GDPR 

GENERAL INFORMATION CLAUSE 

Pursuant to Article 13 paragraphs 1-2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – (Text with EEA relevance), hereinafter referred to as the “GDPR“, we hereby inform you that: 

1. The controller of your personal data is “MERCOR” Spółka Akcyjna with its registered office in Gdańsk, 80-408 Gdańsk, Grzegorza z Sanoka Street 2 (“Controller” or “MERCOR”) – which can be contacted by email at odo@mercor.com.pl
2. MERCOR processes your personal data on the basis of: 
   • Article 6 paragraph 1 letter a) of the GDPR
   • Article 6(1)(b) of the GDPR – for the performance of a contract or to take steps prior to entering into a contract,
   • Article 6(1)(c) of the GDPR – to comply with a legal obligation to which the Controller is subject, 
   • Article 6(1)(f) of the GDPR – to pursue legitimate interests pursued by the Controller or by a third party, 
   • Article 6(1)(f) of the GDPR – for archival (evidential) purposes, which are the pursuit of our legitimate interest in securing information in the event of a legal need to prove facts and for the possible establishment, exercise, or defense against legal claims, which are the pursuit of our legitimate interest in this respect, 
   • Article 6(1)(f) of the GDPR – for customer satisfaction surveys, which are the pursuit of our legitimate interest in determining the quality of our service and the level of customer satisfaction with our products and services. 
3. You have the right to object to the processing of your data described above at any time. We will cease processing your data for these purposes unless we can demonstrate that we have compelling legitimate grounds for processing your data that override your interests, rights, and freedoms, or that your data is necessary for the establishment, exercise, or defense of potential claims. 
4. Please remember that providing your personal data is voluntary; however, failure to provide it will prevent the conclusion and performance of the contract. 
5. MERCOR processes personal data for the duration of negotiations, the performance of the contract, or services provided after its termination – until the expiry of the limitation period for claims, including the limitation period for tax liabilities. 
6. Your personal data will also be processed by MERCOR for marketing purposes: its own products and services.
7. The categories of recipients to whom your personal data has been or will be disclosed by MERCOR include MERCOR employees and associates. Your data may also be accessed by recipients such as IT companies, postal operators, couriers, suppliers, transport companies, banks (for payroll purposes), employee benefit providers, employee insurance providers, advisory, accounting, and tax advisory services, and claims settlement service providers. 
8. Generally, your personal data will not be transferred to recipients in third countries or international organizations. An exception to this may be statistical or analytical data. In this case, MERCOR transfers your personal data to a so-called “third country” within the meaning of the GDPR, namely the United States of America. 
   The United States of America is a country that is not part of the European Economic Area and does not meet the high standards of personal data protection in force in the European Union. However, your personal data is safe – we use a mechanism for transferring personal data between the European Union and the United States of America that complies with EU law. MERCOR entrusts the processing of personal data to processors (e.g., Google) based on data processing agreements containing Standard Contractual Clauses (SCCs). SCCs are model clauses adopted by the European Commission, referred to in Article 46(2)(c) of the GDPR, which aim to facilitate the transfer of personal data while ensuring a level of data protection equivalent to that provided for in the GDPR. 
9. There will be no automated decision-making, including profiling, during the processing of your personal data. 
10. You have the right to access your personal data, the right to rectify it, erase it, restrict its processing, transfer it, object to its processing, or withdraw consent to its processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal. 
11. You also have the right to lodge a complaint with the supervisory authority, i.e., the President of the Personal Data Protection Office.