GDPR

In accordance with Article 6 of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter referred to as the “GDPR Regulation”), the client, as the data subject, hereby gives consent to the processing of personal data provided in the order. The client gives consent to the processing of the following personal data: name, surname, phone number, email, address, and other billing information voluntarily provided or to be provided in connection with the order. Consent is granted to the data controller for the purpose of fulfilling the agreed services, to the extent necessary for the performance of activities that are the subject of its business, as well as for activities directly related thereto. If some of the provided personal data are not essential for achieving the purpose of processing, the client declares that they have been informed of this fact and expressly agree to the processing of such data by signing. This consent is granted for an indefinite period from the date of granting. The processing period of the client’s personal data lasts until the client withdraws the consent. The client is entitled, under Article 7 of the GDPR, to withdraw this consent to the processing of personal data in writing. The client declares that they have been informed by the controller about their rights under the GDPR Regulation.

Information for the data subject under the GDPR Regulation: The data subject (i.e. any natural person whose personal data are processed by the controller of the information system under the GDPR Regulation) has the right to obtain confirmation from the controller as to whether or not personal data concerning them are being processed, and, if so, has the right to access such personal data and the following information:

* purposes of processing

* categories of personal data concerned

* recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations

* where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period

* the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing

* the right to lodge a complaint with a supervisory authority

* if the personal data are not collected from the data subject, any available information as to their source

* the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

The data subject also has the right to object in writing to the controller against:

a) the processing of their personal data, which they believe are or will be processed for the purposes of direct marketing without their consent, and to request their deletion;

b) the use of their name, surname, title, and address for direct marketing purposes in postal communication;

c) the provision of their name, surname, title, and address for direct marketing purposes.

The controller shall provide a copy of the personal data being processed. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, the information shall be provided in a commonly used electronic form unless otherwise requested. The right to obtain a copy must not adversely affect the rights and freedoms of others. Where personal data are transferred to a third country or an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The data subject also has the right:

a) to have the controller rectify inaccurate personal data concerning them without undue delay. Considering the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

b) to have the controller erase personal data concerning them without undue delay (“right to be forgotten”). Where the controller has made the personal data public and is obliged to erase them, taking account of available technology and the cost of implementation, the controller shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject requests the erasure of any links to, or copies or replications of, those personal data.

c) to have the controller restrict processing where one of the following applies:

* the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data

* the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead

* the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims

* the data subject has objected to processing pursuant to Article 21(1) of the GDPR, pending verification of whether the legitimate grounds of the controller override those of the data subject

The controller shall inform the data subject who has obtained restriction of processing before the restriction is lifted.

d) to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and to have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.

e) to object, at any time and on grounds relating to their particular situation, to processing of personal data concerning them based on Article 6(1)(e) or (f), including profiling based on those provisions.

f) not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

As the data subject is not obliged to provide their personal data to the controller, they have the right to withdraw their consent to the processing of personal data at any time in writing. The controller must not coerce the data subject into giving consent or make it conditional upon the threat of denial of service or a legal obligation. The controller will process personal data manually and/or by means of computing technology, exclusively through authorized persons. Processing of personal data means any operation or set of operations performed on personal data or on sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction, whether or not carried out by automated means.