Source: https://www.digitronicgas.com/privacy-policy/
Timestamp: 2019-04-22 12:19:41+00:00

Document:
Taking into account the obligations arising from art. 25 and art. 32 of Regulation of the European Parliament and of the Council (EU) 2016/679 of 27April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1), to ensure that personal data at DIGITRONIC AUTOGAS Julia Furmanek, ul. Elewatorska 9, 15-620 Białystok, NIP: 9661799625 (hereinafter: Digitronic) are processed and secured in accordance with the provisions of law by implementing appropriate technical and organizational measures designed to effectively implement data protection principles and to provide the necessary safeguards for processing; and Digitronic ensures, that by default, only personal data that are necessary to achieve each specific processing purpose are processed.
a set of procedures, instructions and detailed regulations concerning the processing of Personal Data in Digitronic regarding specific areas of personal data protection; constituting attachments to the Policy.
control and supervision over the processing of Personal Data.
The supervision of compliance with the policy is ensured by Julia Furmanek, the owner of the company. The supervision referred to in the preceding sentence seeks, in particular, but not exclusively to ensure that the activities related to the processing of Personal Data in Digitronic comply with the requirements of law and the provisions of the Policy.
Digitronic ensures compliance of the business entities cooperating with Digitronic, including, in particular, the Processors with the provisions of the Policy in an appropriate scope in all situations where personal data are transferred to these entities for processing, including storage.
The policy is stored and made available in paper and electronic version at the Digitronic office.
to interested persons, in particular to data subjects – at their request.
Sensitive Data – means Personal Data referred to in art. 9 THE GDPR.
the promotion of Digitronic products and services (Article 6 (1) (a) and (f) of the GDPR).
Digitronic processes Personal Data collected in data sets.
Updating or expanding the Data Sets list follows the previous analysis of the consequences and risks of personal data processing for the rights and freedoms of natural persons included in the set.
Digitronic does not undertake any Processing activities that could involve a significant risk of violating the rights and freedoms of the data subjects. In the case of planning the activities referred to in the preceding sentence, Digitronic obligatorily carries out a prior assessment of the effects of the processing referred to in Art. 35 GDPR.
By default, personal data are processed in ​​the Digitronic premises located in Białystok at ul. Elewatorska 9. Additional areas in which Personal Data are processed are all portable computers and other data carriers located outside the area indicated in the preceding sentence.
Digitronic ensures the application of technical and organizational measures necessary to ensure confidentiality, integrity, accountability and continuity of the processed data.
Authorized persons and all other persons, to whom personal data are provided at Digitronic are obliged to process it in accordance with the legal requirements and in accordance with the provisions of the Policy, as well as other internal Digitronic laws or internal procedures related to the processing of personal data.
notify Digitronic immediately if any incident related to a Personal Data breach takes place.
processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organizational measures.
Accountability – Digitronic provides a proper documentation of how to comply with data protection obligations.
monitoring changes in the processing of personal data in the Digitronic and on an ongoing basis managing changes affecting the protection of Personal Data at Digitronic.
The register includes categories of processing of Personal Data in the Office. Through the Digitronic Registry, it documents the processing of Personal Data and inventory and monitors the manner, in which it uses Personal Data.
Through the Registry, in particular by indicating in the Register general protection measures for Personal Data covered by a separate processing activity, Digitronic also strives to demonstrate compliance of the Personal Data Processing with the legal requirements.
a general description of the technical and organizational measures to protect Personal Data applicable to the activity.
In the event of an upgrade or extension of the category of processing personal data, Digitronic shall immediately update the Register in order to ensure that the Registry complies with the actual state and scope of the processing of Personal Data in Digitronic.
The provisions of paragraph. 6.3 above do not exclude the possibility of including additional information in the Register, increasing the accuracy or legibility of the Register or facilitating the management of the compliance of personal data protection with the legal requirements, and the implementation of the accountability principle.
Digitronic documents in the Register the legal grounds for data processing for particular processing activities by indicating the general legal basis for processing, such as: consent, contract, legal obligation imposed on Digitronic, legitimate purpose of Digitronic.
Digitronic implements consent management methods that enable registration and verification of the consent of the person to process specific data for a specific purpose, consent to remote communication (email, telephone, text messages) and registration of refusal of consent, withdrawal of consent and similar activities such as raising an objection or restriction of processing.
Digitronic takes care of the legibility and style of information transmitted and communication with data subjects.
In order to exercise the rights of data subjects, Digitronic provides procedures and mechanisms to identify the data of specific persons processed by Digitronic, integrate this data, make changes to them and delete in an integrated manner.
on the processing of its data, in the collection of data from that person.
about the planned change of the purpose of data processing.
before revoking the processing restriction.
rectification, deletion or limitation of data processing (unless this requires a disproportionate effort or is impossible).
about the right to object to data processing at the latest at the first contact with that person.
Digitronic informs the person about the personal data breach without undue delay, if it can cause a high risk of violating the rights or freedoms of that person.
At the request of persons regarding access to their data, Digitronic informs the person whether he processes its data and informs the person about the details of processing, in accordance with art. 15 GDPR, and also gives the person access to data concerning him. Access to the data can be done by issuing a copy of the data.
Digitronic issues to the person whose Personal Data relates to a copy of its data and notes the fact of the first copy of the data.
Digitronic corrects incorrect data at the request of the data subject. Digitronic has the right to refuse to rectify the data, unless the person in a reasonable manner shows the irregularities of the data which he or she demands. If the data is corrected, the Digitronic informs the person about the recipients of the data at the request of that person.
Digitronic supplements and updates data at the request of the data subject. Digitronic has the right to refuse to supplement the data if the supplement would be incompatible with the purposes of data processing. Digitronic may rely on a statement of the person for the data being filled in, unless this is insufficient in the light of the procedures adopted by Digitronic, the law or the grounds for considering the statement to be unreliable.
the request concerns the child’s data collected on the basis of consent to provide information society services directly offered to the child.
Digitronic takes into account the removal of personal data to ensure effective implementation of this law, while respecting all data protection principles, including security, and verifying that there are no exceptions referred to in Article 17. sec. 3 GDPR.
If the data to be deleted has been made public by Digitronic, Digitronic takes reasonable steps, including technical measures, to inform other controllers processing this personal data about the need to delete and access data. In the event of deletion of data, Digitronic informs the person about the recipients of the data at the request of that person.
the person has objected to the processing for reasons related to its specific situation – until it is established that there are legitimate grounds on the Digitronic side that override the grounds of objection.
During processing restrictions, Digitronic stores data but does not process them (it does not use them, does not transmit them), without the consent of the data subject, unless to establish, investigate or defend claims, or to protect the rights of another natural or legal person, or because of important public interest considerations. Digitronic informs the person before revoking the processing limit. In the event of limitation of data processing Digitronic informs the person about the recipients of data, at the request of that person.
At the request of the person, the Digitronic publishes in a structured, commonly used machine-readable format or transfers to another entity, if possible, data about the person provided by the Digitronic, processed on the basis of that person’s consent or to conclude or perform a contract with contained in it, in Digitronic information systems.
If a person objects to a special situation motivated by it, the opposition to the processing of his data referred to in art. 21 of the GDP and data are processed by Digitronic on the basis of Digitronic’s legitimate interest or the Digitronic task entrusted to the public interest, Digitronic undertakes to take into account objections, unless Digitronic has important legitimate grounds for processing that override interests, rights and the freedom of the opponent or grounds for establishing, investigating or defending claims.
If the person objects to the processing of his data by the Digitronic for direct marketing purposes, Digitronic will take into account the opposition and stop such processing.
limitation of storage time of Personal Data to the period for which storage of Personal Data is necessary due to the fulfillment of the purpose of the Processing or obligations imposed on Digitronic.
Digitronic performs a periodic review of the amount of data processed and the scope of their processing at least once a year.
implementing physical technical measures to protect Personal Data referred to in paragraph 5.1 (iv) Policies.
Digitronic updates the access permissions for changes in the composition of personnel and changes in the roles of persons, as well as changes of processors. Digitronic performs periodic review of established system users and updates them at least once a year.
Detailed rules for controlling physical and logical access are contained in the Digitronic physical security and information security procedures.
Digitronic processes personal data taking into account the criteria indicated in the Register. Digitronic implements the personal data life cycle control mechanisms at Digitronic, including verification of the further suitability of the data against the dates and checkpoints indicated in the Register.
Data whose scope of use is limited as time goes by are removed from Digitronic systems as well as from handheld and main files. Such data can be archived and located on backups of systems and information processed by Digitronic. Procedures for archiving and using archives, creating and using backup copies take into account the requirements of controlling the life cycle of data, including the requirements for data deletion.
Taking into account the state of technical knowledge, the cost of implementation and the nature, scope, context and purposes of processing and the risk of violating the rights or freedoms of individuals with different probability of occurrence and risk of death Digitronic implements technical and organizational measures ensuring adequate protection of personal data, corresponding to the risk of violation of rights and freedoms individuals due to the processing of personal data by Digitronic.
Digitronic implements measures to ensure business continuity and prevent the effects of disasters, i.e. the ability to quickly restore the availability of personal data and access to them in the event of a physical or technical incident.
unauthorized or accidental damage, loss, destruction or change of Personal Data.
In the event of a breach of personal data protection, Digitronic assesses whether the breach could have the potential to infringe the rights or freedoms of individuals and estimates the scale of risk.
In the event of a breach of Personal Data protection, Digitronic shall, without undue delay – if possible, no later than 72 hours after the violation is discovered – report it to the appropriate supervisory authority, unless it is unlikely that the violation would result in the risk of violating the rights or freedoms of natural persons.
it would require a disproportionately large effort. In this case, a public message is issued or a similar measure is put in place by which the data subjects are informed in an equally effective manner.
Notwithstanding the obligations set out in paragraph 10.2-10.4 above, Digitronic documents any breaches of the protection of personal data, including the circumstances of personal data breach, its consequences and the remedial actions taken.
Digitronic may entrust the Processing of Personal Data to a Processing Entity only by way of an agreement concluded in writing, in accordance with the requirements specified in art. 28 para. 3 GDPR.
Digitronic uses only the services of such Processors that provide sufficient assurances that appropriate technical and organizational measures are implemented to ensure that the processing complies with the requirements of this regulation and protects the rights of the data subjects. In order to verify the fulfillment of the obligation referred to in the preceding sentence, Digitronic prior to entrusting the processing to a potential Processing Entity, if possible, obtains information about the principles of Personal Data Protection applied by a potential Processing Entity, and about the practices of that entity regarding the protection of Personal Data.
Digitronic does not transfer Personal Data to a third country located outside the territory of the European Union or the European Economic Area, except where it occurs at the request of the person to whom the Personal Data relates.
To avoid unauthorized data export, in particular in connection with the use of publicly available cloud services, Digitronic periodically verifies user behavior and, where possible, provides equivalent solutions to data protection law.
The policy comes into force on the day of announcement.
In matters not covered in the Policy, the provisions of the GDPR and generally binding provisions of Polish and European law apply accordingly.
Any changes or supplements to the Policy require a written form to be effective, otherwise they are null and void. Changes or supplements to the Policy shall enter into force not earlier than within 7 days from the date of their publication.

References: art. 25
 art. 32
 art. 9
 Art. 35
 art. 15
 art. 21
 art. 28