4JAWA.COM | 4Jawa.com

INFORMATION

1) processing of personal data of the customers is acceptable, for instance, in the following cases: a) processing is necessary for the performance of the agreements whose party is a data subject, or to undertaking activities upon the data subject's request before entering into the agreement=no consent required, only the need to inform (as specified in information not requiring selection by the customer); b) processing is necessary for goals resulting from legally justified interests of the administrator or a third party, unless these interests are overridden by interests or basic rights and freedoms of the data subject, requiring personal data protection, in particular when the data subject is a child = direct marketing of own products or services and enforcing claims under conducted business operations (see item 5 below)= no consent from customers is required, c) with prior consent of the data subject. It relates to other purposes, e.g. newsletters; marketing of services of associated/external entities; sale of database; use of an opinion, etc. = a consent is required.

2) a separate requirement to obtain the customer's consent results also from the Act on Electronic Provision of Services, including sending of newsletters= a consent is required.

3) GDPR provides for specific conditions for obtaining consent, including:

a) the administrator must be able to demonstrate that the data subject expressed his/her consent for processing of his/her personal details.

b) should the consent be expressed by a written statement that applies also to other issues, a request for consent must be presented in a manner expressly distinguish them from other issues, in an understandable and easily available form, in clear and simple language. A part of such statement of the data subject violating GDPR is not binding;

c) the data subject has the right to withdraw his/her consent at any time. Withdrawal of the consent does not affect the lawfulness of processing made on the basis of the consent prior to its withdrawal. The data subject is informed of this fact, before expressing the consent. Withdrawal of the consent must be equally easy as its expression,

d) when assessing whether the consent was provided voluntarily, it is considered to the possibly greatest extent whether, among others, the performance of the agreement, including provision of service, is not dependent on the consent to data processing, if personal data processing is not necessary for the performance of this agreement.

4) it is unlawful to acknowledge the consent to personal data processing for marketing purposes as identical with the consent to obtaining information and offers as defined by the Act on Electronic Provision of Services. The consent to personal data processing for marketing purposes should not be confused with the consent to obtain commercial information via an e-mail. These are two different consents regulated by two different legal acts. The need to obtain the consent to obtain commercial information via an e-mail results from the Act on Electronic Provision of Services. On the other hand, in situations when personal details of our customers are to be used for marketing purposes of associated/external entities, for such action their consent expressed on the basis of GDPR should be obtained. And though both these acts stipulate that the consent may not be presumed from the declaration of will with a different content, sending commercial information electronically is a different action than the use of data for marketing purposes via route other than electronic,

5) a different situation is, however, when the customer has an agreement with a company whose services he/she uses. In such case no consent is required to process personal data for the purposes of marketing of OWN PRODUCTS AND SERVICES OF SUCH COMPANY. The basis for the use of personal details is a legally justified interest of the data administrator. This means that – in order to promote own products and services – you may use personal data of your customers without their permission, provided that such action does not violate rights and freedoms of data subjects.