INFORMATION NOTE
INFORMATION ON DATA CONTROLLER AND RIGHTS OF PERSONS WHOSE PERSONAL DATA ARE BEING PROCESSED
pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), please be informed of the following:
1. PERSONAL DATA CONTROLLER
The personal data controller is:
ALUMETAL S.A. with its registered office in Kęty at ul. Kościuszki 111, 32-650 Kęty, registered in the Business Register of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS No.: 0000177577, Tax Identification Number (NIP): 5492040001, Statistical Number (REGON): 357081298;
The Controller can be reached by a letter sent to the following address: ul. Kościuszki 111, 32-650 Kęty or by e-mail: info.rodo@alumetal.pl;
2. GROUNDS FOR AND PURPOSE OF DATA PROCESSING
Data will be processed: (i) for the purpose of performing a contract (Article 6 paragraph 1 point b of the GDPR); (ii) within the scope of legitimate interests pursued by Alumetal S.A. or third parties (Article 6 paragraph 1 point f of the GDPR) – in the case of contacting the data subject in matters unrelated to a binding contract, taking any and all steps aimed at entering into a contract and/or other types of cooperation, ensuring the security of persons and property, as well as in other justified cases; (iii) where it is necessary to fulfil a legal obligation (Article 6 paragraph 1 point c of the GDPR) – for the purpose of enabling correct settlements and enforcement of due amounts, handling requests of data subjects, and in other cases envisaged by legal regulations; (iv) based on the data subject’s consent (Article 6 paragraph 1 point a of the GDPR) – with respect to newsletter recipients and job applicants;
An information note for anyone interested in the recruitment process is available at [link]
3. PERSONAL DATA PROCESSING PERIOD
The period for which data are processed depends on the grounds for and purpose of their processing.
The data processing period may thus result from applicable legal regulations if the processing is based on such regulations. If the data are processed on the grounds of:
- Legitimate interest of the Controller – the data are processed for a period allowing for such interest to be pursued or until an effective objection to data processing is made.
- Consent – the data are processed until such consent is withdrawn.
- Necessity in the context of the conclusion and performance of a contract – the data are processed until the contract is dissolved.
The data processing periods indicated above may be extended where processing is necessary for the establishment, exercise, or defence of legal claims. Once the processing period elapses, the data are irretrievably deleted or rendered anonymous.
4. PERSONAL DATA SHARING
Data may be made available to entities and authorities authorised to process such data under legal regulations. Data may be made available to third parties in the form of other entities from the capital group of Alumetal S.A., technical and organisational service providers (e.g., IT service providers), as well as legal and advisory service providers, with the stipulation that such entities process data based on a contract concluded with the Controller and on the Controller’s instructions.
5. PROFILING
Personal data will not be subject to automated processing for decision-making purposes, including profiling.
6. TRANSFER OF PERSONAL DATA OUTSIDE EEA
Data may be transferred to a third country situated outside the EEA for the purposes of servicing the software used by the Controller. The transfer will occur in accordance with applicable regulations regarding personal data protection based on the standard contractual clauses adopted by the European Commission.
7. DATA SUBJECT RIGHTS
In connection with personal data processing, data subjects are entitled to (accordingly):
- request from the Controller access to the personal data being processed,
- request from the Controller rectification of the personal data being processed,
- request from the Controller erasure of the personal data being processed,
- request from the Controller restriction of personal data processing,
- object to personal data processing,
- exercise the right to data portability,
- withdraw consent to personal data processing, with the stipulation that such withdrawal of consent does not affect the lawfulness of the processing performed based on such consent prior to its withdrawal,
- lodge a complaint with a supervisory authority (President of the Personal Data Protection Office).
8. DATA SOURCE
If personal data were obtained by us from entities other than the data subject, it means that we procured the data from our counterparties, social media, the Internet, or other publicly available sources.