GDPR
INFORMATION CLAUSE REGARDING THE PROCESSING OF PERSONAL DATA
In accordance with the guidelines of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation “GDPR”), we inform you about the rules for processing your personal data and your rights related to it.
The Data Controller of your personal data is: Bochnia Salt Mine Ltd., located at ul. Campi 15, 32-700 Bochnia, KRS: 0000478929, NIP: 8680000485, REGON: 000867845.
Data Protection Officer: Agnieszka Pachuta; contact: iod@kopalnia-bochnia.pl
The Controller processes your personal data based on applicable law, contracts, and granted consent, depending on the purpose for which the data was collected or provided.
The basis for processing your personal data depends on the purpose for which the data was provided:
a) Recruitment:
6(1)(a) – the data subject has consented to the processing of their personal data beyond the scope provided by current regulations (Article 221 § 1 of the Labor Code, dated June 26, 1974).
9(2)(a) – as in point a), but it concerns sensitive data, e.g., religious beliefs, health status, etc.
6(1)(c) – processing is necessary for the performance of a legal obligation on the part of the controller under the Labor Code, Social Security Act, etc.
b) Employment:
6(1)(a) and Art. 9(2)(a) when applying documents containing personal data beyond the set provided by current regulations (Labor Code) – until they are deleted or consent is withdrawn.
6(1)(c) – processing is necessary to fulfill a legal obligation on the controller under the Labor Code, Social Security Act, etc.
6(1)(b) – processing is necessary for the performance of a contract to which the data subject is a party.
c) Public Procurement:
6(1)(c) GDPR in connection with the provisions of the Public Procurement Law of September 11, 2019, (Journal of Laws 2019, item 2019, as amended), for purposes related to public procurement procedures.
d) Educational Activity:
6(1)(c) – processing is necessary to fulfill a legal obligation on the controller, i.e., the performance of statutory activities,
Act of November 21, 1996, on Museums (as amended),
Act of October 25, 1991, on organizing and conducting cultural activities (as amended).
e) Civil-law Contracts, Sales, Lease Agreements:
6(1)(b) – processing is necessary for the performance of a contract to which the data subject is a party.
f) Volunteering:
Recruitment for volunteering based on Art. 6(1)(a) and (b),
Signing a volunteering agreement based on Art. 6(1)(b) and (c).
g) Monitoring:
6(1)(c) – processing is necessary to fulfill a legal obligation on the part of the controller and to carry out tasks in the public interest.
h) Newsletter, Marketing:
6(1)(a) – consent of the data subject.
In connection with the processing of your personal data for the purposes outlined in point 4, recipients of your personal data may include public authorities and entities performing public tasks or acting on behalf of public authorities, or other entities that process personal data on behalf of the Controller under appropriate data processing agreements, such as IT service providers.
Your personal data will be stored for the period necessary to achieve the purposes specified in point 4, and thereafter for the period required by applicable law and in accordance with the office protocol. For example:
• Monitoring recordings for a maximum period of 14 days – after which they are overwritten.
• Purchases in the store – a minimum of 5 years according to the accounting law, and the current fiscal year, and then deleted when the account is removed.
• Newsletter or other marketing consents – until the consent is revoked.
In connection with the processing of your personal data, you have the following rights: the right of access to your personal data, the right to rectify data – if they are incorrect or incomplete, the right to request deletion of personal data (the right to be forgotten), the right to request the restriction of processing, the right to object to the processing of data.
If the processing of personal data is based on the consent of the data subject (Art. 6(1)(a) GDPR), you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
If you learn of any unlawful processing of your personal data, you have the right to file a complaint with the supervisory authority responsible for data protection, i.e., the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
In cases where the processing of personal data is based on the consent of the data subject, providing personal data to the Controller is voluntary.
However, providing personal data is mandatory when the processing of personal data is based on the law or an agreement between the parties.
Your data may be processed in an automated manner, but will not be subject to profiling.
Your personal data will not be transferred to a third country/international organization.