Privacy Policy

General Provisions

Data Controller – Ponar Wadowice spółka akcyjna with its registered office in Wadowice (34-100) at ul. Wojska Polskiego 29, entered in the Register of Entrepreneurs kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register under KRS number: 0000279758, NIP (Tax Identification Number): 5512486669, REGON (National Business Registry Number): 120453770, share capital of PLN 32,186,245.00 fully paid up.
Privacy Policy – this policy containing information on the manner of collecting and processing personal data by the Data Controller.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Personal Data – any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Data Subject – a natural person whose personal data is processed by the Data Controller.
Processing – means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Website – the ponar-wadowice.pl website owned by the Data Controller.
Newsletter – a service provided electronically by the Data Controller, consisting of sending messages containing information about products, services, events and promotions of the Data Controller and its partners to the provided e-mail address, provided in accordance with the Newsletter Terms and Conditions available at: www.ponar-wadowice.pl/pl/regulamin-newslettera.

Contact

The Data Controller may be contacted directly at its registered office or by correspondence at: Wadowice (34-100), ul. Wojska Polskiego 29, or via e-mail at: wadowice@ponar-wadowice.pl.
The Data Controller has appointed a Data Protection Officer – Mr Roman Krawczyński, whom you may contact regarding the protection of your personal data and the exercise of your rights via e-mail at: iod@dasec.pl or by traditional mail at: DaSec Sp. z o.o., ul. Wł. Łokietka 3a, 59-800 Lubań, marked “IOD”.

The Data Controller and the Data Protection Officer are available to assist with any matters concerning the processing of personal data.

Processing of Personal Data

The Data Controller collects and processes personal data necessary for the proper and lawful execution of business ventures as part of its conducted business activity.
The Data Controller processes personal data in accordance with the principles of fairness, transparency and lawfulness.
The Data Controller collects and processes personal data in the following cases, for the following purposes and on the following legal bases:

handling of contacts and correspondence – in the event of contacting the Data Controller via e-mail, telephone, contact form, messenger, traditional correspondence or any other available channel, data such as e-mail address, telephone number, first and last name, address are processed for the purpose of responding, handling the inquiry and managing the matter to which the contact relates. The legal basis is the legitimate interest of the Data Controller consisting in ensuring efficient communication and handling enquiries addressed to it (Article 6(1)(f) of the GDPR);
taking action prior to concluding a contract as well as contract conclusion and performance – in the case of a natural person who is a party to a contract or taking action aimed at concluding it, in particular requesting a quote, placing an order or conducting negotiations with the Data Controller, data such as first and last name, e-mail address, telephone number, information contained in the contract preamble or CEIDG (Central Registration and Information on Business) extract, as well as – to the extent necessary for the conclusion or performance of the contract, in particular to demonstrate sufficient professional experience required for the execution of the contract – also information on previous professional experience, qualifications and education, are processed for the purpose of taking pre-contractual steps, concluding and performing the contract (Article 6(1)(b) of the GDPR);
maintaining business relations with contractors and potential contractors – data of persons representing contractors, their employees, associates, proxies and contact persons – such as first and last name, function held, e-mail address, telephone number and information contained in the contract preamble, KRS (National Court Register) or CEIDG extract, or in the power of attorney to conclude a contract – are processed in particular for the purpose of exchanging and analysing offers, conducting negotiations, agreeing on terms of cooperation, placing and executing orders, concluding and performing contracts, and maintaining ongoing communication. The legal basis is the legitimate interest of the Data Controller consisting in establishing and maintaining business relations (Article 6(1)(f) of the GDPR);
use of the Website and cookies – data such as IP address, server date and time, internet browser information and operating system information, to the extent necessary to ensure its proper and secure operation, may be processed based on the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR). Data collected via cookies or similar technologies that are not necessary for the operation of the Website, in particular analytical and statistical data, are processed based on the user’s consent (Article 6(1)(a) of the GDPR);
Newsletter and marketing – in the event of subscribing to the Newsletter or consenting to receive marketing information, the e-mail address is processed for the purpose of sending information about products, services, events, promotions and other activities of the Data Controller or its partners. The legal basis is consent (Article 6(1)(a) of the GDPR);
social media – in the event of viewing the Data Controller’s social media profiles or engaging in activity on them, data such as profile name, information posted on the profile as “public”, image (if visible in photos shared on the profile as “public”), personal data posted in comments under content published on the Data Controller’s profile or sent in a private message to the Data Controller, as well as statistical and advertising data collected by the given social media platform, may be processed for the purpose of running profiles, communicating with users, presenting and promoting the Data Controller’s activity, and conducting statistics and analyses. The legal basis is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR);
recruitment – in the event of applying for employment, personal data within the scope indicated in Article 22¹ § 1 of the Labour Code Act are processed to conduct the recruitment process pursuant to Article 6(1)(c) of the GDPR in conjunction with Article 22¹ of the Labour Code, and with regard to data provided by the candidate on their own initiative, exceeding this catalogue (e.g. in a CV or cover letter) – based on consent expressed by sending such data (Article 6(1)(a) of the GDPR). Upon separate consent of the candidate, data may also be processed for the purpose of participating in future recruitment processes conducted by the Data Controller (Article 6(1)(a) of the GDPR);
fulfilment of legal obligations – data is processed if it is necessary to comply with obligations resulting from legal provisions, in particular tax, accounting or record-keeping provisions (Article 6(1)(c) of the GDPR);
establishment, exercise or defence of claims – data may be processed for the purpose of protecting the rights of the Data Controller, demonstrating specific facts and securing documentation for the needs of potential proceedings. The legal basis is the legitimate interest of the Data Controller consisting in the protection of its rights (Article 6(1)(f) of the GDPR).

Links to websites of external entities may be posted on the Website. The Data Controller is not responsible for the privacy policy or personal data protection rules applied by these entities. A data subject using such links should read the privacy policy applicable to the given external entity’s website.

Cookies

The Data Controller informs that the website uses cookies.
Cookies are small text information stored on an end device (laptop, smartphone, etc.) that can be read by the Data Controller’s ICT system (first-party cookies) or third-party ICT systems (third-party cookies).
Cookies are sent to the website upon its opening and allow for the identification of the device or user.
The Data Controller uses cookies on the website that are technically necessary for the proper operation of the website and, with the user’s consent, third-party cookies used for analytical and statistical purposes. Among the cookies used are both files deleted after the end of each browser session, i.e., its closing (session cookies), and files stored on the end device used by the data subject until they are deleted from that device by the data subject (persistent cookies).
Cookies are used to ensure the proper operation of the website www.ponar-wadowice.pl and its basic functionalities. They allow for navigating the website and properly using its elements. The files are used in the regionalisation mechanism, which is crucial for its operation.
Furthermore, the Data Controller informs that with the user’s consent, it uses Google Analytics tools and services provided by Google LLC. This tool is used to obtain information about activity while using the website www.ponar-wadowice.pl and to generate activity reports. Information collected on the basis of cookies regarding the use of the above-indicated website has the character of pseudonymised data and is transferred to and stored by Google LLC. Google does not use the collected data to directly identify the data subject nor does it combine this information to enable identification. Details concerning the rules of collecting, processing and storing data by Google Analytics can be found at the link: [https://policies.google.com/technologies/partner-sites?hl=pl](https://policies.google.com/technologies/partner-sites?hl=pl).
Disabling the necessary cookies used on the website may hinder or prevent the use of this website.
Details regarding the collection, processing, sharing and storage of cookies can be changed using the configuration options available in the internet browser.
Upon the first visit to the website, a banner is displayed to the user allowing them to consent to the use of cookies other than necessary ones, including accepting all categories of cookies, rejecting cookies other than necessary ones, or making a detailed selection of cookie categories through dedicated settings. Consent given can be changed or withdrawn at any time via the cookie settings available on the website.

Transfer of Personal Data

When conducting business activity and pursuing specific purposes for which it collects and processes personal data, the Data Controller may disclose data to external entities, i.e.:

entities providing IT services and supplying IT tools,
entities providing accounting services,
entities providing legal services,
postal and courier operators,
insurance entities

for the purpose of executing a given venture.

The Data Controller may disclose personal data processed by it to third parties whose obligation to disclose results from legal provisions, and the Data Controller is obliged to disclose them on that legal basis.
The transfer of data outside the EEA (European Economic Area) takes place due to organisational circumstances and the location of some of the providers, including Google Analytics and services provided by Google LLC.
In the event of transferring personal data outside the EEA, the transfer takes place solely on the basis of applicable legal provisions, using appropriate protection mechanisms, such as standard contractual clauses approved by the European Commission or other required safeguards.

Data Retention Period

The Data Controller stores personal data for a period no longer than necessary for the purposes for which the data was collected, taking into account obligations resulting from legal provisions and periods during which data may be necessary to establish, exercise or defend against claims.
Depending on the purpose of processing, data will be stored for:

data related to contact and correspondence – for the period necessary to handle and conclude the matter to which the contact relates, and if the matter may lead to the emergence of claims – also until the expiry of the relevant limitation period for such claims;
data related to the conclusion and performance of a contract – for the period necessary to prepare and conclude the contract, and if the contract is concluded – for the period of its performance, and thereafter until the expiry of the relevant limitation period for claims related to the contract;
data related to business relations, offers, negotiations and cooperation with contractors or potential contractors – for the period of conducting talks, the quotation process, negotiations or cooperation, and thereafter for the period necessary to secure potential claims;
data related to the use of the Website and cookies – for the operational lifespan of individual cookies. In the case of cookies requiring consent – no longer than until its withdrawal, earlier deletion of the cookie or expiry of its operational lifespan;
data related to recruitment – for the duration of the recruitment process and for the period necessary for the potential establishment, exercise or defence against claims related to the recruitment process, however no longer than for a period of 3 years from its completion;
data processed in connection with the Newsletter or marketing – for the period of using the Newsletter or conducting marketing communication. After terminating the contract or unsubscribing from the Newsletter, the e-mail address and subscription/unsubscription logs will be stored for a period of up to 3 years (calculated in years from the end of the year), solely for the purpose of defence against potential claims (demonstrating the compliance of the Data Controller’s activities with the GDPR and the Electronic Communications Law Act);
data related to social media – for the period of running the given profile or maintaining activity by the user related to the profile, and in the case of correspondence – for the period necessary to handle the matter it concerned. If the matter may lead to the emergence of claims – also until the expiry of the relevant limitation period for such claims;
data processed for the purpose of fulfilling legal obligations – for the period required by applicable legal provisions, in particular tax and accounting provisions;
data processed for the purpose of establishing, exercising or defending against claims – until the expiry of the relevant limitation period for claims, and if proceedings have been initiated – until their final and binding conclusion.

Upon the expiry of the relevant retention period, personal data is deleted or anonymised, unless its further storage is required based on applicable legal provisions.

Rights Related to the Processing of Personal Data

The data subject has the right to request the Data Controller to:

access personal data, including information on its processing and obtaining a copy of the processed personal data,
rectify personal data,
erase personal data – if processing is based on consent and there is no other legal basis for processing, personal data is no longer necessary for the purposes for which it was collected or otherwise processed, personal data is processed unlawfully, or the obligation to delete data results from a legal obligation incumbent on the Data Controller,
port data – if processing is based on consent or a contract,

as well as to object to processing – if processing is based on the legitimate interest of the Data Controller or a third party, to the extent indicated by legal provisions.

The data subject has the right to request the Data Controller to restrict the processing of personal data in cases where:

they contest the accuracy of the personal data – for a period enabling the Data Controller to verify the accuracy of the data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
the Data Controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing – pending the verification whether the legitimate grounds of the Data Controller override those of the data subject.

To the extent that personal data is processed based on a legal obligation incumbent onಾಂಶ the Data Controller, the data subject does not have the right to object, the right to data erasure and the right to data portability.
The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of personal data concerning them violates data protection regulations.
To exercise their rights, the data subject may submit requests of a specific content via traditional correspondence or e-mail correspondence, directly to the Data Controller or the Data Protection Officer. The Data Controller shall respond to submitted requests within one month from the date of receipt of the application, via the form of correspondence chosen by the data subject. The Data Controller reserves the right to extend the above deadline by another two months due to the complex nature of the request or the number of requests. Within one month of receiving the request, the Data Controller shall inform the data subject of such extension, stating the reasons for the delay.

Information on the Voluntariness of Providing Personal Data

To the extent that the processing of personal data is necessary to fulfil legal obligations incumbent on the Data Controller (e.g. tax, accounting or archiving obligations), the obligation to provide data results from legal provisions (it is a statutory requirement). Failure to provide this data prevents the Data Controller from fulfilling its legal obligation, which may result in the inability to handle a given matter or service.
If providing data is necessary to achieve a specific purpose, including taking action at the request of the data subject, concluding or performing a contract, handling an inquiry or request, or maintaining a business relationship, failure to provide it may prevent its execution, in particular responding, preparing an offer, concluding or performing a contract, or executing an order.
If the processing of personal data is based on consent, the data subject may withdraw consent at any time, provided that the withdrawal of consent does not affect the lawfulness of data processing carried out on the basis of this consent before its withdrawal.
An integral part of this Privacy Policy consists of the following GDPR information clauses:

Appendix no. 1 – GDPR Information Clause for the monitoring system,
Appendix no. 2 – GDPR Information Clause regarding contractors,
Appendix no. 3 – GDPR Information Clause regarding persons representing contractors,
Appendix no. 4 – GDPR Information Clause for job candidates.

The privacy policy is effective from 28 October 2026. Every update to the privacy policy is published on the website www.ponar-wadowice.pl.

—

GDPR Information Clause for the Monitoring System

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), we inform you that in connection with conducting video surveillance on the premises of PONAR Wadowice S.A., Plant in Wadowice and Plant in Łaziska Górne, which covers the premises of the Data Controller’s registered office and the property area, your personal data in the form of an image are processed under the following terms:

Data Controller

The Controller of your personal data is Ponar Wadowice spółka akcyjna with its registered office in Wadowice (34-100) at ul. Wojska Polskiego 29, entered in the Register of Entrepreneurs kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register under KRS number: 0000279758, NIP: 5512486669, REGON: 120453770, share capital of PLN 32,186,245.00 fully paid up. This means that we are responsible for using them in a secure manner, in accordance with the contract and applicable regulations.

Data Protection Officer

We have appointed a Data Protection Officer – Mr Roman Krawczyński, whom you may contact regarding the protection of your personal data and the exercise of your rights via e-mail at: iod@dasec.pl or by traditional mail at: DaSec Sp. z o.o., ul. Wł. Łokietka 3a, 59-800 Lubań, marked “IOD”.

Purposes and Legal Bases of Processing

Your personal data are processed pursuant to Article 6(1)(f) of the GDPR. Video surveillance is conducted solely for the purpose of:

ensuring employee safety (including clarifying the circumstances of work accidents, violations of health and safety regulations, and circumstances of other undesirable events or behaviours on the workplace premises);
production control;
protection of the Data Controller’s property;
maintaining the confidentiality of information whose disclosure could expose the Data Controller to damage.

Recipients of Data

Video surveillance recordings will not be transferred to other entities, except for entities authorised to obtain them under the provisions of applicable law or entities providing physical security and property protection services under a separate agreement, or other entities with which the Data Controller has concluded agreements for performing services related to the operation or servicing of the video surveillance system.

Data Retention Period

Video surveillance recordings will be stored for the period necessary to achieve the purposes for which they were collected, no longer than 3 months from the date of recording. If image recordings constitute evidence in proceedings conducted pursuant to law or the controller learns that they may constitute evidence in such proceedings, then the personal data retention period shall be extended until the final conclusion of the proceedings. After the lapse of these periods, image recordings containing personal data obtained as a result of monitoring are permanently deleted, unless separate provisions state otherwise.

Rights of Data Subjects:

You have the right to:

access your data;
erase data – if they are not deleted by the Data Controller within the period indicated above;
access your data and the right to rectify them – to a limited extent in the event that data is incorrect or incomplete;
restrict processing;
object;
lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates GDPR provisions.

Automated Processing, Including Profiling

Your personal data will not be processed in an automated manner (including in the form of profiling) that could produce legal effects concerning you or similarly significantly affect your situation.

—

GDPR Information Clause Regarding Contractors

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), we inform you that in connection with submitting offers, negotiations, conclusion and performance of a contract with the Data Controller, your personal data are processed under the following terms:

Data Controller

The Controller of your personal data is PONAR Wadowice spółka akcyjna with its registered office in Wadowice (34-100) at ul. Wojska Polskiego 29, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number: 0000279758, NIP: 5512486669, REGON: 120453770, share capital of PLN 32,186,245.00 paid up in full (hereinafter: “Data Controller”).

Data Protection Officer

The Data Controller has appointed a Data Protection Officer, whom you can contact in all matters concerning the processing of personal data and the exercise of rights granted, via e-mail at: iod@dasec.pl or by traditional mail at: DaSec Sp. z o.o., ul. Wł. Łokietka 3a, 59-800 Lubań, marked “Data Protection Officer PONAR Wadowice”.

Purposes and Legal Bases for Processing Personal Data

If you are a sole trader and directly undertake activities aimed at concluding a contract with the Data Controller, including submitting an offer, request for quotation, order, or accepting the Data Controller’s offer, or if you are a party to a contract concluded with the Data Controller, personal data are processed for the purpose of taking steps prior to concluding a contract as well as its conclusion and performance – pursuant to Article 6(1)(b) of the GDPR. Data may also be processed for the purpose of fulfilling the Data Controller’s legal obligations, in particular resulting from tax and accounting regulations – pursuant to Article 6(1)(c) of the GDPR – and for the purpose of establishing, exercising or defending against claims – based on the Data Controller’s legitimate interest, in accordance with Article 6(1)(f) of the GDPR.

Categories of Processed Personal Data

In the cases referred to above, the categories of your personal data processed include: first and last name, residential/registered office address, PESEL number, NIP number, e-mail address and telephone number, as well as other information contained in the contract preamble or CEIDG extract. To the extent necessary for the conclusion or performance of the contract, in particular to demonstrate sufficient professional experience required for the implementation of the contract, these categories may also include information on previous professional experience, qualifications and education.

Voluntariness of Providing Data

Providing first and last name, residential/registered office address, PESEL number, NIP number, e-mail address and telephone number is necessary for the conclusion and performance of the contract. Providing information on professional experience, qualifications and education is voluntary, unless it is necessary for the conclusion of the contract, in particular to demonstrate sufficient professional experience required for a given venture. Failure to provide necessary data may prevent the conclusion or performance of the contract.

Recipients of Data

Personal data may be disclosed to entities providing services to the Data Controller necessary for the performance of the contract, including in particular suppliers of IT services and tools, entities providing accounting and legal services, postal and courier operators, as well as entities authorised to obtain data on the basis of legal provisions.

Data Retention Period

Personal data processed for the purpose of concluding and performing the contract will be stored for the duration of the contract and the limitation period for claims resulting therefrom. Data processed for the purpose of fulfilling legal obligations will be stored for the period required by applicable legal provisions (e.g. tax or accounting provisions).

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

To the extent that personal data are processed for the purpose of fulfilling a legal obligation incumbent on the Data Controller, you do not have the right to object or the right to data portability. The right to data erasure may in such a case not apply if further processing is necessary for the fulfilment of this obligation.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

As a rule, personal data are not transferred outside the European Economic Area. In the event that the Data Controller uses tools or providers transferring data outside the EEA, such transfer takes place exclusively to entities ensuring an adequate level of personal data protection, based on the mechanisms provided for in Chapter V of the GDPR.

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.

—

GDPR Information Clause Regarding Persons Representing Contractors

In accordance with Articles 13 and 14 of the GDPR, we inform you that in connection with representing a contractor or acting on their behalf when submitting and receiving offers, conducting negotiations and concluding and performing contracts, your personal data are processed under the following terms:

Data Controller

Data Protection Officer

Purposes and Legal Bases for Processing Personal Data

If you represent or act on behalf of or for the benefit of a current or potential contractor of the Data Controller, in particular as a member of a body, proxy, employee, associate or contact person, including if you have been indicated in the text of the contract as a person representing the contractor, contact person or person responsible for the implementation of specific tasks resulting from the contract, your personal data may be processed for the purpose of establishing and conducting a business relationship, exchanging and analysing offers, conducting negotiations, concluding and performing a contract with the contractor, pursuing or defending against claims, and ongoing communication related to cooperation. The legal basis for processing is the legitimate interest of the Data Controller referred to in Article 6(1)(f) of the GDPR, consisting in conducting business activity, establishing and maintaining business relations, and concluding and performing contracts. In this case, your personal data may have been obtained from the Data Controller’s contractor or directly from you in connection with the conclusion or performance of the contract.

Categories of Processed Personal Data

In the cases referred to above, the categories of your personal data processed include: first and last name, function held, e-mail address, telephone number and information contained in the contract preamble, KRS or CEIDG extract, or in the power of attorney to conclude a contract. If necessary for the performance of the contract, personal data may also include information concerning your qualifications or authorizations necessary to perform specific activities or tasks as part of the contract performance.

Voluntariness of Providing Data

Providing personal data is voluntary, but necessary for the conclusion and performance of the contract or to act as a representing or contact person in connection with the contract. Failure to provide data may prevent the conclusion or performance of the contract.

Recipients of Data

Data Retention Period

Personal data processed for the period of conducting the business relationship and performing cooperation with the contractor, and thereafter for the period appropriate for the limitation of potential claims. Data processed for the purpose of fulfilling legal obligations will be stored for the period required by applicable legal provisions (e.g. tax or accounting provisions).

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.

—

GDPR Information Clause for Job Candidates

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), I inform you that:

Data Controller

Data Protection Officer

Purposes and Legal Bases for Processing Personal Data

Your personal data within the scope indicated in Article 22¹ § 1 of the Labour Code Act are processed for the purpose of conducting the recruitment process – the legal basis for processing is Article 6(1)(c) of the GDPR in conjunction with Article 22¹ of the Labour Code, and with regard to data exceeding this catalogue, provided by you on your own initiative (e.g. in a CV or cover letter) – the legal basis is consent expressed by sending such data (Article 6(1)(a) of the GDPR).

In the event of your voluntary, separate consent, your personal data may also be processed for the purpose of participating in future recruitment processes conducted by the Data Controller – the legal basis for processing in this respect is Article 6(1)(a) of the GDPR. This consent is entirely voluntary and independent of the consent to participate in current recruitment, and failure to grant it does not affect the course and outcome of the current recruitment process.

Furthermore, your personal data may be processed after the completion of the recruitment process for the purpose of establishing, exercising or defending against potential claims – the legal basis for processing in this respect is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR).

Categories of Processed Personal Data

In the cases referred to above, the categories of your personal data processed include: first and last name, date of birth, contact details indicated by the candidate, and when necessary for the performance of a specific type of work or in a specific position – education, professional qualifications and employment history (excluding information on remuneration in the current employment relationship and in previous employment relationships).

Voluntariness of Providing Data

Providing personal data in accordance with Article 22¹ of the Labour Code is voluntary, but necessary to participate in the recruitment process, whereas providing data in a broader scope and granting consent to participate in future recruitments are entirely voluntary.

Recipients of Data

Personal data may be disclosed to entities providing services to the Data Controller necessary to conduct recruitment, including in particular suppliers of IT services and tools, entities providing accounting and legal services, postal and courier operators, as well as entities authorised to obtain data on the basis of legal provisions.

Data Retention Period

Your personal data processed for the purpose of conducting current recruitment will be stored for the duration of the recruitment process and for the period necessary for the potential establishment, exercise or defence against claims related to the recruitment process, however no longer than for a period of 3 years from its completion. In the event of granting consent to participate in future recruitments, data will be stored for a period of 12 months from the date of granting consent or until its earlier withdrawal.

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.

GDPR Information Clause for the Monitoring System

Data Controller

Data Protection Officer

Purposes and Legal Bases of Processing

Your personal data are processed pursuant to Article 6(1)(f) of the GDPR. Video surveillance is conducted solely for the purpose of:

ensuring employee safety (including clarifying the circumstances of work accidents, violations of health and safety regulations, and circumstances of other undesirable events or behaviours on the workplace premises);
production control;
protection of the Data Controller’s property;
maintaining the confidentiality of information whose disclosure could expose the Data Controller to damage.

Recipients of Data

Data Retention Period

Rights of Data Subjects:

You have the right to:

access your data;
erase data – if they are not deleted by the Data Controller within the period indicated above;
access your data and the right to rectify them – to a limited extent in the event that data is incorrect or incomplete;
restrict processing;
object;
lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates GDPR provisions.

Automated Processing, Including Profiling

Your personal data will not be processed in an automated manner (including in the form of profiling) that could produce legal effects concerning you or similarly significantly affect your situation.

GDPR Information Clause Regarding Contractors

Data Controller

Data Protection Officer

Purposes and Legal Bases for Processing Personal Data

Categories of Processed Personal Data

Voluntariness of Providing Data

Recipients of Data

Data Retention Period

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.

GDPR Information Clause Regarding Persons Representing Contractors

Data Controller

Data Protection Officer

Purposes and Legal Bases for Processing Personal Data

Categories of Processed Personal Data

Voluntariness of Providing Data

Recipients of Data

Data Retention Period

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.

GDPR Information Clause for Job Candidates

Data Controller

Data Protection Officer

Purposes and Legal Bases for Processing Personal Data

Categories of Processed Personal Data

Voluntariness of Providing Data

Recipients of Data

Data Retention Period

Rights of the Data Subject

You have the right to request the Data Controller to:

access personal data, including obtaining information on its processing and a copy of the processed data;
rectify personal data;
erase personal data, if:

data are processed on the basis of consent, consent has been withdrawn and there is no other legal basis for further processing;
personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
personal data are processed unlawfully;
the necessity to delete data results from a legal obligation incumbent on the Data Controller;

port personal data, if processing is carried out on the basis of consent or in connection with the conclusion or performance of a contract.

If personal data are processed on the basis of the legitimate interest of the Data Controller or a third party, you also have the right to object to their processing.

You also have the right to request the restriction of the processing of personal data, if:

you contest the accuracy of the personal data – for a period enabling the Data Controller to verify their accuracy;
the processing of personal data is unlawful, and you oppose their erasure and request the restriction of their use instead;
the Data Controller no longer needs the personal data for processing purposes, but they are required by you for the establishment, exercise or defence of legal claims;
you have objected to processing – pending the determination whether the legitimate grounds on the part of the Data Controller override the grounds of your objection.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that personal data are processed in violation of applicable regulations.

Transfer of Data to Third Countries

Automated Decision-Making

Your personal data are not used for automated decision-making, including profiling, producing legal effects concerning you or similarly significantly affecting your situation.

Additional Information

Full information regarding the processing of personal data by the Data Controller is contained in the Privacy Policy available at: www.ponar-wadowice.pl/polityka-prywatnosci.