Document update date: 16 August 2023
Pursuant to the stipulations of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”), the Contracting Authority informs that:
PERSONAL DATA CONTROLLER AND DATA PROTECTION OFFICER
The controller of your personal data is the Łukasiewicz Research Network – Poznań Institute of Technology (hereinafter “Łukasiewicz – PIT”).
Łukasiewicz – PIT can be contacted as follows:
- by post: ul. Ewarysta Estkowskiego 6, 61-755 Poznań
- by phone: +48 61 850 48 90
- by e-mail: office@pit.lukasiewicz.gov.pl
A Data Protection Officer has been appointed who can be contacted in matters related to the processing of your personal data and the exercise of your rights in this regard. The Officer can be contacted by e-mail: iod@pit.lukasiewicz.gov.pl
PURPOSE OF PERSONAL DATA PROCESSING
The purpose of the processing of your data is to carry out all the necessary activities related to the conclusion of the contract (agreement, letter of intent), hereinafter referred to as the “contract”, and its performance in accordance with the agreed content and applicable laws.
In fulfilling the stated purpose, personal data of the following parties are processed:
- contractors who are natural persons;
- persons representing contractors (including proxies, representatives);
- employees of contractors and sub-contractors designated as contact persons and responsible for the performance of the contract.
LEGAL BASIS FOR PERSONAL DATA PROCESSING
The legal basis for the processing of your personal data is:
- Article 6(1)(b) GDPR – in connection with the conclusion and performance of a contract, as regards the personal data of a contractor who is a natural person;
- Article 6(1)(c) GDPR – in connection with the need to comply with legal obligations of the controller (including tax, insurance, accounting, archiving obligations), with regard to the personal data of a contractor who is a natural person, persons authorised to represent the contractor (including proxies, representatives) and employees and sub-contractors of the contractors designated as contact persons and responsible for the performance of the contract;
- Article 6(1)(f) GDPR – in relation to the need to process personal data for purposes arising from the legitimate interests pursued by the controller as regards the personal data of the contractor who is an natural person, persons authorised to represent the contractor (including proxies, representatives) and employees and sub-contractors of the contractors designated as contact persons and responsible for the performance of the contract. If we process personal data for purposes arising from the legitimate interests pursued by the controller, these interests may be the conduct of our own business, assertion and enforcement of claims, direct marketing and other forms of marketing, advertising or the provision of security (e.g. using monitoring), IT and network security.
CATEGORIES OF PROCESSED DATA
The scope of the processed personal data of the natural person contractor, persons authorised to represent the contractor (including proxies, representatives) and the employees and sub-contractors of the contractor designated for contact and responsible for the performance of the contract includes, but is not limited to: name, surname, position and location of work, business telephone number, business email address and tax identifier/NIP or data provided by the entity with which the contract is concluded.
SOURCE OF THE PERSONAL DATA
The processed personal data was obtained:
- in the case of a contractor who is a natural person, persons authorised to represent the contractor (including proxies, representatives) – either directly from such persons or from publicly available sources (official registers, the Internet, etc.);
- in the case of employees and sub-contractors of the contractors designated as contact persons and responsible for the performance of the contract, directly from such persons, from the contractor or from publicly available sources (official registers, the Internet, etc.).
INFORMATION ON RECIPIENTS OF PERSONAL DATA
Your personal data is sometimes transferred to other recipients. This can be the case when a service used by Łukasiewicz – PIT (e.g. IT, financial, insurance, auditing, courier and postal services, destruction and archiving of documentation, legal services) requires it. Whenever your personal data is shared with a recipient, this takes place in accordance with the provisions of the GDPR.
TRANSFERRING PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS
Your personal data is not transferred to a third country or an international organisation; However, if such a transfer does take place, it always takes place in accordance with the provisions of the GDPR.
Łukasiewicz – PIT uses Microsoft Office 365, which may result in the transfer of your personal data to a third country. The terms and conditions for the use of the MS Office 365 online services and the obligations with regard to the processing and safeguarding of user data and personal data by the online services are set out in Microsoft documentation, including in particular:
- privacy statement – https://privacy.microsoft.com/pl-pl/privacystatement;
- Microsoft Services Agreement, MSA – https://www.microsoft.com/pl-pl/servicesagreement/.
Microsoft 365 complies with international security standards, as evidenced by the ISO/IEC 27001:2005 certification. The service is also subject to regular audits. The service has certified its services for conformity with the ISO 27018 cloud data protection standard, which means that customer data stored in the cloud will not be used for marketing purposes without their knowledge.
THE PERIOD FOR WHICH THE PERSONAL DATA WILL BE KEPT
Your personal data is stored until Łukasiewicz – PIT has fulfilled the purpose for which this processing is carried out. The processing period also results from legal provisions, including in particular financial and archiving regulations, i.e. the VAT Act and the Act on the National Archives and Records, as well as internal acts in force at the Controller regarding the creation and retention of records.
YOUR RIGHTS
The persons, the data of whom is processed by Łukasiewicz – PIT, have the right to request from Łukasiewicz – PIT access to their personal data, its rectification, erasure or restriction of processing or to object against the processing, as well as the right to data portability (if the processing is based on Article 6(1)(b) of the GDPR). In order to exercise your rights, you should contact Łukasiewicz – PIT, which in such a case will always analyse whether the prerequisites for the exercise of individual rights have been met, in accordance with the detailed, relevant regulations of the GDPR.
COMPLAINT TO THE PRESIDENT OF THE PERSONAL DATA PROTECTION OFFICE
The data subject has the right to lodge a complaint relating to the processing of his/her personal data with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw).
OBLIGATION TO PROVIDE PERSONAL DATA
The provision of personal data is required to conclude and execute the contract. Failure to provide data will render the conclusion and execution of the contract impossible.
AUTOMATED DECISION-MAKING, INCLUDING PROFILING
As a data controller, Łukasiewicz – PIT does not process personal data in a manner involving automated decision-making, including profiling.
OBLIGATION TO PROVIDE INFORMATION CONCERNING THIS CLAUSE
A contractor in possession of personal data of natural persons, the personal data of whom is processed in relation to contract conclusion and execution, shall be obliged to provide said persons with the contents of this clause according to the agreed content and the effective legal regulations.
