Privacy Policy 

To Whom It May Concern:

Your personal data can be provided to us both directly (e.g. when using our website or mobile application, subscribing our newsletter or buying our magazine subscription) and through our Partners (e.g. when participating in events organized or co-organized by Visteria or following our social media accounts).

We process your data in accordance with the applicable legal regulations, including particularly, without limitation, the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”). 

Please read the “VISTERIA” privacy policy (“Privacy Policy”), containing the information about the way your personal data are handled — about their protection and your rights with regard to your personal data processing.

1. General provisions

The Data Controller with regard to your personal data is Visteria sp. z o.o. with its registered office in Warsaw, at ul. Krakowskie Przedmieście 13, 00-071 Warszawa (Warsaw, Poland), entered to the National Court Register kept by the 12th Commercial Department of the National Court Register of the District Court for the Capital City of Warsaw under the KRS number: 0000529544, NIP (tax identification number): 7010446698, REGON (statistical identification number): 360096691, with share capital amounting to PLN 1,450,000.00 (“Data Controller” or “Visteria”).

 You can contact the Data Controller at the following e-mail address: pomoc@vogue.pl.

The Data Controller makes every legal, technical and organizational effort to protect any and all personal data received from you and used by the Data Controller to the greatest possible degree.

All personal data in possession of the Data Controller are stored and processed in accordance with the applicable legal regulations, in particular, without limitation, with the GDPR.

The Data Controller makes every effort to ensure that the data required for correct functioning of the Website are not collected from you in a manner causing inconvenience on your part and that only such data that are required for the purposes indicated in the Privacy Policy are processed.

2. Groups of persons

The Data Controller processes personal data of the following groups of persons:

• Partners — entities that Visteria collaborates with on current basis.
• Subscribers — persons following the accounts of Visteria in social media (e.g. Facebook, Instagram, Twitter).
• Guests — persons taking part in entertainment, cultural and promotional events organized or co-organized by Visteria.
• Clients — persons who use the “Visteria” subscription and other services or products offered by Visteria.
• Website Users — users of the visteriafoundation.pl website.

3. Categories of data

Identification and contact data: first name and surname, a telephone number (including a mobile phone number, if provided), as well as an e-mail address and mailing address (when the magazine subscription and other services and products offered by Visteria are purchased).

Data regarding the presence and activity in social media: posts and “likes” on Facebook and Instagram, as well as other social media interactions pertaining to Visteria (e.g. sharing posts and images of “Visteria” on your own account and tagging the “Visteria” account on Instagram and Facebook).

Data regarding subscriptions: data related to individual preferences for the purposes of personalization of offers received from Visteria.

Data connected with organization of entertainment, cultural and promotional events: data required for contact purposes and pertaining to your participation in the above mentioned events and your opinion about them, your image on photos taken or videos recorded during such events and their sharing on social media accounts of “Visteria”.

Data received from Partners: data shared by our Partners in relation with jointly organized cultural and entertainment events and actions (e.g. data of Guests, including first names and surnames, e-mail addresses, telephone numbers, Facebook and Instagram user names).

4. Purpose of personal data processing 

1. Data of Partners are used by the Data Controller for the following purposes:

• promoting and advertising the operations, products and services of Visteria (in the case of persons who granted their consent and exclusively within the scope of this consent) — under the provisions of Article 6 sec. 1 letter a) of the GDPR and not longer than until the said consent is revoked;
• execution and performance of contracts with Partners — under the provisions of Article 6 sec. 1 letter b) of the GDPR and not longer than until the expiry of claims related to such contracts;
• performance of Visteria’s obligations arising out of applicable regulations and the ability to confirm their performance, e.g. under the tax law or accounting act — under the provisions of Article 6 sec. 1 letter c) of the GDPR and not longer than until the end of the period of limitation of claims for public law liabilities;
• pursuing legitimate interests of Visteria — under the provisions of Article 6 sec. 1 letter f) of the GDPR, e.g. for the purposes of promoting and advertising our activity, services and products (not longer than until an objection is made), pursuing any claims, archiving for the purposes of protecting our legitimate interests (not longer than until the completion of the said purposes). As regards the purposes related to archiving to protect the legitimate interests of Visteria, we have the right to process data in an automated way.

2. Data of Guests, Clients and Subscribers are used by the Data Controller for the following purposes:

• promoting and advertising the operations, products and services of Visteria and Partners of Visteria (in the case of persons who granted their consent and exclusively within the scope of this consent) — under the provisions of Article 6 sec. 1 letter a) of the GDPR and not longer than until the said consent is revoked;
• sending the newsletter from the Website (in the case of persons who granted their consent and subscribed to the newsletter) — under the provisions of Article 6 sec. 1 letter a) of the GDPR and not longer than until the said consent is revoked;
• performance of Visteria’s obligations arising out of applicable regulations and the ability to confirm their performance, e.g. under the tax law or accounting act — under the provisions of Article 6 sec. 1 letter c) of the GDPR and not longer than until the end of the period of limitation of claims for public law liabilities;
• pursuing our legitimate interests — under the provisions of Article 6 sec. 1 letter f) of the GDPR, e.g. for the purposes of promoting and advertising our activity, services and products (not longer than until an objection is made), pursuing any claims, archiving for the purposes of protecting our legitimate interests (not longer than until the completion of the said purposes). In the event of pursuing claims or protecting legitimate interests of the Data Controller, we employ automated data processing, including profiling, but it is necessary for the purposes of execution of or refusal to execute the agreement on delivering subscribed magazines to Clients or rendering any other services or products;
• monitoring the activity of Guests, Clients and Subscribers in the Visteria’s social media in order to adjust and optimize the content displayed to you in response to your needs, which constitutes our legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than until an objection is made; for this purpose, we may use profiling in some cases, but we do not identify persons covered by such profiling;
• organizing entertainment, cultural and promotional events by Visteria — under the provisions of Article 6 sec. 1 letter f) of the GDPR — not longer than until an objection is made;
• ensuring secure and correct functioning of the Website and enabling the data controller to render free services by electronic means in accordance with the Terms & Conditions of the Website, which constitutes our legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than until the end of the period during which it is necessary for the above mentioned purpose;
• handling your questions, if they are not directly related to the ordered services or products, which constitutes our legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than required for the above mentioned purpose or than the end of the period of limitation of claims.

3. Data of Website Users are used by the Data Controller for the following purposes:

• promoting and advertising the products offered by Visteria and Partners of Visteria and monitoring the activity of Users on the Website (in the case of persons who granted their consent and exclusively within the scope of this consent) — under the provisions of Article 6 sec. 1 letter a) of the GDPR and not longer than until the said consent is revoked;
• ability to confirm the performance of Visteria’s obligations arising out of applicable regulations, e.g. under the tax law or accounting act — under the provisions of Article 6 sec. 1 letter c) of the GDPR and not longer than until the end of the period of limitation of claims for public law liabilities;
• monitoring the activity of Users on the Website and in the Visteria’s social media profiles in order to adjust and optimize the content displayed to you in response to your needs, keep the statistics of the number of visits of Users in the Visteria’s social media profiles and check the level of promotion and advertising of the Visteria’s social media profiles, which constitutes our legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than until an objection is made; for this purpose, we may use profiling in some cases, but we do not identify persons covered by such profiling;
• handling your questions, if they are not directly related to the ordered services or products, which constitutes our legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than required for the above mentioned purpose or than the end of the period of limitation of claims.

4. Data of each and every person entering the office of Visteria are used by the Data Controller for the following purposes:

• ensuring safety of people, property and confidential documentation present in the office with the help of a video surveillance system and a log of people entering and leaving the office — with regard to specific purposes other than the purposes of the administrator of the building where the office of Visteria is located. The Data Controller processes also personal data (images) of persons entering our offices, which constitutes the Data Controller’s legitimate interest under the provisions of Article 6 sec. 1 letter f) of the GDPR, not longer than required to ensure the security of the office. Regardless of the circumstances, should you not agree with our assessment of the situation, please submit a complaint to the following e-mail address: daneosobowe@vogue.pl, so that it can be handled promptly.
  

5. Duration of personal data processing 

Your personal data will be stored for the period necessary for each and every of the above mentioned purposes.

If personal data are processed under your consent, you have the right to revoke your consent at any moment, which, however, does not affect the legality of data processing performed upon consent before its revocation.

6. Other consents

On the Website, you can grant your consent for being sent commercial information on products or services offered by the Data Controller or its Partners using electronic means by the Data Controller. This consent is voluntary and can be revoked at any moment (e.g. by sending an e-mail message to: daneosobowe@vogue.pl).

7. Recipients of personal data 

The Data Controller can share your personal data with third parties (recipients) rendering IT, courier mail, freight forwarding, publishing, marketing (e.g. web portals and community websites, such as Youtube, Facebook, Vimeo and Instagram), security, tax, legal and statistic services for the Data Controller. The Data Controller obliges every entity it collaborates with to maintain the level of protection of your personal data adequate to the state of technical knowledge, the costs of implementation and the nature, scope, context and purpose of data processing, as well as the risk of infringement of your rights and freedoms regarding the personal data processing. Your personal data processed by us will be retained not longer than it is required under the applicable regulations. 

In some cases your personal data can be transmitted outside the territory of the European Economic Area.

8. Rights of data subjects

You have the following rights:

• the right to access your personal data and to obtain copies of such data;
• the right to request rectification of personal data, when they are inaccurate, or to request adding missing data, when, for instance, they are incomplete, inaccurate or have changed;
• the right to request erasure of your personal data (so-called “the right to be forgotten”) — when, for instance, you believe there are no grounds justifying your personal data processing, your data will no longer be required for the purposes for which they were collected by the Data Controller, you revoke your consent for personal data processing, you make an objection justified by extraordinary circumstances or such erasure of data is required for the purpose of performing an obligation under any applicable legal regulations;
• the right to request restriction of personal data processing — when your data are inaccurate and their rectification requires time, when there are no grounds justifying your personal data processing, but you do not want the Data Controller to erase such data, when the Data Controller will no longer need your data, but you need for protection of your rights or claims, until it is determined whether the legitimate interests of the Data Controller override your objection to personal data processing;
• the right to transfer personal data — collected in relation to the executed agreement or granted consent, which you can request in the form of a structured universal format readable with widely used mobile or computer hardware;
• the right to revoke your consent — if you grant your consent for your personal data to be processed, you can revoke such a consent;
• the right to object to personal data processing — when your personal data are processed for the purposes related to the performance of a task carried out for reasons of public interest or for the purposes of legitimate interests of the Data Controller — on grounds relating to the data subject’s particular situation, i.e. the facts that did not exist at the moment of data collection, if such personal data were collected directly from the data subject, or the facts that existed at the moment of data collection, but were not known to the Data Controller, if such personal data were not collected directly from the data subject;
• the right to object to personal data processing — if your personal data are processed for the purposes of direct marketing;
• the right to complain to the supervisory authority (President of the Personal Data Protection Office [UODO]).

Should you have any further questions regarding the above mentioned rights, please contact us by e-mail at: daneosobowe@vogue.pl.

Sharing personal data is voluntary, but if you do not share such data, it might make the Data Controller unable to render certain services for you, such as sending the newsletter or performance of any agreements made with Visteria.

We do not collect any data of children or persons under 16. Children and persons under 16 may not share their personal data with us.

9. Transferring personal data outside the EEA 

Upon collecting some of your personal data, the Data Controller uses third-party tools for the purposes of collecting information, Website traffic monitoring and advertisement publication management. For more information, see the “Cookie Policy”.

In relation to the application of the above mentioned technologies, your data will be transferred outside the territory of the European Economic Area. In such events, we make reasonable effort to ensure that the recipients of your data observe adequate security standards, including adequate legal standards; for instance, we verify whether a given recipient has its registered office in a country with personal data protection standards compliant with the EU standards in accordance with the applicable Decision of the European Commission defining an adequate personal data protection level in a given country or we implement standard contractual clauses approved by the European Commission.

10. Links to third-party websites

The website of the Data Controller contains links or other references to third-party websites or social media (e.g. Youtube, Facebook, Vimeo and Instagram) and the Data Controller’s profiles on such portals not belonging to the Data Controller. The Data Controller has no influence on and is not responsible for the manner of personal data processing by owners of such third-party portals, whereas the “Privacy Policy” and the “Cookie Policy” apply accordingly to the Data Controller’s profiles on such websites. Privacy policies and cookie policies implemented by administrators of third-party websites apply to every person who uses a link to any of such third-party websites. Please read those policies when visiting such third-party websites.

The Data Controller is not responsible for personal data protection policies of other entities and organizations, social media providers and online stores with applications (e.g. Youtube, AppStore, Google Play, Microsoft Store, Facebook, Vimeo and Instagram), operating systems, web portals, services, including data shared with other entities through such social media. However, the Data Controller will be able to obtain access to certain data of Users of the above mentioned web portals, such as their age, gender, location, activity on third-party websites within the Data Controller’s profile, which will not enable identification of Users. Such data can be used for the purposes of advertisement targeting, which constitutes a legitimate interest of the Data Controller.

You can grant or refuse your consent for the above mentioned data to be used in relation to the above mentioned web portals in your social media account settings after logging in — under the privacy tab and in the ad display settings. 

11. Final provisions

This “Privacy Policy” contains information on the principles of processing of personal data shared with Visteria directly or indirectly, both by Partners collaborating with us, and by our Clients, Guests, Website Users in relation with the use of the Website and social media (including Facebook, Instagram, Twitter), including the rendition of services (also through the Website and social media, including the newsletter subscription or presence of the indicated group of persons in social media), the performance of agreements made with Visteria and handling questions addressed to Visteria by the groups of persons indicated in the “Privacy Policy”.

The “Privacy Policy” is reviewed and updated on current basis. Any and all changes to this “Privacy Policy” arising out of changes of the applicable legal regulations or connected with changes in the services available on the Website or the development of the Website’s functionality will be promptly communicated to Users by displaying a message on the Website or sending an e-mail message to persons with registered accounts on the Website.

The above mentioned changes will become effective within 14 days from the date of notification in the manner specified above. Any and all changes may come into force and effect after at least 14 days from the moment on which you are notified about the planned changes in the manner specified in the previous sentence.