Information clause for contractors’ representatives
Personal Data Protection under the General Data Protection Regulation (GDPR)
This information applies to personal data that is collected by the Company(s) with equity affiliation with the Company – HOLDING-ZREMB Gorzów S.A., located in Gorzów Wielkopolski, Fabryczna 13-17, 66-400 Gorzów Wielkopolski (hereinafter: “HOLDING-ZREMB Gorzów”).
The controller(s) of the data will be the respective Company(s) of HOLDING-ZREMB Gorzów S.A., which has/are contracting or cooperating with a contractor based on a standing order or one-time order.
This information also applies to personal data collected by companies with equity ties to Company – HOLDING-ZREMB Gorzów as joint collectors of contractor contact data collected as part of the HOLDING-ZREMB Gorzów Contractor Database.
In the case of joint data administration mentioned above, the joint controllers will be the companies HOLDING-ZREBM Gorzów:
- HOLDING-ZREMB Gorzów S.A., located in Gorzów Wielkopolski, Fabryczna 13-17, 66-400 Gorzów Wielkopolski;
- ZREMB-GORZÓW sp. z o.o., located in Gorzów Wielkopolski, Fabryczna 13-17, 66-400 Gorzów Wielkopolski.
For matters related to the protection of personal data, you can contact the data protection coordinator by writing at e-mail address info@holding-zremb.pl or the address of the company’s registered office listed in subsections a. and b. above.
In this clause we inform you about the ways in which personal data is used, as well as the rights of individuals related to the collection and use of such data. If you have any questions or comments, please contact us at the address indicated above.
- Scope of information
In this clause, the Companies inform about all forms of personal data usage in Poland concerning individuals who are:
a. suppliers or contractors of the Company,
b. subcontractors of suppliers or contractors of the Company,
c. associates, employees, legal representatives, attorneys, representatives of suppliers, contractors or their subcontractors,
d. other persons whose data we process for the purposes of issuing or processing invoices in the course of cooperation with suppliers or contractors
(collectively “you” or “Contractors”).
- Types of Personal Data Processed
- Data provided by Contractors
In connection with the cooperation between you and the Company, which may involve, in particular, the provision of services by you or the organization you represent, the supply of goods to the Company, or cooperation through intermediary entities, we may process the personal data provided by you, such as:
a. First name, surname, company, business address and mailing addresses,
b. numbers held in relevant registers (e.g. NIP or REGON number, PESEL number),
c. contact details, such as e-mail address or telephone or fax number,
d. position held within your organization or function performed,
e. experience or qualifications,
f. bank account number.
In the case of concluding a contract directly between you and the Company, providing the data specified above is voluntary, but necessary for the purpose of concluding the contract and handling the cooperation between you and the Company. This also applies if the Companies periodically or once a year order goods or services from you.
In the event that you do not enter into a contract directly with the Company, providing personal data may be your business obligation or may be necessary to enter into a contract between you and a third party (e.g., if you are a subcontractor of the Contractor).
The consequence of failing to provide the data is that the Company will not be able to perform the above actions (for example, failure to provide the data may involve the inability to fulfill or issue an invoice).
Contact data of Contractors indicated in items a-f will be processed by Companies belonging to HOLDING-ZREMB Gorzów as joint controllers of the data for the purpose of creating the Contractor Database. The data may be used by the Companies:
- HOLDING-ZREMB Gorzów S.A. and ZREMB-GORZÓW Sp. z o.o. with its branches operating under the name:
- REMBUD-ZREMB
- METPOL-BARLINEK
- MEPROZET-DREZDENKO
- OCYNKOWNIA-DREZDENKO
for the purpose of contacting the Contractor (e.g., sending an inquiry, placing an order, etc.).
3.2 Data collected from other sources
We may obtain your personal data from publicly available sources, such as the CEIDG or KRS business registers, to verify the information provided by you. In such cases, the scope of processed data will be limited to the data publicly available in the relevant registers.
We may also obtain your personal data from entities where you are employed or which you represent. The scope of processed data will include information necessary for managing cooperation and contact with the Contractor, such as information about the termination of your employment with a given entity or changes in contact details.
We may also obtain personal data of Contractors’ subcontractors from Contractors who have provided such data to the Company for the purpose of managing cooperation between the Contractor and the Company.
- Legal Basis, Purposes, and Duration of Data Processing
Legal Basis for Data Processing
We process personal data only when:
a. Processing is necessary to fulfill contractual obligations to you, if you are or will be a party to a contract concluded with the Company or Companies, or to take specific actions before concluding a contract, such as preparing a draft contract (Article 6(1)(b) GDPR);
b. Processing is necessary for the Companies to comply with legal obligations or is explicitly required by law (Article 6(1)(c) GDPR) – in relation to personal data contained in documents that must be archived under legal provisions;;
c. Processing is necessary for the purposes of the legitimate interests pursued by the Companies or a third party and does not unduly affect your interests or fundamental rights and freedoms (Article 6(1)(f) GDPR). When processing personal data on this basis, we always strive to balance our legitimate interest with your privacy.
Such legitimate interests include:
- enabling the Companies to contact Contractors and handle a given contract;
- using the Contractors’ contact information within the Contractors’ Database;
- storing documentation to demonstrate compliance with obligations arising from the settlement of public funding;
- preventing fraud and criminal activity;
- conducting internal audit processes at HOLDING-ZREMB Gorzow;
- establishing or pursuing civil law claims by the Companies cooperating with the Contractor in the course of their business, as well as defending against such claims;
- verifying the credibility of the Counterparty;
- verifying Contractors in public registers.
- Data Processing Periods Established for Specific Purposes
Personal data is processed only for the specified purpose and to the extent necessary to achieve that purpose, and for as long as necessary. Listed below are the primary purposes that the Companies achieve through the processing of personal data and the periods for which it is processed.
Processing purposes and processing period:
- fulfillment of contractual obligations – Duration of the contract between the Contractor and the Company;
- exchange of contact data about Contractors within HOLDING-ZREMB Gorzow – Until the Contractor objects to the processing;
- storage of documentation for the purpose of demonstrating compliance with obligations under the law, in particular the Accounting Act and the Act Tax Ordinance – The period indicated in the relevant legislation – as a rule, these are 5-year periods, calculated from the end of the calendar year in which, for example, an invoice was issued.
Notwithstanding the above periods, your data may be processed by the Companies:
- for the purpose of establishing or asserting civil law claims by the Companies in the course of their business, as well as defending against such claims – for the relevant periods of limitation of such claims, i.e. as a rule no longer than 3 years from the event giving rise to the claim, and
- for the purposes of demonstrating compliance with obligations arising from the settlement of a grant from public funds – for the relevant periods indicated in the agreements and in the relevant regulations governing the granting of funds – as a rule, these are 5-year periods.
- Transfer of personal data to other recipients
- Transfer of personal data within HOLDING-ZREMB Gorzów
We may transfer personal data to other HOLDING-ZREMB Gorzów entities. This applies to the following situations:
- joint control of contact data of Contractors within the Contractor Database
- sharing documentation with authorized internal audit units at HOLDING-ZREMB Gorzów for the purposes of conducting such audits;
- provision of services to an equity-affiliated company by another company of HOLDING-ZREMB Gorzów, in particular, operation of IT systems used for processing personal data.
- Transfer of Personal Data Outside of HOLDING-ZREMB Gorzów
Data may be transferred to recipients outside of HOLDING-ZREMB Gorzów. Such recipients include:
a. entities processing personal data on behalf of the Company, such as:
i. Entities providing IT support services related to systems or IT tools used for processing personal data or similar services,
ii. Entities providing document archiving services,
iii. Entities providing services for preparing and sending correspondence.
These entities do not independently decide how to process your personal data. Their processing of personal data occurs only to the extent necessary for the Companies’ operations and will not exceed the scope of the purposes indicated in section 4. The Companies control the actions of such entities through the right to conduct audits and appropriate contractual provisions protecting your privacy.
a. other data controllers, such as:
i. entities providing or settling public funding (in case the cooperation with the Contractor aims to implement a project for which public funding has been provided),
ii. entities involved in the process of insuring transactions,
iii. Economic Information Bureau,
iv. financial institutions involved in the process of implementation and settlement of the contract,
v. courier or postal service providers,
vi. consulting entities, auditing entities and law firms,
vii. other Contractors or subcontractors participating in the contract execution process,
a. other persons within the organization of the respective Contractor or subcontractor.
- Transfer of Data Outside the European Economic Area
Personal data transferred to entities outside of HOLDING-ZREMB Gorzów may also be processed in a country located outside the European Economic Area (“EEA”), which includes the EU member states, Iceland, Liechtenstein, and Norway.
Your data may be transferred outside the EEA (i) to a customer, supplier, or contractor of the Companies, if required to fulfill obligations under a contract between HOLDING-ZREMB Gorzów and the Contractor, or (ii) entities that are providers of IT systems and hosting services.
If your personal data is transferred outside the EEA, the Companies will implement appropriate safeguards to ensure that such transfers are carried out in accordance with applicable data protection principles. To ensure an adequate level of protection for your personal data, the Companies may, for example, use an entrustment agreement with the recipient based on standard data protection clauses approved by the European Commission, or ensure that the transfer takes place to a jurisdiction that is subject to a decision by the European Commission on adequate protection of personal data.
You may also request additional information regarding the transfer of data outside the EEA and obtain a copy of the appropriate safeguard by exercising your rights set forth in Section 6.
- Rights of Contractors and how to exercise the rights
- Rights
Every individual has the right to access their personal data processed by the Companies. If you believe that any information concerning you is incorrect or incomplete, please submit a request for its correction in the manner specified in section 6.2 below. The Companies will promptly correct such information.
Furthermore, you have the right to:
a. withdraw your consent if the Companies have obtained such consent for the processing of personal data (provided that the withdrawal does not affect the lawfulness of data processing conducted prior to the withdrawal);
b. request the deletion of your personal data in cases specified by the GDPR;
c. request the restriction of processing your personal data in cases specified by the GDPR;
d. object, on grounds relating to your particular situation, to the processing of your personal data if such processing is carried out for the purpose of performing a task in the public interest or for the legitimate interests of the Companies or a third party;
e. data portability, i.e., to receive the personal data you provided to the Companies in a structured, commonly used, and machine-readable format, and to request the transfer of such personal data to another data controller without hindrance from the Companies, subject to their own confidentiality obligations.
The companies will review your requests, demands or objections in accordance with applicable data protection laws. However, please note that these rights are not absolute; the regulations provide for exceptions to their application.
In response to your request, the Companies may ask you to verify your identity or provide information that will help the Companies better understand the situation. The Companies will make every effort to explain their decision to you if your requests are not fulfilled.
- Exercising your rights
In order to exercise the above rights, please send a message by e-mail to the address of the relevant company indicated in section 1 above, or send your application in writing to the mailing address indicated in section 1 in subsection a. or b. with a note – “Data protection – contractors”.
If you become aware of unlawful processing of your personal data by the Companies, you have the right to lodge a complaint to the supervisory authority competent in matters of personal data protection, i.e. the President of the Office for Personal Data Protection.
In order to ensure that your personal information is up-to-date and accurate, we may periodically ask you to check and confirm the personal information we have about you, or to inform us of any changes to that personal information (such as a change of email address). We encourage you to regularly check the accuracy, timeliness and completeness of the personal data we process.
