01Data controller
The controller of your personal data is NEST Wojciech Szymała, ul. Gałczyńskiego 4/6, 46-203 Kluczbork, Poland, NIP (tax ID): 7511709803 (the Controller).
For matters concerning personal data, you can contact the Controller by post at the address above, by e-mail at kontakt@nestit.pl or through the contact form, choosing the topic “Other”. The Controller has not appointed a data protection officer, as it is not required to do so.
This policy applies to the NEST website and describes how data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
02What data we process
Contact form data: your name and e-mail address (required), and the name of your company or institution, phone number, topic and message, if you provide them.
Technical data: the server hosting the website automatically records in its logs the IP address, the date and time of the visit, the address of the page opened, and information about the browser and operating system.
Please do not include special categories of data (for example about health) or other people's data in your message unless necessary.
03Purposes and legal bases
- Replying to your enquiry and further correspondence: the Controller's legitimate interest in communicating with people who contact it (Article 6(1)(f) GDPR).
- Preparing an offer or contract, if you ask for one: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). If you act on behalf of a company or institution, the basis is the Controller's legitimate interest in contacting a representative of the counterparty (Article 6(1)(f) GDPR).
- Performing a concluded contract and meeting tax and accounting obligations: Article 6(1)(b) and (c) GDPR.
- Establishing, pursuing or defending legal claims: the Controller's legitimate interest (Article 6(1)(f) GDPR).
- Security and proper operation of the website (technical data in server logs): the Controller's legitimate interest (Article 6(1)(f) GDPR).
Providing data in the form is voluntary, but without your name and e-mail address we will not be able to reply. The Controller does not make automated decisions about you and does not use profiling.
04How long we keep data
- Form enquiries: for the duration of the correspondence, then for 12 months from the last contact in case the conversation continues. If you successfully object earlier, the data will be deleted sooner.
- Data related to a concluded contract: for the term of the contract and, after it ends, until the limitation periods for claims and the document retention periods required by tax and accounting law have expired.
- Server logs: no longer than 30 days, unless they are needed to investigate a security incident.
05Who we share data with
Data may be shared only with entities that help the Controller run the website and communications, under data processing agreements:
- the hosting provider whose servers run the website,
- the e-mail provider and the service that handles form submissions,
- providers of accounting and legal services, where needed in connection with a concluded contract.
Data may be disclosed to public authorities only where the law requires it.
06Transfers outside the EEA
The Controller does not transfer your data to countries outside the European Economic Area. Should this become necessary in the future, it will happen only with the safeguards required by the GDPR (for example standard contractual clauses), and this policy will be updated accordingly.
07Your rights
In connection with the processing of your data, you have the right to:
- access your data and receive a copy (Article 15 GDPR),
- rectify your data (Article 16 GDPR),
- erase your data (Article 17 GDPR),
- restrict processing (Article 18 GDPR),
- data portability for data processed under a contract (Article 20 GDPR),
- object to processing based on the Controller's legitimate interest (Article 21 GDPR).
To exercise these rights, contact the Controller as described under Data controller. We will reply without undue delay and in any case within one month.
If you believe your data is being processed unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
09Security
The Controller uses technical and organisational measures appropriate to the risk, in particular an encrypted connection to the website (HTTPS), restricted access to data and regular software updates.
10Changes to this policy
This policy may be updated, for example following changes in the law or in how the website works. The current version is always available on this page together with the date from which it applies.