GDPR Information Obligation

The following information provides a concise, understandable, and transparent summary of the details outlined in the Privacy Policy regarding the Data Controller, the purpose and method of processing personal data, and your rights concerning this processing, as required to fulfill the GDPR information obligation. Detailed information about the processing methods and entities involved in this process is available in the aforementioned policy.

Who is the Data Controller?

The Data Controller (hereinafter “Controller”) is the company “MIK Sp. z o.o.,” operating at Melioracyjna 6, 57-200 Ząbkowice Śląskie, NIP: 8871650604, KRS: 0000061943, providing electronic services through the Service.

How can you contact the Data Controller?

The Controller can be contacted in one of the following ways:

• Mailing address – MIK Sp. z o.o., Melioracyjna 6, 57-200 Ząbkowice Śląskie
• Email address – contact@mikplastics.com
• Phone call – (74) 816 41 74
• Contact form – available at: /contact

Has the Controller appointed a Data Protection Officer?

The Controller has appointed a Data Protection Officer, Anna Basarab.

You can contact the Officer via:

• Email: iod@mikplastics.com
• Phone: 608 311 275
• Mail: Melioracyjna 6, 57-200 Ząbkowice Śląskie

The Data Protection Officer can be contacted for all matters related to personal data processing.

Where do we obtain personal data, and what are their sources?

Data is obtained from the following sources:

• From individuals whose data are involved
• From social media platforms, with the explicit consent of these individuals, in cases of registration through these platforms

What is the scope of personal data processed by us?

The Service processes ordinary personal data voluntarily provided by the individuals involved.
(e.g., name, login, email address, phone number, IP address, etc.)

The detailed scope of processed data is available in the Privacy Policy.

What are the purposes of processing data?

Personal data voluntarily provided by Users is processed for one of the following purposes:

• Provision of electronic services:
  • User account registration and maintenance in the Service and associated functionalities
  • Newsletter services (including sending advertising content with consent)
  • Commenting / liking posts in the Service without registration
• Communication between the Controller and Users concerning the Service and data protection
• Ensuring the legitimate interest of the Controller

What are the legal grounds for data processing?

The Service collects and processes User data based on:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation)
  • Art. 6(1)(a)
    The data subject has given consent to the processing of their personal data for one or more specific purposes
  • Art. 6(1)(b)
    Processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject before entering into a contract
  • Art. 6(1)(f)
    Processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party
• The Personal Data Protection Act of 10 May 2018 (Dz.U. 2018 item 1000)
• The Telecommunications Law of 16 July 2004 (Dz.U. 2004 No. 171 item 1800)
• The Copyright and Related Rights Act of 4 February 1994 (Dz. U. 1994 No. 24 item 83)

What legitimate interests are pursued by the Controller?

• To establish, pursue, or defend potential claims – the legal basis for processing is our legitimate interest (Art. 6(1)(f) GDPR) in protecting our rights, including, among others
• To assess the risk of potential clients
• To evaluate planned marketing campaigns
• To carry out direct marketing

For how long do we process personal data?

Generally, personal data is stored only for the duration of service provision within the Service by the Controller. It is deleted or anonymized within 30 days after the end of the service (e.g., deletion of a user account, unsubscribing from the Newsletter, etc.).

In exceptional cases, to secure the legitimate interest pursued by the Controller, this period may be extended. In such cases, the Controller will retain the indicated data, from the time of the User’s deletion request, for no more than 3 years in case of a violation or suspected violation of the Service terms by the data subject.

Who are the recipients of the data, including personal data?

Generally, the sole recipient of the data is the Controller.

However, data processing may be entrusted to other entities performing services for the Controller to maintain the Service’s operation.

Such entities may include:

• Hosting companies providing hosting or related services for the Controller
• Companies through which the Newsletter service is provided
• IT support companies performing maintenance or responsible for maintaining the IT infrastructure

Will your personal data be transferred outside the European Union?

Personal data is transferred outside the European Union.
Data transfers outside the EU are due to using services from entities located outside the EU or as a result of publication by individual User actions (e.g., posting comments), which will make data accessible to any visitor to the Service.
In cases of transferring or entrusting the processing of personal data outside the EU, the data is processed based on an agreement between the Controller and the Service Provider.

Will personal data be the basis for automated decision-making?

Personal data is used for automated decision-making (profiling).
Profiling personal data does not produce legal effects or similarly significantly impact the person subject to automated decision-making.

What rights do you have regarding the processing of personal data?

• Right of access to personal data
  Users have the right to access their personal data, exercised upon request submitted to the Controller
• Right to rectify personal data
  Users have the right to request the Controller to promptly rectify inaccurate or incomplete personal data, exercised upon request submitted to the Controller
• Right to erase personal data
  Users have the right to request the Controller to promptly erase personal data, exercised upon request submitted to the Controller. For user accounts, data deletion involves anonymizing identifying data. In the case of the Newsletter service, Users can delete their personal data themselves using the link included in each email message.
• Right to restrict processing of personal data
  Users have the right to restrict the processing of personal data in cases specified in Art. 18 GDPR, including questioning the accuracy of personal data, exercised upon request submitted to the Controller
• Right to data portability
  Users have the right to obtain their personal data from the Controller in a structured, commonly used, machine-readable format, exercised upon request submitted to the Controller
• Right to object to the processing of personal data
  Users have the right to object to the processing of their personal data in cases specified in Art. 21 GDPR, exercised upon request submitted to the Controller
• Right to lodge a complaint
  Users have the right to lodge a complaint with the supervisory authority dealing with personal data protection.