Privacy policy

I. Data of the Personal Data Administrator
We kindly inform you that the administrator of your personal data is PATON Europe Sp. z o. o., 35-213 Rzeszów, ul. Kapitałowa 4, NIP: 813 375 25 15 .hereinafter referred to as the “Company”. Contact with the Company regarding personal data protection is possible at the following e-mail address: biuro@paton.pl.

II. Purposes and grounds for processing personal data
In order to provide services in accordance with its business profile, the Company processes your personal data – for various purposes, but always in accordance with the law. Below you will find the specified purposes of the processing of your personal data together with the legal bases.

For the purposes of the service quotation and the performance of the service, we process personal data such as:

• your name or possibly your company name
• delivery address
• e-mail address
• VAT number in the case of an entrepreneur
• order number
• date of registration.

The legal basis for such data processing is Article 6(1)(b) of the RODO, which allows us to process personal data if it is necessary for the performance of a contract or taking steps to conclude a contract

In order to process a complaint, we process such personal data as:

• name or possibly company
• e-mail address
• order number,
• residence address, if applicable – if a refund is made,
• possibly bank account number – if a refund is made.

The legal basis for such data processing is Article 6(1)(b) RODO, which allows us to process personal data if it is necessary for the performance of a contract or for taking steps to conclude a contract;

For the purpose of sending email notifications about messages in the customer panel, we process personal data such as:

• e-mail address,
• order number.

The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, the Company’s interest is to inform the customer about activities related to the performance of the service in order to enhance the customer’s experience of the service);

In order to contact us by telephone on matters related to the provision of the service, we process personal data such as:

• telephone number
• order number
• insofar as you are interested in a form of telephone contact (we do not require a mandatory telephone number). The legal basis for such data processing is Article 6(1)(a) RODO, which allows us to process personal data on the basis of freely given consent;

For the purpose of issuing an invoice and fulfilling other obligations under tax law, such as keeping accounting records for 5 years, we process personal data such as:

• name or possibly company
• company,
• residential or business address,
• VAT number,
• order number.

The legal basis for such processing is Article 6(1)(c) of the RODO, which allows us to process personal data if such processing is necessary for the Data Controller to comply with its obligations under the law;

In order to store unpaid enquiries, we process personal data such as:

• name or possibly company
• e-mail address
• order number
• as it may happen that you decide to use the service some time after receiving the quote. The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company’s interest is to enable the conclusion of a contract for a certain period of time without having to repeat the valuation);

In order to create records and registers related to the RODO, including, for example, a register of customers who have objected in accordance with the RODO, we process personal data such as:

• name,
• email address,
  the RODO regulations impose certain documentation obligations on us to demonstrate compliance and accountability, so if you object to the processing of your personal data for marketing purposes, for example, we need to know who we do not use direct marketing against because they do not wish it.

The legal basis for such processing is firstly, Article 6(1)(c) of the RODO, which allows personal data to be processed if such processing is necessary for the Personal Data Controller to comply with its obligations under the law; secondly, Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, the Company’s interest is to know about individuals who are exercising their rights under the RODO);

For the purposes of establishing, investigating or defending against claims, we process personal data such as:

• name or possibly company name,
• residential address (if provided),
• PESEL number or NIP number (if provided),
• e-mail address,
• IP,
• order number.

The legal basis for such processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company’s interest is to have personal data to establish, assert or defend against claims, including those of customers and third parties);

For archival and evidential purposes, we process personal data such as:

• name (if provided),
• e-mail address,
• order number
• for the purpose of safeguarding information that can serve to prove facts of legal significance. The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, the Company’s interest is to have personal data to prove certain facts related to the provision of services, e.g. when some state authority requests it);

For analytical purposes, i.e. researching and analysing activity on a website belonging to the Company, we process personal data such as:

• date and time of website visit,
• type of operating system,
• approximate location,
• type of Internet browser used to view the website,
• time spent on the website,
• sub-pages visited,
• the subpage where the contact form was filled in.

The legal basis for such processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller is pursuing its legitimate interest (in this case, the Company’s interest is to learn about customer activity on the website);

In order to use cookies on the website, we process such textual information. The legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent (when you first access the website, you are asked if you agree to the use of cookies);

In order to administer the website, we process personal data such as:

• IP address,
• date and time of the server,
• information about your browser,
• information about the operating system
• these data are saved automatically in so-called server logs every time the website belonging to the Company is used. Administration of the website without the use of a server and without this automatic recording would not be possible. The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company’s interest is the administration of the website);

Newsletter subscription

Insofar as you have consented to subscribe to the Newsletter, the email address you provide will be used for marketing purposes of Paton.pl’s own products.
You can withdraw your consent at any time, e.g. by writing to us at newsletter@paton.pl.

In this email, you must provide your email address given when signing up for the Newsletter and the name of the person signing up. Unsubscribing from the Newsletter will be carried out immediately.

PRIVACY OF CHILDREN
The services we offer are not intended for children under the age of 16. For these reasons, we would like to inform you that if we become aware that we are processing the personal data of children under the age of 16 without the consent of their legal guardians, we will take appropriate steps to delete this data as soon as possible.

We do not knowingly process the personal data of children under the age of 16 without the valid consent of their legal guardians.

III. Cookies
The company on its website, as well as other entities, uses so-called cookies, i.e. short text information which is stored on your computer, phone, tablet or other device. They can be read by our system and also by systems belonging to other entities whose services we use (e.g. Facebook, Google).
Cookies perform a very large number of functions on the website, most often useful ones, which we will try to describe below (if the information is insufficient, please contact us):
ensuring security – cookies are used to authenticate users and prevent unauthorised use of the customer panel. They therefore serve to protect the user’s personal data from unauthorised access;
impact on website processes and performance – cookies are used to ensure that the website functions smoothly and that you can use the functions available on it, which is made possible, among other things, by remembering your settings between visits to the site. They therefore enable you to navigate the website and its various pages efficiently;
session status – cookies often store information about how visitors use the website, e.g. which pages they view most often. They also make it possible to identify errors displayed on certain sub-pages. Cookies for storing the so-called “session state” therefore help to improve services and the browsing experience;
maintaining the session state – if the customer logs in to their panel, cookies make it possible to maintain the session. This means that you do not have to re-enter your login and password each time you move to another sub-page, which promotes the comfort of using the website;
creation of statistics – cookies are used to analyse how visitors use the website (how many open the website, how long they stay, which content is of most interest, etc.). This allows the website to be continuously improved and adapted to users’ preferences. We use Google’s tools, such as Google Analytics, to track activity and generate statistics; in addition to reporting website usage statistics, the Google Analytics pixel can also be used, together with some of the cookies described above, to help display more relevant content to you on Google’s services (e.g. Google Search) and across the web;
use of social features – we have a so-called Facebook pixel on the website, which allows you to like our Facebook fanpage when you use the website. However, for this to be possible, we must use cookies provided by Facebook.
By default, your browser permits the use of cookies on your device, so please allow cookies on your first visit. However, if you do not wish to use cookies when browsing the website, you can change the settings in your browser – block cookies completely or request to be notified each time a cookie is placed on your device. You can change your settings at any time.
While respecting the autonomy of all persons using the website, we feel obliged to warn you that disabling or restricting the use of cookies may cause quite serious difficulties in the use of the website, e.g. in the form of having to log in to every subpage, longer loading times, restrictions on the use of functionalities, restrictions on liking the Facebook page, etc.
IV. Right to withdraw consent
If the processing of your personal data is based on your consent, you may withdraw this consent at any time – at your discretion.
If you would like to withdraw your consent to the processing of personal data, it is sufficient to do so:
send an e-mail directly to the Company at biuro@paton.com.pl or
click on the link in the e-mail attached at the end of the message or
delete a posted comment under an article or
delete a posted service review.
If the processing of your personal data was carried out on the basis of your consent, the withdrawal of this consent does not render the processing of your personal data until that point illegal. In other words, until your consent is withdrawn, we are entitled to process your personal data and the withdrawal of consent does not affect the lawfulness of the previous processing.
V. Requirement to provide personal data
The provision of any personal data is voluntary and at your discretion. However, in some cases, the provision of certain personal data is necessary in order to meet your expectations for the use of the services.
In order to request a service on the website, it is necessary to provide your name and e-mail address – without this, we are unable to conclude and perform the contract.
In order for you to be able to receive an invoice for the services, it is necessary to provide all the data required by the tax law, i.e. your name and surname or company name, your home or business address, your VAT number – without this we are not able to invoice you correctly.
In order to be able to contact you by telephone regarding the provision of the service, it is necessary to provide a telephone number – without this we are unable to make telephone contact.
If you wish to receive SMS notifications about messages in the customer panel, it is necessary to provide a telephone number – without this we are not able to send messages.
If you wish to receive discounts on future services, it is necessary to provide your name and e-mail address – without this we are not able to send discount codes.
VI. Automated decision-making and profiling
We kindly inform you that we do not carry out automated decision-making, including on the basis of profiling. The content of the enquiry that is sent via the contact form is not evaluated by the IT system. The proposed price of the service is in no way the result of an assessment by any IT system.

VII. Recipients of personal data
Like most businesses, we use the assistance of other entities in our activities, which sometimes involves the transfer of personal data. Therefore, if necessary, we pass on your personal data to the lawyers cooperating with us who perform the services, to companies handling fast payments, to an accounting company, to a hosting company, to a company responsible for sending sms messages, as well as to an insurance company (should there be a need to repair a damage).
In addition to this, it may happen that, for example, on the basis of a relevant legal provision or a decision of a competent authority, we will also have to pass on your personal data to other entities, whether public or private. Therefore, it is extremely difficult for us to predict who may come forward with a request for personal data. Nevertheless, for our part, we assure you that we analyse each request for personal data very carefully and very thoroughly so that we do not inadvertently pass on information to an unauthorised person.
VIII. Transfer of personal data to third countries
Like most businesses, we use various popular services and technologies offered by entities such as Facebook, Microsoft or Google . These companies are based outside the European Union and are therefore treated as third countries under the provisions of the RODO.
The RODO introduces certain restrictions on the transfer of personal data to third countries, since since, as a general rule, European rules do not apply there, the protection of personal data of EU citizens may unfortunately be insufficient. Therefore, each controller of personal data is obliged to establish the legal basis for such transfers.
For our part, we ensure that, when using our services and technologies, we only transfer personal data to entities in the United States and only to those that have joined the Privacy Shield programme, based on the European Commission’s implementing decision of 12 July 2016. – you can read more about this on the European Commission’s website available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have signed up to the Privacy Shield programme guarantee that they will comply with the high data protection standards that apply in the European Union, so the use of their services and the technologies they offer in the processing of personal data is lawful.
We will provide you with additional explanations at any time regarding the transfer of personal data, in particular if this issue is of concern to you.
You have the right to obtain a copy of personal data transferred to a third country at any time.
IX. Period of processing of personal data
In accordance with the applicable legislation, we do not process your personal data “indefinitely”, but for the time that is necessary to achieve the stated purpose. After this period, your personal data will be irreversibly deleted or destroyed.
Where we do not need to perform operations on your personal data other than storing them (e.g. when we store the contents of an order for the purpose of defending against claims), we additionally protect them – by pseudonymisation – until permanent deletion or destruction. Pseudonymisation involves encrypting personal data, or a set of personal data, in such a way that it cannot be read without an additional key, so that such information becomes completely useless to an unauthorised person.
Regarding the individual processing periods for personal data, we kindly inform you that we process personal data for the period of:
the duration of the contract – for personal data processed for the purpose of concluding and performing the contract;
3 years or 10 years + 1 year – with regard to personal data processed for the purpose of establishing, asserting or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
6 months – in relation to personal data collected when pricing a service and at the same time the contract was not concluded immediately;
5 years – with regard to personal data involving compliance with tax law obligations;
until the withdrawal of consent or the achievement of the purpose of the processing, but for no longer than 5 years – with regard to personal data processed on the basis of consent;‡.
until an effective objection is lodged or the purpose of the processing is achieved, but for no longer than 5 years – in relation to personal data processed on the basis of the legitimate interest of the Personal Data Controller or for marketing purposes;
until it becomes obsolete or no longer relevant, but for no longer than 3 years – in relation to personal data processed primarily for analytical purposes, the use of cookies and website administration.
We count the periods in years from the end of the year in which we started processing personal data in order to streamline the process of deleting or destroying personal data. Counting the period separately for each contract entered into would involve significant organisational and technical difficulties, as well as a significant financial outlay, so establishing a single date for the deletion or destruction of personal data allows us to manage the process more efficiently. Of course, in the event that you exercise your right to forget, such situations are dealt with on a case-by-case basis.
The additional year associated with the processing of personal data collected for the performance of a contract is dictated by the fact that, hypothetically, you may make a claim moments before the expiry of the limitation period, the demand may be served with a significant delay or you may misstate the limitation period for your claim.
X. Rights of data subjects
We kindly inform you that you have the right to:
access to your personal data;
rectification of your personal data;
erasure of your personal data;
restriction of the processing of your personal data;
to object to the processing of your personal data;
portability of personal data.
We respect your rights under data protection legislation and strive to facilitate the exercise of these rights to the greatest extent possible.
We point out that the rights listed are not absolute and therefore we may lawfully refuse you in certain situations. However, if we refuse to comply with a request, this is only after careful consideration and only if refusal of the request is necessary.
Regarding the right to object, we explain that you have the right to object at any time to the processing of personal data on the basis of legitimate interests of the Personal Data Controller (these are listed in section III) in relation to your particular situation. However, you must bear in mind that, in accordance with the legislation, we may refuse to take into account an objection if we show that:
there are legitimate grounds for the processing which override your interests, rights and freedoms, or
there are grounds for the establishment, assertion or defence of claims.
Furthermore, you may object at any time to the processing of your personal data for marketing purposes. In such a situation, upon receipt of your objection, we will cease processing for this purpose.
You can exercise your rights by:
sending an email directly to the Company at biuro@paton.pl or

• clicking on the link in the e-mail, attached at the end of the message or
• changing your data yourself in the customer panel, under “Data information”.
  XI. Right to lodge a complaint
  If you believe that your personal data is being processed contrary to applicable law, you may lodge a complaint with the President of the Personal Data Protection Authority.

XII. Final provisions
(1) To the extent not covered by this Privacy Policy, the provisions of the Personal Data Protection Act shall apply.

(2) Any changes to this Privacy Policy shall be notified to you by e-mail.

3. this Privacy Policy is effective as of 25 May 2018.