1. The Controller of your personal data is Cardinal Cryptography sp. z o.o. with headquarters in Kraków (30-519), at. Jana Zamoyskiego Street 79a, entered into the Register of Entrepreneurs maintained by the District Court for Krakow-Śródmieście in Kraków, XI Division of the National Court Register at KRS number: 0000780223, share capital: 7500 PLN.;
2. The Controller processes the following categories of personal data: identification data, address data, contact details, and other data, possibly, if these are necessary for the purposes for which the Controller processes the data;
3. Personal data may be processed by the Controller for the following purposes:
a) the implementation of the agreement you have concluded with the Controller, or taking action at your request, prior to the conclusion of the agreement (Article 6 section 1 letter b of the GDPR), including, for instance, making an offer;
b) conducting direct marketing of the Controller’s products and services, which constitutes the Controller’s legitimate interest (Article 6 section 1 letter f of the GDPR);
c) answering your inquiries or correspondence addressed to the Controller, which constitutes the legitimate interest of the Controller (Article 6 section 1 letter f of the GDPR);
d) complying with legal obligations incumbent on the Controller (Article 6 section 1 letter c of the GDPR);
e) asserting or defending against claims, which constitutes a legitimate interest of the Controller (Article 6 section 1 letter f of the GDPR);
4. The Controller may store your personal data for the following periods:
a) in the case of data processed in order to implement an agreement or take action at your request – for the period required by the provisions of law and the period necessary to assert one’s claims or to defend against claims made against the Controller;
b) in the case of data processed in order to conduct marketing – until an objection to the processing for that purpose is raised, the consent is withdrawn, or the Controller decides to delete them;
c) in the case of data processed in order to answer your inquiries or correspondence – for the period of 3 years from the sending of the inquiry or correspondence;
d) in the case of data processed in order to comply with legal obligations incumbent on the Controller – for the period required by the provisions of the law;
e) in the case of data processed in order to assert or defend against claims – for the period of limitation of potential claim
5. The Controller processes personal data that comes from you or an entity with which you are associated; the Controller may also process data from open-access sources;
6. Personal data may be facilitated to entities providing marketing, human resources, accounting, and legal services for the Controller, IT service providers, as well as entities participating in the process of performing an agreement between the data subject and the Controller;
7. The Controller may use the services of IT service providers who are based in the USA and thus outside the European Union. Therefore, your personal data may be transferred there. The Controller uses entities that process personal data on the basis of the Standard Contractual Clauses adopted by the European Commission, referred to in Article 46 of the GDPR, concluded between the Controller and the entity.
8. The data subject shall have the following rights:
a) the right of access to the personal data provided and the right to obtain a copy thereof;
b) the right to rectification of personal data;
c) the right to deletion of personal data;
d) the right to request the restriction of the processing of personal data;
e) the right to transfer personal data;
f) the right to oppose the processing of the personal data provided;
g) the right to file a complaint with a regulatory organ.
9. In the case of the processing of data on the basis of consent, the data subject shall also have the right to withdraw consent to the processing of personal data at any time; the withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.