GDPR Information

Dear Sir or Madam,

In relation to the REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL (EU) 2016/679 of 27 April 2016 on the protection of natural persons in relation to personal data protection and on the free movement of such data, and repealing the Directive 95/46/EC (“General Data Protection Regulation”) and the Act of 10 May 2018 on personal data protection (Polish Journal of Laws; Dz. U. of 2018, item 1000), we hereby provide you with information about the principles of processing personal data of our Partners being natural persons, the persons representing the Partners not being natural persons, contact persons, the data of which will be provided to us in relation to the intent of establishing co-operation or executing concluded agreements and other persons in contact with our company.

GENERAL INFORMATION CLAUSE

According to Article 13 paragraphs 1-2 of the GDPR, we hereby inform that:

1. Personal Data Administrator
   The Administrator of your personal data is Boryszew S.A. Oddział Nowoczesne Produkty Aluminiowe Skawina with registered seat at: ul. Piłsudskiego 23; 32-050 Skawina; telephone: +48 12 2760 802; e-mail: info@npa.pl (“Administrator”).

802. Rights of data subjects:
     You have: the right to access your data, the right to correct, delete the data, limit its processing, right to transfer the data, right to object, and if the processing takes place based on consent – the right to withdraw consent at any time without effect to the legal compliance of the processing done based on the consent prior to its withdrawal. The consent’s withdrawal should be delivered in person or via registered mail to the following address: Boryszew S.A. Oddział Nowoczesne Produkty Aluminiowe Skawina with registered seat at: ul. Piłsudskiego 23; 32-050 Skawina. You can also send the withdrawal via e-mail: info@npa.pl or report it via telephone using the number +48 12 2760 802.
     You are also entitled to file a complaint to the supervisory body – the Head of the Personal Data Protection Office.

III. Purposes and bases for Personal Data processing:
Your data is processed for the following purposes:

• conclusion and execution of agreements concluded with Partners and to take adequate action based on the data subject’s request prior to the agreement’s conclusion – the legal basis for the data processing is the processing’s necessity to conclude and execute the agreement – Article 6 paragraph 1 (b) of the GDPR,
• establishment and pursuing of claims or defence against claims resulting from the agreements concluded with Partners – the legal basis for the data processing is the processing’s necessity for the purpose of pursuing the Administrator’s legitimate interest – Article 6 paragraph 1 (f) of the GDPR,
• meeting the duty of archiving the documentation related to the concluded agreements – the legal basis for the data processing is the processing’s necessity to meet the legal duty deriving from the current rules of law – Article 6 paragraph 1 (c) of the GDPR,
• provision of an answer to queries and applications related to the Administrator’s activity and to conduct further related correspondence – legal basis Article 6 paragraph 1 (b) or (c) of the GDPR,
• ensure the safety of persons and property within the premises of the Administrator’s seat through the identification of the persons entering the seat’s premises and using visual monitoring at the Administrator seat’s public zones and in its direct vicinity – the legal basis is the processing’s necessity for the purpose of pursuing the Administrator’s legitimate interest – Article 6 paragraph 1 (f) of the GDPR,
  The basis for the personal data processing can also be consent granted by a data subject in any case where such consent is required for the personal data processing – Article 6 paragraph 1 (a) of the GDPR.

1. Information about the mandatory / voluntary data provision:
   The provision of personal data in relation to a concluded agreement is required to conclude and execute the agreement. It is impossible to conclude and execute the agreement if the data is not provided.
   The provision of person data in relation to the conducted correspondence is voluntary, however the lack of provision of data required to provide an answer will prevent its provision.
   The lack of consent to provide the data in relation to entry to the premises of the Administrator’s seat will result in the lack of ability to enter the premises.
   The provision of personal data for marketing purposes is completely voluntary.

1. Duration of data processing:
   The duration of data processing depends on the purpose of processing:

• Personal data will be processed for the time required to execute the agreements concluded and then until the expiry of the claims resulting from these agreements and the required retention period for documentation related to the concluded agreements in accordance with the current rules of law.
• The data processed in relation to the provision of answers to the queries and applications sent to the Administrator as well as to conducting further correspondence, including the personal data provided to the Administrator during talks / negotiations if an agreement is not concluded will be processed throughout the shelf life for mutual contact or for the time required for defence against claims, if the correspondence concerns claims made against the Administrator.
• The data processed as part of the visual monitoring in the Administrator seat’s public zones can be kept up to three months, after which they are deleted, with restriction of situations requiring investigative proceeding due to the infringement of the safety of persons or property. In such emergency situations, the processing of data from the monitoring will be executed proportionally to the given circumstances and legal requirements.
• Data processed based on consent will be processed until the consent’s withdrawal, unless the duty or right to process the data further derives from the current rules of law.

1. Personal data recipients:
   The Administrator can provide the personal data to the following entities:

• the Administrator’s employees and business partners authorised to process personal data as part of their performance of official duties,
• suppliers of organisational and technical services to the Administrator, in the scope required for their provision (especially suppliers of IT systems as well as monitoring and security) and other entities that provide the Administrator with services required to conduct business activity, entrusted based on separate agreements (e.g. counselling, legal, auditing, insurance, postal and courier agreements) in the scope required to provide such services,
• entities from the Boryszew S.A. capital group,
• entities entitled by law.

VII. Transfer of personal data to a third country or international organisation:
The Administrator does not provide your personal data to recipients located outside the European Economic Area (EU countries, Iceland, Norway, Liechtenstein).

VIII. Automated decision-making
Your data will not be used to make decisions in an automated manner (without human participation) or profiling.