In connection with the fulfilment of the requirements set forth in Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”), we hereby inform you about the principles of the processing of personal data and about your rights in relation to the processing of your personal data by the Vidicon Group Companies.
The following principles apply as of 25 May 2018.

1. 1. Data Controller
   The controllers of your personal data are the Vidicon Group Companies, which include:
   • Vidicon Sp. z o.o.
   • Vidicon Investments Sp. z o.o.
     both having their registered office at 7-9 Generała Józefa Bema Street, 50-265 Wrocław, Poland, acting jointly as Joint Controllers, represented by the President of the Management Board (hereinafter: ‘Controller’).

   2. Legal basis for processing
   The Controller processes your personal data:

   • in the performance of contracts concluded with counterparties, pursuant to Article 6(1)(b) GDPR,
   • for the fulfilment of legal obligations to which the Controller is subject (e.g. tax obligations), pursuant to Article 6(1)(c) GDPR,
   • for the purposes arising from the legitimate interests pursued by the Controller or by a third party, such as marketing activities, informational activities, and actions taken to protect the interests of the Controller or a third party, pursuant to Article 6(1)(f) GDPR,
   • where necessary to protect the vital interests of the data subject or another natural person, pursuant to Article 6(1)(d) GDPR,
   • in other cases, solely on the basis of prior consent granted by you, pursuant to Article 6(1)(a) GDPR, and to the extent and for the purposes specified in such consent.

   3. Recipients of your personal data
   In connection with the processing of your personal data for the purposes referred to above, the recipients of your data may include:

   • public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes that arise from generally applicable laws,
   • other authorised bodies and entities,
   • entities performing tasks and providing services for the Controller.

   4. Data retention period
   Your personal data will be stored for the period necessary to achieve the purposes specified above, and thereafter for the period and to the extent required by applicable law or arising from the legitimate interests of the Controller.

   5. Your rights
   In connection with the processing of your personal data by the Controller, you have the following rights:

   • the right of access to your personal data, including the right to obtain a copy thereof,
   • the right to request rectification (correction) of your personal data where the data is incorrect or incomplete,
   • the right to request erasure of your personal data (“right to be forgotten”) where:
     • the data is no longer necessary for the purposes for which it was processed,
     • you have objected to the processing of your personal data,
     • you have withdrawn your consent on which the processing is based and there is no other legal basis for processing,
     • the personal data has been processed unlawfully,
     • the personal data must be erased in order to comply with a legal obligation,
   • the right to request restriction of processing where:
     • you contest the accuracy of the personal data,
     • the processing is unlawful and you oppose the erasure of the data, requesting restriction of use instead,
     • the Controller no longer needs the data for its purposes, but you require it to establish, exercise or defend legal claims,
     • you have objected to the processing pending verification whether the legitimate grounds of the Controller override those of the data subject,
   • the right to data portability where all of the following conditions are met:
     • the processing is based on a contract concluded with you or on your consent,
     • the processing is carried out by automated means,
   • the right to object to the processing of your personal data where:
     • there are reasons related to your particular situation in the case of processing carried out in the public interest or in the exercise of official authority vested in the Controller, or
     • the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where your interests or fundamental rights and freedoms override such interests, in particular where you are a child.

   6. Complaints
   If you become aware of unlawful processing of your personal data by the Controller, you have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (PUODO).

   7. Voluntary or mandatory data provision
   Where processing is based on consent (Article 6(1)(a) GDPR), the provision of your personal data is voluntary. Consent may be withdrawn at any time, which will not affect the lawfulness of processing based on consent before its withdrawal. However, withdrawal of consent will prevent certain actions from being undertaken for your benefit.
   The provision of data is mandatory where the legal basis for processing is a legal provision or a contract between the parties.

   8. Profiling
   Your personal data may be processed by traditional and automated means, but will not be subject to profiling.

   9. Further information
   Detailed information on the processing of personal data will be published on the websites:
   www.vidicon.pl | www.vesser.com.pl | www.alarmycentrum.pl

   10. Contact
   You can contact the Controller by sending correspondence to the address indicated in point 1.