Information Clause regarding the processing of personal data in Novismo Academy sp. z o.o.
Dear Sir or Madam,
Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (referred to as “GDPR” or the “General Data Protection Regulation”), hereinafter referred to as GDPR, I present basic information about the principles and methods of processing your personal data in Novismo Academy sp. z o.o.
Personal Data Protection
Novismo Academy sp. z o.o. takes the protection of your personal data extremely seriously. This personal data protection statement applies to the entire website for which it is responsible. Below we inform you about the collection of personal data when using our pages on the website. Personal data includes all data that can be related to you personally, e.g., surname, first name, address, email addresses. We have implemented security measures, both technical and operational, to protect your data against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. Our security procedures are regularly reviewed and adapted to technological progress.
Data Controller and Data Protection Officer
The Controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR) and in accordance with Article 13(1)(a) and (b) of the GDPR is:
- Novismo Academy sp. z o.o. with its registered office in Warsaw at ul. Domaniewska 37/2.43;
- office@novismo.academy
As the Data Controller, we are responsible for ensuring the security of your personal data and the way it is used in accordance with applicable legal provisions. You can obtain any additional information from our Data Protection Officer.
Contact with the Data Protection Officer:
- office@novismo.academy
- to our postal address with the note “Data Protection Officer (DPO)”
Your Rights
In connection with our processing of your personal data, you have the following rights arising from the provisions of the GDPR:
- Right of access to data (Art. 15 GDPR): the right to obtain confirmation whether we process your data, information about the purpose and scope of processing, and to obtain a copy of this data.
- Right to data rectification (Art. 16 GDPR): the right to have inaccurate data corrected or incomplete data completed without undue delay.
- Right to erasure (“right to be forgotten”) (Art. 17 GDPR): the right to request the deletion of data if, for example, it is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent (provided there are no other legal grounds for its further storage).
- Right to restriction of processing (Art. 18 GDPR): the right to withhold operations on data in situations specified in the regulations (e.g., when you contest the accuracy of the data).
- Right to data portability (Art. 20 GDPR): the right to receive data in a structured format and transmit it to another controller if the processing is based on consent or a contract and is carried out by automated means.
- Right to object (Art. 21 GDPR): the right to object at any time to the processing of data based on our legitimate interest (including for direct marketing purposes).
- Right to withdraw consent (Art. 7(3) GDPR): the right to withdraw consent at any time without affecting the lawfulness of processing carried out based on consent before its withdrawal.
- Right not to be subject to automated decision-making (Art. 22 GDPR): the right not to be subject to a decision based solely on automated processing, including profiling, if it produces legal effects concerning you.
- Right to lodge a complaint with a supervisory authority: if you believe that the data processing violates the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
You have the aforementioned rights against us regarding your personal data. You can request the exercise of your rights by providing us with a completed application. The application is available by clicking on the link: Request to exercise personal data protection rights.
In the event of your objection, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or grounds for the establishment, exercise, or defense of legal claims.
Purpose of processing personal data and legal basis
- Personal data of contractors and clients
We process personal data to conclude and perform a contract (Art. 6(1)(b) GDPR). In addition, we process this data to fulfill the legal obligations incumbent on the Controller resulting from the provisions of the Accounting Act of September 29, 1994, and tax regulations (Art. 6(1)(c) GDPR). - Correspondence
We process the data of senders and recipients of correspondence (traditional and electronic) to ensure the proper flow of information, respond to inquiries, and supervise communication, which constitutes our legitimate interest (Art. 6(1)(f) GDPR). - Claim establishment and debt collection
We process data for the purpose of establishing, pursuing, or defending against claims based on the Controller’s legitimate interest (Art. 6(1)(f) GDPR) in connection with the provisions of the Civil Code of April 23, 1964.
(Note: References to the Code of Administrative Procedure and administrative enforcement have been removed, as the civil path is the appropriate route for a commercial company). - Data of employees and collaborators
The processing of employee data is a statutory obligation resulting from the provisions of the Labor Code of June 26, 1974 (Art. 6(1)(c) GDPR). In the case of using social benefits, we process data based on the Act of March 4, 1994, on the company social benefits fund. Regarding the data of collaborators (B2B/mandate contracts), the basis is the performance of a contract (Art. 6(1)(b) GDPR). - Keeping statistics and analytics
We process data to keep statistics and analyze the effectiveness of our activities, which allows for the optimization and improvement of our business operations. The basis for processing is the Controller’s legitimate interest (Art. 6(1)(f) GDPR). - Marketing
We conduct marketing activities promoting our business based on our legitimate interest (Art. 6(1)(f) GDPR). In accordance with the Electronic Communications Law, sending commercial information and telephone marketing are carried out exclusively on the basis of your voluntary and prior consent.
Data Retention Period
Your personal data will be stored for periods resulting from the purposes of their processing:
- In order to perform the contract: for the duration of the contract and until its final settlement.
- In order to fulfill legal obligations: for periods required by law, in particular for 5 years for accounting and tax purposes (counted from the end of the calendar year in which the tax payment deadline expired).
- In order to pursue claims or defend against claims: for the limitation periods specified in the Civil Code (generally 3 years for claims related to running a business, maximum 6 years in other cases).
- In the case of data processed on the basis of consent: until it is withdrawn, but no longer than is necessary to achieve the purpose for which the consent was given.
Recipients of Personal Data
The recipients of your personal data may be entities authorized to obtain personal data under generally applicable legal provisions. Personal data may be transferred to entities with which the data controller has concluded a personal data processing entrustment agreement.
Transfer of your Data to countries outside the EU/EEA
Your data may be transferred to a third country located outside the European Union if it turns out to be necessary for the performance of the contract between us. The Controller will provide the authorized person with copies of the transferred data upon each of their requests.
Automated decision-making process
Our Entity does not use an automated decision-making process (including profiling) within the meaning of Art. 22 of the General Data Protection Regulation. If such processes are used in the future, data subjects will be informed about it in accordance with applicable statutory provisions.
Additional Information
A complaint regarding the processing of personal data can be submitted to the supervisory authority dealing with personal data protection. In the Republic of Poland, the supervisory authority is the President of the Personal Data Protection Office.
These Terms and Conditions are valid from 02.01.2026 until further notice and fulfill the legal obligation resulting from Art. 13 – 14 GDPR. We reserve the right to make changes to these Terms and Conditions, always in order to improve the quality of the services we provide and with respect for your rights and privacy.
