Online store

NOTICE ON THE PROCESSING OF PERSONAL DATA

of the Consumers using the online store www.sklep.pkl.pl

1. We would like to inform you that the controller of the personal data of persons using the online store (hereinafter: "Data") is Polskie Koleje Linowe S.A. with its seat in Zakopane (34-500), at ul. Bachledy 7D (hereinafter: "Controller").
2. In matters related to the processing of the Data, the Data Protection Officer can be contacted in the following ways:
3. by email to: iodo@pkl.pl,
4. in writing to the Controller's registered office address (given above).
5. The Data will be processed to:
   1. conclude and perform a sales agreement for the services of the Controller and its partners, including those belonging to the PKL S.A. Group, i.e. in particular Kolej Gondolowa Jaworzyna Krynicka S.A., PKL FOOD Sp. z o.o., PKL FOOD Sp. z o.o. sp. k., PKL Horeca Sp. z o.o., PKL Solina Sp. z o.o. (hereinafter: "PKL Group") - including with regard to the conclusion and performance of the agreement, its settlement and processing of any complaints or refunds - and the basis for processing the Data for this purpose is the necessity to perform the agreement or to take action prior to its conclusion at your request or to fulfill legal obligations incumbent on the Controller, including in particular tax or accounting obligations;
   2. carry out statistical, analytical or promotional activities of the Controller or PKL Group, including marketing and contact, responding to inquiries regarding services, products and providing other information concerning the Controller and PKL Group (e.g., presenting advertisements and offers - also customised to your preferences, including with the use of the information contained in cookies) - and the basis for their processing will be the necessity to realise the Controller's legitimate interest consisting in marketing the Controller's or PKL Group's products and services and making contact;
   3. respond to any inquiries or requests addressed to the Controller and to conduct further correspondence in this regard - and the basis for their processing will be the necessity to fulfill the purposes arising from the Controller's legitimate interest in conducting correspondence / responding to inquiries;
   4. establish, assert and defend against claims - and the basis for their processing will be the necessity to fulfill the purposes of the Controller's legitimate interest in establishing, defending and asserting possible claims.
6. Provision of personal data is voluntary, however, it is necessary for the Controlle to carry out certain activities, in particular, necessary to conclude an agreement within the online store, to make contact with you and to use other features of the online store requiring processing of the Data (failure to provide the Data will make it impossible to conclude and perform an agreement within the online store).
7. Recipients of the data may be the Controller's business partners, in particular those providing support in the field of technical service, payment service, work organisation, IT service providers, entities providing marketing and consulting or legal services, insurance firms, partners belonging to the PKL Group and entities authorised under the law - to the extent necessary for the implementation of the above purposes.
8. You have the right to access the Data, including the right to obtain a copy of such Data, to request their rectification, deletion or restriction of processing, to object to their processing (to the extent that the Data are processed based on the legitimate interests of the Controller), to transfer them to another controller, as well as the right to lodge a complaint to the President of the Personal Data Protection Office - in accordance with the rules of law.
9. The Data are kept by the Controller for the purposes specified above and for the period necessary for the performance of the agreement, and thereafter until the expiration of the statute of limitations for possible claims or for the period prescribed by law, whichever is later.
10. The Controller may exceptionally transfer the Data to processing partners outside the European Economic Area (EEA) but only to the extent necessary, related to the provision of services by these partners to the Controller. In such cases, the Controller shall ensure the protection of the Data, in particular by applying standard data protection clauses adopted by a decision of the European Commission, or transfer the Data to countries on which the European Commission has issued a decision stating an adequate level of protection. In such cases, you have the right to obtain a copy of the security measures used.
11. The data is not subject to automated decision-making and profiling.

NOTICE ON THE PROCESSING OF PERSONAL DATA

OF USERS OF THE KASPROWY WIERCH RESORT

1.We would like to inform you that the controller of personal data of users of the Kasprowy Wierch Resort (hereinafter: “Data”) is Polskie Koleje Linowe S.A. with its registered office in Zakopane (34-500) at ul. Bachledy 7D (hereinafter: “Controller”).

2. In matters related to the processing of personal data, the Data Protection Officer may be contacted as follows:

a) by e-mail: iodo@pkl.pl or

b) in writing to the address of the Controller’s registered office (as indicated above).

3. In connection with the provision of services at the Kasprowy Wierch Resort (hereinafter: “Resort”), the Controller may process the following Data:

a) identifying data (first name and surname),

b) contact data (e-mail address, phone number),

c) other data provided in connection with the use of the Resort or services provided by the Controller.

4. Your Data has been obtained directly from you, from an entity that is a separate controller of your Data, or from other persons (in particular, from an entity or person who has purchased a ticket on your behalf, or who has provided your Data for the purpose of inclusion on the ticket).

5. In connection with the operation of the Resort, the Controller may process Data for the following purposes:

a) in connection with the Controller’s provision of services at the Resort, including in particular the sale of tickets (e.g. Skipass, Tourpass), for the purpose of:

• execution of the agreement for the sale of services of the Controller and its partners, including those belonging to the Capital Group of PKL S.A., i.e., in particular, Kolej Gondolowa Jaworzyna Krynicka S.A., PKL FOOD Sp. z o.o., PKL FOOD Sp. z o.o. sp. k., PKL Horeca Sp. z o.o., PKL Solina Sp. z o.o. (hereinafter: “PKL Group”) – including the conclusion and execution of the agreement, its settlement and the processing of any complaints or refunds,
• the promotional activities of the Controller and/or the PKL Group, including marketing and contacting/responding to enquiries about services, products and other information relating to the Controller and the PKL Group,
• defending against or asserting any claims,

and the basis for its processing is the need to perform the agreement or take action prior to its conclusion at your request, to comply with legal obligations incumbent on the Controller, including in particular tax/accounting obligations and the legitimate interest pursued by the Controller in the form of marketing of products and services of the Controller and/or PKL Group, contacting and defending against or asserting any claims;

b) in connection with the verification of identity documents (inspection of an identity document) – to the extent that this constitutes the processing of Data in order to verify whether the services of the Controller are used by the person who has entered into an agreement with the Controller and whose Data has been entered on the ticket – and the basis for its processing is the legitimate interest pursued by the Controller in the form of ensuring appropriate conditions for the use of services and protecting the interests of persons using the Controller’s services;

c) in connection with the operation of an organised ski area – in order to fulfil the obligations incumbent on the Controller in this respect, which include, among other things, of the obligation to keep a record of accidents in an organised ski area – and the basis for its processing is the need to fulfil the legal obligation incumbent on the Controller and the legitimate interest pursued by the Controller in the form of establishing, asserting and defending against any claims, and, in the case of health Data, the need for medical diagnosis and treatment of persons involved in accidents, as well as the need to process the Data to establish, assert and defend against claims and for statistical purposes;

d) in connection with ensuring security on the premises of the Resort – to ensure the safety of persons using the Resort and the protection of property – and the basis for its processing is the legitimate interest pursued by the Controller in the form of ensuring the safety of persons using the Resort and the protection of property, and the necessity of the processing to protect the vital interests of the Data subject or another natural person;

e) in connection with the implementation of video surveillance on the premises of the Resort, including but not limited to the area of the ticket offices, stations, and the cable car route with its infrastructure  – Data including the image of persons using the Resort is processed – in order to ensure the safety of persons using the Resort (including protection against abnormal or aggressive behaviour of others) and the protection of property (including protection against destruction, theft and/or burglary) – and the basis for its processing is the legitimate interest pursued by the Controller in the form of ensuring the safety of persons using the Resort and the protection of property.

6. Recipients of the Data may include:

1. partners belonging to the PKL Group;
2. the Controller’s business partners – in particular, those providing support in the field of technical support, payment processing, work organisation, providers of IT services and technical solutions (e.g. SkiData), entities providing marketing, consulting/legal services and security companies;
3. entities authorised by law.

7. The provision of Data is voluntary, but necessary to use the Resort and the services provided by the Controller (failure to provide Data will result in the impossibility of providing the service).

8. The Data are kept by the Controller for the purposes specified above and for the period necessary for the performance of the agreement, and thereafter until the expiry of the statute of limitations for any claims or for the period prescribed by law, whichever is the later. In the case of video surveillance – the recordings will be kept for a maximum period of 3 months, unless they have been secured, in accordance with applicable regulations, for the purposes of pending proceedings or when the Controller has become aware that they may constitute evidence in the proceedings – in which case the retention period will be extended until the final conclusion of the proceedings. To the extent that the processing is based on the Controller’s legitimate interest (including, but not limited to, marketing activities), the Data will be processed until the Controller no longer has such legitimate interest or until the Data subject successfully objects to such processing. In the case of a register of accidents in an organised ski area, the Data shall be kept for a period of 10 years from the date of entry into the register.

9. You have the right to access the Data, including the right to obtain a copy of such Data, to request their rectification, deletion or restriction of processing, to object to their processing (to the extent that the Data are processed based on the legitimate interests of the Controller), to transfer them to another controller, as well as the right to lodge a complaint to the President of the Personal Data Protection Office - in accordance with the rules of law.

10. Data is not transferred outside the European Economic Area.

11. The Data is not subject to automated decision-making and profiling.