Information on the Processing of Personal Data of Luksor Sp. z o.o. Clients

In accordance with our legal obligation arising from the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “General Data Protection Regulation” or “GDPR”), we provide you with the following information regarding the processing of your personal data for a specific purpose.

1. The controller of your personal data is Luksor Sp. z o.o., ul. Pasaż Ursynowski 9, unit 4B, 02-782 Warsaw, Poland. You may contact the Controller: by email at: office@luksor.eu, or in writing at: Luksor Sp. z o.o., ul. Pasaż Ursynowski 9, unit 4B, 02-782 Warsaw, Poland, with the note “Personal Data”.
2. The Controller has appointed a Data Protection Officer, whom you may contact regarding any matters related to the processing of your personal data: by email at: iod@luksor.eu, or in writing to the Controller’s address with the note “Data Protection Officer”.
3. Your personal data is processed because you have used or intend to use the products and services provided by the Controller, Luksor Sp. z o.o. Your personal data has been obtained directly from you.
4. The personal data we may process includes name and surname, email address, telephone number, position/job title, details of your business activity or the entity you represent, and other data, if necessary for the proper provision of services.
5. Your personal data is processed based on:
   • Article 6(1)(b) GDPR – performance of a contract or taking steps prior to entering into a contract at your request;
   • Article 6(1)(c) GDPR – compliance with a legal obligation, including obligations under tax regulations;
   • Article 6(1)(f) GDPR – the legitimate interest of the Controller, consisting in handling correspondence, including complaints, pursuing or defending claims, and archiving documentation;
   • Article 6(1)(a) GDPR – your consent, where you have given it, e.g. to receive marketing information.
6. Your personal data will be processed for the following periods:
   • data processed in connection with a contract – for the duration of the contract, and thereafter for the period necessary to pursue or defend claims;
   • data processed to comply with legal obligations – for the periods required by applicable law, e.g. accounting records retained for 5 years;
   • data processed based on legitimate interest – for up to 6 years or until that interest ceases; this period may be shortened if you effectively object to processing;
   • data processed based on consent – until the consent is withdrawn or the purpose of processing ceases.
7. Your personal data may be transferred to entities providing services to the Controller, e.g. hosting providers, IT service providers, legal advisors, accounting offices; entities authorized under applicable law; other entities at your request. In such cases, data is transferred based on data processing agreements and with appropriate technical and organizational safeguards in place.
8. We do not transfer personal data to third countries, outside the European Economic Area, unless it is necessary for the proper and lawful provision of services. If such transfer is required, we ensure an adequate level of data protection and compliance with applicable legal provisions.
9. Your personal data may be processed automatically, however, it is not subject to profiling and does not produce legal effects or otherwise significantly affect you.
10. In connection with the processing of your personal data, you have the following rights:
    • the right to withdraw consent, Article 7 GDPR;
    • the right of access to your data, Article 15 GDPR;
    • the right to rectification of your data, Article 16 GDPR;
    • the right to erasure of your data, Article 17 GDPR;
    • the right to restriction of processing, Article 18 GDPR;
    • the right to object to processing, Article 21 GDPR;
    • the right to lodge a complaint with a supervisory authority, Article 77 GDPR. In Poland, the supervisory authority is the President of the Personal Data Protection Office, UODO: https://uodo.gov.pl
11. Further information regarding the processing of your personal data and the exercise of your rights is available on our website at: https://luksor.eu in the GDPR section.