Privacy Policy

I. GENERAL PROVISIONS

  1. The administrator of the personal data obtained within the scope of activity of the SOUL Resto Bar restaurant, including via the website located at https://soul-resto-bar.pl/ is AKROPOL PIOTR NAKIELNY ul. Władysława Łokietka 240C/1, 31-334 Kraków , tel. no. (+48) 662-230-824 e-mail address: kontakt@soul-resto-bar.pl NIP: 8691056986, REGON: 852129895 hereinafter referred to as the “Administrator”.
  2. Personal data is processed by the Administrator in accordance with the currently effective Personal Data Protection Act of August 29, 1997, the Act on Providing Electronic Services of July 18, 2002, as well as in accordance with the provisions of the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation) i.e. the so-called “RODO”.
  3. The controller shall exercise special care to protect the interests of the personal data subjects, and in particular shall ensure that the personal data it collects are:
    1. processed lawfully, fairly and transparently to the data subject;
    2. collected for specific, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes;
    3. adequate, relevant and limited to what is necessary for the purposes for which they are processed;
    4. correct and updated as necessary;
    5. kept in a form that allows identification of the data subject for no longer than necessary for the purposes for which the data are processed;
    6. processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by means of appropriate technical and organizational measures.

II. PURPOSE AND SCOPE OF DATA COLLECTION

  1. Personal data obtained by the Administrator via the Website (online booking, contact form), via e-mail and in the course of phone and in-person bookings made at the Club are used by the Administrator to provide the service to Customers including:
    1. Reservation of seats in the Club for customers for the selected event/event
    2. allow customers to enter the Music Club
    3. Provide customers with tickets to the selected event/event
    4. to respond to customer inquiries about the Club’s offerings sent via the contact form or by e-mail;
    5. Processing of complaints filed;
    6. Settlement of services provided to customers.
  2. Administrator w wyżej wymienionym celu przetwarza następujące dane osobowe:
    1. Name;
    2. The company;
    3. NIP;
    4. Address (street and house/apartment number, postal code, city);
    5. Phone number;
    6. Email address;
  3. The Administrator also processes personal data in the form of an e-mail address in order to send interested persons a Newsletter containing information about the Club’s activities and its current offer (i.e., in particular, information about upcoming events/events at the Club).
  4. In the course of events and parties held at the Club, photographs are taken to document the course of these events/ parties. The photographs taken are used for promotion and marketing of the Club on the Website, as well as in other promotional materials of the Club. Photographs of Club guests are not used for any other purpose other than to promote the Club and the events taking place in the Club.
  5. For security purposes, the Club has a video surveillance system installed, which records the course of the event/event and the entrance to the Club. Personal data (in particular, images of persons) recorded on the monitoring are used solely for the purpose of ensuring the safety of guests and are made available only at the legally justified request of state authorities, in particular the police, the prosecutor’s office or the courts.
  6. The Administrator has the right to entrust personal data to entities by means of which the Administrator carries out the purposes of personal data processing specified in this policy, in particular employees, contractors, and other entities with which the Administrator cooperates, including in particular a website host, a marketing agency and an entity processing electronic payments. The Administrator shall ensure that the protection of personal data entrusted to these entities is maintained under the terms of this policy and the provisions of applicable law.

III. BASIS OF DATA PROCESSING

  1. The Administrator processes personal data obtained by the Administrator via the Website (online booking, contact form), via e-mail, and in the course of making telephone and personal reservations at the Club on the basis of the consent of the data subject, freely and voluntarily given. The provision of data is completely voluntary, but it is necessary for the implementation of services provided by the Administrator, including in particular the reservation of places in the Club. In case of refusal to provide consent for the processing of personal data, it will not be possible to carry out these services.
  2. The processing of the e-mail address for the purpose of sending the Newsletter is carried out on the basis of the consent of the data subject and is completely voluntary. If the data subject does not consent to the processing of his/her personal data for the purpose of sending the Newsletter, the Newsletter will not be sent, however, this does not affect the possibility of booking places in the Club via the website or the possibility of using other services provided by the Club.
  3. The Administrator’s processing of personal data in the form of photographs of guests taken in the course of a party/event at the Club takes place on the basis of the consent of the person in the photograph given in the course of that party/event. This consent is completely voluntary and does not affect the ability to participate in this event/event. Consent is given to the photographer prior to taking the photos.
  4. The controller is also entitled to process personal data, regardless of the consent given, in situations where:
    1. processing is necessary for the performance of a contract to which the data subject is a party, or to take action at the request of the data subject prior to entering into a contract;
    2. processing is necessary to fulfill a legal obligation of the controller;
    3. processing is necessary to protect the vital interests of the data subject or another natural person;
    4. processing is necessary for the performance of a task carried out in the public interest or in the exercise of public authority entrusted to the controller;
    5. processing is necessary for the purposes of legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
  5. Within the scope of the Administrator’s legitimate interests referred to above, the Administrator may, in particular, process personal data in the form of photographs of persons participating in events/events at the Club, if they constitute a detail of a larger whole, in accordance with the provisions of the Law on Copyright and Related Rights. In order to pursue the legitimate interests of the Administrator, the Administrator may also process personal data for the purpose of asserting claims against data subjects, in particular claims for payment of remuneration.
  6. The controller shall keep personal data for the period necessary for the performance of the contract concluded between him and the data subject, as well as for the period after the termination of the contract, until the completion of all claims to which the parties are entitled under the concluded contract, or until their statute of limitations.
  7. Data in the form of an e-mail address for the newsletter, as well as personal data in the form of photos, are used for the duration of the given consent, which can be revoked at any time, but for no longer than 10 years.
  8. The data subject has the right to withdraw the consent granted for the processing of personal data at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. The withdrawal of consent may be made in writing to the Administrator’s address, or electronically to the e-mail address biuro@shineclub.com.pl.
  9. In the case of withdrawal of consent, a situation may arise where the Administrator will be entitled to continue processing personal data on the basis of generally applicable laws. In such a situation, the Administrator will process personal data only for the purposes and to the extent permitted by law despite the lack of consent of the data subject.

IV. RIGHTS OF THE DATA SUBJECT

A. ACCESS TO DATA

  1. The data subject is entitled to obtain confirmation from the Controller as to whether personal data concerning him or her is being processed, and if this is the case, he or she is entitled to access the data and the following information:
    1. purposes of personal data processing;
    2. categories of personal data processed;
    3. information about the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations, as well as the safeguards applied in connection with the transfer of data to recipients in third countries or international organizations;
    4. as far as possible, the planned period of storage of personal data, and when this is not possible, the criteria for determining this period;
    5. information on the right to request from the controller rectification, erasure or restriction of the processing of personal data concerning the data subject, and to object to such processing;
    6. Information about the right to file a complaint with the supervisory authority;
    7. if the personal data was not collected from the data subject – any available information about its source;
    8. information about automated decision-making, including profiling
  2. Upon request, the Administrator shall provide the data subject with a copy of the personal data being processed. For any subsequent copies requested by the data subject, the Administrator may charge a reasonable fee based on administrative costs. If the data subject requests a copy electronically, and unless he or she indicates otherwise, the information will be provided electronically if possible.

RECITIFICATION

  1. The data subject has the right to request from the Controller the immediate rectification of personal data concerning him/her that is inaccurate. Taking into account the purposes of the processing, the data subject has the right to request the completion of incomplete personal data, including by providing an additional statement.

C. DELETION OF DATA

  1. The data subject has the right to request from the controller the immediate erasure of personal data concerning him/her, and the controller is obliged to erase the personal data without undue delay if one of the following circumstances occurs:
    1. personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
    2. the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for the processing;
    3. the data subject objects to the processing and there are no overriding legitimate grounds for the processing
    4. the data subject objects to processing for direct marketing purposes;
    5. personal data were processed illegally;
    6. personal data must be deleted in order to comply with a legal obligation under Union or Member State law to which the Administrator is subject;
    7. personal data was collected in connection with offering information society services.

D. RESTRICTION OF DATA PROCESSING

  1. The data subject has the right to request the controller to restrict processing in the following cases:
    1. the data subject questions the accuracy of the personal data – for a period that allows the Administrator to verify the accuracy of the data;
    2. processing is unlawful and the data subject objects to the erasure of the personal data, requesting instead a restriction on its use;
    3. the controller no longer needs the personal data for the purposes of processing, but they are needed by the data subject to establish, assert or defend claims;
    4. the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of the Controller override the grounds of the data subject’s objection.
  2. Restricting the processing of personal data means storing personal data in order to limit further processing.
  3. If processing has been restricted pursuant to the aforementioned request, such personal data may be processed, with the exception of storage, only with the consent of the data subject, or to establish, assert or defend claims, or to protect the rights of another natural or legal person, or for compelling reasons of public interest of the Union or a Member State. Before lifting a restriction on processing, the controller shall inform the data subject who requested the restriction.

E. DATA TRANSFER

  1. The data subject shall have the right to receive in a structured, commonly used machine-readable format the personal data concerning him or her that he or she has provided to the controller, and shall have the right to send such personal data to another controller without hindrance from the controller to whom the personal data was provided, if the processing is based on consent or on a contract in and if the processing is carried out by automated means.
  2. In exercising the right to data portability set forth above, the data subject has the right to request that the personal data be sent by the Controller directly to another controller, insofar as this is technically possible.
  3. The data subject has the right not to be subject to a decision that is based solely on automated processing, including profiling, and that produces legal effects on the person or similarly significantly affects the person.

F. OBJECTION

  1. The data subject has the right at any time to object – for reasons related to his or her particular situation – to the processing of personal data concerning him or her based on the provision of Article 6(1)(e), (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, including profiling under these provisions.
  2. Once an objection has been lodged, the Controller shall no longer be allowed to process such personal data, unless the Controller demonstrates the existence of compelling legitimate grounds for the processing overriding the interests, rights and freedoms of the data subject, or grounds for establishing, asserting or defending claims.
  3. If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, including profiling, to the extent that the processing is related to such direct marketing. If the data subject raises an objection to processing for direct marketing purposes, the personal data may no longer be processed for such purposes.

G. EXERCISING RIGHTS

  1. Exercise of the rights set forth above shall occur upon request notified to the Administrator in writing or electronically to the e-mail address biuro@shineclub.com.pl. The same e-mail address may be used to address any inquiries regarding the rights to which the data subject is entitled. The Administrator shall make every effort to explain the rights to which the data subject is entitled in a clear and accessible manner and to enable the data subject to exercise them.

COMPLAINT

  1. A data subject has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, his or her place of work or the place where the alleged violation was committed, if he or she believes that the processing of personal data concerning him or her violates this Regulation. As of May 24, 2018, the complaint can be submitted to the Inspector General for Personal Data Protection at the address of the Office of the Inspector General for Personal Data Protection 2 Stawki Street, 00-193 Warsaw.

V. "COOKIES"

  1. The Administrator also processes data characterizing the User’s use of the Website (exploitation data), including:
    1. Designations identifying the telecommunications network termination or data communications system used by the User (e.g. IP address, type and language of the Internet browser, operating system);
    2. Information about the beginning, end and scope of each time the User uses the Website;
    3. Information about data stored to users’ terminal devices (cookies).
  2. “Cookies” used on the Website come from the Administrator, as well as from other entities – in particular, the entity that processes electronic payments, as well as the entity that provides analytical services for website usage (Analytics).
  3. Failure on the part of the user to change the browser settings is equivalent to consent to their use.
  4. Installation of “cookies” is necessary for the proper provision of certain services on the Website, especially those requiring authorization (booking, electronic payments).
  5. The Website uses three types of “cookies”: session, permanent and analytical:
    1. “Session” “cookies” are temporary files that are stored on the final device of the Service Recipient until logging off (leaving the Website).
    2. “Permanent” “cookies” are stored in the final device of the Customer for the time specified in the parameters of “cookies” or until they are deleted by the User.
    3. “Analytical” “cookies” allow to better understand how the Service Recipient interacts with the content of the Website, in particular to better organize its layout. “Analytical” “cookies” collect information about how the Website is used by Service Recipients, the type of page from which the Service Recipient was redirected, and the number of visits and the time of the Service Recipient’s visit to the Website.
  6. The exploitation data collected by the Administrator, as defined above, do not record specific personal data of the Service Recipient, but are used by the Administrator to develop statistics on the use of the Site.
  7. Cookies stored on the user’s device may be used by entities other than the Administrator to profile the user, in particular to display personalized advertising or other content on other websites.
  8. You have the right to decide on the access of “cookies” to your computer by selecting them in advance in your browser window. Detailed information about the possibility and methods of handling “cookies” is available in the settings of your software (web browser). If the User does not want to save files on his/her device, he/she should disable such possibility in the browser window.

VI. FINAL PROVISIONS

  1. The administrator does not make decisions solely by automated means, nor does he use personal data for profiling.
  2. The Administrator does not establish a Data Protection Officer.
  3. The rights of the data subject, as detailed in this Privacy Policy, arise under generally applicable law, and the provisions of this Privacy Policy do not limit these rights in any way.
  4. The extent to which it will be possible to exercise the data subject’s rights may be limited by law, in particular for reasons of the rights and freedoms of others or for reasons of public interest.

Hello! We use cookies to improve your browsing experience. Agree to a little bit of our cookies while you surf? For the inquisitive, our cookie policy is here.