Privacy
Data confidentiality and protection of our clients' privacy is a priority for us. Therefore, out of concern for the security of your personal data at Sun&Snow Sp. z o.o., ul. Gałczyńskiego 4, 02-672 Warszawa, a policy has been established specifying the rules on how to process personal data.
We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ( General Data Protection Regulation, hereinafter referred to as the GDPR).
Personal data administrator
The administrator of your personal data within the meaning of art. 4 item 7) of the GDPR is Sun&Snow Sp. z o.o., ul. Gałczyńskiego 4, 02-672 Warsaw.
Contact with the Administrator
In all matters related to the processing of personal data, you can contact the Administrator at the above-mentioned registered office address or by e-mail: dane@sunandsnow.pl or by calling 22 450 26 60.
Source of obtaining personal data
Personal data is obtained directly from you or from third parties / entities, e.g. the entity on behalf of which you are acting or our Partners, as well as from other publicly available registers. We also obtain information from completed contact forms or through cookies.
Scope of processed personal data
In the event of contact with the Administrator via the website or contact details provided on the website, the Administrator processes the data provided by you in order to make contact (as well as, among others, make a reservation, register the owner of the facility) including name, surname, e-mail address or telephone number, the content of the question or issue raised, and possibly other data that you have provided. In connection with the use of cookies for statistical purposes, the Administrator may process the following data: IP address, duration of a given session, frequency of visits to the website.
Purpose and legal basis for the processing of personal data
| Purpose of data processing |
Legal basis |
|
Replying to the person or contacting the person who contacted the Administrator |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Activities aimed at concluding and implementing a contract - if you are a party to the contract. |
Data processing is necessary for the conclusion and performance of the contract - Art. 6 sec. 1(b) of the GDPR. |
|
Actions aimed at implementing the booking service and concluding a rental agreement. |
Data processing is necessary for the conclusion and performance of the contract - Art. 6 sec. 1(b) of the GDPR. |
|
Ensuring contacts necessary to service and implement the contract concluded with the entity on behalf of which you are acting and to maintain business contacts. |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Carrying out activities to improve and coordinate the Administrator's work, including recording correspondence. |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Consideration of possible complaints, as well as determination, investigation and defence against claims. |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Implementation of legal obligations imposed on the Administrator, regarding, among others, accounting processes and documentation, as well as exercising the rights of data subjects. |
Fulfilment of the legal obligation incumbent on the Administrator - Art. 6 sec. 1(c) of the GDPR.
|
|
Sending marketing content in the form of a newsletter (containing in particular information about the company, current offer, etc.) by e-mail. |
Voluntary consent - Art. 6 sec. 1(a) of the GDPR. |
|
Conducting direct marketing activities. |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Conducting the recruitment process and selecting the right person for employment. |
To the extent resulting from Art. 22(1) of the Labour Code, the legal basis is the legal obligation incumbent on the Administrator (Article 6(1)(c) of the GDPR). This applies to such data as: name (names) and surname, date of birth and contact details indicated by the job candidate. If it is necessary to perform work of a specific type or in a specific position, this also applies to information on education, professional qualifications and previous employment. The legal obligation incumbent on the Administrator also includes those data, the provision of which is necessary to exercise the right or fulfil the obligation resulting from the law. If a job candidate provides personal data in a wider scope than specified in the provisions of labour law, the legal basis for their processing in the abovementioned purpose is the consent of the candidate (Article 6(1)(a) of the GDPR). This applies to all data provided by the job candidate in the curriculum vitae (CV), cover letter or made available during job interviews. |
|
Collecting information about website traffic statistics. |
The legitimate interest of the Administrator - Art. 6 sec. 1(f) of the GDPR.
|
|
Fulfilment of people's requests, consideration of a request regarding personal data. |
Compliance with the legal obligation to consider your application (Article 6(1)(c) of the GDPR).
|
|
Setting up and maintaining an account on the Administrator's website at: https://www.sunandsnow.pl/ |
The legal basis for the processing of your personal data in order to use the account is the necessity of their processing to implement the contract, consisting of Sun&Snow Sp. z o. o. providing electronic services in the form of an account on the website (Article 6(1)(b) of the GDPR). |
|
Making purchases in the online store. |
Data processing is necessary for the conclusion and performance of the contract - Art. 6 sec. 1(b) of the GDPR. |
Profiling of personal data
Your personal data will not be used to make automated decisions, including profiling.
Recipients of personal data
The recipients of your personal data will be:
- a) authorised personnel of the Administrator,
- b) entities processing personal data at the request of the Administrator to fulfil the purposes for which the data is collected (in particular entities providing IT solutions and providing IT and technical support services). These entities must have access to the data to perform their duties. These entities will have access to personal data only to the extent necessary to perform their tasks.
- c) public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for purposes resulting from the provisions of generally applicable law.
Can your personal data be transferred outside the European Economic Area?
Due to the fact that the Administrator uses the Google Analytics tool, personal data may be transferred outside the European Economic Area. In connection with the transfer of data outside the EEA, the Administrator made sure to use only suppliers that guarantee a high level of personal data protection. The Administrator ensures that the transfer of data to entities operating outside the European Economic Area takes place with the use of appropriate safeguards, based on an appropriate agreement between the Administrator and such entity containing standard contractual clauses adopted by the European Commission. The content of the agreement is available from the Administrator.
Personal data storage period
The period of data processing depends on the purposes and grounds for their processing, therefore:
- a) data processed on the basis of statutory requirements will be processed for the time in which the law requires data storage;
- b) data processed for the purpose of concluding and performing the contract will be processed for the period necessary for its implementation and settlement, which may be extended, if appropriate, by the period of limitation of civil law claims.
- c) data processed on the basis of the Administrator's legitimate interest will be processed until the objection is effectively filed or this interest ceases, e.g. data processed for the purpose of pursuing or defending against claims will be processed for a period equal to the period of limitation of these claims.
- d) data processed on the basis of consent will be processed until the consent is withdrawn.
- e) personal data processed for recruitment purposes will be stored until the recruitment in which you participate is completed. In the case of an additional consent to the use of data for future recruitment purposes, your data will be stored for a period of 9 months.
- f) personal data regarding the account will be processed until your account is deleted. The desire to delete the account should be reported by e-mail to rezerwacja@sunandsnow.pl or by calling 22 450 26 26. In addition, Sun&Snow Sp. z o. o. has the option to delete your account if you violate the provisions of the regulations. Your account will also be deleted if it has been inactive for five years.
Is it your duty to provide your personal data?
Providing your personal data is voluntary, but necessary to achieve your desired goal, such as using the website, concluding a contract, receiving a response to your inquiry or the issue raised by you.
The Administrator indicates that the candidate's provision of personal data indicated in Art. 22(1) of the Labour Code is mandatory under applicable labour law. Failure to provide them will result in the inability to participate in the ongoing recruitment process. Providing personal data by the candidate in a wider scope than resulting from Art. 22(1) of the Labour Code is voluntary. The Administrator declares that the failure to provide such data may not be the basis for unfavourable treatment of the person applying for employment, and may not cause any negative consequences for them, in particular it may not be a reason for refusing employment.
Your rights
You have the right to:
- a) request access to your personal data, rectification, deletion or limitation of processing, as well as the right to transfer data,
- b) if the basis for the processing of personal data is the legitimate interest of the Administrator - the right to object at any time to the processing of personal data for reasons related to the particular situation of the person,
- c) if the legitimate interest consists of conducting direct marketing activities - the right to object at any time to the processing of personal data for the purposes of marketing activities, without the need to justify your decision,
- d) withdrawal of consent at any time without affecting the lawfulness of the processing which was made on the basis of consent before its withdrawal,
- e) lodge a complaint with the supervisory body, i.e. the President of the Office for Personal Data Protection.
A request to exercise your rights can be submitted to the contact details provided at the beginning.
Cookies
The website uses so-called cookies that process your personal data for statistical purposes. The website uses cookies offered by Google Analytics. For more information, please visit: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage