GDPR - information about personal data

(In the scope of personal data of the controller's contractors, personal data of persons employed or applying for employment by the controller)
Personal data are processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR. The controller of personal data is an entrepreneur entered in the Central Register and Information on Business Activity maintained by the minister responsible for the economy and maintaining the Central Register and Information on Business Activity:

1. Piotr Hoffman, Tax Identification Number (NIP) 9512077559, National Business Registry Number (REGON) 015342000, operating under the name PIOTR HOFFMAN, partner in the civil partnership HAMED - partner in the civil partnership.
2. Andrzej Hoffman, Tax Identification Number (NIP) 5210411203, National Business Registry Number (REGON) 011829023, operating under the name ANDRZEJ HOFFMAN, partner in the civil partnership HAMED - partner in the civil partnership.
3. Magdalena Hoffman, Tax Identification Number (NIP) 1132637172, National Business Registry Number (REGON) 140881147, operating under the name MAGDALENA HOFFMAN, partner in the civil partnership HAMED - partner in the civil partnership. civil

conducting business activity within a civil partnership under the name Hamed Spółka Cywilna Piotr Hoffman, Andrzej Hoffman, Magdalena Hoffman with its registered office at ul. Migdałowa 31, 02-796 Warsaw, NIP 9512494949, REGON number 384980417. .
In matters concerning the processing of personal data and the exercise of rights related to the processing of personal data, you can contact us by writing to the e-mail address: sklep@medimall.pl.
The Controller processes personal data in particular:
- pursuant to art. 6 sec. 1 letter a) of the GDPR – the data subject has consented to the processing of his or her personal data for one or more specific purposes – in particular for the purpose of maintaining contact with the data subject; sharing or delivering (including by e-mail) commercial information, other information or product samples; organizing, conducting and documenting events, including competitions, promotions and other marketing campaigns;
- pursuant to art. 6 sec. 1 letter b) of the GDPR – processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject before entering into a contract – in particular in order to exercise all rights and obligations arising from contracts concluded by the controller;
- pursuant to art. 6 sec. 1 letter c) of the GDPR – processing is necessary for compliance with legal obligations to which the controller is subject – in particular in order to exercise the rights and obligations of the controller resulting from applicable legal provisions, in particular in the field of tax law, labor law and social security;
- pursuant to art. 6 sec. 1 letter b) of the GDPR f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the controller – in particular for the purpose of pursuing claims.
The recipients of personal data are persons employed by the controller (under an employment contract or another agreement) and trusted entities cooperating with the controller – to the extent necessary to achieve the purposes of processing; personal data may also be made available to public authorities and other entities authorized to do so under legal provisions, at their request. The controller does not intend to transfer personal data to a third country or to international organizations.
Personal data are stored:
- in the case of data processed on the basis of art. 6 sec. 1 letter a) GDPR – until the processing purposes indicated in the consent granted are achieved;
- in the case of data processed on the basis of art. 6 sec. 1 letter b) GDPR – until the parties to the contract have fulfilled all obligations related to the performance of the contract, and then until the expiry or limitation period for any claims related to the contract has elapsed;
- in the case of data processed on the basis of art. Article 6 paragraph 1 letter c) of the GDPR – until the controller complies with the legal obligation to keep documentation;
- in the case of data processed under Article 6 paragraph 1 letter f) of the GDPR – until the purposes of processing have been achieved, in particular until the claim is satisfied, expires or is time-barred. The data subject has the right to request from the controller access to their personal data and, in the cases specified in the GDPR, also rectification, erasure or restriction of processing; they also have the right to data portability.
The data subject has the right to lodge a complaint with the data protection supervisory authority provided by law if they believe that the processing of their personal data infringes the provisions of the GDPR.
In the case of personal data processed under Article 6 paragraph 1 letter a) of the GDPR, the data subject has the right to withdraw consent to the processing of such data at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent may occur, for example, by sending a declaration of withdrawal of consent by email to the following address: sklep@medimall.pl
In the case of personal data processed under Article 6(1)(a) of the GDPR, providing personal data is not a statutory or contractual requirement and is voluntary. However, failure to provide data may result in preventing or hindering the achievement of the processing purposes, in particular, inability to contact the controller; failure to provide commercial information, other information, or product samples; and inability to participate in events, including contests, promotions, and other marketing campaigns. In other cases, providing personal data may be a statutory or contractual requirement if so required by law or contractual provision. No automated decision-making, including profiling, occurs in connection with the processing of personal data by the controller.