PERSONAL DATA PROCESSING POLICY

Due to the obligations imposed on Kognita sp. z o.o. pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC (general data protection regulation “GDPR”), the Company informs about the rules for the processing of your personal data and about your rights Your rights related to it.

1. The administrator of personal data is Kognita sp. z o.o. and with headquarters in Warsaw, 02-979 at ul. Aleji Rzeczypospolitej 20/96, entered into the Register of Entrepreneurs of the National Court Register, for which the registration files are kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division, under the KRS number: 0000829988; NIP: 9512498321; REGON: 38561038400000, with share capital of PLN 5,000 (fully paid up).
2. Questions regarding the method and scope of processing personal data entrusted to Kognita sp. z o.o., as well as regarding your rights, can be submitted to the Personal Data Protection Inspector at the following address: iod@oazavr.pl.
3. Cognita sp. z o.o. processes personal data on the basis and within the limits of applicable law, concluded contracts and on the basis of consent granted on one of the forms (A01, A02, A03 – indicated in the Regulations for the provision of services in the Premises) or when making a reservation through the Bookero booking system located on the website www. oazavr.pl.
4. Personal data is processed within the limits of the consent granted in order to:

4.1. performance of the concluded contract for the provision of services in the Virtual Reality Salon;

4.2. performance of future contracts provided in the Virtual Reality Salon;

4.3. for marketing purposes;

5. Your personal data will be kept for the period necessary to achieve the goals set out in paragraph 4, and after that time for the period and to the extent required by the provisions of generally applicable law.
6. In connection with the processing of your personal data, you have the following rights:

6.1. the right to access personal data, including the right to obtain a copy of this data;

6.2. the right to request rectification (correction) of personal data – if the data is incorrect or incomplete;

6.3. the right to request the deletion of personal data (the so-called right to be forgotten), if:

6.3.1. the data is no longer necessary for the purposes for which it was collected or otherwise processed,

6.3.2. the data subject has objected to the processing of personal data,

6.3.3. the data subject has withdrawn consent to the processing of personal data, which is the basis for data processing and there is no other legal basis for data processing,

6.3.4. personal data is processed unlawfully,

6.3.5. personal data must be removed in order to comply with the legal obligation;

6.4. the right to request the restriction of the processing of personal data – if:

6.4.1. the data subject questions the correctness of personal data,

6.4.2. data processing is unlawful, and the data subject opposes the deletion of data, requesting their restriction instead,

6.4.3. The administrator no longer needs the data for his purposes, but the data subject needs them to establish, defend or pursue claims,

6.4.4. the data subject has objected to the processing of data until it is determined whether the legitimate grounds on the part of the administrator override the grounds of objection;

6.5. the right to transfer data – if the following conditions are jointly met:

6.5.1. data processing takes place on the basis of an agreement concluded with the data subject or on the basis of the consent expressed by that person,

6.5.2. the processing is carried out in an automated manner;

6.6. the right to object to the processing of data – if the following conditions are jointly met:

6.6.1. there will be reasons related to your particular situation, in the case of data processing on the basis of a task carried out in the public interest by the Administrator,

6.6.2. processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, in particular when the data subject is a child.

7. If the processing of personal data is based on the consent of the person to the processing of personal data (Article 6 (1) (a) of the GDPR), you have the right to withdraw this consent at any time. This withdrawal does not affect the compliance of the processing, which was carried out on the basis of consent before its withdrawal, with applicable law.
8. In the event of learning about unlawful processing at the Office of the Capital City of Warsaw of your personal data, you have the right to lodge a complaint with the supervisory authority competent in matters of personal data protection.
9. In a situation where the processing of personal data takes place on the basis of the consent of the data subject, providing your personal data to the Administrator is voluntary.
10. Providing your personal data by you is mandatory when the premise for the processing of personal data is a legal provision or an agreement concluded between the parties.

11. Your data may be processed in an automated manner and will not be profiled.