Source: https://dafi.info/en/privacy-policy/
Timestamp: 2019-04-24 09:02:04+00:00

Document:
– each also hereinafter referred to as the “Administrator“.
2. GDPR – Regulation of the European Parliament and the Council (EU) 2016/679 dated 27 April 2016 on protection of individuals with regard to processing of personal details and on the free movement of such data and repeal to Directive 95/46/EC.
4. Application – the mobile application of the Service Provider called “My Dafi”.
5. User – every natural person visiting the Service, using the Application, or using one or several services or functions offered by the Service Provider.
6. Device – shall stand for the electronic device by means of which the User gains access to web pages of the Service or to the Application.
7. In order to ensure the safety of personal data we have been entrusted with, we have prepared internal procedures and instructions that are to prevent unauthorized persons from accessing the personal data. We monitor their performance and constantly check their compliance with relevant legal acts, i.e. the GDPR, the act dated 10 May 2018 on protection of personal data (Polish Journal of Laws dated 2018 item 1000 with further amendments), the act dated 18 July 2002 on provision of services by electronic means (consolidated text, Polish Journal of Laws dated 2017 item 1219 with further amendments), as well as any other commonly applicable regulations of law.
b. through storage of cookie files.
9. Personal data provided by the User as a part of a particular form completed in relation to the use of the Service or the Application shall be processed solely for the purpose arising from the function of the specific form, e.g. in order to implement the process of handling the information contact and shall be treated as confidential and shall not be visible for unauthorized persons.
10. As a part of the Service and the Application, we use unique, fixed identifiers of devices for diagnostic and statistical purposes – tools to monitor applications (whether errors occur and if yes, on which devices, etc.), we use Android Advertising ID (Android platform) and identifierForVendor (iOS platform).
11. Obtained personal data shall not be made available for third persons in any way, except for situations strictly provided for in applicable regulations of law.
Who processes personal data and why?
12. The role of the Administrator of personal data shall be performed by the Service Provider.
d. for the purpose compliant with the voluntary consent expressed by the User to the processing of their personal data, i.a. in the case of the User’s subscription to the newsletter, loyalty programs, or giving consent to participation in competitions and marketing actions (indicated precisely in the terms and conditions regarding a specific competition or marketing event) – pursuant to Art. 6 section 1 letter a) of the GDPR.
14. The Service Provider shall also process Personal Data of Users who visit the profiles of the Service Provider that are managed in social media (Facebook, YouTube, Instagram). Such data are processed solely in relation to the management of the profile, including the purpose to inform Users on the Service Provider’s activities and promotion of various events, services, and products. The legal grounds for the processing of personal data by the Service Provider for this purpose shall be their justified interest (Art. 6 section 1 letter f of the GDPR) involving promotion of own brand.
c. for purposes arising from legally justified interests implemented by the Administrator, particular to provide you with communication prior to conclusion of the agreement and during the agreement period, as well as determination, pursuit, and protection against possible claims under Art. 6 section 1 letter f) of the GDPR.
a. for purposes arising from the legally justified interests realized by the Administrator, in particular to ensure contact with the entity being a party to an agreement with the Administrator, verify whether the person who contacts the Administrator is authorized to undertake actions on behalf of that entity, correct performance of the agreement concluded with the Administrator, and to determine, pursue, or protect against possible claims under Art. 6 section 1 letter f) of the GDPR.
b. for purposes necessary to fulfil the legal obligations imposed on the Administrator, in particular obligations arising from tax law and regulations on accounting pursuant to Art. 6 section 1 letter c) of the GDPR.
For how long will we process personal data?
17. The Administrator shall exercise due diligence so that the processing of personal data is always substantively correct and adequate with regard to the purpose of their processing and stored in a form making it possible to identify persons that the data refer to, for no longer than it is necessary to achieve the purpose of processing.
a. If the processing takes place on the basis of your voluntary given consent, your personal data shall be processed until such consent for processing of personal data for specific, clear, and legally justified purposes is revoked.
b. If the processing of personal data is necessary to perform the agreement of which you are one of the parties or to undertake action upon your order, prior to conclusion of the agreement, your personal data shall be processed for the period of the agreement and then, after that period, for the period of prescription of possible claims arising from commonly applicable provisions of law.
c. If the processing is necessary to fulfil a legal obligation imposed on the Administrator, your personal data will be processed for the period resulting from commonly applicable provisions of law.
d. If the processing is required for purposes arising from legally justified interests implemented by the Administrator or by a third party, your personal data shall be processed for a period not longer than it is necessary for the purposes for which the data are processed or until an objection is made to the processing of personal data within the scope of processing of personal data for such purposes, for reasons concerning a special situation, unless the Administrator proves the existence of important and legally justified grounds for the processing, precedent to your interests, rights and freedoms or grounds for determination, pursuit, or protection of claims.
e. If personal data are processed for the purposes of direct marketing, your personal data shall be processed until an objection is made to processing of personal data for purposes of such marketing, within a range in which the processing is connected with such direct marketing.
What rights are you entitled to in terms of processing of personal data?
c. the right to remove personal data.
(vi) personal data have been collected with regard to offering information society services directly to a child.
(iii) for archiving purposes for public interest, for scientific or historical research, or for statistical purposes pursuant to Art. 89 section 1 of the GDPR, provided that it is possible that the law referred to in section 1 prevents or drastically hinders implementation of purposes of such processing.
(iv) to determine, pursue, and defend claims.
(iv) the person that the data refer to has submitted an objection to the processing of his or her personal data pursuant to Art. 6 section 1 letter e) or f) of the GDPR, including profiling based on those regulations – until it is determined whether the legally justified grounds on the Administrator’s side are precedent over the grounds of the objection submitted by the person that the data refer to.
(ii) processing of data for the purposes of direct marketing, including profiling.
20. The person that the data refer to shall have the right to revoke the granted consent for processing of personal data at any time, without affecting the lawfulness of processing that had been performed under the consent prior to its revocation. Revocation of the consent shall be made through communication made to, respectively (depending on the Administrator): for Formaster S.A. – rodo@formaster.com, for Dafi Pro S.A. – rodo@formaster.com, for Dafi Market S.A. – rodo@formaster.com.
21. The person whose data are processed shall be entitled to submit a complaint to the supervisory authority, i.e.
the President of the Office of Personal Data Protection, if he or she decides that the processing of personal data is in breach with regulations of law.
Is provision of personal data mandatory?
22. If personal data are processed on the basis of the consent given by the person that the data refer to, provision of personal data is voluntary. No provision of data shall result with, i.a. lack of possibility to render a service, if the consent constitutes a condition to have that service rendered.
23. If personal data are processed for purposes required to perform the agreement one of the parties of which is the person that the date refer to or in order to undertake action upon a request of the person that the data refer to, prior to conclusion of the agreement, provision of personal data shall be voluntary yet necessary to conclude an agreement with the Administrator.
24. If the processing of personal data is necessary to fulfill a legal obligation imposed on the Administrator, the provision of personal data shall be considered a statutory requirement.
25. If the personal data are processed for purposes arising from legally justified interests realized by the Administrator or a third party, provision of personal data is voluntary yet necessary to implement those purposes.
How may I communicate with regard to matters concerning protection of personal data?
c. Dafi Market S.A. with its registered office in Kielce (25-315), ul. Starodomaszowska 10 or via electronic means to: rodo@formaster.com.
27. One may contact the person appointed by the Administrator for matters regarding protection of personal data via electronic means, respectively, (depending on the Administrator) to the following e-mail address: for Formaster S.A. – rodo@formaster.com, for Dafi Pro S.A. – rodo@formaster.com, for Dafi Market S.A. – rodo@formaster.com.
To whom will the personal data be transferred?
28. Recipients of personal data might include – only in situations in which it is necessary or in a necessary scope – entities that cooperate with the Administrator within the scope of services rendered by the Administrator and support of ongoing business processes of the Administrator, particularly entities that render services concerning bookkeeping, marketing, legal, courier, or IT services, haulers and suppliers of other additional services connected with the Administrator’s rendering of services as a part of the Service or the Application, and entities from the Formaster capital group.
29. The Administrator shall not transfer personal data to third countries or international organizations.
30. We respect the right to one’s privacy and we care for data safety. For that purpose, we use i.a. a safe protocol for encryption of communication (SSL) and we implemented access control so that we can minimize the outcome of a possible breach of data safety.
31. Personal data are processed only by authorized persons and only within the scope in which it is necessary due to such persons’ duties. The Administrator shall ensure that all operations on personal data are recorded and performed solely by authorized employees and partners.
32. The Administrator shall take all the necessary actions to have their subcontractors and other collaborating entities guarantee to apply proper safety measures in every case during their processing of personal data upon the Administrator’s order.
35. The request must be submitted by sending it respectively (depending on the Administrator) to: for Formaster S.A. – rodo@formaster.com, for Dafi Pro S.A. – rodo@formaster.com, for Dafi Market S.A. – rodo@formaster.com.
36. In the case of no processing of the Requestor’s personal data by the Administrator (excluding processing of personal data for the purposes of the request itself), the Requestor shall be informed about it and the data of the Requestor that have been acquired as a part of submission of the request shall be immediately removed.
37. After receipt of the request, the Administrator shall immediately inform the Requester about it and input information on the request in the registry they keep.
38. The Administrator shall be entitled to verify the Requestor’s identity. Lack of successful verification of the Requestor’s identity due to reasons beyond the Requestor’s liability might result in lack of the Administrator’s execution of the submitted request and the Requestor shall be immediately informed about it.
39. The Administrator shall reply to the Requestor’s request within maximum 3 (three) days starting from the date of its receipt. For objectively justified cases (i.e. cases that require a lot of effort on the Administrator’s side), the above-mentioned period might be extended to 2 (two) months and the Requestor shall be informed about it.
h. the right to submit a complaint to the supervisory authority.
41. In the case of execution of the right to access the data and the right to transfer them, the reply given to the Requestor shall include a copy regarding their personal data in commonly known and available formats that are machine-readable.
c. Dafi Market S.A. with its registered office in Kielce (25-315), ul. Starodomaszowska 10 or by electronic means to: rodo@formaster.com.
43. The complaint shall be considered immediately but not later that within 7 (in words: seven) days from the date of its delivery and the Requestor shall be immediately informed about it. The Requestor shall also be informed that the complaint has been received. The information on the complaint shall be input in the registry kept by the person designated to handle matters connected with protection of personal data.
44. The Service uses cookie files. “Cookies” shall be understood as IT data stored in the users’ end devices to allow the usage of web pages. In particular, cookies are text files that contain the name of the website they come from, the storage period on the end device, and a unique number.
45. The Service does not collect any information in an automatic way, except for the information contained in cookie files.
a. Session cookies: they are stored on the User’s Device and will remain there until the end of the session of a particular web browser. Stored information will then be permanently removed from the memory of the Device. The mechanism of session cookies does not allow downloading any personal data nor any confidential information from the User’s Device.
b. Persistent cookies: they are stored on the User’s Device and shall be kept on them until removed. Finishing the session of a particular web browser or switching the Device off will not remove such cookies from the User’s Device. The mechanism of persistent cookies does not allow downloading any personal data nor any confidential information from the User’s Device.
c. create anonymous statistics (excluding the possibility to identify the User), which help in understanding the manner in which the Service Users use the Service website, which allows improving the structure and contents of those web pages.
d. save the settings selected by the User and to personalize the User’s interface, e.g. in terms of the selected language or region the User comes from, size of font, look of the web page, etc.
e. correctly handle the partner program, making it particularly possible to verify the sources of User redirections to web pages of the Service.
48. Collected data are used to monitor and check the way in which the Users use our websites so that we can improve the functioning of the Service, ensuring more efficient and flawless navigation. We monitor the information on Users by using the Google Analytics tool that records the User’s behavior on web pages of the Service.
e. “advertisement” cookie files that allow providing the Users with ads that suit better their interests.
52. Users of the Service may at any time change the settings regarding cookie files. Detailed information on the possibilities and methods regarding handling of cookie files are available in the software settings (of the web browser).
53. The Website Service Provider informs that limitations in the use of cookie files might affect some functions available on pages of the Website.
54. The conduction of direct marketing by companies from the Formaster capital group can take place through sending commercial information via electronic means of communication, particularly via electronic mail or by phone (refers to the mobile application “My Dafi”).
55. Companies of the Formaster capital group can send you information on products and services, in general, in the case of expressing a voluntary consent to processing of personal data for marketing purposes. The consent for processing of personal data can be revoked at any moment.
56. The sending of information on products and services of companies from the Formaster capital group through means of electronic communication shall require giving a consent to receive commercial information via means of electronic communication, in particular via electronic mail and providing the address of electronic mail.
57. Presentation of information on products and services of companies from the Formaster capital group by telephone shall require your consent to the usage of telecommunication end devices for the purposes of direct marketing and giving access to the phone number.
58. If you no longer want to receive information on products and services from companies of the Formaster capital group, you can revoke your consent to processing of personal data for marketing purposes or make an objection to processing of personal data for the purposes of direct marketing, including profiling, within the scope in which the processing is connected with such direct marketing.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 89
 Art. 6