Acting under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the so-called GDPR, Gamrat WPC Sp. z o.o. informs that:
1. Data Controller:
The personal data controller is
“Gamrat WPC” Sp. z o.o. with its registered office in Jasło, ul. Mickiewicza 108, 38-200 Jasło.
2. Categories of personal data processed:
Personal data are processed:
– in order to conclude an employment contract or at the request of the data subject before concluding an employment contract based on art. 6 sec. 1 letter b of the GDPR;
– on the basis of the consent of the job candidate based on art. 6 sec. 1 letter a of the GDPR and art. 9 sec. 2 letter a of the GDPR, which may also include the processing of personal data for the purposes of subsequent recruitment processes.
The scope of the processed data is limited to information that is required to be provided under labor law, necessary to conclude a contract (name(s) and surname, date of birth, contact details provided by such a person, education, professional qualifications, previous employment history), as well as information provided voluntarily by the job candidate (e.g. image – photo), other contact details.
In the case of an online recruitment interview, personal data in the scope of first name, last name, username, data provided during the recruitment interview and image in the case of its display during the recruitment interview are used solely for the purpose of conducting the online recruitment, which constitutes the legitimate interest of the Administrator under Art. 6 sec. 1 let. f of the GDPR.
Processing of personal data is necessary to participate in the recruitment process for work with the Administrator.
To the extent that the basis for processing personal data is consent, providing personal data is completely voluntary.
Personal data is processed during the recruitment process, and after its completion as long as the consent to the processing of personal data is not withdrawn, but no longer than for a period of one year.
Each job candidate is entitled to:
• under Article 15 of the GDPR, the right to access personal data;
• under Article 16 of the GDPR, the right to rectify personal data;
• under Article 17 of the GDPR, the right to request the deletion of personal data;
• under Article 18 of the GDPR, the right to request the restriction of the processing of personal data, subject to the cases referred to in Article 18, paragraph 2 of the GDPR;
• under Article 20 of the GDPR, the right to transfer personal data only to the extent that personal data are processed in an automated manner;
• the right to lodge a complaint with the President of the Personal Data Protection Office if it is found that the processing of personal data violates the provisions of the GDPR.
In the event of processing personal data based on consent, the job candidate has the right to withdraw it, which, however, does not affect the validity of actions performed on the basis of consent in the period between its granting and withdrawal.
Due to the nature of the processing of personal data during the online recruitment interview, you do not have the right to access your data, the right to receive a copy of your data, the right to delete your data, the right to limit the processing of your data, the right to transfer your data and the right not to be subject to automated decision-making.
The job candidate does not have the right to object to the processing of personal data under Article 21 of the GDPR, as the legal basis for the processing of personal data is not Article 6 paragraph 1 letter e or f of the GDPR.
The scope of processed personal data includes data that must be provided under the law, the legitimate interest of the Administrator, necessary for the performance of the employment contract, as well as personal data provided voluntarily by the employee.
Personal data are processed:
- on the basis of voluntary consent to the processing of personal data on the basis of art. 6 sec. 1 letter a and art. 9 sec. 2 letter a of the GDPR;
- in order to conclude an employment contract on the basis of art. 6 sec. 1 letter b of the GDPR;
- in order to fulfil the legal obligations incumbent on the Administrator on the basis of art. 6 sec. 1 letter c of the GDPR and art. 9 sec. 2 letter b of the GDPR, in particular in the scope of obligations arising from the provisions of labour law, tax law and social security;
- in the scope of data processed for the purpose of providing social benefits from the Company Social Benefits Fund on the basis of art. 6 sec. 1 letter c of the GDPR and art. 9 sec. 2 letter b of the GDPR;
- in the scope of video monitoring in order to ensure the safety of persons, protect property, control production and ensure the confidentiality of information, which constitutes the legitimate interest of the Administrator on the basis of art. 6 sec. 1 letter f of the GDPR and art. 22 (2) § 1 of the Labour Code;
- in the scope of other forms of monitoring used by the Administrator in order to ensure the organization of work enabling full use of working time and proper use of work tools provided to the employee, which constitutes the legitimate interest of the Administrator under Art. 6 sec. 1 letter f of the GDPR and Art. 22 (3) of the Labour Code;
- in the scope of data processed during meetings during remote work, which constitutes the legitimate interest of the Administrator under Art. 6 sec. 1 letter f of the GDPR.
The processing of personal data is necessary for the conclusion and implementation of the employment relationship with the Administrator.
To the extent that the basis for the processing of personal data is consent, the provision of personal data is voluntary.
Personal data are processed during and after employment for as long as required by applicable law or until the consent to the processing of personal data is withdrawn when it constitutes the legal basis for the processing of personal data or until an objection to the processing of personal data is raised in the case of a legitimate interest.
Personal data from video monitoring are stored for no longer than 30 days, and data from other forms of monitoring are stored for the period indicated in IT procedures.
Each employee is entitled to:
• under Article 15 of the GDPR, the right to access personal data;
• under Article 16 of the GDPR, the right to rectify personal data;
• under Article 17 of the GDPR, the right to request the deletion of personal data;
• under Article 18 of the GDPR, the right to request the restriction of the processing of personal data, subject to the cases referred to in Article 18, paragraph 2 of the GDPR;
• under Article 20 of the GDPR, the right to transfer personal data only to the extent that personal data are processed in an automated manner;
• the right to lodge a complaint with the President of the Personal Data Protection Office if it is found that the processing of personal data violates the provisions of the GDPR.
In the case of processing personal data based on consent, the employee has the right to withdraw it, which, however, does not affect the validity of actions performed on the basis of consent in the period between its granting and withdrawal.
Due to the nature of the processing of personal data during online conversations, there is no right to access the data, the right to receive a copy of the data, the right to delete the data, the right to limit the processing of data, the right to transfer the data and the right not to be subject to automated decision-making.
In the case of data processing on the basis of Article 6 paragraph 1 letter f of the GDPR, i.e. for the purpose of pursuing legitimate interests, the employee has the right to object to the processing of data.
The scope of personal data includes data necessary for identification, data recorded by monitoring and vehicle data (optional data).
Personal data are processed on the basis of art. 6 sec. 1 letter f of the GDPR solely for the purpose of ensuring the safety of persons and protection of property, production control and ensuring the confidentiality of information, which constitutes the legitimate interest of the Administrator.
Providing data is necessary – failure to provide it will result in the inability to identify yourself, and therefore to enter the Company’s premises.
Therefore, it is necessary to present an identity card in order to issue a pass – however, the identity card will not be photocopied, scanned or photographed.
Personal data is processed for as long as required by law regarding ensuring the safety of persons and protection of property in the scope of determining, pursuing or defending claims or until an objection is filed to the processing of personal data.
Data recorded by video monitoring is stored for a period not exceeding 30 days.
Every person has the right to:
• under Article 15 of the GDPR, the right to access personal data;
• under Article 16 of the GDPR, the right to rectification;
• under Article 18 of the GDPR, the right to request that the controller restrict the processing of personal data, subject to the cases referred to in Article 18, paragraph 2 of the GDPR;
• the right to lodge a complaint with the President of the Personal Data Protection Office if it is found that the processing of personal data violates the provisions of the GDPR.
In the event that the legal basis for data processing is Article 6, paragraph 1, letter f of the GDPR, you have the right to object to the processing of personal data pursuant to Article 21 of the GDPR.
You do not have:
• the right to request the deletion of personal data pursuant to Article 17, paragraph 3, letters b, d or e of the GDPR;
• the right to transfer personal data pursuant to Article 20 of the GDPR.
Video surveillance recordings may not be corrected for technical reasons and are not subject to the right to obtain a copy if this could violate the rights and freedoms of other persons who may be included in the recording.
- CUSTOMERS AND CONSTRUCTORS:
The scope of personal data includes identification data, contact data and data contained in publicly available registers and sources or provided by the Client/Contractor, including data of persons authorized to represent and data of proxies and data of persons designated for contact.
Personal data are processed, depending on the legal basis connecting the Parties, for the purpose of:
• concluding a contract or performing its provisions pursuant to art. 6 sec. 1 letter b of the GDPR;
• taking action before concluding a contract, at the request of the data subject, in particular preparing an offer pursuant to art. 6 sec. 1 letter b of the GDPR;
• fulfilling a legal obligation in the scope of tax and accounting obligations pursuant to art. 6 sec. 1 letter c of the GDPR;
• fulfilling the legitimate interest of the Administrator consisting in marketing its own goods, conducting correspondence or providing answers to inquiries asked using the Administrator’s contact details and conducting debt collection activities and considering complaints if necessary pursuant to art. 6 sec. 1 letter f of the GDPR;
• in the scope of data processed for the purpose of holding remote meetings, which constitutes the legitimate interest of the Administrator pursuant to art. 6 sec. 1 letter f of the GDPR.
In the event of concluding an agreement with an entrepreneur or institution, the Administrator will process the personal data of persons authorized to represent them and persons designated for contact only for purposes related to concluding and performing agreements and conducting possible complaint and debt collection activities, which constitutes the legitimate interest of the Administrator pursuant to art. 6 sec. 1 letter f of the GDPR. In such a case, personal data include identification data, contact details, position held and other data available in publicly available registers (e.g. KRS, CEIDG) or provided by the company or institution in order to conclude and perform the agreement.
Providing personal data is necessary to conclude and execute the contract.
Personal data will be stored for the duration of the contract, and also:
• until the limitation period for claims in accordance with generally applicable laws;
• in the scope of accounting and tax documentation – for a period of 5 years counted from the end of the calendar year in which the contract was terminated or expired;
• the Administrator recognizes the objection as justified in the case of processing personal data solely on the basis of the legitimate interest of the Administrator.
Each person has the right to:
• under Article 15 of the GDPR, the right to access personal data;
• under Article 16 of the GDPR, the right to rectify personal data;
• under Article 17 of the GDPR, the right to request the deletion of personal data;
• under Article 18 of the GDPR, the right to request the restriction of the processing of personal data, subject to the cases referred to in Article 18, paragraph 2 of the GDPR;
• under Article 20 of the GDPR, the right to transfer personal data only to the extent that personal data are processed in an automated manner and on the basis of a contract;
• the right to lodge a complaint with the President of the Personal Data Protection Office if it is found that the processing of personal data violates the provisions of the GDPR.
In the case of data processing on the basis of Article 6 paragraph 1 letter f of the GDPR, i.e. for the purpose of pursuing legitimate interests, the customer/contractor has the right to object to the processing of data.
Personal data are processed in order to answer the question asked using the contact form based on the consent to the processing of personal data (Article 6 paragraph 1 letter a of the GDPR) or via e-mail or traditional mail, which constitutes the legitimate interest of the Administrator under Article 6 paragraph 1 letter f of the GDPR.
Providing data is necessary to answer the question asked using the contact form or mail.
Your personal data are processed for the period necessary to expire claims.
Each person has the right to:
• under Article 15 of the GDPR, the right to access personal data;
• under Article 16 of the GDPR, the right to rectify personal data;
• under Article 17 of the GDPR, the right to request the deletion of personal data;
• under Article 18 of the GDPR, the right to request the restriction of the processing of personal data, subject to the cases referred to in Article 18, paragraph 2 of the GDPR;
• under Article 20 of the GDPR, the right to transfer personal data only to the extent that personal data are processed in an automated manner and on the basis of a contract;
• the right to lodge a complaint with the President of the Personal Data Protection Office if it is found that the processing of personal data violates the provisions of the GDPR.
In the case of processing personal data based on consent, the job candidate has the right to withdraw it, which, however, does not affect the validity of actions performed on the basis of consent in the period between its granting and withdrawal.
In the case of processing data based on art. 6 sec. 1 letter f GDPR, i.e. for the purpose of pursuing legally justified interests, the sender or addressee of correspondence has the right to object to the processing of data.
3. Transfer of personal data outside the European Economic Area:
Employee personal data may be transferred outside the European Economic Area only in the case of business trips. In such a case, the Administrator will ensure proper protection of personal data, in particular by signing appropriate agreements, and will also ensure the possibility of exercising the right to obtain a copy of the data or information about the place where the data is made available.
In cases not mentioned above, personal data are not transferred outside the European Economic Area or to international organizations.
4. Profiling:
Personal data are not used in automated decision-making processes, in particular profiling.
5. Recipients of personal data:
Personal data may be made available to state authorities in connection with proceedings conducted by them under applicable law.
In the remaining scope, access to personal data is also granted to trained and authorized employees or associates of the Administrator, including entities providing services in the field of personal and property protection, legal, advisory, IT, accounting, courier or postal, auditing, programming, and insurance.
6. Contact details of the Data Protection Officer:
If you have any questions or comments regarding the processing of personal data, in particular in order to exercise your rights, please contact the Data Protection Inspector, Mr. Tomasz Cygan, e-mail: inspektor@gamrat.com.pl, phone: 0 694 429 337 or by mail to the Administrator’s address with the note “Data Protection Inspector”.
