Gdpr Data Protection Policy
Policy of the processing of personal data in SPARK sp. z o.o.
This document is created according to Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Data Protection Directive), further called the Regulation.
Personal data administration and technical conditions of data processing
1. Administrator of personal data is SPARK sp. z o.o., located in Warsaw, ul. Chłodna 20/56, 00-891 Warsaw, TIN (NIP) 5272696432, REGON: 1467212290, email: email@example.com, further called SPARK.
2. Personal data, described in this document, can be stored according to conditions as follows:
a. on email server or serves, accessible via email program or from internet browser. Access is secured by login and password.
b. on VPS cloud server or servers, used to store and process data, access is secured by login and password, accessible via internet browser or application.
c. as physical copy (paper document): in SPARK sp. z o.o. operational office (al. Solidarności 78/101 in Warsaw). Access to the office possible for SPARK employees.
3. Passwords and logins mentioned in pt. 2 a.-b. are known to SPARK sp. z o.o. employees, who are obliged to preserve them in secrecy. Key to SPARK office mentioned in pt. 2 c. are in hands of these employees only.
4. SPARK maintains records of categories of processing activities, according to art. 30 pt. 1-2 of the Regulation. These records document processing of special categories of personal data (as described in pt. 8 of this document)
Purposes of processing of personal data
5. Personal data are processed by SPARK on purpose of organizing tours and providing tour related services to it’s customers.
a. data described in pt. 6 letter a. and c. (data of turists and bus drivers) are processed solely on the purpose of organizing, conducting, providing specific tour or service and are deleted from SPARK databases within 30 days from end of the tour or service or expiry of legal claims, mentioned in art. 17 pt.3 letter e. of the Regulation.
b. data mentioned in pt. 6 letters b.,d.,e., are processed on for the purpose of organizing current and future touristic events, services and tours.
6. People, whose data are processed by SPARK, can be described using the categories below:
a. participants of touristic event/service/tour (tourists): name and surname, email address, address, telephone number, number of passport or ID, and – in the event of business tourism services: name of his/her employer and job position can be processed. This data are processed according to art. 6 point 1 letter b. of the Regulation (as administrator) or according to legal agreement with data administrator (as processor),
b. tour leaders and tour guides: name, surname, email address, telephone (processed by SPARK on basis of art 6. Pt. 1 lit.b of the Regulation) (as Administrator) or according to legal agreement with data administrator (as processor),
c. bus drivers: first name, phone number, processed according to written consent.
d. contractors and theirs employees: name, surname, phone number, email address, job position, processed according to art. 6 pt. 1 lit. b of the Regulation,
e. owners or employees of travel agencies, offices, transport companies, museums, touristic attractions etc.: email address, name and surname, phone number (processed according to art. 6 pt. 1 letter b.,c.,f., of the Regulation).
Rules of transferring personal data to other subjects
7. Transferring of personal data is possible only for the purpose of organizing specific tour or providing specific services. Categories of receivers, to whom the data described in pt. 6 can be transferred, are described below:
a. data of tourists: transfer is possible to hotels, where tourists are staying, to room/transfer and other digital booking platforms (programs or online services), airlines and other transport companies, tour leaders and tour guides, taking part in the tour/service, insurance companies if the SPARK sells travel insurance as an agent and offices and other state-run institutions for the purpose of visa and other official procedures connected with the tour/service,
b. data of tour leaders and tour guides: transfer is possible to hotels, other tour leaders and guides, travel agencies, museums and other tourisitic attractions, bus drivers and tourists.
c. data of bus drivers: transfer is possible to tour guides and tour leaders,
d. data of owners or employees of travel agencies, offices, transport companies, museums, touristic attractions and other SPARK contractors involved in organization of the tour etc.– transfer is possible to tour leaders, tour guides and tourists, as well as to SPARK accountant office (if the data is visible on invoices).
Processing of special categories of personal data
8. It can happen that for the purpose of organizing of a tour / providing a service, SPARK will process information regarding food allergies, special room requirements, special diet. Because this kind of data can lead to knowledge about one’s health, disability, religious or other believes, the data are processed in anonymized way, to not allow anyone to easily connect this special categories of data with specific person. Processing should be done in a way similar to these examples: “number of gluten free meals for the group”, “number of rooms for disabled people for the group”. These kinds of data are removed from SPARK database within 30 days after the tour ends or expiry of legal claims, mentioned in art. 17 pt.3 letter e. of the Regulation.
8.1 Processing of data mentioned in pt. 6a., and pt. 8. is based on consent:
a. acquired in written form by SPARK from the one whose data is processed (also – in digital form) – when SPARK is the administrator of the data,
b. acquired according to the Regulation by administrator – when SPARK is a processor of data.
8.2 In case of processing data mentioned in pt. 8 lit. b., SPARK requires written statement (in digital form if possible) of administrator, that he or she accepts SPARK’s data processing policy. Administrator is obliged to process data shared to SPARK according to the Regulation.
8.3 Consent form, mentioned in pt. 8.1 letter a. and pt.6 letter a. and c. are an annex to this document.
Rights of people, whose data is processed by SPARK
9. A person, whose personal data is processed by SPARK, has the right to:
d. restricting processing,
e. protest against processing,
g. withdraw the consent for processing of data in any moment,
h. make an official complain to data protection authorities,
of his/her data.
9.1 Rights, enumerated in pt. 9 above can be executed according to rules described in the Regulation.
10. In case of processing data on the base of consent, mentioned in pt. 8.1, SPARK provides one information, mentioned in art. 13 pt. 1 and 2 of the Regulation, only in case one does not have information about mentioned data from other sources.
11. This document is preserved in written form in SPARK’s office, address: al. Solidarności 78/101 in Warsaw.
12. This policy is valid from 25 of May 2018.