Expansion

2. You may contact the controller via: kontakt@carrefour.pl, by phone (phone numbers are indicated above) or by letter sent to controller’s register office address.
3. The controller appointed a data protection officer, who you may contact via e-mail: iod@carrefour.pl or by letter sent to controller’s register office address. You may contact the data protection officer in every case concerning personal data processing and rights connected with personal data processing.
4. Your personal data will be processed in following purposes:
a) to obtain your notification and to prepare and send an answer to you. The legal basis of personal data processing is our legitimate interest, i.e. art. 6 pt 1 let. f of the General Data Protection Regulation [GDPR].
b) to monitor a quality of Client service and for analytical and statistical purposes. The legal basis of personal data processing is our legitimate interest.
c) to defend claims. The legal basis of personal data processing is our legitimate interest to assess existence of potential claims and defense against claims raised against Carrefour Polska.
5. Your personal data may be shared with entities, which provide services for Carrefour Polska in the area of documents archiving and destruction, IT services, legal, tax, audit, courier, post services and entities from the Carrefour Group.
6. Your personal data will be processed until we reply to your notification. After that your data may be processed until the end of clams termination period – in the scope necessary to assess existence of potential claims and claims defense.
7. You have a right to request access to your data as well a a right to request to have your data deleted, amended and to restrict processing of your personal data, as well as right to object to further processing of your data as well as right to file a complaint to the data protection authority of your residence or where the alleged breach took place (in Poland: to the President of polish data protection authority – “Urząd Ochrony Danych Osobowych”).
8. The controller may transfer your personal data to the third country (outside EU), i.e. to the USA – based on decision which determined appropriate personal data security level, issued in accordance with art. 45 of the GDPR by the European Commission – to entities certified under the contract concluded between European Union and United States concerning personal data privacy („Data Privacy Framework”).
9. You provide your personal data to the controller voluntarily, however it is necessary to provide personal data when you want to receive answer to your notification by letter, e-mail or phone.
10. The controller will not make any automated decisions based on your personal data (including profiling).