CBMAX Spirits Ltd.
The controller, i.e. the entity determining the purposes and means of processing personal data, is CBMAX SPIRITS sp. z o.o. with its registered office in Reda, ul. Wejherowska 67, 84-240 Reda, entered into the register of entrepreneurs of the National Court Register kept by the District Court Gdańsk – Północ in Gdańsk, VIII Commercial Division of the KRS, under number 0001040321, REGON: 222050990, NIP: 5871701725, BDO number: 000514146, share capital PLN 14,682,400, hereinafter referred to as the „Controller” or the „Company”.
The administrator encourages you to get in touch with any doubts regarding the processing of your personal data, either at the Company's registered address indicated above or at the office address in Warsaw, 00-728, at Dziekońskiego 3 street.
The company is primarily a distributor of alcoholic beverages. In fulfilling its business functions, we process personal data for the following purposes:
| Processing purpose | Legal basis and data retention period | Legally justified purpose, if applicable |
|---|---|---|
| Entering into and performing a contract with a contractor who is a private individual |
Article 6(1)(a), (b) and (c) of the GDPR The data is provided by the person interested in concluding the agreement; in this case, the data is processed on the basis of their consent. For the duration of the agreement, and after its termination – until the expiry of the limitation periods arising from it. |
Conclusion and performance of the ticket sales agreement, including conducting correspondence and direct remote communication, in particular for conveying organisational information regarding the event with the user of the service. Fulfilment of the Company's legal obligations, in particular the obligation to provide information arising from the personal data protection regulations or the Consumer Rights Act. |
| Handling of complaints and claims |
Article 6(1)(b) and (f) GDPR For 1 year after the expiry of the guarantee or the resolution of a complaint. |
The administrator contacts service users for a legitimate purpose in connection with the processing of complaints. |
| Investigating claims or defending against legal claims |
Article 6(1)(f) GDPR For the duration of the proceedings regarding the claims being pursued, i.e. until their final and legally binding conclusion, and in the case of enforcement proceedings, until the final satisfaction of the claims being pursued. |
In connection with the investigation of claims or defence against claims, the administrator may, for a legitimate purpose, process user data. |
| Archiving documents, i.e. contracts and settlement documents |
art. 6(1)(c) GDPR For periods indicated by law, and if not indicated for specific documents, for the time during which their storage falls within the legally justified purpose of the administrator, regulated by the time for possible claims. |
– |
| Statistics and analysis |
Article 6(1)(f) GDPR Until the expiry of another processing purpose indicated in this table. We do not store personal data solely for statistical and analytical purposes. |
Keeping statistics and analysing activities allows the administrator to improve their operations. |
| Marketing communications using electronic means |
Article 6(1)(a) GDPR These activities, due to other applicable regulations, in particular the Telecommunications Law and the Act on the Provision of Services by Electronic Means, are carried out on the basis of the consents obtained. Until the consent is withdrawn or revoked, i.e. you indicate to us in any way that you do not wish to remain in contact with us and receive information about our activities, and after its revocation – for the purpose of demonstrating the correct fulfilment of the legal obligations incumbent upon the Company and related claims for up to 6 years from the withdrawal of consent. |
Conducting marketing activities to promote your business using email addresses and phone numbers. |
| Running a contact form on a website |
Article 6(1)(f) GDPR Until objection is raised, for no longer than 2 years. |
Responding to submissions and queries made using the contact form or in any other format, including the storage of sensitive requests and responses to maintain accountability. |
| Tailoring website content to user needs, optimising the use of internet services |
Article 6(1)(f) GDPR Personal data will be processed for the periods indicated in the „Cookie Policy” or until an objection is raised to the processing of data. An objection can only be made by changing the end-user's browser settings, which will prevent the collection of information using cookies. |
The administrator's legally justified interest, such as website operation, user visits to the website, analysis of activity on the website, and optimisation of the use of online services. |
If the limitation periods for pursuing potential claims are shorter than the periods for storing accounting documents for tax purposes, we will store these documents for the time necessary for tax and accounting purposes, i.e. for 5 years from the end of the year in which the tax liability arose.
We obtain personal data of ticket purchasers from the following sources:
The Buyer, by accepting the relevant clauses posted on the website, agrees to:
Information regarding the processing of personal data using cookies, via the Cookiebot by Usercentrics tool, is available here: https://festiwalwhisky.pl/#cookiebot
Scope of data processed:
In connection with the activity carried out using the service available at the link https://festiwalwhisky.pl/, The Company may disclose personal data to its service providers, e.g. IT, advisory, security, banking, insurance, debt collection service providers, entities belonging to the same capital group, if such transfer or entrustment of processing is necessary to enable the use of the service, including for ticket purchases, as well as, if such an obligation arises from legal regulations – government and local government authorities, law enforcement agencies, common and administrative courts.
Payments on the service are made in cooperation with and using tools provided to the Administrator by Krajowy Integrator Płatności S.A. based in Poznań, NIP: 7773061579, KRS registration number: 0000412357, hereinafter referred to as the „Provider”. The Administrator is not responsible for consequences arising from irregularities in the functioning of the Provider's payment system, and any irregularities in the operation of the payment system should be reported directly to the Provider by the buyer. The terms and conditions of the Tpay system, used by the Administrator under an agreement with the Provider, are available at the link https://tpay.com. The Supplier's contact details are available here: https://tpay.com/kontakt
Every person whose data is processed by the Company has the right to:
More information on the rights of data subjects is available in Articles 12-23 of the GDPR, the text of which can be found at: https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
Furthermore, the person whose data is processed by the Company has the right to lodge a complaint with a supervisory authority, namely the President of the Personal Data Protection Office; more information can be found at: https://uodo.gov.pl
Providing data is essential for concluding contracts and for the Company to fulfil its obligations imposed upon it by applicable legal regulations, in particular regarding the verification of the age of purchasers and their having reached the age of 18, which obligations are detailed in the Act on Sobriety and Alcoholism Prevention. In other respects, in particular for the processing of data by the Company for marketing or promotional purposes, the provision of data is voluntary.
Personal data is not transferred by us outside the European Union and the European Economic Area. Detailed information about the EEA can be found here: https://www.europarl.europa.eu/ftu/pdf/pl/FTU_5.5.3.pdf.
Personal data will not be processed in an automated manner, including profiling, in such a way that as a result of such automated processing any decisions could be made, other legal effects would be caused, or it would otherwise significantly affect the data subjects processed by the Controller.
Polish Polish 
English
Ukrainian
