Personal Data Protection Policy

“PRZEMYSŁÓWKA” — Przedsiębiorstwo Budownictwa Przemysłowego Holding Sp. z o.o.

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn, established pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119/1).

1. Scope of application

This document, entitled “Personal Data Protection Policy” (hereinafter the “Policy”), is intended to provide a framework of requirements, principles and rules for personal data protection at “PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn (hereinafter the “Company”), within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR; Official Journal of the EU L 119/1). It is a set of principles and rules for managing personal data within the Company. The Policy covers the protection of personal data processed both by traditional means and in IT systems.

The Policy contains: (a) a description of the personal data protection principles in force at the Company; and (b) references to appendices providing further detail, in particular records and registers relating to specific areas of personal data protection that require separate documentation.

The Policy applies in particular to: (a) information concerning employees and persons cooperating with the Company under civil-law contracts; (b) data of job applicants collected during recruitment; (c) information concerning the Company’s contractors; (d) the register of entities entrusted with data processing; and (e) other documents containing personal data.

The Data Controller is responsible for implementing and maintaining this Policy.

All Company personnel are responsible for applying this Policy. “Personnel” means Company employees and persons providing services on another legal basis.

The Company primarily processes personal data of employees, persons cooperating under civil-law contracts and contractors. The list of individual personal data registers, together with the software used to process the data in the Company, is contained in the Register of Personal Data Processing Activities, in accordance with Appendix 1 to the Policy.

Personal data in the registers listed above are processed and stored in both paper-based and electronic form.

2. Abbreviations and definitions

Policy — this Policy, unless the context clearly indicates otherwise.

Data Controller — “PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn.

Contractor — a person cooperating with the Company under a civil-law contract.

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation; Official Journal of the EU L 119/1).

Personal data — any information relating to an identified or identifiable natural person.

Identified person — a person whose identity is known and who can be distinguished from other persons.

Identifiable person — a person who can be identified directly or indirectly, in particular by an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

Personal data filing system — an organised set of personal data accessible according to specific criteria, regardless of whether it is centralised, decentralised, or functionally or geographically dispersed.

Data processing — an operation or set of operations performed on personal data or sets of personal data, by automated or non-automated means, including collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Entrusting data processing — the Company entrusting personal data processing to another entity, person or organisation, for example an IT service provider or external accounting firm.

Data erasure — destruction of personal data or modification of the data so that the identity of the person to whom they relate can no longer be established.

Profiling — any form of automated processing of personal data consisting of using personal data to evaluate personal aspects of a natural person, in particular to analyse or predict aspects concerning that person’s work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Pseudonymisation — processing personal data so that they can no longer be attributed to a specific person without additional information, provided that the additional information is stored separately and protected by technical and organisational measures to prevent attribution to an identified or identifiable natural person.

Consent of the data subject — a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which, through a statement or a clear affirmative action, the person agrees to the processing of personal data relating to them.

Personal data breach — a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

IT system — a set of interconnected devices, programmes, information-processing procedures and software tools used to process personal data.

DPIA (Data Protection Impact Assessment) — an assessment of the impact on personal data protection, meaning the identification of appropriate technical and organisational measures to minimise identified risks.

IT Systems Administrator — a person cooperating with the Company under a civil-law contract who is responsible for the proper operation and maintenance of the IT system, implementation of technical safeguards and security of personal data in the IT system.

3. General principles

The pillars of personal data protection at the Company are:

Lawfulness — the Company protects privacy and processes data in accordance with the law.

Security — the Company ensures an appropriate level of data security through ongoing measures.

Respect for individual rights — the Company enables data subjects to exercise their rights and fulfils those rights.

Accountability — the Company documents how it fulfils its obligations so that compliance can be demonstrated at any time.

The Company processes personal data:

on a legal basis and lawfully (lawfulness);

fairly and honestly (fairness);

transparently for the data subject (transparency);

for specified purposes (purpose limitation);

only to the extent necessary (data minimisation);

no longer than necessary (storage limitation);

with due regard to accuracy (accuracy);

ensuring appropriate data security (security).

4. Register of Personal Data Processing Activities

The Data Controller maintains a Register of Personal Data Processing Activities, in which the ways personal data are used are inventoried and monitored (Appendix 1 to the Policy).

The Register documents processing activities and is one of the key elements supporting the fundamental accountability principle on which the personal data protection system is based.

The Register is one of the basic tools enabling the Data Controller to account for most personal data protection obligations.

For each processing activity, the Data Controller records:

name of the processing activity or personal data resource;

location where the data are processed (organisational unit);

purpose of processing;

categories of data subjects;

categories of personal data;

legal basis;

source of the data;

planned date for erasure of the data categories;

categories of recipients other than processors;

name and contact details of the processor;

name of the system or software;

description of technical and organisational security measures;

DPIA, where applicable;

transfer to a third country or international organisation, where applicable.

5. Register of persons authorised to process personal data

Only persons authorised by the Data Controller may be permitted to process personal data.

Authorisation may be granted only to Company employees, including trainees and interns, and to natural persons cooperating with the Company who obtain access to personal data in connection with services provided under civil-law contracts.

Authorisations are issued individually before the person begins processing personal data.

The Data Controller may revoke an authorisation at any time. A revocation statement must be made in writing.

Authorisation expires when the condition on which it was granted ceases to exist, in particular when employment or a civil-law contract ends.

The Data Controller maintains a Register of Persons Authorised to Process Personal Data, in accordance with Appendix 2 to the Policy.

For each authorisation, the register records at least:

the authorised person’s full name and position;

the date authorisation was granted;

the scope of the authorisation;

the date the authorisation expires or is revoked;

remarks, especially the reasons for revocation.

The written authorisation form is specified in Appendix 4 to the Policy.

Each person processing personal data is responsible for day-to-day operational protection of those data within the scope of their authorisation and role in the processing.

Anyone who comes into contact with personal data must protect them and process them only within the limits of their authorisation.

The key obligations of authorised persons include: understanding and applying all personal data protection measures; processing data in accordance with applicable law and Company rules; following internal data-processing procedures; preventing unauthorised persons from accessing places where data are processed; keeping confidential the personal data accessed and information about how they are secured; informing the Company of suspected or observed breaches and weaknesses in the data-processing system; and familiarising themselves with this Policy.

6. Register of entrusted personal data processing

The Data Controller may entrust data processing to another entity only after a data processing agreement has been concluded.

The data processing agreement must include at least: (a) the subject matter of processing; (b) the duration of processing; (c) the nature and purpose of processing; (d) the type of personal data; (e) the categories of data subjects; (f) the controller’s obligations and rights; and (g) the processor’s obligations.

The Data Controller maintains a Register of Entrusted Personal Data Processing, in accordance with Appendix 3 to the Policy, containing at least: (a) identification of the entity entrusted with processing; (b) the purpose and scope of the entrustment; and (c) a description of technical and organisational measures for the entrusted data.

7. Staff training

Before being allowed to work with an IT system processing personal data or with paper-based personal data files, every person authorised by the Data Controller must receive training in the protection of personal data in electronic and paper form.

The training should familiarise the authorised person with the GDPR, legal acts issued pursuant to it, and the Company’s internal personal data protection rules.

8. Other obligations of the Company

The Data Controller determines effective and lawful ways to fulfil information obligations.

The Data Controller documents how information obligations, notifications and requests from individuals are handled.

The Data Controller informs an individual about the processing of their data when collecting data directly from that individual.

The Data Controller informs individuals of a planned change in the purpose of processing.

The Data Controller informs recipients about rectification, erasure or restriction of processing unless this would require disproportionate effort or be impossible.

The Data Controller informs individuals of their right to object to processing no later than at the time of the first communication with them.

The Data Controller handles requests from individuals without undue delay. If the time limit for handling a request is extended beyond one month, the Company informs the individual and provides reasons for the extension.

The Data Controller notifies an individual without undue delay of a personal data breach if it is likely to result in a high risk to that person’s rights or freedoms.

Third-party rights: when responding to data subjects’ rights, the Data Controller establishes procedural safeguards for the rights and freedoms of third parties. In particular, if there is credible information that providing a copy of data or allowing data portability could adversely affect other people’s rights and freedoms (for example, data protection rights, intellectual property rights, trade secrets or personal rights), the Data Controller may ask the individual to clarify the matter or take other lawful steps, including refusing the request.

No processing: if an individual submits a request concerning their rights, the Data Controller informs them if it does not process their data.

Refusal: within one month of receiving a request, the Data Controller informs the individual of a refusal to act on the request and of the related rights of the individual.

Access to data: upon request, the Data Controller informs the individual whether their data are being processed, provides details of the processing in accordance with Article 15 GDPR (corresponding to the information obligation at collection), and provides access to the data concerning them.

Copies of data: upon request, the Data Controller provides a copy of the individual’s personal data and records that the copy was issued.

Rectification: the Data Controller corrects inaccurate data at the individual’s request. It may refuse to rectify data unless the individual reasonably demonstrates that the data they want corrected are inaccurate. Following rectification, the Data Controller informs the individual of the recipients of the data at the individual’s request.

Completion of data: the Company completes and updates data at the individual’s request. The Data Controller may refuse to complete data if doing so would be inconsistent with the purposes of processing (for example, the Company need not process data it does not need). The Data Controller may rely on the individual’s statement about the data to be added unless that is insufficient under the Controller’s procedures or there are grounds to consider the statement unreliable.

Erasure: at the individual’s request, the Data Controller erases data where: (a) the data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) consent has been withdrawn and there is no other legal basis for processing; (c) the individual has effectively objected to processing; (d) the data were processed unlawfully; (e) erasure is required by law; or (f) the request concerns data of a child collected on the basis of consent for the provision of information society services offered directly to the child.

The Data Controller establishes a procedure for handling the right to erasure so that the right can be exercised effectively while respecting all data protection principles, including security, and checking whether the exceptions in Article 17(3) GDPR apply.

If data to be erased have been made public by the Data Controller, reasonable steps, including technical measures, are taken to inform other controllers processing the data that the data and links to them should be erased.

Following erasure, the Data Controller informs the individual of the recipients of the data at the individual’s request.

Restriction of processing: the Data Controller restricts processing at the individual’s request where: (a) the individual contests the accuracy of the data, for a period allowing verification; (b) processing is unlawful and the individual opposes erasure and requests restriction instead; (c) the Data Controller no longer needs the data but the individual needs them to establish, exercise or defend legal claims; or (d) the individual has objected on grounds relating to their particular situation, pending verification of whether the Controller has overriding legitimate grounds.

8. Other obligations of the Company — continued

During restriction of processing, the Data Controller stores the data but does not process them (use or disclose them), unless the data subject consents, or processing is necessary to establish, exercise or defend legal claims, protect the rights of another natural or legal person, or for reasons of important public interest. The Data Controller informs the individual before lifting the restriction. At the individual’s request, the Data Controller informs them of the recipients of the data.

Data portability: at the individual’s request, the Data Controller provides, in a commonly used, machine-readable format, or transfers to another entity where technically feasible, the personal data concerning that individual that they provided to the Controller, where processing is based on consent or a contract and is carried out by automated means in the Company’s IT systems.

Objection based on a particular situation: if an individual objects, on grounds relating to their particular situation, to processing based on the Company’s legitimate interests or a task carried out in the public interest, the Data Controller will honour the objection unless compelling legitimate grounds override the individual’s interests, rights and freedoms, or the data are needed to establish, exercise or defend legal claims.

Objection to scientific, historical or statistical processing: where the Data Controller processes data for scientific or historical research or statistical purposes, an individual may object on grounds relating to their particular situation. The objection will be honoured unless processing is necessary for a task carried out in the public interest.

Data minimisation: the Data Controller minimises processing with regard to (a) the adequacy of the data for the purposes, including volume and scope of processing; (b) access to data; and (c) the data retention period.

9. Risk analysis and risk treatment

The Data Controller conducts a risk analysis of resources involved in data processing periodically, at least once a year.

The likelihood and severity of risks to the rights or freedoms of data subjects are assessed with reference to the nature, scope, context and purposes of processing. Risk is estimated on the basis of an objective assessment using the Risk Analysis and Risk Treatment Plan form attached as Appendix 5.

Following the analysis, the Data Controller determines whether data processing operations involve risk or high risk.

Based on the analysis, the Data Controller decides how to address the risk and establishes a risk treatment plan intended to minimise it.

10. Protection of premises where personal data are stored

Managers of the Company’s individual departments are responsible for properly securing the physical personal data resources in their departments.

The Data Controller periodically checks the physical security of personal data files, at least once a year.

Unauthorised persons may be present in rooms where personal data are processed only when accompanied by persons authorised to process those data.

Cleaning staff may enter such rooms outside the Company’s working hours without an authorised person being present.

Rooms where personal data are processed must be locked whenever authorised persons are absent, in a way that prevents access by unauthorised persons.

The Company’s buildings and rooms have security measures, including: external and internal doors fitted with locks; entrance access and keys held by authorised employees; spare keys to all doors kept at reception in a locked cabinet; office-room keys held by authorised employees; and personal-data documents stored in lockable filing cabinets and a safe, whose keys are held only by an authorised person.

When personal data are processed on portable devices or paper documents outside the areas specified in this Policy, they must be strictly protected against access by unauthorised persons.

11. Procedure in the event of a personal data security breach

Anyone authorised to process personal data must notify the Data Controller upon identifying a threat to, or breach of, personal data protection.

Typical threats to personal data security include:

Inadequate physical security of premises, devices and documents.

Inadequate security of hardware or software.

Failure to comply with personal data protection rules.

Typical personal data security incidents include:

External accidental events, such as fire or power failure.

Internal accidental events, such as failure of a server, computers, disks or software.

Deliberate incidents, such as breaking into an IT system or premises, theft or leakage of information, disclosure of data to unauthorised persons, deliberate destruction of documents, or malicious software.

When a threat is identified, the Data Controller conducts an investigation in which they: (a) establish the scope and causes of the threat and its possible consequences; (b) initiate any necessary disciplinary action; (c) recommend preventive measures to eliminate similar threats in future; and (d) document the investigation.

When an incident is identified, the Data Controller investigates and: (a) establishes when the breach occurred, its scope, causes, consequences and extent of damage; (b) secures any available evidence; (c) reports the breach to the supervisory authority under Article 55 GDPR without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights or freedoms of natural persons; if the report is made after 72 hours, it includes reasons for the delay; (d) identifies the persons responsible; (e) takes disciplinary action; (f) draws conclusions and recommends corrective measures to prevent similar incidents; and (g) documents the proceedings in accordance with Appendix 6 to the Policy.

12. Instructions for managing IT systems

General principles

These instructions set out the rules for operating and managing IT systems used to process personal data at the Company.

The rules in this document comply with applicable legal requirements, in particular the GDPR.

Users of IT systems processing personal data authenticate using user IDs and passwords. Each ID is uniquely assigned to a specific user.

Users must change their password immediately if they suspect it may have become known to an unauthorised person. The new password should differ from previously used passwords.

Users must not disclose passwords to anyone, including other users; must keep passwords confidential even after they expire; must not write passwords down; must handle passwords so that third parties cannot access them; and must enter passwords in a way that minimises the risk of them being observed by others.

When starting work in an IT system processing personal data, users start the computer and enter the required IDs and passwords in a way that minimises the risk of observation by third parties.

When pausing work in the IT system or leaving their workstation, users lock the workstation. Work may resume after the workstation is unlocked by entering the user ID and password.

When leaving a room where personal data are processed, an employee must lock it if no other authorised person remains in the room.

Rooms where personal data are processed must not be left unattended.

At the end of work in the IT system, users log out of all applications used, shut down the workstation and secure data media.

If the user is the last person to leave the room, they check that the windows are closed and lock the door.

Backup procedure

A Company employee or associate is authorised to act as IT Systems Administrator, including in particular creating and storing backups.

At the request of the Data Controller, the IT Systems Administrator registers new users in the IT system, assigns them an ID and enables access to systems processing personal data in line with their individual duties.

Personal data are stored electronically on media built into IT equipment or forming part of the system.

Personal data may be stored on portable electronic media only when necessary and only for as long as needed to fulfil the purpose for which they were saved. Once that period ends, the contents of the media must be erased.

Personal data in the IT system are stored for as long as required for the purpose of storage. After that period, they must be erased or anonymised.

Backups of systems processing personal data are saved on a network drive located in a locked server cabinet (server room).

Protection of IT systems against software intended to obtain unauthorised access

To protect the IT system against malicious software, users are prohibited from: (a) running software that has not been approved for use by the Data Controller; (b) opening email where the subject or sender address does not suggest a connection with their official duties—in doubtful cases, they should contact the IT Systems Administrator or an authorised person; (c) using the Internet for purposes unrelated to their official duties; and (d) connecting computers to external networks through modems not supplied by the Data Controller.

If a user notices symptoms that may indicate malicious software, they must notify the IT Systems Administrator or an authorised person.

Such symptoms may include:

A marked slowdown in the IT system.

Unusual application behaviour.

Unusual messages.

Loss or modification of data.

The IT system is protected against malicious software by: (a) a firewall; (b) antivirus software; and (c) system software updates.

Inspection and maintenance of systems and media

Service work is carried out at the Company’s premises.

Equipment may be sent for repair outside the Company’s premises only if: (a) it is handed over without media containing personal data, and a report confirms the media have been removed or that no such media were present; and (b) the equipment handover is confirmed in a report that clearly identifies the person handing over the equipment and the person receiving it.

All service work performed by external entities requires a service report containing at least: (a) the name of the person performing the work and the entity they work for; (b) the name of the person supervising the work, where it is carried out at the Company’s premises; (c) the subject of the service work; (d) its scope; and (e) the time when it was performed.

13. Final provisions

The Data Controller must familiarise every person authorised to process personal data, and every user of an IT system involving personal data processing, with the contents of this Policy.

Authorised persons and users referred to above must comply with this Policy when processing personal data.

All provisions of this Policy concerning IT systems also apply to personal data processing in databases maintained by the Data Controller, regardless of form.

Disciplinary proceedings may be initiated against a person who, when an IT system security breach occurs or is reasonably suspected, fails to take the action required by this Policy—especially failing to notify the appropriate person in accordance with the stated rules—or fails to document the relevant incident.

Matters not regulated by this Policy are governed by the GDPR.

14. Appendices

Appendix 1. Register of Personal Data Processing Activities

Appendix 2. Register of Persons Authorised to Process Personal Data

Appendix 3. Register of Entrusted Personal Data Processing

Appendix 4. Authorisation to Process Personal Data

Appendix 5. Risk Analysis and Risk Treatment Plan

Appendix 6. Information for a Job Applicant in the Recruitment Process

Appendix 7. Information Clause for an Employee

Appendix 1 to the Personal Data Protection Policy

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn

Item number

Name of processing activity

Organisational unit

Purpose of processing

Categories of individuals

Categories of data

Legal basis

Source of data

Planned erasure date

Categories of recipients

Name of system or software

General description of technical and organisational security measures

DPIA

Transfer to a third country or international organisation

Appendix 2 to the Personal Data Protection Policy

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn

Item number

Full name and position

Date authorisation to process personal data was granted

Scope of authorisation to process personal data

Date authorisation to process personal data ends

Date authorisation expires / is revoked

Reason for revocation

Blank register rows: 1, 2, 3, 4, 5.

Appendix 3 to the Personal Data Protection Policy

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn

Item number

Entity entrusted with personal data processing

Purpose and scope of entrustment

Description of technical and organisational measures

Blank register rows: 1, 2, 3, 4.

Appendix 4 to the Personal Data Protection Policy

Authorisation to Process Personal Data

Pursuant to Article 29 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR; Official Journal of the EU L 119/1), I hereby authorise:

Full name of authorised person: ________________________________

Position: ________________________________

Name of organisational unit: ________________________________

to process personal data at “Przemysłówka” Przedsiębiorstwo Budownictwa Przemysłowego Holding Sp. z o.o. in Olsztyn, in accordance with their individual duties.

I also require you to familiarise yourself with and comply with the GDPR, the legal acts issued pursuant to it, and internal data protection rules, and to keep confidential the personal data processed and the methods used to secure them.

Date on which the Company is represented: ____________________________

Signature of person authorised to represent the Company: ____________________________

Confirmation of receipt of authorisation: ____________________________

Date: ____________________________

Signature of authorised person: ____________________________

Appendix 5 to the Personal Data Protection Policy

Risk Analysis and Risk Treatment Plan

Resource name

Threat (description of vulnerability)

Description of safeguards

Assessment of safeguards

Likelihood of threat occurring

Impact of threat occurrence

Risk value

Risk treatment method

Date

Signature of person authorised to represent the Company

Appendix 6 to the Personal Data Protection Policy

Information on the scope of personal data processing during recruitment

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn

Place and date: ____________________________

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR; Official Journal of the EU L 119/1), we inform you that:

The controller of your personal data is “Przemysłówka” Przedsiębiorstwo Budownictwa Przemysłowego Holding Sp. z o.o., ul. Mickiewicza 21/23, 10-508 Olsztyn.

Your personal data will be processed on the basis of your consent (Article 6(1)(a) GDPR).

We will process your personal data for one month after the recruitment process has ended.

You have the right to access your data, rectify or erase them, restrict processing, exercise data portability, object to processing and withdraw consent to processing.

You have the right to lodge a complaint with the Polish supervisory authority (UODO) if you consider that the processing of your data violates the GDPR.

Your consent to the processing of data during recruitment is necessary for your application to be accepted and considered.

Job applicant’s consent to the processing of personal data

I, the undersigned, hereby consent to the processing of my personal data by “PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn, to the extent necessary for the recruitment process, subject to the data security requirements set out in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and other applicable legal provisions.

Signature of the data subject: ____________________________

Appendix 7 to the Personal Data Protection Policy

Information Clause

“PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office in Olsztyn

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, GDPR; Official Journal of the EU L 119/1), we inform you that:

The controller of your personal data is “PRZEMYSŁÓWKA” PRZEDSIĘBIORSTWO BUDOWNICTWA PRZEMYSŁOWEGO HOLDING, a limited liability company with its registered office at ul. Adama Mickiewicza 21/23, 10-508 Olsztyn; email: poczta@holding.olsztyn.pl; telephone: 89 527 23 53.

Your personal data will be processed to implement the Agreement on the Organisation of Compulsory Student Internships, pursuant to Article 6(1)(c) GDPR.

Your personal data will be stored for the duration of the Agreement on the Organisation of Compulsory Student Internships and for the period necessary to secure any potential claims.

You have the right to access your data, rectify them, request erasure or restriction of processing, and object to processing. Since processing is not based on consent, you do not have the right to data portability.

You have the right to lodge a complaint with the supervisory authority (UODO) if you believe that processing of your personal data violates the applicable GDPR provisions.

Your personal data will not be disclosed to other entities except entities authorised under law.

Your personal data were obtained directly from you. Providing personal data is voluntary; however, failure to provide them will make it impossible to perform the Agreement and the obligations associated with it.

Confirmation that you have read the clause: ____________________________

Back to website