INFORMATION CONCERNING THE PROCESSING OF PERSONAL DATA BY

The information contained in this document relates to the processing by Muzyka Na Językach Olga Szałamacha, located at ulica Konstantego Troczyńskiego 2, 60-682 Poznań (hereinafter referred to as the “School") of the personal data of Customers in connection with concluded contracts for the provision of educational services and services The information provided is in accordance with the EU provisions on the processing of personal data (Regulation of the European Parliament and of the Council (EU) 2016/679 – the so-called GDPR).

Regardless of applicable law, the processing of personal data according to the highest standards, respect for and protection of clients’ privacy are one of the highest priorities for the School.

Data administrator and contact details

The data administrator is the school.

School contact details: info@yamahaszkola.poznan.pl, tel. +48 61 100 01 01.

Contact details of the data protection officer: iod@yamahaszkola.poznan.pl

The purposes of processing personal data

Clients’ personal data are processed for the purposes of: performing a contract or taking actions before concluding a contract (e.g. accepting orders, rendering services, handling orders and applications, examining complaints); fulfilling legal obligations of the data administrator and performing tasks in the public interest (e.g. performing tasks related to security and defence, storing tax documentation); arising from legitimate interests pursued by the School (e.g. direct marketing of own products, protection and redress, protection and protection against the claims of the Customer or third parties); marketing, not resulting from legitimate interests pursued by the School (e.g. marketing of third-party services and products, non-direct marketing).

Legal grounds for processing personal data

The legal grounds for data processing are: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC ( General Data Protection Regulation), in particular art. 6 of this Regulation laying down general principles for the compliance of data processing; Civil Code; consent – in situations where the School is entitled or obliged to process data on the basis of explicit consent and this results from previously cited legal acts.

Legitimate interests

In the case of data processing pursuant to art. 6 clause 1 letter f) of the General Data Protection Regulation (when processing is necessary for purposes arising from legitimate interests pursued by the School or by a third party), the School informs that the legitimate interests pursued by the administrator are: direct marketing of its own products; securing and pursuing claims and securing and protecting against claims on the part of the Customer.

Data recipients

In accordance with the definition of “recipient" in the General Data Protection Regulation, mentioned in art. 4 point 9, the School informs the Customer that his personal data during their processing may be disclosed to the following categories of recipients: the Customer and persons authorized by the Customer; persons employed by the School authorized by the School; entities processing data on behalf of and on behalf of the School and authorized persons employed in these entities (e.g. marketing by external companies, debt collection and redress based on the services of external companies); to third parties – in the event of the Customer’s consent to the transfer of data (e.g. in the event of transfer of data for marketing purposes, in the event of verification of the Subscriber’s credibility by the Economic Information Bureaus, in the case of direct debit) or in the event of the School exercising its rights (e.g. in the event of an assignment of claims together with the transfer of personal data related to the claim); public authorities that may receive data in cases other than in the context of specific proceedings conducted in accordance with Union or Polish law.

Data processing in third countries

The school does not transfer personal data to third countries (outside the European Union) or international organizations. Should such an intention arise, the School will endeavour to transfer data to a third country or international organization if it is a country or organization against which the European Commission (in accordance with the General Data Protection Regulation) has established an adequate level of protection. Otherwise, the School will be able to transfer personal data to a third country or international organization only provided that adequate safeguards are provided and that enforceable rights of data subjects and effective remedies as referred to in the General Data Protection Regulation are in force and taking into account providing the Customer with information about the possibilities of obtaining a copy of the data or about the place of access to the data.

Data retention periods

Personal data is stored:

• in the case of collecting personal data for the purposes of the contract or the conclusion of the Agreement (legal basis: art.6 par.1 lit.b RODO): from the moment of collecting data before concluding the contract for the purpose of its conclusion or from the moment of collecting this data during the conclusion of the Agreement or from the moment of collecting this data during the term of the contract (in the event of supplementing or updating the data during the term of the Contract) until the termination of the contract or the implementation of the contract after its termination (e.g. consideration of complaints);

• in the case of collecting personal data in order to fulfil obligations arising from legal provisions or in connection with the performance of tasks in the public interest (legal basis: art.6 par.1 lit.c and e) for the period of implementation of obligations and tasks arising from individual legal provisions;

• in the case of processing personal data for purposes arising from the legitimate interests of the School (legal basis: art.6 par.1 lit.f), the data will be stored no longer than six years from the termination of the contract or until a reasoned objection to the processing is made. for this purpose;

• in the case of collecting personal data on the basis of consent (legal basis: art.6 par.1 lit.a or f RODO): from the moment of consent to the processing of data covered by it (also during the implementation of the contract) until the implementation of the request to withdraw this consent if it is withdrawn or until an objection is noted;

• apart from the situations listed above, the data may be stored during the period of limitation of processing of such data established at the request of the Customer, the request of the supervisory body – in the situations provided for by the GDPR in art. 18 and art. 58.

At any time during the processing of personal data, the School is guided by the principles of purpose limitation, data minimization and limited processing periods.

Customer rights related to the processing of personal data

The customer has the right to request access to the content of his personal data, rectification, deletion, processing restrictions. In addition, the Customer has the right to object to data processing and the right to transfer data. The rights listed in this paragraph are implemented in accordance with the provisions of the General Data Protection Regulation (GDPR) – based on the definitions and mechanisms described in this Regulation.

If the School processes personal data based on the consent of the Customer, the Customer has the right to withdraw consent at any time, without affecting the lawfulness of the processing that was carried out on the basis of consent before its withdrawal.

The customer has the right to lodge a complaint with the supervisory authority on the principles set out in the General Data Protection Regulation, and in particular pursuant to art. 77 of this Regulation. In Poland, the Supervisory Authority since May 25, 2018 is the Office for Personal Data Protection.

Data categories. Data Requirement. Consequences of not providing data.

The school informs that providing the following data is a contractual requirement and at the same time a condition for a free trial lesson: name, surname, email address, mobile phone. The school informs that providing the following data is a contractual requirement and at the same time a condition for concluding the Agreement: name, surname, type and number of ID card, PESEL, place of residence, correspondence address, mobile phone, e-mail address. Providing other data, such as landline numbers, is a contractual requirement, but it is not a condition for the conclusion or implementation of the Agreement. Providing all data is voluntary. The consequence of not providing data that is a condition for the conclusion of the contract is the inability to conclude a Contract with the School or take a free trial lesson. The consequence of not providing data that is not a condition for the conclusion of the contract is the inability to use this data for the purposes of collecting it (i.e., e.g. contacting the customer using this data to perform the contract, the possibility of presenting marketing offers).

Final information

The principles described in the document apply from May 25, 2018 – i.e. from the date of application of the GDPR.

When formulating the above information, we were guided by making it as specific and precise as possible (including in line with the strict concepts and definitions established by the GDPR), as well as simple, clear and understandable. In order to ensure this permanently and in connection with frequently changing legal provisions, we reserve the right to continually improve and improve the form and content of this information. We are aware that this material is extensive, so in case of any comments, questions or doubts (in particular related to the processing of personal data by us for specific purposes and situations) please contact the School’s data protection officer: iod@yamahaszkola.poznan.pl

The full text of the general European Data Protection Regulation (GDPR) can be found at:

https://www.giodo.gov.pl/pl/569/9276