GDPR Information Clause

I. Personal Data Controller

The administrator of your personal data is F.H.PU. TEK-PAK spółka z ograniczoną odpowiedzialnością spółka komandytowa with its registered office in Zbylitowska Góra, ul. Zbylitowskich 157, 33-113 Zbylitowska Góra, registered in the District Court for Krakow-Śródmieście in Krakow, XII Commercial Division of the National Court Register, KRS number: 0000688175, NIP: 9930663892, REGON: 367878400 (hereinafter: the „Administrator”).

II. Contact Regarding Personal Data

In matters concerning personal data processing, you can contact us at: ul. Zbylitowskich 157, 33-113 Zbylitowska Góra, by phone: 780 140 337, e-mail: biuro@tek-pak.pl

III. Where do we get your data from?

We received your personal data directly from you – in connection with your use of our website, by phone, email, contact form, in person, or in connection with the conclusion or performance of a contract.

IV. Purposes and legal bases for processing

Contracting parties — individuals or individuals representing entities with whom we cooperate
1. Purpose and legal basis for processing: conclusion and performance of the agreement (Art. 6(1)(b) GDPR); pursuit of any claims (Art. 6(1)(f) GDPR); maintaining agreement documentation; accounting and administrative services; verification of service quality; contact in connection with the execution of the delivery.
2. Data type: first name, last name, position; phone number, delivery/residence address; in case of proxies - ID card number, PESEL; company data (NIP, REGON); data related to the purchased goods.
3. Storage period: until the expiry of the limitation period for claims arising from the agreement. Data in tax and accounting documentation — until the statutory obligation to store expires.
Website users
1. Purpose and legal basis for processing: responding to inquiries; sending information about goods and services in accordance with the content of the inquiry (Art. 6(1)(b) or (f) GDPR).
2. Data type: Full name, email address — scope defined in the contact form or email correspondence.
3. Storage period: until the time when the legitimate interests of the Administrator are fulfilled, in particular the expiration of claims arising from correspondence.
Individuals corresponding with us (by traditional and electronic mail)
1. Purpose and legal basis for processing: carrying out correspondence as the pursuit of a legitimate interest or taking steps at your request prior to entering into a contract (Art. 6(1)(b) or (f) of GDPR).
2. Data type: identification, address, and other data contained in the correspondence.
3. Storage period: until the time when the legitimate interests of the Administrator are fulfilled, in particular until the expiry of the statute of limitations.
The target audience for our marketing communications
1. Purpose and legal basis for processing: managing marketing communications — based on legitimate interest (existing customers, Article 6(1)(f) GDPR) or consent (new recipients, Article 6(1)(a) GDPR).
2. Data type: Contact details: phone number and/or email address, full name.
3. Storage period: until the moment of withdrawal of consent or objection to data processing.

V. Is providing the data mandatory?

Providing personal data required by law is mandatory. Failure to provide this data will prevent the conclusion or proper performance of the agreement. Providing the remaining data is voluntary; however, refusal may limit the possibility of providing certain services.

VI. Your Rights

Based on Articles 15–22 of the GDPR, you have the following rights:

access to your personal data;
correction of personal data;
personal data deletion;
limitations on the processing of personal data;
objection to the processing of personal data;
transfer of personal data;
withdrawal of consent at any time, without prejudice to the lawfulness of the processing carried out before its withdrawal;
to file a complaint with the President of the Personal Data Protection Office.

When can you exercise each right?

Correction — when your data is incorrect or incomplete.
Deletion—when data is no longer necessary for the purposes for which it was collected, you withdraw consent, object effectively, or the data is processed unlawfully.
Restriction of processing — when you dispute the accuracy of data, processing is unlawful but you do not want the data erased, the data is no longer needed by us but you require it for claims, or you are awaiting the resolution of an objection.
Data transfer — when processing is based on consent or contract and is automated.

You can file a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

When can you object to the processing of your personal data?

When processing is based on a legitimate interest or for statistical purposes, and your objection is justified by your specific situation — we will stop processing the data unless we demonstrate compelling legitimate grounds for the processing that override your interests, or grounds related to the establishment, exercise, or defense of legal claims.
When your data is processed for direct marketing purposes, including profiling for that purpose.

VII. Transfer of Data Outside the EEA

Your personal data will not be transferred outside the European Economic Area.

VIII. Data recipients

Your data may be transferred exclusively to entities required by law or participating in the performance of the contract:

to our employees and colleagues responsible for customer service, accounting, and marketing;
to external entities providing services on our behalf: IT companies, auditors, law firms, debt collection agencies, accounting firms;
to tax offices and other public administration bodies, when required by law;
by postal operators and courier companies.

In every case of using subcontractors, we provide appropriate legal, technical, and organizational safeguards to ensure the protection of personal data.