Information on the Processing of Personal Data of Luksor Sp. z o.o. Partners and Their Representatives

In accordance with our legal obligation arising from the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “General Data Protection Regulation” or “GDPR”), we provide you with the following information regarding the processing of your personal data for a specific purpose.

1. The controller of your personal data is Luksor Sp. z o.o., ul. Pasaż Ursynowski 9, unit 4B, 02-782 Warsaw, Poland. You may contact the Controller: by email at: office@luksor.eu, or in writing at: Luksor Sp. z o.o., ul. Pasaż Ursynowski 9, unit 4B, 02-782 Warsaw, Poland, with the note “Personal Data”.
2. The Controller has appointed a Data Protection Officer, whom you may contact regarding any matters related to the processing of your personal data: by email at: iod@luksor.eu, or in writing to the Controller’s address with the note “Data Protection Officer”.
3. Your personal data is processed in connection with ongoing business discussions or in connection with the conclusion and performance of an agreement to which the entity you represent is a party.
4. Your personal data has been obtained directly from you or provided by a contractual party, e.g. as a person responsible for the performance of the agreement. Personal data may also be obtained from business registers, CEIDG and the National Court Register (KRS).
5. The personal data we process includes:
   
   1. In the case of representatives of an entity:
      • name and surname, as well as role/function;
      • identification data of the entity, e.g. KRS number, tax identification number, REGON, registered office;
      • contact details, email address and telephone number;
      • other data provided in connection with the conclusion of an agreement.
   2. In the case of persons responsible for the performance of an agreement:
      • name and surname, as well as position/job title;
      • email address;
      • telephone number;
      • other data provided voluntarily, e.g. image included in electronic correspondence.
6. Your personal data is processed based on:
   • Article 6(1)(b) GDPR – performance of a contract or taking steps prior to entering into a contract at your request;
   • Article 6(1)(c) GDPR – compliance with a legal obligation, including obligations under tax regulations;
   • Article 6(1)(f) GDPR – the legitimate interest of the Controller, consisting in handling correspondence, pursuing or defending claims, archiving documentation, and, in the case of persons designated by a contractual party, documenting the course of cooperation;
   • Article 6(1)(a) GDPR – your consent, where you have given it, e.g. to receive marketing information.
7. Your personal data will be processed for the following periods:
   • data processed in connection with a contract – for the duration of the contract, and thereafter for the period resulting from the Controller’s legitimate interest;
   • data processed to comply with legal obligations – for the periods required by applicable law, e.g. accounting records are stored for 5 years from the end of the relevant financial year;
   • data processed on the basis of legitimate interest – for up to 6 years or until that interest ceases; this period may be shortened if you effectively object to processing;
   • data processed on the basis of consent – until the consent is withdrawn or the purpose of processing ceases.
8. Your personal data may be transferred to entities providing services to the Controller, e.g. hosting providers, IT service providers, legal advisors, accounting offices; entities authorized under applicable law; other entities at your request. In such cases, data is transferred based on data processing agreements and with appropriate technical and organizational safeguards in place.
9. We do not transfer personal data to third countries, outside the European Economic Area, unless it is necessary for the proper and lawful provision of services. If such transfer is required, we ensure an adequate level of data protection and compliance with applicable legal provisions.
10. Your personal data may be processed automatically; however, it is not subject to profiling and does not produce legal effects or otherwise significantly affect you.
11. In connection with the processing of your personal data, you have the following rights:
    • the right to withdraw consent, Article 7 GDPR;
    • the right of access to your data, Article 15 GDPR;
    • the right to rectification of your data, Article 16 GDPR;
    • the right to erasure of your data, Article 17 GDPR;
    • the right to restriction of processing, Article 18 GDPR;
    • the right to object to processing, Article 21 GDPR;
    • the right to lodge a complaint with a supervisory authority, Article 77 GDPR. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO): https://uodo.gov.pl
12. Further information regarding the processing of your personal data and the exercise of your rights is available on our website at: https://luksor.eu in the GDPR section.