Personal data administrator
The administrator of the personal data concerned by this information is Łukasiewicz Research Network – ITECH Institute of Innovation and Technology based in Warsaw (00-879), ul. Żelazna 87, entered into the register of entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under number 0000098349 (“Administrator”). Regarding the processing of personal data, you can contact the Administrator at the address indicated above or via e-mail at the following e-mail address: rodo@itech.lukasiewicz.gov.pl .
You can also contact the Data Protection Inspector appointed by the Administrator at this address.
This information sets out the rules for the processing of the following personal data by the Administrator:
a) personal data of persons who contact the Administrator by telephone, e-mail or traditional correspondence in any matter and are not job or cooperation candidates, clients, contractors of the Administrator or their contact persons;
b) personal data of candidates for work or cooperation with the Administrator taking part in recruitment processes or submitting applications regardless of the recruitment process;
c) personal data provided to the Administrator during meetings, conferences (e.g. in the form of business cards);
d) personal data of employees and persons representing the Administrator’s contractors and clients.
The Administrator collects and processes personal data in connection with its business activities and processes it in accordance with the provisions of law, including the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of data personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).
The principles of processing personal data by the Administrator in connection with concluded contracts are provided to data subjects separately when concluding the contract.
Purposes and legal basis for data processing
1. Personal data of persons who contact the Administrator by telephone, e-mail or traditional correspondence, provided during a telephone conversation or included in this correspondence, and who are not job or cooperation candidates, clients, contractors of the Administrator or their contact persons , are processed solely for the purpose of conducting this conversation or correspondence and resolving the matter that is the subject of the conversation or correspondence or, respectively, in order to establish or maintain cooperation and relationships within the framework of running a business, which constitutes the legitimate interest of the Administrator and the legal basis for this processing (Article 6(1) .1 letter f GDPR).
2. Personal data of candidates for work or cooperation with the Administrator taking part in recruitment processes or submitting their applications to the Administrator, regardless of the recruitment process, are processed in order to conduct the recruitment process, assess candidates, their abilities and qualifications and select the candidate or candidates for work or cooperation. If a given candidate expresses separate consent, the data will also be processed in order to invite such a candidate to participate in future recruitment processes and carry out these processes with his or her participation. Detailed information on the processing of job candidates’ personal data is provided to candidates during the recruitment process.
3. Personal data provided to the Administrator during meetings, conferences (e.g. in the form of business cards) are processed in order to build a network of business and professional contacts and the possibility of staying in contact with the data subject, which constitutes the legitimate interest of the Administrator and the legal basis for this processing (Article 6(1)(f) of the GDPR).4. Personal data of employees or persons representing the Administrator’s contractors and clients are processed in order to contact contractors and clients through them in connection with current matters regarding, among others, the performance of contracts between the Administrator and the contractor or client, implementation of cooperation, receiving and placing orders and responding to to questions about what constitutes the legitimate interest of the Administrator and the legal basis for this processing (Article 6(1)(f) of the GDPR), as well as it is necessary for the conclusion and implementation of the contract pursuant to Art. 6 section 1 letter b GDPR.5. Personal data of persons participating in specific projects implemented by the Administrator are processed for the purpose of implementing these projects, which constitutes the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR), which may also be done as part of the public interest indicated in Act on the Łukasiewicz Network, in accordance with Art. 6 section 1 letter e GDPR.
2. Any consent to the processing of data by the Administrator may be withdrawn at any time, which, however, does not affect the lawfulness of the processing carried out before the consent was withdrawn.
III. Recipients of personal data
1. The recipients of personal data will only be institutions and bodies authorized to obtain data under applicable law. In addition, personal data processed by the Administrator may be disclosed to external entities providing services to the Administrator on the basis of contracts concluded with him. These may include, among others: entities providing accounting, legal or IT services, marketing agencies, insurers, couriers or suppliers of software used by the Administrator in its current operations.
2. Personal data processed by the Administrator may exceptionally, and only to the extent necessary, be transferred to the Administrator’s partners processing them outside the European Economic Area, e.g. in connection with the provision of IT services by these entities to the Administrator, including in the cloud. The security of personal data is ensured by appropriate security measures applied by the Administrator, including: standard contractual clauses approved by the European Commission.
3. Decisions will not be made based on automated processing of personal data.
Personal data processing period
1. Personal data processed by the Administrator in connection with contacting the Administrator of data subjects by telephone, e-mail or by traditional correspondence in any matter are processed for the duration of the legally justified interest of the Administrator, i.e. until the matter is resolved. applies to a telephone conversation or correspondence or for the duration of cooperation.
2. Personal data provided to the Administrator during meetings and conferences (e.g. in the form of business cards) are processed for the duration of the legitimate interest of the Administrator which is the basis for this processing.
3. Personal data of employees and persons representing the Administrator’s contractors and clients provided to the Administrator are processed for the duration of the Administrator’s legitimate interest which is the basis for this processing (e.g. for the duration of the contract the performance of which is related to the processing of these personal data) and then until the expiry of the limitation period for claims. related to the contract relating to the processing of this data.
4. In the case of personal data processed on the basis of consent, the Administrator will also cease processing them if the data subject withdraws his or her consent to their processing.
5. Personal data processed on the basis of the legitimate legal interest of the Administrator will cease to be processed after the data subject objects to the processing, if the law allows it or the Administrator’s interest does not override the interest of the person expressing the objection.
Rights of data subjects
1. Persons affected by personal data processed by the Administrator have the following rights:
a. the right to receive information about personal data being processed, access it and obtain a copy thereof;
b. the right to request the rectification of personal data that is false or incomplete;
c. the right to request the deletion of data, e.g. if it is no longer necessary for the purposes for which it was collected or if the data subject has withdrawn consent to processing;
d. the right to request restriction of processing, e.g. if the accuracy of the data is questioned, for a period enabling the Administrator to check its correctness;
e. the right to object at any time to the processing of data by the Administrator pursuant to Art. 6 section 1 letter f or letter e GDPR;
f. the right to transfer data, i.e. to receive this personal data in a structured, commonly used, machine-readable format and to request that these personal data be sent to another administrator, if technically possible; this right applies only to data processed on the basis of consent or contract and only to the extent that these data are processed in a fully automated manner;
g. the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office.
2. Moreover, in the case of data processing based on the consent of the data subject, such a person has the right to withdraw his/her consent at any time, which, however, does not affect the lawfulness of the processing carried out before its withdrawal.
3. To exercise their rights, the data subject should contact the Administrator. Contact details are provided in point 1 of this information.
Source of personal data
1. The administrator most often receives personal data directly from the data subject.
2. In the case of some data subjects, e.g. employees or persons representing the Administrator’s contractors and clients, personal data was obtained directly from these persons or from the entities they represent, e.g. from their employers, entities to which they provide services or from with whom they cooperate in a different way. The scope of this data most often includes name, surname, telephone number, e-mail address, position, place of work and information about the scope of duties or activities performed for the contractor or client.
VII. Information on the freedom or obligation to provide data
Providing personal data referred to in this information is voluntary, however, their provision and processing is necessary to achieve the purposes for which the data are processed. Failure to provide data may result in the Administrator being unable to take specific actions for the data subject. Providing personal data processed on the basis of consent is always voluntary and failure to provide it does not result in any negative consequences.
VIII. Changes and updating of information
This information is constantly verified and updated by the Administrator. Any changes will be published on the Administrator’s website itech.lukasiewicz.gov.pl.