Information Notice

Pursuant to Articles 13 and 14(1)–(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the General Data Protection Regulation, hereinafter referred to as the “GDPR”, we hereby inform you that:

  1. The Controller of your personal data is Pierwsza Fabryka Lokomotyw w Polsce “Fablok” spółka z ograniczoną odpowiedzialnością with its registered office in Chrzanów at ul. Fabryczna 16, 32–500 Chrzanów, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0000930509, tel.: +48 32 494 42 40, e-mail: biuro@fablok.com.pl, hereinafter referred to as the “Company” or the “Controller”.
  2. Purposes and legal bases of processing

We will process your data:

  1. for the purpose of performing the agreement concluded between the Controller and the entity that you represent or that has designated you as a contact person for cooperation in connection with the performance of the agreement — legal basis: Article 6(1)(f) GDPR; legal basis: Article 6(1)(b) GDPR if you are a party to the agreement,
  2. due to legal requirements with which the Controller is obliged to comply — Article 6(1)(c) GDPR,
  3. for the purpose of establishing, defending and pursuing claims, as well as for archival and evidentiary purposes, which constitute the implementation of our legitimate interest in securing information in the event of the need to demonstrate facts or prove the fulfilment of obligations — legal basis: Article 6(1)(f) GDPR,
  4. Source and categories of data processed

We have received your personal data directly from you or from the entity that you represent, or that has designated you as a contact person for cooperation in connection with the conclusion and performance of the Cooperation Agreement concluded with the Controller, as well as implementing agreements and licence agreements concluded on its basis.

We process data provided directly by you or indicated by the above-mentioned entity in the Cooperation Agreement, including implementing and licence agreements, namely: first name, surname, e-mail address, name of the represented entity, and bank account number.

  1. Processing period

We will process your personal data for the period necessary to achieve the purposes specified in Section 2 above, i.e. for the term of the agreement referred to in Section 2(a) above, as well as for the period during which legal provisions require us to retain the data, and for the period necessary to secure any potential claims — in accordance with the limitation periods for claims arising under applicable law.

  1. Your rights

You have the right at any time to:

  1. object to the processing of data processed on the basis of Article 6(1)(f) GDPR, as indicated in Section 2 above. We will cease processing the data in this respect unless we are able to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the data are necessary for the possible establishment, pursuit or defence of claims,
  2. request access to your personal data and receive a copy thereof, request rectification, erasure or restriction of processing of your personal data, as well as exercise the right to data portability,
  3. lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office.

Requests in the above scope may be sent to the addresses indicated in Section 1 above. In order to ensure that you are authorised to submit a request concerning the above matters, we may ask you to provide additional information enabling us to authenticate your identity. The scope of each of these rights and the situations in which they may be exercised result from applicable law, including the GDPR.

  1. Recipients of personal data

The recipients of personal data will be external entities providing and supporting the Controller’s IT systems and providing services related to the Controller’s ongoing business activities, pursuant to relevant personal data processing entrustment agreements and with the assurance that such entities apply appropriate technical and organisational measures ensuring the protection of data.

  1. Profiling and automated processing

Personal data are not subject to profiling and are not subject to automated decision-making.

  1. Information on transfers of data to third countries

Personal data are not transferred to third countries, i.e. countries outside the European Economic Area.