WoshWosh Sp. z o.o. based in Warsaw
I. General provisions.
II. Personal data processing by Administrator.
III. Purpose and storage period of personal data.
IV. Transfer of personal data to other entities.
V. Rights of individuals whose data is processed.
VI. Final provisions.
I. General provisions
administrator processes personal data, the purposes of processing personal data, the
period of its storage and the rights of individuals whose data is processed.
2. The Administrator of your personal data, obtained in connection with the business
activity of the administrator, is WoshWosh Sp. z o.o. with registered office in Warsaw
(02-120), ul. Grójecka 117 lok. 21. The company entered into the Register of
Entrepreneurs registered in the National Court Register of the District Court for the
capital city of Warsaw, XII Commercial Department, under no. KRS 0000793043, NIP
7010934707, REGON 383781101.
3. Personal data is processed in accordance with the law, in particular in accordance with
the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of individuals with regard to the processing of personal data and
on the free movement of such data and repealing Directive 95/46/EC (General Data
Protection Regulation - GDPR, hereinafter referred to as "GDPR")
II. Personal data processing by Administrator
The administrator processes data in cases where at least one of the following conditions
a) The data subject has consented to the processing of his personal data for one or more
b) Processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a
c) Processing is necessary to fulfill the legal obligation incumbent on the administrator;
d) Processing is necessary for the purposes of the legitimate interests pursued by the
administrator or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.
III. Purpose and storage period of personal data
1. Personal data is used for the purpose of:
a) Conclusion and performance of the contract to which the data subject is a party or in
order to take steps at the request of the data subject prior to entering into a contract -
Article 6(1)(b) GDPR;
b) Performance of the legal obligation incumbent on the administrator – Article 6(1)(c)
GDPR - in particular arising from tax law, consumer law, protection of personal data
GDPR (issuing and storing invoices, bills, consideration of requests provided for in the
provisions of the GDPR;
c) Legitimate interests pursued by the administrator – Article 6(1)(f) GDPR - in particular
contact with clients in order to perform the contract and handle complaints.
2. Personal data is processed for the period necessary to perform the contract to which the
data subject is a party, including the period necessary to consider the complaint, as well
as for periods resulting from applicable law, e.g. until the claims expire.
3. Personal data processed on the basis of the consent of the person they concern is stored
until it is withdrawn.
4. Personal data stored on the basis of the legitimate interest of the administrator is used
until an objection is made, if justified.
IV. Transfer of personal data to other entities
The administrator may transfer personal data to other entities if it is necessary to
achieve the administrator's goals related to his business activity. In particular, the
administrator transfers personal data to entities conducting postal or courier activities
in order to perform binding contracts.
V. Rights of individuals whose data is processed
1. The data subject has the right to request the administrator to:
a) Access their personal data, correct and erasure ("the right to be forgotten”);
b) Limit the processing of their personal data;
c) Transfer their personal data;
d) Object to the processing of their personal data;
e) Lodge a complaint with a supervisory authority.
2. The data subject who has consented to their processing, pursuant to Article 6(1)(a) or
Article 9(2)(a) GDPR, has the right to withdraw their consent at any time. The
withdrawal of consent shall not affect the lawfulness of processing based on consent
before its withdrawal.
3. The data subject has the right to object, on grounds relating to their particular situation,
at any time to processing of personal data concerning them, which is based on Article
6(1)(e) or (f), i.e. due to an interest public, exercising public authority or legitimate
interest pursued by the administrator, including profiling based on these provisions.
The administrator is no longer allowed to process this personal data, unless the
administrator demonstrates compelling legitimate grounds for the processing which
override the interests, rights and freedoms of the data subject or for the establishment,
exercise or defence of legal claims.
4. The data subject has the right to lodge a complaint with the supervisory authority,
exercising control over compliance with the provisions on the protection of personal
data. The supervisory authority in Poland is the President of the Office for Personal Data
Protection - www.uodo.gov.pl
VI. Final provisions
In every case concerning the personal data processing, it is possible to contact the
Administrator in writing to the address of registered office: WoshWosh Sp. z o.o., ul.
Grójecka 117 lok. 21, 02-120 Warszawa, or by e-mail: firstname.lastname@example.org