has appointed a Data Protection Officer who can be contacted: by e-mail at: iod@plus.pl or in writing to the above mentioned address of the controller marked „Inspektor ochrony danych” (Data Protection Officer).
Purposes and legal basis of personal data processing
3. Providing of Activation Data is a condition for concluding an agreement. Refusal to provide the Activation Data prevents conclusion of the agreement. An obligation of providing the first and last name, the PESEL personal number or the name, the series and the number of the document confirming a person’s identity results from the Act of 16 July 2004 – Telecommunication Law. Provision of other data does not constitute a condition for conclusion of an agreement but may be required if the option of concluding an agreement in a document form has been selected.
4. Personal data are processed, including profiling, for the purpose of:
- undertaking activities prior to entering into an agreement and for the performance of an agreement – pursuant to Article 6 item 1 letter b of GDPR,
- ensuring compliance with legal obligations – pursuant to Article 6 item 1 letter c of GDPR,
- the legitimate interests pursued POLKOMTEL or by a third party, such as: marketing, collections, detection and elimination of irregularities in the process of conclusion and performance of an agreement, internal purposes related to the provision of Services and conducting of business activities, including evidence gathering, analytical and statistical purposes as well as development of statistical models - pursuant to Article 6 item 1 letter f of GDPR, or
- processing based on the granted consent, exclusively for a specific purpose indicated in the contents of consent - pursuant to Article 6 item 1 letter a of GDPR.
To whom the personal data will be transferred
5. Personal data may be transferred to the following categories of recipients: entities providing to the controller the services that are required for fulfilling the above mentioned purposes, including logistic partners, IT partners, entities providing after-sale services and repair services, entities providing technical, organizational and consulting support, other subcontractors with respect to conclusion of agreements and customer service, charging and processing of payments, marketing, pursuing of claims, integrators and entities providing additional services under premium rate services, entities authorized by law, credit information bureaus, institutions created pursuant to Article 105 item 4 of the Act of 29 August 1997 – Banking Law, telecommunication companies, entities involved in debt and claims trading, companies who are members of Cyfrowy Polsat Group, entities providing services executed through Polkomtel Services, other entities indicated in the contents of a relevant consent.
6. Personal data may be transferred to countries / international organizations located outside of the European Economic Area, where such a country / organization, based on the decision of the European Union, is deemed as ensuring an adequate level of personal data protection, equivalent to the degree of protection valid on the territory of the European Economic Area or provided that the appropriate safeguards are applied, which may consist in applying valid corporate rules, standard contractual clauses adopted by the European Commission, standard personal data protection clauses adopted by the President of the Personal Data Protection Office or contractual clauses authorized by the President of the Personal Data Protection Office, while the copies thereof may be obtained by submitting a request in the manner mentioned in item 1 above.
7. Moreover, bearing in mind the judgment of the Court of Justice of the European Union (CJEU) of 16 July 2020 in Schrems II case we would like to inform you that some of the technical solutions that we employ may be provided by the parties based outside the European Economic Area (EEA), including in the United States of America. Thus in some specific situations personal data may be transferred to the countries where the providers’ registered offices are located, including the USA.. Such partners include Google and Facebook who declare that they assure a relevant level of security of the processed personal data by adopting and using standard EU contractual clauses in place of the so-called Privacy Shield which was repealed by the above court ruling (Information by FB, Information by Google). The type of the safeguards employed is reviewed from the point of view of risks and may change when the relevant EU bodies adopt new legal instruments serving the purpose of assuring the relevant degree of security of the personal data transferred outside the EEA.
For how long will the personal data be processed
8. Personal data will be processed during the validity of an agreement as well as after its termination or, in a situation when an agreement has not been finally concluded, for the period: a) envisaged for the fulfillment of the obligations resulting from the provisions of the law concerning national defense, state security and public law and order, as well as tax and accounting regulations, b) for the period of limitation of claims and until the end of civil, enforcement, administrative and criminal proceedings requiring personal data processing, and, if processed on the basis of a granted consent – until the purpose for which the consent has been granted is achieved or until the consent is revoked, whichever comes earlier.
What rights are associated with personal data
9. You have the right to correct the data, access the data, erase the data, restrict processing of the data, transfer the data supplied to the controller.
10. You have the right to object against data processing which is performed based on the legitimate interest of the controller or a third party, including profiling, due to the reasons related to specific circumstances, and to object against data processing for direct marketing purposes, including profiling.
11. With respect to the data processed based on a granted consent – you have the right to revoke such consent at any time. Revoking of the consent has no impact on the legality of data processing which took place before such consent was revoked.
12. The above mentioned requests and declarations shall be submitted in the manner indicated in item 1 above.
Where a complaint regarding personal data protection can be filed
13. A complaint regarding personal data processing can be filed to the supervising authority dealing with personal data processing. The President of the Personal Data Protection Office is the supervising authority in the Republic of Poland.
Automated processing of personal data
14. Prior to concluding the agreement an automated decision is made to determine whether entering into the agreement will require the customer to pay a deposit and if so, then in what amount. The related decision is made on the basis of the client’s credit scoring. The assessment is performed by referring to a statistical model created as a result of the analysis of the customers’ past behavior, including their demographic characteristics, such as age, the area where they live, their employment as well as other behavioral characteristics, such as payment of dues, types of contracts customers have entered into, other contracts they are party to. The automated decision to request a deposit is also made in the situation when a Client refuses to give consent to verification by credit reference bureaus or on the basis of the information obtained from other telecommunication companies.
15. Automated decisions are made during the performance of an agreement in order to counter the activities which constitute a breach of the agreement, resulting in the possibility of further use of telecommunication services being blocked and the agreement being terminated. These decisions are made based on an analysis of network traffic parameters, that is type, value and direction of calls, time of call set-up and the reason for disconnecting a call.
16. If the limits defined in the agreement (e.g. value, volume, time limits) are reached or exceeded during the performance of an agreement, then the consequences set out in the agreement follow automatically (e.g. restriction, suspension or blocking the possibility of using the services, sending of a notification, request for payment of a deposit).
17. In the cases mentioned in items 14-16, you have the right to seek intervention by a Controller’s representative, express your own opinion or question the decision that was made by submitting a request in the manner described in item 1 above.
INFORMATION BY POLKOMTEL SP. Z O.O. ABOUT PROCESSING OF PERSONAL DATA OF A CUSTOMER / A PREPAID SERVICE SUBSCRIBER
Who will process the personal data and how to contact the entity
1. POLKOMTEL sp. z o. o., address: ul. Konstruktorska 4, 02-673 Warsaw, is the controller of personal data within the meaning of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”). Requests, declarations and any correspondence regarding personal data shall be addressed by phone to the Customer Service Department (phone no. 601102601), or in writing to the following address: Polkomtel sp. z o.o. - Reklamacje, ul. Konstruktorska 4, 02-673 Warszawa, by e-mail to: bok@plus.pl, as well as in writing or orally for the record at a Point of Sale (Service).
2. The controller has appointed a Data Protection Officer who can be contacted: by e-mail at: iod@plus.pl or in writing to the above mentioned address of the controller marked „Inspektor ochrony danych” (Data Protection Officer).
Purposes and legal basis of personal data processing
3. Providing of Activation Data is a condition for concluding an agreement. Refusal to provide the Activation Data prevents conclusion of the agreement. An obligation of providing the Activation Data results from the Act of 16 July 2004 – Telecommunication Law. Provision of other data does not constitute a condition for conclusion of an agreement.
4. Personal data are processed, including profiling, for the purpose of:
- undertaking activities prior to entering into an agreement and for the performance of an agreement – pursuant to Article 6 item 1 letter b of GDPR,
- ensuring compliance with legal obligations – pursuant to Article 6 item 1 letter c of GDPR,
- the legitimate interests pursued POLKOMTEL or by a third party, such as: marketing, collections, detection and elimination of irregularities in the process of conclusion and performance of an agreement, internal purposes related to the provision of Services and conducting of business activities, including evidence gathering, analytical and statistical purposes as well as development of statistical models - pursuant to Article 6 item 1 letter f of GDPR, or
- processing based on the granted consent, exclusively for a specific purpose indicated in the contents of consent - pursuant to Article 6 item 1 letter a of GDPR.
To whom the personal data will be transferred
5. Personal data may be transferred to the following categories of recipients: entities providing to the controller the services that are required for fulfilling the above mentioned purposes, including logistic partners, IT partners, entities providing after-sale services and repair services, entities providing technical, organizational and consulting support, other subcontractors with respect to conclusion of agreements and customer service, charging and processing of payments, marketing, pursuing of claims, integrators and entities providing additional services under premium rate services, entities authorized by law, credit information bureaus, institutions created pursuant to Article 105 item 4 of the Act of 29 August 1997 – Banking Law, telecommunication companies, entities involved in debt and claims trading, companies who are members of Cyfrowy Polsat Group, entities providing services executed through Polkomtel Services, other entities indicated in the contents of a relevant consent.
6. Personal data may be transferred to countries / international organizations located outside of the European Economic Area, where such a country / organization, based on the decision of the European Union, is deemed as ensuring an adequate level of personal data protection, equivalent to the degree of protection valid on the territory of the European Economic Area or provided that the appropriate safeguards are applied, which may consist in applying valid corporate rules, standard contractual clauses adopted by the European Commission, standard personal data protection clauses adopted by the President of the Personal Data Protection Office or contractual clauses authorized by the President of the Personal Data Protection Office, while the copies thereof may be obtained by submitting a request in the manner mentioned in item 1 above.
7. Moreover, bearing in mind the judgment of the Court of Justice of the European Union (CJEU) of 16 July 2020 in Schrems II case we would like to inform you that some of the technical solutions that we employ may be provided by the parties based outside the European Economic Area (EEA), including in the United States of America. Thus in some specific situations personal data may be transferred to the countries where the providers’ registered offices are located, including the USA.. Such partners include Google and Facebook who declare that they assure a relevant level of security of the processed personal data by adopting and using standard EU contractual clauses in place of the so-called Privacy Shield which was repealed by the above court ruling (Information by FB, Information by Google). The type of the safeguards employed is reviewed from the point of view of risks and may change when the relevant EU bodies adopt new legal instruments serving the purpose of assuring the relevant degree of security of the personal data transferred outside the EEA.
For how long will the personal data be processed
8. Personal data will be processed during the validity of an agreement as well as after its termination or, in a situation when an agreement has not been finally concluded, for the period: a) envisaged for the fulfillment of the obligations resulting from the provisions of the law concerning national defense, state security and public law and order, as well as tax and accounting regulations, b) for the period of limitation of claims and until the end of civil, enforcement, administrative and criminal proceedings requiring personal data processing, and, if processed on the basis of a granted consent – until the purpose for which the consent has been granted is achieved or until the consent is revoked, whichever comes earlier.
What rights are associated with personal data
9. You have the right to correct the data, access the data, erase the data, restrict processing of the data, transfer the data supplied to the controller.
10. You have the right to object against data processing which is performed based on the legitimate interest of the controller or a third party, including profiling, due to the reasons related to specific circumstances, and to object against data processing for direct marketing purposes, including profiling.
11. With respect to the data processed based on a granted consent – you have the right to revoke such consent at any time. Revoking of the consent has no impact on the legality of data processing which took place before such consent was revoked.
12. The above mentioned requests and declarations shall be submitted in the manner indicated in item 1 above.
Where a complaint regarding personal data protection can be filed
13. A complaint regarding personal data processing can be filed to the supervising authority dealing with personal data processing. The President of the Personal Data Protection Office is the supervising authority in the Republic of Poland.
Automated processing of personal data
14. During the performance of an agreement in order to counter the activities which constitute a breach of agreement, automated decisions are made, resulting in blocking of a possibility of using telecommunication services and termination of the agreement. These decisions are made based on an analysis of network traffic parameters, that is type, value and direction of calls, time of call set-up and a reason for disconnecting calls.
15. If the limits defined in the agreement (e.g. value, volume, time limits) are reached or exceeded during the performance of an agreement, then the consequences set out in the agreement follow automatically (e.g. restriction, suspension or blocking the possibility of using the services, sending of a notification, request for payment of a deposit).
16. In the cases mentioned in items 14-15, you have the right to seek intervention by a Controller’s representative, express your own opinion or question the decision that was made by submitting a request in the manner described in item 1 above.
