Menu top
Login
Koszyk
EN
Search
Turn on contract mode
Enable print version
RSS
Menu top
Login
Koszyk
EN
Menu EN
  1. Homepage
  2. Privacy Policy

Privacy Policy

 

Data Controller

The personal data is controlled and administered by TARGI KIELCE S.A with its registered seat in 1 Zakładowa St., entered into the entrepreneurs register - the National Court Register KRS kept by the District Court  in Kielce, X Commercial Division of the National Court Register under the number KRS   NIP Tax Identification Number: 6912501686, Regon National Business Registry:  290036480, BDO registration number: 000215403, with share capital of PLN 81,454,900.00, fully paid up.

You can contact the Data Controller:

  • By post: at the address given above;
  • Via the contact form: available at https://www.targikielce.pl/en/contact, or by email at biuro@targikielce.pl;
  • by phone: +48 41 365 12 22 or +48 41 345 62 61.

The Data Controller has appointed Mr Damian Bielecki as Data Protection Officer. You can contact the Data Protection Officer by email at iod@targikielce.pl.

Why Do We Process Your Personal Data?

 

Your personal data will be processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, GDPR). The purposes and scope of the data processed will vary depending on your relationship with us.

 

In all cases, your personal data will be processed to protect and enforce our claims, which constitutes our legitimate interest (Article 6(1)(f) GDPR). Personal data will be processed until the applicable limitation period for claims under the law has expired.

 

In the case of business partners, personal data may be processed for the following purposes:

  • Performance of the contract and protection of our claims (Article 6(1)(b) and (f) GDPR). Personal data will be processed until the contract has been completed or the relevant claims have expired. Providing the data is voluntary, but the data is necessary to enter into the contract.
  • Compliance with tax obligations (Article 6(1)(c) GDPR). Personal data will be retained for five years, calculated from the end of the calendar year in which the tax payment deadline expired. Providing the data is necessary to enter into the contract.
  • Verification of the business partner’s identity against public registers and communication regarding the performance of the contract, which constitutes our legitimate interest (Article 6(1)(b) and (f) GDPR).

 

In the case of individuals creating an account on the Customer, Visitor or Event Organiser portal, personal data will be processed for the following purposes:

  • Provision of electronic services, including ticket purchases, application and registration processes, event organisation and settlement of accounts (Article 6(1)(b) and (c) GDPR). Personal data will be processed until the services have been provided and the relevant legal obligations, particularly tax obligations, have ceased to apply. Providing the data is necessary to create an account or purchase a ticket.
  • Promotion of the Data Controller and its events through photographs and video recordings, where an individual’s image is captured in the footage. This constitutes our legitimate interest (Article 6(1)(f) GDPR). Personal data will be processed until the purpose has been fulfilled or the individual objects to the processing.

 

In the case of website users and individuals contacting us by email, personal data will be processed for the following purposes:

  • Responding to enquiries submitted by email or telephone, which constitutes our legitimate interest (Article 6(1)(f) GDPR). Personal data will be processed until the relevant claims have expired. Providing the data is voluntary, but necessary for us to respond to the enquiry.
  • Ensuring the proper functioning of the website through the use of cookies (Article 6(1)(f) GDPR). Users can block cookies through their browser settings. Disabling the storage or reading of cookies may cause some parts of the website to function incompletely or incorrectly. However, you will still be able to use the website.
  • Analyses and statistics of user activity help us understand how users access and use our services, which allows us to improve our existing services and develop new services for you, which constitutes our legitimate interest (Article 6(1)(f) of the GDPR). Users can block cookies through their browser settings. Doing so may result in the services offered being less tailored to their needs.

 

In the case of individuals interacting with us through social media, personal data may be processed for the following purposes: Personal data may be processed for the following purposes:

  • Running a fan page on a social networking site, which constitutes our legitimate interest (Article 6, paragraph 1, letter f of the GDPR).
  • Direct contact with the user using the available functionalities of the website (e.g. comments, messenger), which constitutes our legitimate interest (Article 6, paragraph 1, letter f of the GDPR). Data will be processed until consent is withdrawn or the user takes action themselves, for example, by deleting a comment. Use of the platform’s available features is voluntary.
  • Analysing the performance, popularity and use of our social media pages, which constitutes the Data Controller’s legitimate interest (Article 6(1)(f) GDPR). Data will be processed until the purpose has been fulfilled or the individual objects to the processing.

We may act as joint controllers of personal data together with the social media platform provider. Such processing is carried out jointly for marketing and analytical purposes. Further information on the division of responsibilities can be found in the privacy notice of the relevant social media platform through which you interact with us.

 

In the case of subscribers to our newsletter, personal data will be processed to promote our services, which constitutes our legitimate interest (Article 6(1)(f) GDPR). Data will be processed until the individual objects to the processing.

 

In the case of VIP guests and media representatives, personal data may be processed for the following purposes:

  • Registration for an event (Article 6(1)(b) GDPR). Personal data will be processed until the relevant services have been provided. Providing the data is necessary to obtain a VIP ticket or press accreditation.
  • Inviting individuals to events, which constitutes our legitimate interest (Article 6(1)(f) GDPR). Personal data will be processed until the purpose has been fulfilled or the individual objects to the processing. The personal data concerned is primarily contact information obtained through previous cooperation or from publicly available sources, such as organisational websites.

 

In the case of participants in competitions and prize draws organised by the Data Controller, personal data will be processed for the following purposes:

  • Conducting the competition or prize draw, including receiving entries, verifying compliance with the participation requirements set out in the rules, selecting winners and awarding prizes (Article 6(1)(b) and (f) GDPR). Providing the data is voluntary, but necessary to participate. Personal data will be processed for the duration of the competition or prize draw.
  • Announcing the results, including publishing the winner’s details to the extent specified in the rules. This constitutes our legitimate interest (Article 6(1)(f) GDPR). Personal data will be processed until the purpose has been fulfilled or the individual objects to the processing.
  • Meeting tax and accounting obligations associated with awarding prizes, including withholding flat-rate income tax on winnings and preparing tax documentation (Article 6(1)(c) GDPR). Personal data will be retained for five years, calculated from the end of the calendar year in which the tax payment deadline expired.
  • Fulfilling the organiser’s statutory obligations, including maintaining records of prizes awarded, issuing certificates in the winners’ names confirming their winnings, and making documentation available to the National Revenue Administration, where the activity organised constitutes a game of chance within the meaning of the Gambling Act (Article 6(1)(c) GDPR).

 

Where the Data Controller acts as an obliged entity within the meaning of the Act of 1 March 2018 on Counteracting Money Laundering and the Financing of Terrorism, personal data will be processed for the following purposes:

  • Applying customer due diligence measures, including identifying and verifying individuals using identity documents, establishing the identity of beneficial owners and the ownership and control structure, determining whether an individual is a politically exposed person, a family member of such a person or a close associate, and assessing the risk of money laundering and terrorist financing (Article 6(1)(c) GDPR). Providing the data is a statutory requirement. Refusal to provide it may prevent the establishment of a business relationship, the execution of a transaction or the payment of winnings.
  • Fulfilling information and reporting obligations towards the General Inspector of Financial Information and applying specific restrictive measures (Article 6(1)(c) GDPR).
  • Personal data processed for these purposes will be retained for five years, calculated from the first day of the year following the year in which the business relationship ended, or the occasional transaction was carried out, unless the General Inspector of Financial Information requires this period to be extended.

 

Where we engage with individuals under B2B cooperation agreements, contracts for specific work, contracts of mandate, graduate internships, student placements or similar arrangements, personal data will be processed for the following purposes:

  • Performance of the contract (Article 6(1)(b) GDPR). Data will be processed to the extent necessary to perform the contract. This includes activities related to entering into and terminating the contract, day-to-day personnel administration, and the calculation and payment of remuneration. Personal data will be processed until the contract has been completed or the relevant claims have expired. Providing the data is necessary to enter into the contract.
  • Fulfilling our public law obligations, based on tax, accounting and social security regulations; this applies in particular to processing for the purpose of calculating and paying income tax advances, social security, health and sickness insurance contributions (Article 6, paragraph 1, letter c of the GDPR). Personal data will be processed until the completion of individual legal obligations. Providing data is necessary to conclude and perform the contract.
  • Ensuring the organisation of tasks through video, email, network traffic and GPS monitoring, which constitutes the legitimate interest of the Controller (Article 6 paragraph 1 letter f of the GDPR), consisting in ensuring the safety of property and personnel. Personal data will be processed in accordance with applicable internal procedures.
  • Fulfillment of the obligation arising from the standards of protection of minors, in particular, verification of criminal record status - if the provision of services involves contact with children (Article 6 paragraph 1 letter c of the GDPR). Personal data will be stored until the legal obligation expires. Providing the data is necessary to enter into the contract.

 

In case of people taking part in recruitment, personal data will be processed for the purpose of:

  • Taking part in the recruitment process (Article 6(1)(a) of the GDPR). Personal data will be processed until consent is withdrawn or until the recruitment process is completed.  Providing data is voluntary, but necessary in order to consider your application.
  • Taking part in future recruitment processes - if consent has been given (Article 6, paragraph 1, letter a of the GDPR). Personal data will be deleted upon withdrawal of consent or after one year.  Providing data is voluntary, but necessary to participate in future recruitment processes.
  • If we offer employment on the basis of an employment contract, Personal Data will be processed in connection with the obligation of the future employer to obtain data (Article 6, paragraph 1, letter c of the GDPR). Personal data will be processed for the period specified by law, and their provision is necessary in order to conclude a contract.
  • In the event of concluding an employment contract or a mandate contract (Article 6, paragraph 1, letter b of the GDPR). Personal data will be processed until the contract is terminated or the claims expire.  Providing the data is voluntary, but the data is necessary to enter into the contract.

 

In case of minors staying on the premises of the Controller or using its services, personal data will be processed for the purpose of:

  • Organising participation in the event as part of an organised school group, including maintaining a list of participants, ensuring safety and contact with the group supervisor, which constitutes our legitimate interest (Article 6, paragraph 1, letter f of the GDPR). We receive data in this regard (name, surname, school name, class) from the school or other institution registering the group, and not directly from the participant. Personal data will be processed for the duration of the event and for the period necessary to clarify any events, but no longer than the statute of limitations for claims.
  • The sale and issuance of named tickets, including tickets purchased by a parent or legal guardian on behalf of a minor, and the organisation of events aimed at children (Article 6(1)(b) and (c) of the GDPR). We then receive the minor's data from the ticket purchaser. Personal data will be processed until the services have been provided and the relevant legal obligations, particularly tax obligations, have ceased to apply.
  • Enabling a minor to complete an internship or apprenticeship, including concluding and performing a contract and fulfilling obligations arising from the provisions of labor law and education law (Article 6, paragraph 1, letter b and c of the GDPR). To conclude a contract with a person under 18 years of age, the consent of the legal representative is required.  The retention periods correspond to the periods stipulated for employee and training records.
  • Fulfilling the obligations arising from the Act of 13 May 2016 on counteracting the threat of sexual crime and the protection of minors, including the implementation and application of standards for the protection of minors and the receipt and consideration of reports of abuse of minors and undertaking intervention measures (Article 6 paragraph 1 letter c of the GDPR, and in the scope of special categories of data - Article 9 paragraph 2 letter b of the GDPR). We retain documentation of reports and interventions for the period necessary to complete the actions taken and forward the case to the competent authorities.

 

In the case of video monitoring, personal data are processed to ensure employee safety, protect property, and maintain the confidentiality of information, which constitutes the controller's legitimate interest (Article 6 (1) (f) of the GDPR) and covers most of the facility. The recordings are stored for a period not exceeding 3 months, unless they constitute or may constitute evidence in the proceedings, in which case this period is extended until the final conclusion of the proceedings.

 

Your data will not be subject to automated decision-making. The Data Controller does not process the collected data in an automated manner. Profiling is used only to prepare commercial information, including direct marketing relating to the organisation of future trade fairs or conferences, and only where the data subject has consented to receiving such information. This process is applied only to contractors and supports activities in this area, but the final decision is made by designated and authorized employees.

 

Who do we share your data with?

 

  1. Entities based on concluded data entrustment agreements, in particular IT/hosting service providers, payment providers, as well as persons authorised by us, i.e. employees and associates.
  2. External data controllers, e.g. legal advisors and lawyers, postal operators, payment service providers, as well as judicial authorities, the police, prosecutor's offices, offices, e.g. Social Insurance Institution or Tax Office.
  3. To entities located outside the EEA, but only where necessary and with an adequate level of protection, in particular through:
    • cooperation with entities in countries for which an appropriate decision of the European Commission has been issued;
    • use of standard contractual clauses issued by the European Commission.

The Controller always informs about the intention to transfer personal data outside the EEA at the stage of their collection.

 

What rights do you have?

  1. The right to access your personal data processed by us (Article 15 of the GDPR).
  2. The right to rectification of personal data, including their correction (Article 16 of the GDPR).
  3. The right to request the deletion of your personal data in cases provided for by law (Article 17 of the GDPR).
  4. The right to request restriction of the processing of personal data (Article 18 GDPR).
  5. The right to receive personal data from the Data Controller in a structured, commonly used, and machine-readable format and to transfer personal data to another controller (Article 20 of the GDPR).
  6. The right to withdraw consent to the processing of personal data. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
  7. The right to object to the processing of your personal data if it is processed to pursue the legitimate interest of the controller (Article 21 of the GDPR).
  8. If you believe that data protection legislation has been breached, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) at https://uodo.gov.pl/.