INFORMATION CLAUSE ON THE PROTECTION OF PERSONAL DATA
for persons running a business who are interested in cooperation and who are clients as well as their representatives, attorneys and employees

This information concerns the processing of personal data by CIARKO Spółka z ograniczoną odpowiedzialnością Sp.k., (“Company”) and is related to the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC (Official Journal of the EU L 119 of 04.05.2016, page 1) – hereinafter referred to as the “GDPR”.
This information is addressed to natural persons who are:

• clients and business partners, including potential clients and trading partners of the Company;
• partners, employees, statutory representatives, attorneys or representatives of such clients/potential clients (trading partners);
• other persons whose data is processed for the purpose of performing contracts between clients (trading partners) the Company, including for the purpose of issuing or processing invoices.

In this information clause, the Company, acting as the personal data controller (“PDC”), notifies you in particular about the purpose and manner in which your personal data is collected, used and stored, the legal basis for data processing, as well as your rights.
All inquiries or requests related to the processing of your personal data by the PDC should be directed to us using the contact details provided below:
E-mail: koordynator@ciarko.pl
Correspondence address: CIARKO Spółka z ograniczoną odpowiedzialnością Sp.k., ul. Okulickiego 10, 38-500 Sanok.

Correspondence address

In connection with cooperation (the possibility of cooperation) between you and our Company, which may consist, in particular, in the supply of services by you or an organization represented by you or the supply of goods to our Company or cooperation through intermediaries, we may process personal data provided by you, such as:

1. business address and correspondence addresses,
2. numbers in relevant registers (e.g. NIP or REGON number),
3. PESEL number,
4. your position within your organization,
5. specific identification numbers which are not general numbers (e.g. service ID card number).
6. bank account number.

In the case of concluding a contract directly between you and our Company, providing the data specified above is voluntary, but necessary for the conclusion of the contract and servicing cooperation between you and our Company. In the event you do not enter into a contract with our Company directly, providing personal data may be obligatory.
Moreover, your personal data may be collected from publicly available sources, such as business registers CEIDG or National Court Register KRS, in order to verify the information provided by you. The scope of processed data will in this case be limited to data available to the public in relevant registers.
We can also collect your personal data from entities in which you are employed or which you represent. The scope of processed data will include in this case information necessary for the performance of contracts between the Company and such entity, e.g. information about the termination of your employment with a given entity, change of contact details or change of employment status.

Purposes, legal bases and periods of data processing

Your personal data is processed by PDC for the purposes specified below.
For each purpose, we have provided the relevant legal basis for processing and criteria for determining the data processing period.

1. PURPOSE: conclusion and performance of a contract
   LEGAL BASIS: art. 6 par. 1 point b) GDPR
   PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims.
   In the case of concluding a contract between you and the Company, data provided by you will be processed for the purpose of performing that contract or executing that order and for settlement purposes.
2. PURPOSE: performance of a contract between the Company and another entity – if you are listed by this entity as a contact person
   LEGAL BASIS: art. 6 par. 1 point f) GDPR – a legitimate interest of the controller, which is the performance of a contract between the Company and another entity, protection of rights
   PROCESSING PERIOD: the period of performing obligations and the period of limitation of claims arising from applicable regulations or up to the day of upholding objections submitted pursuant to art. 21 GDPR
   In the case of indicating you as a contact person by the employer or other entity, your data may be processed in order to perform and settle a contract (or an order) concluded between you and your employer or such entity. Data processing will in this case include ongoing contacts related to the implementation of such contract, preparation and archiving of the contract documentation, as well as pursuing of claims or defense against claims of the other party.
3. PURPOSE: fulfilment of the legal obligation to prepare and retain documentation
   LEGAL BASIS: art.6 par.1 point c) of GDPR
   PROCESSING PERIOD: the retention period for invoices, accounting records and documents confirming the conclusion and performance of a contract arising from the controller’s national laws and regulations.
   If a contract is performed, order is executed or other service is provided, we will also process personal data included in invoices, accounting records or other documentation confirming the conclusion and performance of the contract in order to draw up and retain the necessary documents in accordance with applicable law. This applies in a situation where you are a party to a contract or order, as well as situations where your employer or a business partner is a party to a contract or order or where any service has been provided to you (e.g. execution of an order).
4. PURPOSE: confirming the fulfilment of obligations, and exercise claims or defense of legal claims
   LEGAL BASIS: art. 6 par. 1 point f) GDPR – a legitimate interest of the controller, which is the protection of rights, confirmation of the performance of duties and obtaining due remuneration
   PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims.
   Data made available under a contract or order or otherwise made accessible to the Company may be processed for the purposes related to retention of information or documents confirming the performance of the Company’s obligations and for the purpose of exercising or defending any legal claims by the Company. This applies in a situation where you are a party to a contract or an order, where your employer or a business partner is a party to a contract or order, or where, on whatever basis, the Company was obliged to perform a service for you or to exercise your rights.
5. PURPOSE: trade information
   LEGAL BASIS: art. 6 par. 1 point a) of GDPR
   PROCESSING PERIOD: until your consent is withdrawn
   In the case of giving consent to have your personal date processed for marketing purposes and to receive trade information via email and/or to provided phone number, your email address and phone number will be used for sending trade information including promotional materials and current offer of our Company and our business partners.
6. PURPOSE: co-operation with a partner of the Company
   LEGAL BASIS: article 6.1.f) of GDPR
   PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims, or until your objection submitted under Article 21 of GDPR is granted
   If you are interested in a product or service distributed by one of the Comapny’s partners, your personal data will be made available to a dedicated partner. This applies if you are a potential or existing client of the Company, and if your employer or business partner is/will be a party to a contract or order with the Company

Consequences of failure to provide data

In the case of data collected by the Company’s representatives in connection with purchases – providing data is fully voluntary but if you fail to provide data we may not be able to contact you in the future.
In the case of the data of persons who are a party to a contract concluded with the Company – the provision of data necessary to perform the contract and fulfil the relevant legal obligations is a prerequisite to its conclusion and performance.

Recipients of personal data

Your personal data will be shared with our trusted business partners, i.e. entities we cooperate with, for the purposes specified above. the PDC provides the collected personal data to companies that provide the PDC with ICT and legal services, as well as entities supplying goods, providing accounting services, IT service providers, banks, other payment operators, debt collecting and auditing companies.

Automated decision making

Your personal data will not be processed for the purposes of automated decision making and will not be subject to profiling.

Rights of data subjects

In relation to the processing of your personal data, you have the following rights:

•  the right of access to data;
• the right to rectification of data;
• the right to erasure of data;
• the right to restriction of data processing;
• the right to data portability;
• the right to object (when a legitimate interest of the PDC is the basis for data processing);
• the right to withdraw consent (when such consent is the basis for data processing).

The exercise of these rights is subject to the conditions set out in the GDPR. If your request has been rejected, you will receive a response specifying the reasons for such decision zależy od warunków określonych w RODO. W przypadku odmowy uwzględnienia żądania otrzyma Pani/Pan odpowiedź z uzasadnieniem odmowy.

Please note that:

• the right to erasure of data and the right to restriction of data processing will only apply in cases specifically mentioned in the GDPR;
• the right to data portability will only apply if your consent or performance of a contract constitute the legal basis for data processing;
• the PDC may refuse to remove your data despite receiving such a request if one of the exceptions listed in the GDPR applies, for instance if the processing is required for compliance with a legal obligation or for the establishment, exercise or defense of legal claims;
• in some cases, the PDC may refuse to grant your objection to data processing on the basis of a legitimate interest of the controller, when there are compelling legitimate grounds for data processing that override your interests, rights and freedoms, or where there are grounds for the establishment, exercise or defense of legal claims;

As of May 25th 2018, you will have the right to lodge complaints with a competent supervisory authority, which in Poland is the President of the Office for Personal Data Protection.

Data protection measures

As the PDC, we have implemented appropriate technical and organizational measures to protect personal data against unauthorized, accidental or unlawful destruction, loss, alteration, misuse, disclosure or access, and against all other illegal forms of processing. These security measures have been implemented taking into account the state of the art, implementation costs, processing risks and the nature of personal data.

Legal note

This clause was updated on 25 May 2018, and may be subject to further changes. If required by law, we will inform you of any significant changes through our website or other communication channels customarily used with you.