Privacy policy

PRIVACY POLICY

We respect the right to privacy of persons using the Services available on the
Website (hereinafter “Users”) and we make every effort to ensure that the
personal data of our Users are processed in accordance with applicable law,
including the provisions of Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free
movement of such data and repealing of Directive 95/46/EC (hereinafter
referred to as the “Regulation”).
The use of the Services available on the Website involves our need to
process personal data of the User.
Our Privacy Policy was created to inform Users about who is the controller of
their personal data, what personal data we process, for what purpose, on
what basis and for how long, and to whom we make it available as well as
what are the rights of the User as a personal data subject.
This Privacy Policy shall also apply to cookies used on the Website.

PERSONAL DATA CONTROLLER

The controller of Users’ personal data is Olivia Star Top Spółka z ograniczoną
odpowiedzialnością with its registered office in Gdańsk at al. Grunwaldzka
472C, entered into the Register of Entrepreneurs of the National Court
Register by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial
Division of the National Court Register under the number KRS 0000785038,
Tax ID (NIP) 5842783933, Business Statistical No. (REGON) 383308043,
having share capital paid up in full in the amount of PLN 5,000.00 (hereinafter
referred to as the “Service Provider”).
In addition, the controller of Users’ personal data for the purpose of making
an online payment for an admission ticket to the Observation Deck is the
Payment Operator – PayPro Spółka Akcyjna with its registered office in
Poznań at ul. Kanclerska 15 (60-327) Poznań, entered into the Register of
Entrepreneurs of the National Court Register kept by the District Court
Poznań Nowe Miasto i Wilda, 8th Commercial Division of the National Court
Register, under the number KRS 0000347935, Tax ID (NIP) 7792369887 and
into the register of national payment institutions kept by the Polish Financial
Supervision Authority under the number of the entity in UKNF IP24/2014 (as a
national payment institution).

HOW TO CONTACT US REGARDING THE
PROCESSING OF PERSONAL DATA?

In all matters regarding the processing of personal data, the User should

contact the Service Provider on the contact details given above or on the e-
mail address biuro@oliviastar.pl

In all matters regarding the processing of personal data for the purpose of
making an online payment for an admission ticket to the Observation Deck,
the User should contact the Payment Operator on the contact details
indicated in the “Regulations for the Purchase of Admission Tickets to the
Observation Deck”, available on the Website.

W H AT P E R S O N A L D ATA D O W E
PROCESS?

The Service Provider processes personal data which is provided or left by the
User as part of the use of the Website or Services available on the Website.
The scope of the User’s personal data processed by the Service Provider
depends on the scope of the User’s use of the Website or Services available
on the Website. In the case of visiting/entering a page of the Website, the
Service Provider processes the data that the User leaves in cookies, which
may include, among others: IP address, information about the device,
browser or operating system of the User, time and date of the visit. If the User
uses the Services available on the Website, defined by the “Regulations for
the Purchase of Admission Tickets to the Observation Deck” (hereinafter
referred to as the “Regulations”), the Service Provider shall process personal
data entered by the User in the electronic forms available on the Website for
the purpose of purchasing an online admission ticket to the Observation Deck

and data related to making an online payment, in particular: the name and e-
mail address of the User, the amount of payment made and the transaction number.

FOR WHAT PURPOSE AND ON WHAT
BASIS DO WE PROCESS PERSONAL
DATA OF THE USER?

The Service Provider shall process personal data of the User for the following
purposes:
1. conclusion or performance of the online purchase transaction of an
admission ticket to the Observation Deck and the exercise of the
entitlement resulting from this ticket, defined by the provisions of the
Regulations, pursuant to Article 6 section 1(b) of the Regulation,
2. fulfilment of legal obligations incumbent on the Service Provider, in
particular as regards the preparation, maintenance and archiving of
accounting or tax documentation, pursuant to Article 6 section 1(c) of
the Regulation,
3. establishing, securing or pursuing claims by the Service Provider
related to its business, the transaction of the online purchase of an
admission ticket to the Observation Deck or the use of this ticket by the
User, related to the User or in order to determine the Service Provider’s
liability or defend the Service Provider against any claims, before law
enforcement authorities or adjudicating authorities, in criminal, civil or
administrative proceedings, pursuant to Article 6 section 1(f) of the
Regulation,
4. in order to maintain statistics and improve electronic services available
on the Website (pursuit of the legitimate interests of the Service
Provider), pursuant to Article 6 section 1(f) of the Regulation,
5. consideration of complaints related to the online purchase of an
admission ticket to the Observation Deck and the use of this ticket by
the User, pursuant to Article 6 section 1(f) of the Regulation,
6. ensuring the safety of people or protection of property located on the
Observation Deck and allowing the User to access the Observation
Deck, pursuant to Article 6 section 1(f) of the Regulation,
7. if the Service Provider processes personal data based on the consent
given by the User, the content of the consent shall specify for what
purpose the Service Provider processes the User’s personal data, and
the legal basis for the processing of such personal data by the Service
Provider is Article 6 section 1(a) of the Regulation.

TO WHOM DO WE MAKE PERSONAL
DATA OF THE USER AVAILABLE?

The User’s personal data may be made available by the Service Provider to
entities processing data on behalf of the Service Provider, including: the
entities whose services the Service Provider uses or whom it entrusted with

activities in the scope of its business, entities whom the Service Provider
entrusted with the processing of personal data, entities providing tax,
accounting, advisory, audit, insurance, legal, technical or IT services to the
Service Provider, suppliers of systems supporting the Service Provider’s
activities. In addition, personal data of the User may be made available to
other controllers that process personal data on their own behalf, including:
payment service providers, the Payment Operator, entities providing
insurance, courier, postal or banking services, entities purchasing debts,
authorised entities and authorities to whom the Service Provider is obliged or
authorised to disclose personal data based on applicable law, including
prosecution, enforcement, judicial and administrative authorities, the owner of
the office building under the name “Olivia Star” located in Gdańsk at al.
Grunwaldzka 472C.
The Website’s partners cooperating in the implementation of the Services
available on the Website are based in the countries of the European
Economic Area (EEA). However, we do not exclude cooperation with partners
who may be based outside the EEA. In the event that we transfer your data
outside the EEA, we will require that such partners guarantee a high level of
personal data protection by committing themselves to the use of standard
contractual clauses adopted by the Commission (EU) or participation in the
Privacy Shield program established by Commission Implementing Decision
(EU) 2016/1250 of 12 July 2016 on the adequacy of the protection provided
by the EU-U.S. Privacy Shield.

H O W L O N G D O W E P R O C E S S
PERSONAL DATA?

The time of storage of personal data by the Service Provider depends on the
legal basis and the purpose of processing such data, taking into account the
accountability principle.
In view of the foregoing, the User’s personal data may be stored for the
following periods:
1. personal data processed in order to conclude or execute the transaction
of the online purchase of an admission ticket to the Observation Deck
and the exercise of the entitlement arising from this ticket, defined by
the Regulations – for the period of validity of the admission ticket and its
related settlements, and after its completion for the period necessary to
fulfil the legal obligation incumbent on the Seller (for example: in the
scope of preparation, maintenance and archiving of documentation,
including tax documentation) and the time when the Seller may suffer

legal consequences of non-performance of this obligation or for the
period specified in item c) below,
2. in the case of processing personal data in order to fulfil the legal
obligation incumbent on the Service Provider – for the time necessary
to fulfil this obligation and the time during which the Service Provider
may suffer legal consequences of non-performance of this obligation,
3. for the time necessary for the Service Provider to establish, secure or
pursue claims by or to determine the Service Provider’s liability or
defend the Service Provider against any claims, before law
enforcement authorities or adjudicating authorities, in criminal, civil or
administrative proceedings, taking into account limitation periods
specified in applicable law,
4. in the case of personal data processed for the purpose of maintaining
statistics and improving electronic services available on the Website –
at the latest until the time of filing an effective objection,
5. in the case of personal data processed for the purposes of considering
complaints related to the purchase of an admission ticket to the
Observation Deck and the User’s use of this ticket – for the time
necessary to consider this complaint, and after its consideration for the
period necessary to fulfil the legal obligation incumbent on the Service
Provider (for example: as regards the preparation, maintenance and
archiving of documentation) and the time in which the Service Provider
may incur legal consequences of non-performance of this obligation or
for the period specified in item c) above,
6. in the case of personal data processed in order to ensure the safety of
people or protection of property located on the Observation Deck and
allow the User access to the Observation Deck: in the case of an image
– depending on the technical means used by the Service Provider – for
a period of 30 days to 3 months from the date of recording, and in the
case of other personal data processed for this purpose by the Service
Provider – for a period of 3 years counted from the day the User leaves
the Observation Deck, subject to the provisions of item c) above,
7. in the case of personal data processed on the basis of a consent to its
processing granted by the User – at the latest until the time of its
withdrawal.
In the case of personal data processed for different purposes or on different
processing grounds, for which there are different storage periods, the total
storage time of such personal data shall not be longer than the storage period
that expires at the latest.

WHAT RIGHTS DOES THE USER HAVE IN
RELATION TO THE PROCESSING OF HIS
OR HER PERSONAL DATA?

In connection with the processing of the User’s personal data by the Service
Provider, the User has:
1. the right to access personal data,
2. the right to correct personal data,
3. the right to delete personal data (the right to be forgotten),
4. the right to restrict data processing,
5. the right to transfer personal data to another controller,
6. the right to object to the processing of personal data, including
profiling,
7. the right to withdraw the consent in the event that the Service Provider
processes personal data of the User on the basis of consent, at any
time, without affecting the lawfulness of the processing which was made
on the basis of the consent prior to its withdrawal,
8. the right to file a complaint to the President of the Office for Personal
Data Protection, if the User decides that the processing of personal
data violates the provisions of the Resolution.

A U TO M AT E D D E C I S I O N – M A K I N G ,
INCLUDING PROFILING.

During the processing of the User’s personal data, the decision-making is not
based solely on automated processing or profiling within the meaning of
Article 22 of the Regulation. This means that the User is not subject to
decisions based solely on automated processing, including profiling, which
could cause legal effects to the User or similarly materially affect his or her
situation.

IS IT REQUIRED TO PROVIDE PERSONAL
DATA?

Providing personal data is voluntary, although it is necessary to conclude or
perform a contract for the provision of Services available on the Website or
use the Services available on the Website.

COOKIES

The Website uses cookies. Cookies are IT data stored in files on the User’s
device (for example: on a computer, mobile phone), which are sent from the
User’s browser to the Service Provider’s server each time the User’s device
connects to the Service Provider’s web pages.
Cookies usually contain the domain name of the website they come from,
their lifetime and a unique name. Cookies also store information that is
necessary for the proper operation of the website. Cookies can also store a
unique number that identifies the user’s device, but the user’s identity is not
determined on its basis.
The Website of the Service Provider may place a cookies in the User’s
browser, if the browser allows it. The Service Provider may only access
cookies placed by the Website of the Service Provider, and not to files placed
by other websites.
The Service Provider uses cookies to optimise and improve the functionality
of using the web pages of the Website and Services available on the Website
and to collect statistics on the use of the Website and Services available on
the Website. This gives the Service Provider the opportunity to later improve
the structure and content of the Website and Services available on the
Website, excluding the User’s personal identification.
The Service Provider may use session (temporary) and permanent cookies.
Session cookies are stored on the User’s device only until the User logs out
from the Website or closes the browser. Permanent cookies are stored on the
User’s device as long as they have a set lifetime or until the User deletes
them.
When using the Website or Services available on the Website, the User may
receive cookies from the Website partners cooperating with the Service
Provider. Cookies used by the above-mentioned partners are subject to their
own privacy policy. At the same time, the Service Provider informs that, for
the purpose of calculating statistics on the Website, it uses the technology of
Google Analytics, which in the case of Users using the Website and
simultaneously logged in to their Google account may present more data than
the IP address, information about the device, browser or operating system of
the User, time and date of the visit, excluding the possibility of personal
identification of a specific User.
The software used for browsing websites may by default allow cookies to be
accepted on the User’s device. However, the User can change the browser’s

settings so that cookies are blocked in whole or in a specific part or deleted or
to receive messages each time the cookies are sent to the device of the User.
Information on handling cookies and possible configurations are available in
the settings of the browser used by the User.