Privacy Policy of www.cdprojekt.com website
Who we are
Hello, we are CD PROJEKT S.A. We take care of www.cdprojekt.com website and we are the data controller in regards of information we collect through the website.
If you have any question regarding your privacy, please email us at dpo@cdprojektred.com. You may contact us by traditional mail at the address: Data Protection Officer, CD PROJEKT S.A., ul. Jagiellońska 74, 03-301 Warsaw, Poland.
Who is this notice for?
We provide this information to you as a visitor of our website and user of the services available through the website.
The services include providing information through the investors newsletter.
This information also relates to persons who, through a dedicated form available on our website, or using e-mail address, report irregularities which may constitute a breach of law, internal procedures or ethical standards or which in any other way may negatively affect our business activity or reputation.
Why CD PROJEKT processes you data?
We process your data to provide you with access to our services you request. In particular, we do so based on your consent (art. 6.1.a GDPR) to send you the investors newsletter.
On our website we also use cookies and similar tracking solutions to ensure its proper functioning and compliance with the provisions of law, as well as to measure traffic on the website. You can find more about this in our Cookies Policy.
We also process your personal data when you inform us about irregularities regarding our company you observed. In such case we will process your data to fulfil our legal obligations (art. 6.1.c GDPR) or– in case of any other irregularity – based on our legitimate interest (art. 6.1.f GDPR). In this case we have a legitimate interest in preventing or responding to situations that may constitute a violation of law or the norms and standards adopted by us.
We may also process your data to pursue claims or defend against claims, which is also our legitimate interest (art. 6.1.f GDPR).
Are you required to provide CD PROJEKT with your personal information?
If you want to use the service we offer, you must provide us with the data needed to provide it. However, providing the necessary data and using the services is fully voluntary.
If you contact us to report an irregularity, we will only process the data you provide in your message as well as metadata of said message, in particular the sender’s e-mail address.
Your rights
You have the right:
- to access your data;
- to rectify your data;
- to erase your data;
- to limit processing of your data;
- to transfer your data;
- not to be subject to automated decision-making, including profiling (side note: we don’t do it)
- to withdraw your consent for processing of your data.
- to object to the processing of your personal data.
You also have the right to lodge a complaint in relation to our processing of your data to your local data protection authority of to the President of the Personal Data Protection Office – Prezes Urzędu Ochrony Danych Osobowych in Poland.
You may exercise these rights in the following situations:
- regarding right to rectify data – if data is incorrect or incomplete;
- regarding right to erasure of data – if personal data are no longer necessary in relation to the purposes for which they were collected by us; you withdraw your consent on which the processing is based (in scope of this consent); you object to data processing; data has been processed unlawfully; data have to be erased for compliance with a legal obligation;
- regarding restriction of processing: if data is incorrect – for a period enabling us to verify your data; if data has been processed unlawfully, but you don’t want it to be removed; if we no longer needs your data, but you may need them for the exercise or defense of your legal claims; if you object to processing data – until verification whether our legitimate grounds override the grounds of objection;
- regarding right to transfer data: if the processing is based on consent or on a contract and the processing is carried out by automated means;
- regarding right to withdraw consent – at any time, if the processing is based on consent; withdrawing your consent will have no impact on the validity of the processing before your withdrew your consent;
- regarding right to object – if they are processed on a legitimate interest basis, and the objection is justified by your particular situation.
Recipients of your data
We may share your personal data with our partners who help us deliver our services to you, and who provide us with legal support. This includes:
- our partners providing us with internal management and data-sharing tools;
- our partners who help us in data analysis by providing us with analytical tools;
- our partners who help us manage our investors newsletter and email communications by providing us with email marketing tools;
- law firms providing us with legal support.
When required by law, we may also share your data with courts, law enforcement authorities or regulators.
How long will CD PROJEKT store your data?
We will keep your personal data only for as long as needed to fulfil the purposes outlined in this Privacy Policy. In particular:
- data relating to newsletter service – until you withdraw your consent, and in any case no longer than it is consistent with the purpose of processing, and after that for the duration and to the extent required by provisions of law or for our legitimate interest in pursuing claims or defending against potential claims (see above);
- data included in irregularity reports – for the time necessary to investigate the reported case. If we conclude the report was unfounded, we will remove it upon the end of investigation. If the reported case will be submitted to relevant authorities or institutions, we will keep the data until the final completion of the proceedings conducted by these entities.
Data transfers outside EEA
Your personal data may be processed, stored or transferred to the United States in context of our use of statistical tools. If so, we will protect your personal data using EU standard contractual clauses or other acceptable measures to transfer and protect your personal data.
Automatic processing and profiling
Your personal data will not be used for automated decision making, including profiling. By profiling, we mean the processing of your data by using them to evaluate certain information about you, in particular to analyze or forecast your personal preferences and interests