Information clause
INFORMATION CLAUSE GDPR
In accordance with Article 13(1) and (2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), we hereby inform you that:
Personal Data Controller.
The controller of your personal data is Al. Capone Sp. z o.o. with its registered office at ul. KRAKOWSKA 1, 33-113 ZBYLITOWSKA GÓRA.
You can contact the Data Controller regarding personal data:
– in writing at the address: ul. KRAKOWSKA 1, 33-113 ZBYLITOWSKA GÓRA
– via email at: daneosobowe@alejacapone.pl
Purpose of Data Processing and Legal Basis.
Personal data of job applicants.
Personal data is processed for the purpose of conducting recruitment, based on applicable legal provisions, including in particular the Labor Code (Article 6(1)(c) GDPR) and based on consent given by you in connection with participation in the recruitment process (Article 6(1)(a) GDPR).
Personal data of Administrator’s employees.
Personal data of employees are processed for the purpose of:
- cooperation between you and the Administrator in the performance of work, in particular for the purposes of executing an employment contract, including such purposes as granting social benefits and perks, managing business trips (legal basis: Article 6(1)(b) GDPR);
- fulfilling legal obligations incumbent on the employer in connection with the employment of employees, in particular based on labor law regulations (in particular regulating the employer’s documentation and employee personal files), accounting and tax law, and occupational health and safety (legal basis: Article 6(1)(c) GDPR);
- if you cooperate with us based on a civil law contract (mandate, work, or other form of cooperation), then we will process your personal data only for purposes related to the performance of mutual obligations under the contract and their settlement (Article 6(1)(b) GDPR),
- pursuing potential claims, conducting judicial and debt recovery proceedings (legal basis: Article 6(1)(f) GDPR);
fulfilling legal obligations arising, inter alia, from the Act of 4 October 2018 on employee capital plans (legal basis: Article 6(1)(c) GDPR) - based on consent given (Article 6(1)(a) GDPR).
Personal data of former employees/cooperators of the Administrator.
The purpose and legal basis for the processing of personal data are the obligation to archive documents containing personal data (Article 6(1)(c) GDPR) resulting from separate provisions (including the Labor Code, the Social Security System Act, the Act on pensions and benefits from the Social Insurance Fund) and the legitimate interest of the Administrator (Article 6(1)(f) GDPR) i.e. potential pursuit or defense against claims.
Personal data of customers, representatives of customers, or persons designated to contact on their behalf.
The purpose and legal basis for the processing of personal data are taking actions aimed at concluding an agreement, concluding an agreement, as well as its proper performance (Article 6(1)(b) GDPR); the necessity of fulfilling legal obligations, including those arising from the Accounting Act (Article 6(1)(c) GDPR); the legitimate interest of the Administrator (Article 6(1)(f) GDPR), maintaining contacts with customers, proper communication, and potential pursuit or defense against claims;
Personal data of contractors (suppliers, service recipients) and their representatives.
Personal data is processed in connection with:
- execution of the agreement concluded between you and the Administrator (Article 6(1)(b) GDPR);
- the Administrator’s fulfillment of legal obligations, including tax law regulations (Article 6(1)(c) GDPR);
- pursuing the Administrator’s legitimate interests, including pursuing potential claims (Article 6(1)(f) GDPR).
Personal data of individuals conducting sole proprietorship.
The purpose and legal basis for the processing of personal data are the proper performance of the contract/assignment, fulfillment of legal obligations imposed by tax regulations, as well as potential pursuit or defense against claims arising from civil law regulations (Article 6(1)(b), (c), (f) GDPR);
Monitoring.
The purpose and legal basis for the processing of personal data in the form of images are the use of video surveillance in the areas of points of sale operated by the Administrator to ensure the safety of individuals, based on the legitimate interest of the Administrator (Article 6(1)(f) GDPR).
Personal data of participants in games and competitions.
Personal data of winners of competitions and games are processed by the Administrator based on consent given (Article 6(1)(a) GDPR), for the purpose of issuing, receiving, and settling prizes and related legal provisions, in particular accounting and accounting regulations, as well as the obligation to archive (Article 6 GDPR, paragraph 1, letter c of the GDPR).
Recipients of Personal Data.
The recipients of personal data may be entities with which the Administrator cooperates under concluded entrustment agreements, including an IT company, accounting office, and entities to which the Administrator is obliged to provide personal data under the applicable law;
Transfer of Data outside the European Economic Area.
Personal data will not be transferred to international organizations or third countries outside the European Economic Area.
Period of Personal Data Storage.
Depending on the purpose of data processing, they will be stored for a period:
- required by law under separate regulations, including tax, accounting, relating to the storage of personal files and payroll documents;
- necessary to secure potential claims – until the expiry of their limitation period;
- in the case of consent, for the period for which this consent was given or until its withdrawal;
- in the case of monitoring – for a period of up to 3 months or until the end of the proceedings in the event that the recording from the monitoring serves as evidence in the proceedings.
- in the case of recruitment, until the end of the recruitment process or the end of the period for which consent was given for future recruitments;
Automated Decision Making.
Personal data will not be processed in an automated manner for the purpose of decision making, including profiling.
Rights of Data Subjects.
Data subjects have the right to request from the Administrator:
- access to the content of their data;
- rectification of data;
- erasure of data (if they are no longer necessary for the purposes for which they were collected, and the Administrator has no legal basis for their processing);
- restriction of processing;
Data subjects also have the right to:
- data portability;
- object to processing;
- withdraw consent at any time; however, this does not affect the lawfulness of processing based on consent before its withdrawal;
- lodge a complaint with the supervisory authority (President of the Office for Personal Data Protection) if this person believes that the processing of personal data concerning him/her violates the provisions of the general regulation on data protection of 27 April 2016;
Providing Personal Data by the Data Subject.
Providing personal data, the obligation to provide which is regulated by legal provisions, is mandatory. In other cases, it is voluntary, although failure to provide them may prevent contact with the person, transfer of information, as well as commencement of actions aimed at concluding an agreement.