DATA PROCESSING NOTICE

INFORMATION ON THE PROCESSING OF YOUR PERSONAL DATA

We hereby inform you that we process your personal data. Details can be found below.

I. Personal Data Controller and Data Protection Officer:

The Personal Data Controller is Holiverse sp. z o.o. with its registered office in Warsaw (00-819), ul. Złota 75a lok. 7, a company entered in the Register of Entrepreneurs of the National Court Register [KRS] 0000875362 whose registration files are located in the District Court for the Capital City of Warsaw, Commercial Division, with the share capital of 5000PLN. NIP [Tax ID No.]: 7011011086; REGON [Business ID No.]: 387869809.

The Controller can be contacted at phone number: +48660432757 and via email address: tantrafestivalpoland@gmail.com

The Controller has appointed a Data Protection Officer (DPO) who can be contacted on all matters concerning the processing of personal data. The DPO’s contract details: Magda Darmas, milabo.mind@gmail.com

II. Purposes of and basis for the processing

Personal data will be processed for the following purposes:

1. concluding a sales contract based on interest in the Company’s offer (the basis under Article 6(1)(B) of the GDPR);

2. exercising the right to withdraw from the contract on the basis of Article 27 of the Act of 30 May 2014 on consumer rights (the basis under Article 6(1)(C) of the GDPR);

3. exercising warranty or guarantee rights under the Civil Code Act of 23 April 1964 (the basis under Article 6(1)(C) of the GDPR);

4. evidentiary (archival) purposes—securing information in case of a legal need to prove facts, which is a legitimate interest of the Company (the basis under Article 6(1)(F) of the GDPR);

5. possibly establishing, exercising or defending against claims which is a legitimate interest of the Company (the basis under Article 6(1)(F) of the GDPR);

6. surveying customer satisfaction and determining the quality of the Company’s service, which is a legitimate interest of the Company (the basis under Article 6(1)(F) of the GDPR);

7. the Company sending marketing offers (newsletter), information on discounts, new items and services available in its shop, based on the consent expressed for this purpose (the basis under Article 6(1)(A) of the GDPR).

III. Data recipients

The Company may share personal data with the following categories of entities:

1. the Company’s subcontractors, i.e. entities that the Company uses for processing: entities engaged in accounting and bookkeeping, courier, transportation, legal, tax, IT activities.

2. other independent recipients: banks and lessors whose activities enable the purchase of goods in the Company’s online shop in the installment system or lease of the object of purchase

IV. Data storage period

1. The Company processes data obtained for the purpose of concluding a sales contract until the end of the statute of limitations period for potential claims under the contract (claims also arising from warranty and guarantee);

2. the Company processes data obtained for marketing purposes until the authorized person withdraws the consent to their processing;

3. the Company processes data obtained on the basis of a legitimate interest until an objection to their processing is filled or when the Company finds them out-of-date.

V. Rights

The data subject has the following rights:

1. the right to access their data and receive a copy thereof;

2. the right to rectify (correct) their data;

3. the right to erase their data—if, in the data subject’s opinion, there are no grounds for the Company to process their data, they may request their erasure by the Company;

4. the right to restrict data processing—the data subject may request that we restrict the processing of their personal data only to storing the data or performing actions agreed upon with them if they believe that the Company has inaccurate data about them or is processing the data unfoundedly; or they do not want the data erased because they need them to establish, exercise or defend claims; or for the duration of their objection to the processing;

5. the right to object to data processing:

• marketing objection—the data subject has the right to object to the processing of their data against direct marketing. If they exercise this right, the Company will stop processing data for this purpose

• objection due to a particular situation—the data subject also has the right to object to the processing of their data on the basis of legitimate interests for purposes other than direct marketing. You should then explain to us your particular situation that you believe justifies us stopping the processing covered by the objection. We will stop processing your data for these purposes unless we demonstrate that the grounds for our processing of your data override your rights or that your data are necessary for us to establish, exercise or defend claims.

6. the right to data portability: the data subject has the right to receive from us in a structured, commonly used, readable format the personal data concerning the data subject that they have provided to us under a contract or their consent. They can also commission the data to be sent directly to another entity.

7. the right to lodge a complaint with a supervisory authority—if the data subject believes that we are processing their data unlawfully, they may file a complaint on this matter with the President of the Polish Personal Data Protection Office or any other competent supervisory authority

8. the right to withdraw consent to the processing of personal data—at any time they have the right to withdraw their consent to the processing of personal data that we are processing on the basis of their consent. The withdrawal of consent will not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal.

You can exercise your rights by contacting the Company at: tantrafestivalpoland@gmail.com.

VI. Information about the voluntary provision of the data

In each case listed in Section II, the provision of personal data is voluntary. Refusal to provide them may make it impossible:

1. to conclude a contract/agreement with the Company,

2. for the Company to send a newsletter,

3. to carry out purposes based on the legitimate interests of the Controller

VII. Transfer of data to third countries and profiling

Personal data will not be transferred to third countries or international organizations.

Personal data will not be subjected to automated decision-making, including profiling.