Information notice for persons contacting RCE Automatyka
The following information applies to persons who contact us via the contact form on rce-automatyka.pl, by e-mail or by telephone.
1 Data Controller
The controller of your personal data is:
RCE Automatyka Sp. z o.o.
ul. Jana Styki 16, 64-920 Piła, Poland
VAT: PL764 268 4469 | REGON: 368606513
Contact for data protection matters:
E-mail: biuro@rce-automatyka.pl
Tel.: +48 532 881 631
The controller has not appointed a Data Protection Officer (DPO) as it is not obliged to do so under Art. 37 GDPR. For data protection matters please contact us directly using the details above.
2 Purposes and legal bases for processing
We process your personal data for the following purposes and on the following legal bases:
Data: full name, e-mail address, telephone number (if provided), enquiry content
Legal basis: Art. 6(1)(b) GDPR — processing necessary to take steps at the request of the data subject prior to entering into a contract; or Art. 6(1)(f) GDPR — legitimate interests of the controller (responding to an enquiry)
Retention period: until the correspondence or sales process is concluded, no longer than 2 years from the last contact
Data: identification and contact details of persons representing the counterparty, data necessary for the performance of the order
Legal basis: Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR — compliance with a legal obligation (e.g. accounting and tax regulations)
Retention period: for the duration of the contract and thereafter for the period required by law (generally 5 years from the end of the tax year in which the cooperation ended)
Legal basis: Art. 6(1)(f) GDPR — legitimate interests of the controller
Retention period: until the expiry of the limitation period for claims under applicable law (generally 3 years or 6 years for claims related to business activities)
Data: IP address, server logs, browser type
Legal basis: Art. 6(1)(f) GDPR — legitimate interests of the controller (ensuring system security)
Retention period: up to 90 days
3 Recipients of personal data
Your personal data may be shared with the following categories of recipients:
- Formspree Inc. (USA) — provider of the contact form service. Transfer to a third country takes place on the basis of Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR).
- Google LLC (USA) — provider of the reCAPTCHA v3 service protecting the contact form. Transfer on the basis of Standard Contractual Clauses.
- Hosting and IT infrastructure provider — to the extent necessary to maintain the website and e-mail.
- Accounting firm / law firm — for accounting and legal services, on the basis of data processing agreements (Art. 28 GDPR).
- Public authorities (e.g. tax offices, social insurance, courts) — only on the basis and within the limits of applicable law.
We do not sell personal data to third parties. We do not share data with external entities for marketing purposes.
4 Your rights
Under the GDPR you have the following rights. You may exercise them by contacting us at biuro@rce-automatyka.pl. We will respond without undue delay, within 30 days at the latest (extendable by a further 2 months in complex cases).
Right of access (Art. 15)
You may obtain confirmation of whether we process your data and a copy of it.
Right to rectification (Art. 16)
You may request correction of inaccurate or completion of incomplete data.
Right to erasure (Art. 17)
You may request deletion of data when it is no longer necessary for the purposes for which it was collected.
Right to restriction (Art. 18)
You may request restriction of processing in certain cases provided for under the GDPR.
Right to data portability (Art. 20)
You may receive your data in a structured, machine-readable format.
Right to object (Art. 21)
You may object to processing based on the legitimate interests of the controller.
Right to lodge a complaint with a supervisory authority (Art. 77)
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority — in Poland: President of the Personal Data Protection Office (UODO):
5 Voluntary nature of providing data
Providing personal data in the contact form is voluntary but necessary to respond to your enquiry. Failure to provide data makes it impossible to establish contact. Where data is processed on the basis of a legal obligation (e.g. in connection with a concluded contract), providing data is mandatory to the extent required by those provisions.
6 Automated decision-making and profiling
We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR that would produce legal effects concerning you or similarly significantly affect you.
The Google reCAPTCHA v3 service performs an automated risk assessment to distinguish humans from bots — it does not, however, produce any legal effects concerning the user and serves solely to protect the form against spam.
7 Data security
We apply appropriate technical and organisational measures to ensure the security of processed personal data, proportionate to the risk of infringement of the rights and freedoms of natural persons. In particular:
- Encrypted HTTPS/TLS connection for the entire website
- Contact form protected by Google reCAPTCHA v3 and a honeypot mechanism
- Access to data restricted to authorised staff only
- Data processing agreements with external entities (Art. 28 GDPR)
8 Updates to this information
We reserve the right to update this information if the law or the manner of data processing changes. The current version is always available at rce-automatyka.pl/en/rodo.html.