GDPR

Your personal data may be processed according to the purpose for which it was collected on the basis:

1. Article 6(1)(a) of GDPR in one or more specific purposes for which you have consented to the processing of your personal data – to the extent covered by the content of your consent, in which the processing of personal data is not carried out on another of the following grounds (e.g. consent to receive newsletter);
2. Article 6(1)(b) of GDPR for the purpose and to the extent necessary to conclude and perform the agreement to which the data subject is a party (applies only to cases of concluding an agreement with AC S.A. or taking actions at the request of the data subject before concluding the agreement), including in particular the provision of services in the scope of shipment of ordered goods, preparation of accounting and customs documents, payment execution, handling of complaints;
3. Article 6(1)(c) of GDPR in order to fulfil the legal obligations incumbent on the administrator, including those resulting from the tax law or other specific acts (e.g. requirements concerning the approval and installation of gas installations, requirements concerning the archiving of documents, the obligation to issue and keep accounting documents);
4. Article 6(1)(a,f) of GDPR in order to answer your inquiry or to settle an issue with which you will contact the administrator, e.g. by means of a contact form, Facebook chat or e-mail, conducting marketing activities, including direct marketing of the administrator's products and services (in particular, sending marketing information, including commercial information about products, competitions, promotions, training courses, etc.), as well as invitations to events organised by the administrator, promoting the administrator's fanpage), providing technical support for the administrator's products and services, verifying your payment reliability and creditworthiness, e.g. when deciding on cooperation or granting a credit limit, as well as in order to secure due payments (surety agreements and other legal forms of security);
5. Article 6(1)(f) of GDPR for analytical and statistical purposes consistent with the legitimate interest of the administrator, consisting in particular in the need to conduct trade and market analyses, as well as to collect information on the preferences of business partners, among other things in order to develop or improve the products and services provided, ensure the possibility of correct display of the content on the administrator's website or profile on social networking sites, ensure safety and the possibility of eliminating possible technical defects, control and analysis of traffic on the website or fanpage on Facebook, prepare personalized offers and advertisements, place the data of entities with which the administrator cooperates on the administrator's website, including marking their location on a map, register visits of third parties to the company's premises as part of preventive actions – including those preventing the spread of the COVID-19 epidemic;
6. Article 6(1)(f) of the GDPR to protect the rights of AC S.A., including the assertion of possible claims or defence against such claims, in particular the assertion of overdue payments within the framework of debt collection processes and court trials.

AC S.A. processes, in particular, the following categories of personal data: first name, surname/name (company), contact details such as: e-mail address, address of residence or registered office, address for delivery, telephone number, function or position held, NIP, REGON, BDO identification numbers, bank account number, data contained in financial documents, and additionally in connection with the use of the administrator's website or social networking sites: IP address, image e.g. within the framework of a profile photo, the content of published comments or posts, information sent e.g. by chat, information about the device the user uses, the country of origin or the Internet browser used. AC S.A. receives personal data both directly from the data subject (e.g. by filling in an appropriate contact form or by means of social networking sites, e.g. during visits to the administrator's profile (fanpage), as well as it can obtain them from publicly available sources (e.g. from CEIDG, KRS and/or GUS), as well as from other entities (e.g. contractor, business partner, database owner, employees).

If justified by the purpose of the processing referred to above, your personal data may be transferred to third parties with whom the controller cooperates, such as: providers of IT systems, hosting, cloud computing or other services related to IT systems and software, entities maintaining and technical maintenance of the controller's website or e-mail, controlling and analysing website traffic, administrators of social networking sites used by the controller, such as: Facebook, Instagram, LinkedIn, Twitter, entities providing bookkeeping, legal, advisory, marketing, financial, accounting, tax, auditing, document archiving, etc. services to AC S.A., postal operators and couriers, banks for payment execution, debt collection companies, as well as bodies entitled to receive your data on the basis of the law.

In principle, your personal data will be stored for the time necessary to achieve the purposes for which it is collected, not less than the time required by the legal obligations imposed on the controller or the expiry of the statute of limitations on possible claims, if the processing of personal data will be necessary to establish them or pursue them by the controller or to defend against such claims. Subject to the above, data processed on the basis of consent shall, as a rule, be processed until the withdrawal of consent or the cessation of the activity to which the consent relates by the controller, unless the controller has a legally valid interest in their further processing overriding the interests, rights and freedoms of the data subject.

The provision of personal data by you is mandatory to the extent required by law and, for the rest, voluntary, although necessary to achieve the objectives set out above.

You may withdraw your consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to its withdrawal, as well as the possibility of data processing by the controller on another basis. We kindly ask for a possible withdrawal of consents in writing or by e-mail: rodo@ac.com.pl.

You have the right to demand from the controller access to your personal data, the right to demand its correction, deletion or restriction, the right to object to the processing, the right to transfer the data, at any time. You also have the right to lodge a complaint with the competent supervisory authority dealing with personal data protection – i.e. the President of the Personal Data Protection Office – if you believe that the processing of your personal data violates the provisions of GDPR.

AC S.A. does not carry out any automated data processing in a manner that would result in any decision being made against you or in any other similar way significantly affect your situation or bring about legal effects. However, those who receive your personal data, e.g. in connection with accessing a website or a profile on the administrator's social network, may use it, for example, to display your content similar to the content you previously searched for (profiling). This applies in particular to Google and Facebook services.

The administrator uses in particular the following tools on its websites:

• Google Analytics - a web analytics tool provided by Google LLC with its registered office in Mountain View, USA, for more information on this tool visit: http://www.google.com/analytics/learn/privacy.html
• Facebooka Pixel - an analytical tool that helps measure the effectiveness of ads based on the analysis of actions taken by users on the site, provided by Facebook, Inc. with its registered office in Menlo Park, USA, for more information about this tool visit: https://pl-pl.facebook.com/business/help/742478679120153?id=1205376682832142;
• Hotjar - tools that track how users navigate the site with their eyes or mouse, provided by Hotjar Limited based in Malta, for more information about this tool visit: https://www.hotjar.com/.

COOKIES

In order to provide services at the highest level the administrator uses cookies. Cookies (or similar technologies) are small text files sent by the website you visit and saved on your device (computer, smartphone, etc.), which enable, among other things, proper display of the website, use of all its functionalities and statistics on traffic on its pages, as well as allow the administrator to remember your visits to the website and the choices you make on the website, among other things, in order to adjust the website to your needs. Cookies do not change the configuration of your device or the software installed on your device. Some cookies are files that are generated by the administrator's website, while others operate in connection with the services of other entities used by the administrator (e.g. Google, Facebook).

Using the administrator's website means that cookies will be placed on your device. Additionally, using the administrator's website means that you accept the processing of personal data made available electronically. When you visit the website for the first time, you will be asked to accept the use of cookies by the administrator. You can change the settings of your web browser or mobile device at any time, including the settings for cookies, specifying their storage conditions and scope of use.

The administrator uses two types of cookies:

• performance cookies (gathering information on how visitors use the site, e.g. most frequently visited pages or error messages, etc.),
• functional cookies (saving user settings, e.g. language, consents etc.), such as::
  • google-analytics.com cookies – are used to keep statistics for the website;
  • inspectlet.com cookies – are used to determine how users use the site;
  • session cookies – these are temporary information stored in the memory of the browser until the end of the session, i.e., its closure.

Third-party websites, to which the administrator's website sometimes refers, may also use other cookies than those mentioned above, including in particular those enabling logging in and providing advertisements corresponding to the user's preferences and behaviours. These types of cookies are present:

• on youtube.com – those cookies contain user preferences and the number of clicks;
• on player.vimeo.com and av.vimeo.com – those cookies allow you to log in, as well as the ones placed by advertisers to match the content and forms of advertising.

In most web browsers you can: delete cookie files from your computer's hard drive (from the browser settings), block all sent cookies or set a warning before saving them on your drive. However, it should be borne in mind that changes in the settings of these files by limiting their use may affect some of the functionalities available on websites using them, e.g. by making it impossible to log in to an email account. Not changing these settings means accepting the use of cookies..