In accordance with the guidelines of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”), we would like to inform you about the principles of processing your personal data and your rights related to it.

1. The Controller of your personal data is: Targi w Krakowie sp. z o.o. with its registered office in Kraków, ul. Galicyjska 9.

2. Data Protection Officer: Maciej Rymaszewski; Contact: iod@targi.krakow.pl

3. The Controller processes your personal data on the basis of applicable laws, concluded agreements and on the basis of the consent given, depending on the purpose for which the data was obtained or transferred.

4. The basis for processing your personal data depends on the purpose for which the data is provided:
a) Recruitment:
- Article 6(1)(a) the data subject has given his/her consent to the processing of his/her personal data which exceeds the set resulting from current regulations (art. 221 § 1 of the Act of 26 June 1974 Labour Code (Journal of Laws 1974 No. 24 item 141 as amended))
- Article 9(2)(a) – as in point (a), but applies to special categories of data, e.g. religious beliefs, state of health, etc.
- Article 6(1)(c) processing is necessary for the fulfilment of a legal obligation incumbent on the controller under the Labour Code, Social Security Act, etc.
b) Employment:
- Article 6(1)(a) and Article 9(2)(a) in the case of submission of application documents containing personal data exceeding the set resulting from the current regulations (Labour Code) – until their removal or withdrawal of consent
- Article 6(1)(c) processing is necessary for the fulfilment of a legal obligation incumbent on the controller under the Labour Code, Social Security Act, etc.
- Article 6(1)(b) processing is necessary for the performance of an agreement to which the data subject is party
c) Civil law agreements, sales agreements, rental agreements, organisation of training:
- Article 6(1)(b) processing is necessary for the performance of an agreement to which the data subject is party
d) Volunteering, internships
- to carry out the recruitment of volunteers, i.e. preparatory activities for the conclusion of the agreement, pursuant to Article 6(1)(a) and (b)
- to conclude a voluntary service agreement, pursuant to Article 6(1)(b) and (c)
e) Monitoring:
- Article 6(1)(c) – processing is necessary for the fulfilment of a legal obligation to which the controller is subject and for the performance of tasks carried out in the public interest
f) Newsletter, marketing:
- Article 6(1)(a) – consent of the data subject
g) monitoring of potential threats from the spread of COVID-19:
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest

5. In connection with the processing of data for the purposes referred to in point 4, the recipients of your personal data shall be public authorities and entities performing public tasks or acting on commission from public authorities or other entities which, pursuant to relevant entrustment agreements, process personal data in the Controller’s files, such as e.g. entities providing IT services, property protection services.

6. Your personal data will be stored for the period necessary to achieve the objectives set out in point 4, and thereafter for the period and to the extent required by generally applicable law and in accordance with the Office Instruction. E.g.:
- monitoring records for a maximum period of 30 days – then they are overwritten
- purchases in the shop – a minimum of 5 years according to the Accounting Act and the current financial year thereafter to delete the account in the shop
- newsletters or other marketing consent – until such consent is revoked.

7. In connection with the processing of your personal data, you have the following rights: the right to access your personal data, the right to make your data available, the right to rectify your data – if the data is incorrect or incomplete, the right to demand erasure of your personal data (the so-called right to be forgotten), the right to demand restriction of processing, the right to object to the processing of your data.

8. Where the processing of personal data is based on a person’s consent to the processing of personal data (Article 6(1)(a) of the GDPR), you have the right to withdraw that consent at any time. Such revocation shall not affect the compatibility with applicable law of the processing carried out on the basis of consent prior to its revocation.

9. If you become aware of unlawful processing of your personal data, you have the right to lodge a complaint with the supervisory authority competent for data protection.

10. Where the processing of personal data takes place on the basis of the data subject’s consent, the provision of personal data by you to the Controller is voluntary.

11. The provision of personal data by you is mandatory where the prerequisite for the processing of personal data is a provision of law or an agreement concluded between the parties.

12. Your data may be processed by automated means and will not be profiled.

13. Your personal data will not be transferred to a third country/international organisation.