Apartament 68Horyzont · By the Beach

Data Controller

1. We kindly inform you that the controller of your personal data is Sun&Snow, hereinafter referred to as the "Controller". You can contact the Controller regarding the protection of personal data at the e-mail address: .

Purposes and legal bases for processing personal data

1. In order to provide services in line with its business profile, the Controller processes the personal data of visitors to this website for various purposes, but always in accordance with the law. Below we set out the detailed purposes of processing together with their legal bases.
2. For the purpose of handling enquiries, consultations and telephone contact with clients and persons interested in the company's services, we process personal data such as: first name, surname, telephone number, e-mail address, gender, order number, registration date. The legal basis for such processing is Article 6(1)(a) and (b) GDPR, which allow personal data to be processed where necessary to perform a contract or take steps to conclude one, e.g. handling an enquiry from the contact form, and on the basis of voluntary consent expressed by completing and submitting the contact form on the website;
3. For analytical purposes, i.e. examining and analysing activity on the website belonging to the Controller, we process personal data such as: date and time of the visit, type and version of the operating system, approximate location, screen resolution, number of colours supported by the screen, type and version of the web browser, time spent on the site, pages visited, the page where the contact form was completed. The legal basis is Article 6(1)(f) GDPR, which allows processing where the Controller thereby pursues its legitimate interest (here, understanding clients' activity on the website);
4. For the purpose of using cookies and local storage on the website, we process such text information (cookies are described in a separate section). The legal basis is Article 6(1)(a) GDPR, which allows processing on the basis of freely given consent (on the first visit to the website a request for consent to the use of cookies is displayed);
5. For the purpose of administering the website, we process personal data such as: IP address, port number, server date and time, information about the web browser, information about the operating system. This data is recorded automatically in the so-called server logs each time the Controller's website is used. Administering the website without a server and without this automatic recording would not be possible. The legal basis is Article 6(1)(f) GDPR, which allows processing where the Controller thereby pursues its legitimate interest (here, administering the website);

Cookies

1. On its website, like other entities, the Controller uses so-called cookies, i.e. short text information saved on the user's computer, phone, tablet or other device. They can be read by our system as well as by systems belonging to other entities whose services we use (e.g. Google and Facebook).
2. Cookies perform many functions on the website, most often useful ones, which we try to describe below (if this information is insufficient, please contact us):
   • ensuring security – cookies are used to authenticate users and prevent unauthorised use of the client panel. They therefore protect the user's personal data against access by unauthorised persons;
   • influencing processes and performance of the website – cookies are used so that the website works efficiently and its available functions can be used, which is possible, among other things, by remembering settings between successive visits. Thanks to them you can move efficiently around the website and its individual pages;
   • session state – cookies often record information about how visitors use the website, e.g. which pages they display most often. They also make it possible to identify errors displayed on certain pages. Cookies used to record the so-called "session state" thus help improve services and increase browsing comfort;
   • maintaining session state – if a client logs into their panel, cookies enable the session to be maintained. This means that after moving to another page you do not have to enter your login and password again each time, which improves the comfort of using the website;
   • creating statistics – cookies are used to analyse how users use the website (how many open it, how long they stay, which content attracts the most interest, etc.). This allows the website to be continuously improved and adapted to user preferences. To track activity and create statistics we use Google tools such as Google Analytics; in addition to reporting website usage statistics, the Google Analytics pixel may also be used, together with some of the cookies described above, to help display more relevant content to the user in Google services (e.g. Google Search) and across the web;
   • using social features – on the website we have the so-called Facebook pixel, which makes it possible to like our fan page on that service while using the website. However, for this to be possible, we must use cookies provided by Facebook.
3. Your web browser by default allows cookies to be used on your device, which is why on your first visit we ask for your consent to the use of cookies. If, however, you do not wish cookies to be used while browsing the website, you can change your browser settings – completely block the automatic handling of cookies or request to be notified each time cookies are placed on your device. Settings can be changed at any time.
4. Respecting the autonomy of everyone using the website, we feel obliged to warn that disabling or restricting cookies may cause difficulties in using the website, e.g. the need to log in on each page, longer page loading times, restrictions in using functionalities, restrictions in liking the page on Facebook, etc.

Right to withdraw consent

1. Where the processing of personal data is based on consent, you may withdraw that consent at any time.
2. To withdraw consent to the processing of personal data, send an e-mail with the relevant information directly to the Controller, writing to the address: .
3. If the processing of personal data was based on consent, its withdrawal does not make the processing carried out up to that point unlawful. In other words, until consent is withdrawn we have the right to process personal data, and its withdrawal does not affect the lawfulness of the processing carried out so far.

Requirement to provide personal data

1. Providing any personal data is voluntary and depends on an individual decision. However, in some cases providing specific personal data is necessary to meet expectations regarding the use of services.
2. In order to make telephone contact in matters related to the provision of a service or handling an enquiry from the contact form, it is necessary to provide a telephone number – without it we are unable to establish telephone contact.

Automated decision-making and profiling

1. We do not carry out automated decision-making, including profiling. The content of an enquiry sent via the contact form is not assessed by an IT system. Our IT systems do not make any assessments based on data obtained from our website.

Recipients of personal data

1. Like most entrepreneurs, in our business we use the help of other entities, which often involves the need to transfer personal data. In connection with the above, where necessary, we transfer personal data to lawyers cooperating with us who provide services, payment processing companies, an accounting firm, a hosting company, a company responsible for sending SMS messages, as well as an insurance company (should it be necessary to repair damage).
2. In addition, it may happen that, e.g. on the basis of a relevant legal provision or a decision of a competent authority, we will also have to transfer personal data to other entities, whether public or private. It is therefore extremely difficult for us to foresee who may request access to personal data. Nevertheless, we assure you that we analyse each request for access to personal data very carefully so as not to pass information to an unauthorised person.

Transfer of personal data to third countries

1. Like most entrepreneurs, we use various popular services and technologies offered by entities such as Facebook, Microsoft, Google, Cloudflare and Zendesk. These companies are based outside the European Union and are therefore treated as third countries under the GDPR.
2. The GDPR introduces certain restrictions on transferring personal data to third countries, because since, as a rule, European regulations do not apply there, the protection of the personal data of European Union citizens may be insufficient. Therefore, every controller of personal data is obliged to establish a legal basis for such a transfer.
3. For our part, we assure you that when using services and technologies we transfer personal data only to entities from the United States, and only to those that have joined the Privacy Shield programme, on the basis of the European Commission implementing decision of 12 July 2016 – you can read more on this on the European Commission website. Entities that have joined the Privacy Shield programme guarantee that they will comply with the high standards of personal data protection applicable in the European Union, which is why using their services and technologies in the process of processing personal data is lawful.
4. We will provide additional explanations regarding the transfer of personal data at any time, in particular where this matter raises concern.
5. At any time you have the right to obtain a copy of the personal data transferred to a third country.

Period of processing personal data

1. In accordance with applicable law, we do not process personal data "indefinitely" but for the time that is needed to achieve the set purpose. After this period, the personal data will be irreversibly deleted or destroyed.
2. Where we do not need to perform operations on personal data other than storing it (e.g. when we store the content of an order for the purpose of defending against claims), until permanent deletion or destruction we additionally secure it through pseudonymisation. Pseudonymisation consists in encrypting personal data, or a set of personal data, in such a way that without an additional key it cannot be read, and thus such information becomes completely useless to an unauthorised person.
3. Regarding the individual periods of processing personal data, we kindly inform you that we process personal data for a period of:
   • the duration of the contract – with regard to personal data processed for the purpose of concluding and performing the contract;
   • 3 years or 10 years + 1 year – with regard to personal data processed for the purpose of establishing, pursuing or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
   • 6 months – with regard to personal data collected when quoting a service where a contract was not concluded immediately;
   • 5 years – with regard to personal data connected with fulfilling obligations under tax law;
   • until consent is withdrawn or the purpose of processing is achieved, but no longer than 5 years – with regard to personal data processed on the basis of consent;
   • until an objection is effectively raised or the purpose of processing is achieved, but no longer than 5 years – with regard to personal data processed on the basis of the legitimate interest of the Controller or for marketing purposes;
   • until it becomes outdated or loses its usefulness, but no longer than 3 years – with regard to personal data processed mainly for analytical purposes, the use of cookies and administering the website.
4. Periods expressed in years are counted from the end of the year in which we started processing the personal data, in order to streamline the process of deleting or destroying personal data. Counting the deadline separately for each contract concluded would involve significant organisational and technical difficulties, as well as considerable financial outlay, which is why setting a single date for deleting or destroying personal data allows us to manage this process more efficiently. Of course, where the right to be forgotten is exercised, such situations are considered individually.
5. The additional year associated with processing personal data collected for the performance of a contract is dictated by the fact that, hypothetically, a claim may be raised just before the limitation period expires, a demand may be delivered with significant delay, or the limitation period of a claim may be incorrectly determined.

Rights of data subjects

1. We kindly inform you that you have the right to:
   • access your personal data;
   • rectify personal data;
   • erase personal data;
   • restrict the processing of personal data;
   • object to the processing of personal data;
   • data portability.
2. We respect users' rights arising from the personal data protection regulations and try to facilitate their exercise to the greatest possible extent.
3. We point out that the listed rights are not absolute, and therefore in some situations we may lawfully refuse to fulfil them. However, if we refuse to grant a request, it is only after careful analysis and only where the refusal is necessary.
4. Regarding the right to object, we explain that at any time you have the right to object to the processing of personal data based on the legitimate interest of the Controller in connection with your particular situation. However, please remember that in accordance with the regulations we may refuse to consider the objection if we demonstrate that:
   • there are legitimate grounds for processing that override your interests, rights and freedoms,
   • there are grounds for establishing, pursuing or defending claims.
5. Furthermore, at any time you may object to the processing of your personal data for marketing purposes. In such a case, after receiving the objection, we will cease processing for this purpose.
6. You can exercise your rights by sending an e-mail directly to the Controller at the address .

Right to lodge a complaint

1. If you believe that your personal data is processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office.

Final provisions

1. In matters not regulated by this Privacy Policy, the provisions on the protection of personal data apply.
2. You will be notified of any changes made to this Privacy Policy by e-mail.
3. This Privacy Policy is effective from 25 May 2018.