In connection with the provided services, the Service Provider shall be the administrator of personal data. Acting as the administrator of personal data, the Service Provider shall decide on the means and purposes of processing personal data for the purposes of the provided services. The Service Provider shall administer the personal data provided by both the Organizer and the Participant.
By accepting the Regulations, the Participant and the Organizer consent to the processing of their personal data. Providing personal data by the Organizer or Participant is voluntary, however, lack of consent to their processing may prevent the Service Provider from providing services and participation in the event.
The nature of the processing of personal data shall be determined by the role of the Service Provider as the entity providing services and is aimed solely at the performance hereof. The processing and collection of personal data shall take place in particular in the field of registration, handling and implementation of the event, transmission and recording, storage and display of audio-video recording, as well as its processing or other modification.
The Service Provider shall not be obliged to pursue a data protection policy, nor are they obliged to apply approved codes of conduct.
The Service Provider shall not transfer data to third countries.
The Service Provider shall not be obliged to appoint a personal data inspector.
The Service Provider may disclose personal data to third parties operating within their structure and at their request or from outside their structure in order to process the personal data for the purpose of providing services. Such entities have been acquainted with the generally applicable provisions on the processing and protection of personal data and have the necessary knowledge in this regard. Such entities have obtained the necessary authorizations for the processing of personal data, are obliged to protect personal data, in particular against disclosure to unauthorized entities, and to keep such personal data confidential indefinitely. In addition, these entities take all measures required by law to ensure the security of personal data processed.
The Service Provider shall process personal data only to the extent necessary to provide services covered by the content hereof. Such personal data include in particular:
from the Organizer: name, surname, image, e-mail address, telephone number, registered office or address of residence, details of the bank account and payments resulting from the concluded contract, tax identification number, PESEL number, information about the device from which logging into the Platform takes place,
from the Organizer’s representative: name, surname, image, e-mail address, telephone number, function performed, information about the device from which the login to the Platform takes place,
from to the Participant: name, surname, image, e-mail address, telephone number, function performed, data on the scope of participation in the event, information about the device from which the login to the Platform takes place.
As the administrator, the Service Provider shall process personal data in accordance with the generally applicable provisions of law and in the manner required to ensure their appropriate security in connection with the services provided. The Service Provider shall process personal data if at least one of the following conditions is met:
the data subject has consented to the processing of their personal data for one or more specific purposes;
processing is necessary for the performance of an agreement to which the data subject is party or in order to take steps at the request of the data subject prior to entering into an agreement;
processing is necessary to fulfill the legal obligation incumbent on the controller;
processing is necessary to protect the vital interests of the data subject or of another natural person;
The Service Provider shall not process personal data listed in Art. 9 of the GDPR.
Taking into account the state of technical knowledge, the cost of implementation and the nature, scope, context and purposes of processing as well as the risk of violating the rights or freedoms of natural persons with different probability and severity, the Service Provider shall implement appropriate technical and organizational measures to ensure the level of security corresponding to this risk, including, but not limited to:
pseudonymization and encryption of personal data,
the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
the ability to quickly restore the availability and access to personal data in the event of a physical or technical incident;
regularly testing, measuring and evaluating the effectiveness of technical and organizational measures to ensure safety.
Taking into account the nature, scope, context and purposes of processing and the risk of violating the rights or freedoms of natural persons of varying probability and seriousness, the administrator (i.e. the Service Provider) shall implement appropriate technical and organizational measures to ensure that the processing takes place in accordance with generally applicable law and to be able to demonstrate it. Such measures are reviewed and updated as necessary.
If the breach of personal data protection may result in a high risk of violation of the rights or freedoms of natural persons, the Service Provider shall notify the data subject of such breach without undue delay. The Service Provider shall not notify about a personal data breach if:
appropriate technical and organizational security measures have been implemented and these measures have been applied to the personal data concerned by the breach, in particular measures such as encryption, preventing unauthorized access to the personal data from being read;
measures were taken to eliminate the likelihood of a high risk of violating the rights or freedoms of a person,
it would require a disproportionate effort. In such a case, a public notice is issued or a similar measure is applied whereby the data subjects are informed in an equally effective manner.
The Service Provider shall store personal data for the period necessary to fulfill all obligations related to the provision of services. After the end of such provision of services, the Service Provider shall immediately delete the personal data, unless their preservation is necessary for public purposes or is required by generally applicable law, in particular tax regulations. The Service Provider shall use appropriate inventory and deletion systems of personal data for their immediate disposal after the expiry of the period in which their processing was necessary.
The person whose data is processed may withdraw consent to their processing at any time. The Service Provider shall then be obliged to immediately delete personal data, unless their processing is required by generally applicable law.
The Service Provider shall:
Allow to obtain information about the processed personal data, including, in particular, the purposes and legal grounds for processing, the scope of personal data held, entities to whom the data is disclosed and the planned date of deletion of personal data,
Allow to obtain a copy of the personal data processed by the Service Provider,
Enable the rectification of incomplete or incorrect personal data,
Delete personal data to the extent that its processing is not necessary for the purposes for which they were collected or processed, consent to its processing has been withdrawn, objections to the processing of personal data have been raised, there is no basis for the processing of personal data, personal data is processed inconsistently with the law,
limit the processing of personal data, if the data subject questions the correctness of the personal data, the processing is unlawful, and the data subject opposes the deletion of personal data and requests the restriction of its use instead, does not need the personal data to the purposes of the processing.
All complaints, notifications, notifications regarding the processing of personal data should be sent to the following e-mail address:{' '} support@gridaly.com or by post to the following address: Gridaly Sp. z o.o. with its registered office in Warsaw, ul. Nowogrodzka 64, office 43, 02-014 Warsaw.
The data subject shall have the right to lodge a complaint regarding the processing of their personal data by the Service Provider to the supervisory body, President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw.