Shall enter into force on the 25th May 2018, PRIVACY POLICY Aquapark Wrocław shall endeavour to protect privacy of persons who use our services. This document has been implemented to comply with rules of processing personal data of Users during the use of website and sales services in a way that it will comply with the law, and will be reliable and transparent. The Privacy Policy lays down how Aquapark Wrocław protects the Users privacy and personal data. Aquapark Wrocław has also implemented technical and organisational measures, including the personal data protection policy to ensure that only this personal data are processed by default that are necessary for reaching each specific purpose of the processing. Aquapark Wrocław shall endeavour to ensure full transparency in terms of the personal data functions and processing. Aquapark Wrocław allows the data owners to monitor their processing as well as develops and improves security mechanism to ensure personal data protection during the stage of designing its services at any stage. 1 KEY DEFINITIONS Aquapark Wrocław Wrocławski Park Wodny S.A. with the registered office in Wrocław, ul. Borowska 99, 50-558 Wrocław. Terms and Conditions Terms and Conditions to purchase services of Aquapark Wrocław through the online store and the internet platform to provide customer service. GDPR (RODO) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Service internet services owned by Aquapark Wrocław under which Aquapark Wrocław renders its services. The services are available at the following addresses: aquapark.wroc.pl, sklep.aquapark.wroc.pl and zapisy.aquapark.wroc.pl. User account a collection of resources and settings created by a User within the internet Services under which Aquapark Wrocław renders its services, to manage these Services. Settings a functionality of the Account, which enables the User who uses selected services to manage them, including the option where the User is able to modify himself/herself personal data that he/she has provided. User a natural person who is over 18 years of age and has an Account and uses services offered by Aquapark Wrocław through the Services and a natural person who is over 18 years of age and uses these services offered by Aquapark Wrocław that do not require creating an account.
2 CONTACT DETAILS OF THE PERSONAL DATA ADMINISTRATOR Wrocławski Park Wodny S.A. with the registered office in Wrocław (50-558), ul. Borowska 99, shall be the Administrator of the personal data provided by the User in relation to using the Services. Any enquiries, requests and comments concerning the processing of personal data and rights available to the User shall be submitted through our contact form. 3 THE PURPOSE, THE SCOPE AND THE LEGAL BASIS FOR THE PERSONAL DATA PROCESSING In connection with services rendered by electronic means, Aquapark Wrocław shall process the personal data of the Users, for the following purposes: Creating an account, executing transactions, and performing contracts Scope of the data processed: For the above-listed purposes Aquapark Wrocław shall process personal data provided by the User in registration forms of the Services, i.e. in the case of registration in the online store: first and last name, e-mail address, telephone number, in the case of registration in the internet platform used to provide customer service (swimming lessons): first and last name of the lessons participant, date of birth, first and last name of the parent/guardian, telephone number, e-mail address. Legal basis: Data processing shall be necessary to perform contracts to render services (Article 6(1)(b) GDPR). Statistics of using specific functionalities of the Services, facilitating the use of the Services and ensuring IT security of the Services Scope of the data processed: For the above-listed purposes Aquapark Wrocław shall process personal data concerning Users activity in the Services, such as: websites visited, actions performed, mouse clicks, countries of access, devices used, operating system and browsers. Legal basis: Legitimately justified interest of the Administrator (Article 6(1)(f) GDPR), which involves facilitating the use of services rendered by electronic means and improvement of functionality of these services. Establishment, exercise or defence of claims Scope of the data processed: For the above-listed purpose Aquapark Wrocław may process certain personal data provided by the User on voluntary basis, such as: first and last name, e-mail address, date of birth, data on using services, other data
necessary to prove that a claim has occurred and to identify the size of damage suffered. Legal basis: Legitimately justified interest of the Administrator (Article 6(1)(f) GDPR), which involves establishment, exercise or defence of claims and defending against claims in the proceeding before courts and other state authorities. Processing complaints and requests, replying to enquiries Scope of the data processed: For the above-listed purpose Aquapark Wrocław may process certain personal data provided by the User on voluntary basis, as well as data concerning the use of the services, which resulted in a complaint or a request, and data contained in documents attached to the complaint or the request. Legal basis: Legitimately justified interest of the Administrator (Article 6(1)(f) GDPR), which involves improvement of functionalities of services rendered by electronic means and building positive relations with the Users. Aquapark Wrocław shall request the User to provide the following data in order to deliver services rendered by electronic means: Online store: first and last name, e-mail address, telephone number Platform to enrol for lessons: first and last name of the lessons participant, date of birth, first and last name of the parent/guardian, telephone number, e-mail address. Where the User does not provide the above-mentioned data, he/she will be unable to conclude a contract, and consequently will be unable to use services rendered by electronic means. Where Aquapark Wrocław receives the User s consent to process the personal data, the User shall grant voluntarily. If the User does not grant the consent Aquapark Wrocław shall not perform actions laid down in the consent. The User is entitled to withdraw the consent granted at any time. 4 MARKETING OF AQUAPARK WROCŁAW PRODUCTS AND SERVICES Scope of the data processed: For this purpose Aquapark Wrocław processes data concerning the User s activity in services, which are recorded and stored through cookie files. They include the following data in particular: search history, clicks in the services, visits in the Service sites, login and registration dates, data on using specific services in the Services, e- mail communication history. Remarketing: In order to reach the Users with marketing communication outside of the Services, Aquapark Wrocław uses services provided by external providers. These services involve displaying marketing communication on websites other than the Services. Legal basis: Legitimately justified interest of the Administrator (Article 6(1)(f) GDPR), involving marketing of own products and services.
Newsletter: In order to reach the Users with marketing communication, where a User has expressed a separate consent to this communication, Aquapark Wrocław can contact the User via e-mail messages sending a newsletter. Legal basis: Consent of the personal data holder to process his/her personal data (Article 6(1) (a) GDPR). 5 CATEGORIES OF PERSONAL DATA RECIPIENTS Aquapark Wrocław shall transfer the personal data to the following recipients: Authorised employees and partners of the Administrator to whom the personal data will be disclosed to allow them to perform their duties. Processing entities: Aquapark Wrocław uses providers who process personal data of the Users, solely upon Aquapark Wrocław request pursuant to agreements on assignment. These recipients render such services as cloud computing hosting, servicing and IT-related service of the Services and sale systems, payment services, they also provide systems to analyse traffic in the Services and effectiveness of marketing campaigns used for the purpose of online marketing. Aquapark Wrocław providers mostly have their registered offices in Poland and in the EEA states in France or Germany. Other recipients of data: e.g. our law firm, Insurer and public bodies for the purpose of proceedings they conduct. 6 PERIOD OF THE PERSONAL DATA STORAGE Personal data provided by the User to manage his/her Account and related functionalities shall be stored for as long as the User holds the Account in the Services. Once the Account is deleted, the data shall be anonymised for the purpose of archiving, with the exception of the data that is necessary to process complaints and defend claims related to the use of Aquapark Wrocław services; this data shall be stored for the period of 3 years. Personal data of the Users who do not have an account shall be stored for the period equivalent to the life cycle of cookie files saved on their devices. Details on the way of using cookie files are laid down in paragraph 10) of this Policy. In order to execute obligations resulting from the rules of law, tax regulations in particular, the personal data shall be stored for the period of 5 years, in accordance with the regulations. Personal data provided by the User for marketing purposes shall be stored during the term of the contract or until the User objects to their processing, depending on which of these events occurs earlier.
7 USERS RIGHTS IN TERMS OF PROCESSING THEIR PERSONAL DATA Aquapark Wrocław shall ensure that the Users will be able to exercise all their rights laid down in Articles from 15 to 22 of GDPR. The User may exercise his/her rights by submitting a request using such measures as our contact form. He/she can also introduce selected modifications himself/herself in the Account settings, after logging in specific Services. The User shall not be obliged to provide any personal data to Aquapark Wrocław, however if the User does not provide the data, consequently Aquapark Wrocław will be unable to render these services that require the data to render them. The right to withdraw the consent granted The User shall have the right to withdraw any consent granted to process the personal data at any time. The consent withdrawal shall not impact the processing that Aquapark Wrocław performs in accordance with the law pursuant to the consent prior to its withdrawal. The consent withdrawal shall not result in any negative consequences, however in the case of data processing for the purpose of the services that pursuant to the legislation Aquapark Wrocław may render subject to the consent granting, the withdrawal of the consent will prevent Aquapark Wrocław from rendering them. Legal basis: Article 7(3) GDPR. The right of access to the data The User shall have the right to receive the information whether his/her personal data are processed, and if yes, he/she is also entitled to: a) Receive access to these personal data; b) Receive information concerning the purpose of their processing and categories of the personal data processing, recipients and categories of recipients to whom the data have been or will be disclosed, the planned period of storing the data or criteria used to determine this period, the rights to rectify and erase the data, object to their processing, restrict processing, and the right on lodging a complaint to a supervisory authority, and information concerning the source of the data, automated decisionmaking, including profiling, and if the personal data are transferred to a third country, on security mechanisms used for the purpose of the data portability; c) Receive a copy of the personal data processed. Legal basis: Article 15 GDPR The right to rectify the data
The User shall have the right to obtain without delay the rectification of inaccurate personal data. He/she can do it himself/herself in the Setting bookmark after logging in the Account or submitting the request through the contact form. Legal basis: Article 16 GDPR The right to erasure ( right to be forgotten ) The User shall have the right to the erasure of personal data concerning him or her without delay. The request to erase all the personal data will result in deleting the User s Account. The User shall have the right to the erasure of personal data where: a) The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) Withdraws consent on which the processing of the data is based; c) Objects to the processing pursuant to Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the User objects to the processing pursuant to Article 21(2) GDPR; d) The personal data have been unlawfully processed; e) The personal data have to be erased for compliance with a legal obligation in Union or Member State law; f) The personal data have been collected in relation to the offer of information society services to a child. Legal basis: Article 17 GDPR The right to restriction of processing The User shall have the right to restrict processing of the personal data where: a) The accuracy of the personal data is contested by the User in such cases their processing shall be restricted for a period enabling Aquapark Wrocław to verify the accuracy of the personal data, however this period shall be no longer than 14 days; b) The processing is unlawful and the User opposes the erasure of the personal data and requests the restriction of their use instead; c) The Administrator no longer needs the personal data for the purposes of the processing, but they are required by the User for the establishment, exercise or defence of claims; d) The User has objected to processing of these data in this case Aquapark Wrocław shall restrict the use of the data for the period necessary to verify, whether due to a
specific situation protection of the interests, rights and freedoms of the User override the interest that Aquapark Wrocław seeks when processing these data. Legal basis: Article 18 GDPR The right to data portability The User shall have the right to receive the personal data concerning him or her, and to transfer them to another administrator. The User shall also have the right to request that the data shall be transferred to another administrator without any hindrance from Aquapark Wrocław, where technically feasible. Legal basis: Article 20 GDPR The right to object The User shall have the right to object, at any time to processing of the personal data concerning him or her, including profiling. Aquapark Wrocław shall no longer process the personal data unless Aquapark Wrocław demonstrates compelling legitimate grounds for the processing. Legal basis: Article 21 GDPR The right to lodge a complaint with a supervisory authority If the User considers that the processing of personal data relating to him or her infringes the law, and if it is found that the personal data protection right or any other rights pursuant to GDPR have been infringed, the User shall have the right to lodge a complaint to the General Inspector for Personal Data Protection. Legal basis: Article 77 GDPR Where the User submits a request concerning any of the above-mentioned rights, Aquapark Wrocław shall execute it free of charge without due delay, within one month of receipt of this request. Where the request is complex, Aquapark Wrocław shall inform the User of an extension of this period and another possible deadline to execute the request, which will be no longer than two months. Aquapark Wrocław maintains the right to refuse to execute the request or charge a reasonable fee for administrative cost of issuing the information, communication or taking other actions, where the User s request is manifestly unfounded or excessive, in particular because of its repetitive character. Despite the request to erase the personal data, in relation to the submitted objection or withdrawal of the request to process personal data, Aquapark Wrocław shall have the right to keep some personal data that are necessary and required for purposes to establish, exercise or defend claims.
8 PROFILING Personal data might be processed using automated means (including profiling), however this will not cause any legal implications for the User or significantly influence his or her status. Personal data profiling by Aquapark Wrocław shall involve processing of the User s personal data (including automated means), by using them to assess certain information concerning the User, particularly to analyse or forecast his or her personal preferences or interests. 9 PERSONAL DATA SECURITY Aquapark Wrocław shall implement any necessary actions to ensure security of the personal data of the Users. Our Services apply encrypted data transmission (SSL) during registration and login, which protects Users ID data and offers high protection against getting access to the User Accounts by unauthorised systems or individuals. 10 COOKIE FILES Services managed by Aquapark Wrocław use cookie files (cookies). They are used to provide best services and adjust the services to the Users needs. Cookie files are saved in the user terminal equipment, such as a computer, laptop or smartphone, and are used within the following scope: To remember the language version that has been used as last; To remember login information; Statistical and analytical functions (information on the browser, operating system, screen resolution, etc.); To adapt the content to the Users interests. These files are in no way used for the purpose of unique identification of the Users. Many cookie files facilitate more convenient and efficient use of the services. Disabling them might lead to inadequate display of the service in browsers. 11 PRIVACY OF CHILDREN Online services offered by Aquapark Wrocław are not dedicated to children aged under 16 years. Due to this reason Aquapark Wrocław informs that in the case where personal data of children aged under 16 years are processed without a consent of their legal guardians Aquapark Wrocław will take appropriate measures to erase such data as soon as possible.
Aquapark Wrocław does not deliberately process personal data of children aged under 16 years without a valid consent of their legal guardians. 12 AMENDMENTS TO THE PRIVACY POLICY This Policy can be amended or updated as needed. Aquapark Wrocław shall inform the Users of any amendments or updates to this document through its Services. Due to this reason Aquapark Wrocław recommends the Users to view the Privacy Policy periodically. The Users will be able to verify whether the Policy has been amended since their last viewing by checking the date of the Policy enforcement, which is included in the starting section of this document.