I. General terms
- Personal data collected by the openmindeddrumming.com online service (“Online Service”) is processed by the Administrator, i.e. OPEN MINDED CREATIVE SOLUTIONS LIMITED 11101075 with its registered office at 85 GREAT PORTLAND STREET, FIRST FLOOR, W1W 7LT LONDON, GREAT BRITAIN (“Administrator”).
- Personal data is processed by the Administrator in accordance with the Personal Data Protection Act of 10.05.2018, Act on Rendering Electronic Services of 18.07.2002, as well as laws from the 2016/679 Regulation of the European Parliament and the EU Council of 27.04.2016 on the protection of individuals in relation to the processing of personal data and on the free transfer of such data, as well as the repealing of the 95/46/W Directive, i.e. General Data Protection Regulation ( “GDPR”).
- The Administrator takes due care to protect the interests of the individuals whose personal data are processed, and in particular ensures that the collected data:
- a. are processed in accordance to law, in a reliable and transparent manner to the individual they refer to;
b. are collected for specific, explicit and legitimate purposes and are not processed further in a manner inconsistent with those purposes;
c. are adequate, relevant and limited to the extent necessary for the purposes they are processed for;
d. are correct and updated when necessary;
e. are stored in a form which enables the identification of the data subject, for a period no longer than required for the purpose why they are processed;
f. are processed in a manner ensuring adequate security of personal data, including protection from unauthorised and unlawful processing and accidental loss, destruction or damage, by means of appropriate technical and administrative measures.
II. Purpose and scope of collecting personal data
- The Administrator as part of the Online Service collects personal data during the registration of the User in the Online Service, when placing an order, while making entries for participation in music workshops, while completing the contact form, while subscribing for the newsletter and receiving other promotional materials from the Administrator.
- Data collected during user registration in the Online Service, as well as while placing an order and making entries for participation in music workshops are obtained for the purpose of keeping the user account in the Online Service, implementing of the contracts of sale of products and services offered by the Online Service, implementing the contract for participation in the music workshops, including the settlement and delivery of products and services, conducting of music workshops, conducting any complaint procedures and investigating possible claims that may arise.
- The Administrator processes personal data for the purpose of sending a newsletter and other promotional materials about the Administrator’s activities.
- For the purposes mentioned above, the Administrator processes the following personal data:
- i. name and surname;
ii. names and surnames of parents/legal guardians (in the case of making entries for participation in the music workshops);
iv. residential address;
v. date of birth of the participant (in the case of making entries for participation in the music workshops);
vi. e-mail address;
vii. phone number;
viii. image of the participant (in the case of making entries for participation in the music workshops);
ix. bank account number (for the purpose of refunds of payments);
x. other personal data necessary to implement contracts regulated by this policy document.
III. Basis for data processing
- The Administrator processes personal data obtained by the Administrator through the Online Service on the basis of the consent from the person whose data is subject to processing, which is free and voluntary. Providing personal data is completely voluntary.
- Refusal to give consent to the processing of personal data for the purpose of registration to the Online Service makes it impossible to register to the Online Service and to purchase offered products and services, as well as make entries to participate in music workshops.
- Giving consent to receiving the newsletter and promotional information is not required to register to the Online Service or to place an order and make entry to participate in music workshops. In case the consent is not given, the newsletter and other promotional information will not be sent.
- The Administrator has the right to process personal data, regardless of the given consent, when:
- a. processing is necessary to implement the contract to which the person whose data is being processed is party or to take action at the request of the data subject before concluding the contract;
b. processing is necessary to fulfil all legal obligations of the Administrator;
c. processing is necessary to protect the vital interests of the data subject or other individual;
d. processing is necessary to perform any task carried out in the public interest or as part of public authority entrusted to the Administrator;
e. processing is necessary for purposes arising from legitimate interests pursued by the Administrator or by a third party, except for situations in which the interests and basic rights and freedoms of the data subject override those of the Administrator and which require the protection of personal data, in particular when the data subject is a child.
A. Access to data
- The data subject is entitled to obtain confirmation from the Administrator if his personal data is being processed, and if so is also entitled to gain access to those data and to the following information:
- a. the purposes of personal data processing;
b. types of personal data being processed;
c. information about recipients or types of recipients to whom personal data have been or will be revealed, in particular about recipients in third countries or international organisations, and also about security measures applied to the transfer of data to recipients in third countries or international organisations;
d. if possible, the planned time frame of storing of personal data, and in case it is not possible, the regulation which apply to determine of such time frame;
e. information about the right to ask the Administrator to amend, delete or limit personal data processing of the data subject and to object to such processing;
f. information about the right to complain to the supervisory authority;
g. in case personal data has not been obtained from the data subject, all available information about the source of the data;
h. information about automated decision making, including profiling;
- The data subject has the right to demand from the Administrator immediate amendments to be made to his personal data if they are incorrect. Taking into account the purposes of data processing, the data subject has the right to request supplementing of incomplete personal data, also by providing additional declarations.
C. Deleting of data
- The data subject has the right to demand from the Administrator to immediately delete his personal data and the Administrator is obliged to delete personal data without undue delay if one of the following circumstances takes place:
- a. the personal data is no longer required for the purposes for which they have been collected and is no longer processed in any other manner;
b. the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for data processing;
c. the data subject objects to the processing and there are no overriding legitimate grounds for data processing;
d. the data subject objects to data processing for the purposes of direct marketing;
e. personal data have been processed unlawfully;
f. personal data must be deleted in order to comply with the legal obligations under the European Union laws or the laws of the member state to which the Administrator is subject;
g. personal data were collected in connection with offering of the information society services.
D. Limiting of data processing
- The data subject has the right to demand from the Administrator to limit the processing of the data in the following cases:
- a. the data subject questions the accuracy of the personal data – for a period allowing the Administrator to verify the accuracy of these data;
b. data processing is unlawful and the data subject opposes the removal of personal data, requesting to limit their use instead;
c. the Administrator no longer needs the personal data for the purposes of processing, but they are needed by the data subject to establish, assert and defend claims;
d. the data subject has objected to the processing – until it is established whether legitimate grounds on the part of the Administrator override the grounds for objection of the data subject.
E. Transfer of data
- The data subject has the right to receive a copy of his data, previously provided to the Administrator, in a structured commonly used machine readable format; and to forward these personal data to a different administrator without any interference from the Administrator to which the data was originally provided, if the processing of data takes place on the basis of consent or contract and in an automated manner.
- By exercising the right to transfer data specified above, the data subject has the right to demand that her personal data is transferred by the Administrator directly to another administrator if it is possible technically.
- The data subject has the right not to be subject to the decision which is based solely on automated processing, including profiling, and has legal effects on this person or influences him/her in a significant manner.
- The data subject has the right to object at any time – for reasons related to his specific situation – against the processing of his personal data based on provision 2016/679 art. 6 para 1, lit e, f of the Regulation of the European Parliament and the EU Council of 27.04.2016, including profiling based on these provisions.
- After an objection has been raised, the Administrator is no longer allowed to process personal data, unless he demonstrates there exist legally valid grounds for data processing which override the interests, rights and freedoms of the data subject or grounds for establishing, investigating or defending claims.
- If personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time against the processing of his data for the purpose of such marketing, including profiling, to the extent that the processing is related to such form of direct marketing. If the data subject objects against data processing for direct marketing purposes, personal data may no longer be processed for such purposes.
G. Implementation of rights
- The data subject has the right to make a complaint to the supervisory authority, in particular in the member state of his residence, his place of work or the place of alleged violation of rights, if he claims that processing of his personal data is in breach of this regulation. The complaint can filed to the President of the Personal Data Protection Office at Office for Personal Data Protection (Urząd Ochrony Danych Osobowych), Stawki 2, 00-193 Warsaw, Poland.
- The Administrator also processes the data which characterise the way the User uses the Online Service (operational data), including:
- a. Information used to identify the telecommunications network or the telecommunications system used by the User (e.g. IP address, type and language of the web browser, operating system);
b. Information about the start, end and range of each time the User uses the Online Service;
c. Information about the data saved to User’s end devices (cookie files).
- d. Session cookies are temporary files that are stored on the Customer’s end device until logging out (leaving the Online Service).
e. Persistent cookies are stored in the Customer’s end device for a specific period of time in cookie files settings or until they are deleted by the User.
f. Analytical cookies allow for better understanding of how the Customers interact with the content of the Service, in particular to better organise its layout. Analytical cookies collect information about the way the Customers use the Online Service, the type of website from which the Customer was redirected, the number of visits and the time of the visit to the Service.
VI. Final provisions
- The Administrator does not make decisions only in an automated way.
- The Administrator does not establish an Inspector of Personal Data Protection.
- The extent to which it will be possible to exercise the rights of the data subject may be limited by law, in particular due to the rights and freedoms of others or for reasons of public interest. You can contact the Administrator in all matters related to personal data in writing to the address: Al. Legionów 15, 34-300, Żywiec, Polska, electronically at: firstname.lastname@example.org or by phone: +48 516 431 316