VentureDevs - Product Designer

DATA PROCESSING NOTICE

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR) will come into effect on 25 May 2018.

Therefore, we hereby inform you that:

The personal data you have provided is controlled by NANOLABS Spółka z ograniczoną odpowiedzialnością Spółka komandytowa with its registered office in Poznań, ul. 27 grudnia 3, 61-737 Poznań, Tax Id. NIP: 783-177-13-47, Business Registry No. REGON: 36934677, registered in the register of entrepreneurs of the National Court Register kept by the District Court Poznań Nowe Miasto i Wilda in Poznań, 7th Commercial Division of the National Court Register, under KRS No. 0000716046.

Contact: as above, phone: +48 535 198 536; email: gdpr@venturedevs.com

The Controller is responsible for using personal data in a secure manner and in compliance with the agreement and applicable laws. The Controller has no obligation to appoint a Data Protection Officer. The purpose of and legal basis for personal-data processing is: the direct marketing of our products and services for which we have obtained consent (Article 6 (1) (a) GDPR), or, where a contract is in place, the performance of such a contract (Art. 6 (1) (b)). Your personal data is transferred to
a) to our providers of advisory, consulting, audit, legal aid, tax, accounting and HR services;
b) other data controllers which process data in their own name;
- providers of postal or courier services;
- entities which cooperate with us in handling accounting, HR, recruitment, tax and legal matters insofar as they become data controllers.

Obligation to advise you of your rights: You have the right to (1) access your personal data and request a confirmation from the Controller on whether and to what extent your data are processed, (2) have your data rectified, (3) request that your data be erased, (3) request that the processing of your data be restricted, in which case the Controller will notify you of any data rectification, erasure or processing restriction, (4) object to the processing of your personal data, (5) request that your personal data be provided in a structured, commonly used and machine-readable format, (5) file a complaint. For detailed information, go to below "Summary of the request handling procedure" chapter.

If your personal data is processed on the basis of consent (Article 6 (6) (1) (a), you may withdraw your consent by means of electronic communication by sending an e-mail to gdpr@venturedevs.com or by traditional mail (post office) by sending a letter to the Controller’s address (see point 1 above). The withdrawal of the consent does not mean that the processing of data prior to the withdrawal had been illegal. Information on automated decision-making, including on profiling: the Controller will not process data in the above-mentioned manner.

SUMMARY OF THE REQUEST HANDLING PROCEDURE

NANOLABS Spółka z ograniczoną odpowiedzialnością Spółka komandytowa with its registered office in Poznań, ul. 27 grudnia 3, 61-737 Poznań, Tax Id. NIP: 783-177-13-47, Business Registry No. REGON: 36934677 („Controller”), for the purposes of allowing data subjects to exercise their rights as set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 the on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).

The objective rights in relation to the Procedure
1. The Procedure is applied to handling requests from natural persons being data subjects, as submitted to exercise the following rights
a) the right to access personal data, including to obtain a copy of such data (Article 15 GDPR);
b) the right to rectification (Article 16 GDPR);
c) the right to erasure (Article 17 GDPR);
d) the right to restriction of processing (Article 18 GDPR);
e) the right to data portability (Article 20 GDPR);
r) the right to object (Article 21 GDPR);
g) the right not to be subject to automated individual decision-making (Article 22 GDPR).

Request submission rules
1. Requests shall be submitted
a) on the Controller’s premises if submitted in person or delivered to the premises;
b) by telephone at +48 535 198 586- if the Request is made orally;
c) electronically – if the Request is sent to the following email address: gdpr@venturedevs.com
2. The Requests shall be submitted by the Requesting Party (the data subject).
3. Requests may be submitted free of charge, but where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested.
4. Requesting parties should be identified in line with the rules applicable to the relevant means of communication, as mentioned in (1) above:
a) when the Request is submitted in person on the Controller’s premises – the identity is confirmed on the basis of a valid identity document (Identity Card, driving licence, passport);
b) when the Request is submitted by telephone – the Requesting Party is require`d to provide his o her verification details, such as Personal Number (PESEL), telephone number, email address and other information facilitating identification; where the Requesting Party refuses to provide his or her verification details, or where the details provided are inconsistent with the data held by the Controller, the Requesting Party shall be informed that the Request may be submitted in a different form and advised as to the acceptable forms of request submission, and advised on how to effectively submit each form of the Request;
c) when the Request is submitted electronically – the Requesting Party’s identity is verified in the following manner: the Requesting Party will receive either an email (with a backlink, if possible), text-message (to the telephone number stated by the Requesting Party) or phone call asking the Requesting Party to confirm that he or she has submitted the Request;
d) when the Request is submitted in hard copy – the Requesting Party’s identity is verified in the following manner: the Requesting Party will receive a query through either an email (with a backlink, if possible), text-message (to the telephone number stated by the Requesting Party) or phone call asking the Requesting Party to confirm that he or she has submitted the Request.
5. Where the Request has been submitted in the manner referred to in (4) (a) or (b) above, and the person handling the Request has established that the identity-verification requirements have not been met, the person handling the Request shall notify the Requesting Party orally that the Request may not be handled for this reason, and shall advise the Requesting Party on the other acceptable forms of Request submission, and on how identification is verified in each of these forms.
6. Identity-verification requirements are considered not to have been met in particular when
a) the Requesting Party appearing in person on the Controller’s premises does not hold a document which facilitates identification of his or her identity, or if the document produced is invalid, or does not allow the Controller to establish the Requesting Party's identity beyond any doubt due to damage, soiling or a mismatched photograph;
b) the Requesting Party refuses to provide, or provides false or incomplete verification details during a phone conversation.
7. When the Request is submitted in the manner referred to in (4) (c) above or (d), the Controller shall verify the identity of the Requesting Party by comparing the information provided in the Request with the information available to the Controller prior to the Request. If this verification method proves to be insufficient – the Requesting Party’s identity is verified by the Controller in the following manner: the Requesting Party receives from the Controller a query (with a backlink, if possible), text-message (to the telephone number stated by the Requesting Party) or phone call asking the Requesting Party to confirm that he or she has submitted the Request.
8. If the Controller has reasonable doubts as to the identity of a natural person being a data subject who has submitted a Request, the Controller may require additional information from such a person to confirm his or her identity.
9. If the information provided in the Request submitted in the manner referred to in (4) (c) or (d) above does not facilitate identification of the Requesting Party’s identity, the Controller will ask the Requesting Party to fill in the Request again and submit it in the same manner as initially.

Considering Requests
1. The Controller shall provide information on action taken on a Request to the Requesting Party without undue delay and in any event within 30 days of receipt of the Request.
2. The aforementioned period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Controller shall inform the Requesting Party of any such extension within 30 days of receipt of the Request, together with the reasons for the delay.
3. Where the Requesting Party makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the Requesting Party.
4. If the Controller does not take action on the Request of the Requesting Party, the Controller shall inform the Requesting Party without delay and at the latest within 30 days of receipt of the Request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
5. The Controller may refuse to take action on the Request if the Requesting Party's request is manifestly unfounded or excessive, in particular because of its repetitive character. The Controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the Request.
6. The Controller or a person acting on its authority may demand that the Requesting Party supplements the Request in the identified scope, and otherwise the Controller may not consider the Request, in the following cases:
a) the information provided in the Request is insufficient to send a reply or a copy of data,
b) the content of the Request is unclear or incomprehensible,
c) the Request refers to transferring or moving data and the Requesting Party did not specify the scope of data to be copied or transferred,
d) the Request refers to transferring data and the Requesting Party selected a data format that is not used by the Controller,
e) the Request refers to moving data and the Requesting Party did not specify the name or address of another controller or provided a wrong address or data of the controller to which the data are to be moved.
7. The notice shall specify the time limit within which the Requesting Party should supplement the Request, in any case not less than 14 days after receiving the notice by the Requesting Party.
8. In cases specified in section IV (3) the Controller shall inform the Requesting Party of the necessity to pay a fee, indicating its amount, the manner and time limit for making the payment. At the same time, the Controller shall inform the Requesting Party that failure to pay the fee shall result in the Request not being considered.

Resolutions regarding the Request
1. The Controller shall dismiss the Request in the following cases:
a) The Request is ungrounded, in particular when recognising the Request is not permitted by law or there is no legal basis for the Controller to be obligated to recognise the Request,
b) The Controller does not have the technical capabilities to fulfil the Request.
c) The Request was not supplemented by the Requesting Party according to the notice for supplementation or within the time limit specified therein.
3. In the case of dismissing the Request the Controller shall send a notice to the Requesting Party specifying the following:
a) resolution to dismiss the Request,
b) grounds for the dismissal of the Request,
c) instruction for the Requesting Party on its right to lodge a complaint with a supervisory authority and to seek a judicial remedy.
3. As part of recognising the Request, the Controller shall take the following actions:
a) in the case of a request to provide a copy of data – send a copy of data,
b) in the case of a request to move data – send data to the Requesting Party or the specified controller, and notify the Requesting Party,
c) in the case of a request to rectify data – rectify personal data and notify the Requesting Party,
d) in the case of a request to erase data – erase data and notify the Requesting Party,
e) in the case of a request to restrict the processing of data – restrict the processing of data to storing them and notify the Requesting Party,
f) in the case of an objection to the processing of personal data – discontinue the processing of personal data for a specific purpose or erase the data and notify the Requesting Party,
g) in the case of a request associated with automated decision-making – designate an employee to consider the case and notify the Requesting Party.
4. Notifications shall be sent in the form and to the address specified by the Requesting Party.
5. In the event the Requesting Party did not specify the form of reply and did not provide the notification address, notifications shall be made in the form in which the Request was submitted and to the address from which the Request was sent.
6. In the event of transferring a copy of personal data or moving data, they are additionally secured depending on the form of sending the data.

Product Designer

What you bring to the team

Additional skills

What we offer

Atmosphere at the Office