INFORMATION CLAUSE for business partners

  1. Protection of personal data under the General Data Protection Regulation (GDPR)

The data controller is Kuźnia Sułkowice S.A., which has entered into a contract with, or works with, a business partner on the basis of standing or one-off orders. In this clause, we set out how personal data is used, as well as the rights of individuals in relation to the collection and use of such data. If you have any questions or comments, please contact us at the following email address: sekretariat@kuznia-sulkowice.pl

  1. Scope of information

In this clause, Kuźnia Sułkowice S.A. (hereinafter: the Company) provides information on all forms of processing of personal data within Poland in relation to natural persons who are:

  1. the Company’s suppliers or business partners,
  2. subcontractors of the Company’s suppliers or contractors,
  3. partners, employees, legal representatives, authorised representatives, representatives of suppliers, contractors or their subcontractors, other persons whose data we process for the purposes of issuing or processing invoices in the context of our cooperation with suppliers or business partners (collectively, „you” or „business partners”).
  1. Types of personal data processed

Data provided by Contractors

In connection with the cooperation between you and the Company – which may, in particular, involve you or the organisation you represent providing services or supplying goods to the Company, or cooperation via intermediaries – we may process the personal data you have provided, such as:

  1. full name, company name, business address and correspondence addresses,
  2. numbers held in the relevant registers (e.g. tax identification number (NIP) or business registration number (REGON), personal identification number (PESEL)),
  3. contact details, such as an email address or a telephone or fax number,
  4. the position you hold within your organisation or the role you perform,
  5. qualifications held,
  6. bank account number.

Where a contract is concluded directly between you and the Company, the provision of the data specified above is voluntary, but necessary for the purposes of concluding the contract and managing the business relationship between you and the Company. This also applies where the Company places orders for goods or services from you on a regular or one-off basis.

Where you do not enter into a contract directly with the Company, the provision of personal data may be a requirement of your employment or may be necessary for the conclusion of a contract between you and a third party (e.g. where you are a subcontractor to a Contracting Party). Failure to provide your personal data will mean that the Company is unable to carry out the above actions (for example, failure to provide your personal data may mean that we are unable to fulfil an order or issue an invoice).

The contact details of the counterparties specified in points (a) to (f) will be processed by the Company, as the data controller, for the purpose of creating a Counterparty Database.

Data collected from other sources

We may collect your personal data from publicly available sources, such as the CEIDG or KRS business registers, in order to verify the information you have provided. In such cases, the scope of the data processed will be limited to the data publicly available in the relevant registers.

We may also obtain your personal data from organisations where you are employed or which you represent. In such cases, the scope of the data processed will include information necessary to manage our cooperation and maintain contact with the Contractual Partner, e.g. information regarding the termination of your employment with a particular organisation or a change to your contact details.

We may also obtain personal data relating to our Contractors’ subcontractors from the Contractors themselves, who have provided such data to the Company for the purpose of facilitating the cooperation between the Contractor and the Company.

  1. Legal basis, purposes and periods of data processing

Legal basis for data processing

We process personal data only when:

  1. processing is necessary for the performance of contractual obligations towards you, if you are or will be a party to a contract concluded with the Company or Companies, or for taking specific steps prior to entering into a contract, e.g. preparing a draft contract (Article 6(1)(b) of the GDPR);
  2. processing is necessary to comply with the Companies’ legal obligations or is expressly required by law (Article 6(1)(c) of the GDPR) – in respect of personal data contained in documents subject to archiving under the provisions of the law;
  3. Processing is necessary for the purposes of the legitimate interests pursued by the Companies or a third party, and does not unduly affect your interests or fundamental rights and freedoms (Article 6(1)(f) of the GDPR). When processing personal data on this basis, we always endeavour to strike a balance between our legitimate interest and your privacy

Legitimate interests include:

  1. to enable the Company to liaise with its counterparties and to manage the relevant contract;
  2. the use of business partners’ contact details within the Business Partner Database;
  3. prevention of fraud and criminal activity;
  4. the Company, in its capacity as a business partner of the Counterparty, establishing or pursuing civil law claims in the course of its business, as well as defending itself against such claims;
  5. verification of the Counterparty’s credibility;
  6. Verification of contractors in public registers.

Data processing periods set for specific purposes

Personal data is processed solely for a specific purpose and to the extent necessary to achieve that purpose, and for as long as is necessary. Set out below are the main purposes for which the Company processes personal data, and the periods for which it is processed:

  1. contractual obligations – the term of the contract between the Counterparty and the Company;
  2. retention of records for the purpose of demonstrating compliance with legal obligations, in particular those under the Accounting Act and the Tax Ordinance – for the period specified in the relevant legislation. As a general rule, these are 5-year periods, calculated from the end of the calendar year in which the event took place (e.g. the issue of an invoice);
  3. for the purposes of establishing or pursuing civil law claims by the Companies in the course of their business activities, as well as for the defence against such claims – for the relevant limitation periods applicable to such claims, i.e. as a general rule, for no longer than 3 years from the occurrence of the event giving rise to the claim.
  1. Disclosure of personal data to other recipients

Data may be disclosed to the following recipients:

  1. (a) entities processing personal data on behalf of the Company, including, amongst others:
  • organisations providing IT support services relating to IT systems or tools used for the processing of personal data, or similar services,

Such entities do not decide independently on how to process your personal data. Their processing of personal data takes place only to the extent necessary for the Company to carry out its activities and will not exceed the scope of the purposes set out in point 4. The Company has the right to carry out audits.

  1. (b) other controllers of personal data, including, amongst others:
  • courier or postal service providers,
  • consultancy firms, law firms,
  • other contractors or subcontractors involved in the performance of the contract
  1. (c) other entities within the relevant Contractor or subcontractor.

Data transfers outside the European Economic Area

Your personal data will not be transferred outside the European Economic Area.

  1. The Contractor’s rights and the exercise thereof

Entitlements

Every individual has the right to access their personal data processed by the Company. If you believe that any information relating to you is incorrect or incomplete, please submit a request for its rectification in the manner set out in section 6.2 below. The Company will rectify such information without delay.

In addition, you have the right to:

  1. to withdraw your consent where the Company has obtained such consent for the processing of personal data (provided that such withdrawal does not affect the lawfulness of any data processing carried out prior to the withdrawal);
  2. the right to request the erasure of your personal data in the circumstances set out in the GDPR;
  3. the right to request that the processing of your personal data be restricted in the circumstances specified in the GDPR;
  4. to object – on grounds relating to your particular situation – to the processing of your personal data, where such processing is carried out for the purposes of a public interest or the legitimate interests of the Company or a third party;
  5. data transfer.

The company will review your requests, demands or objections in accordance with the applicable data protection legislation. Please note, however, that these rights are not absolute; the legislation provides for exceptions to their application.

In response to your request, the Company may ask you to verify your identity or provide information that will help the Company to better understand the situation. The Company will make every effort to explain its decision to you if your requests are not met.

Exercising your rights

To exercise the above rights, please send an email to: sekretariat@kuznia-sulkowice.pl or submit a written request to the following postal address:  KUŹNIA Sułkowice S.A., ul. 1 Maja 70, 32-440 Sułkowice, with the note: „Data protection – business partners”.

Should you become aware that the Company is processing your personal data unlawfully, you have the right to lodge a complaint with the supervisory authority responsible for data protection matters, namely the President of the Office for Personal Data Protection.

In order to ensure that your personal data remains up to date and accurate, we may periodically ask you to check and confirm the personal data we hold about you, or to inform us of any changes to that personal data (such as, for example, a change of email address).

We encourage you to check regularly that the personal data we process is accurate, up to date and complete.