TERMS OF PROCESSING PERSONAL DATA
Applies to:
- the counterparty (customer, supplier) being a natural person;
- representatives of the counterparty, including designated contact persons.
In order to comply with our obligations under the Regulation of the European Parliament and of the Council (EU) 2016/679 from April 27, 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), in short: “GDPR”, we provide the following information:
Who is the administrator of your personal data?
The Administrator of your personal data is Hmmh Poland sp. z o.o. with its registered office in Wrocław at Kazimierza Michalczyka 5/II p., 53-633 Wrocław, entered into the Register of Entrepreneurs of the National Court Register under the number 0000879523, holding the tax identification number NIP 8971888096 (in short: “Administrator”). The Administrator has appointed a Data Protection Inspector.
You can contact the Administrator on matters concerning your personal data, including for the purpose of enforcing your rights:
• by sending correspondence to the following address: Kazimierza Michalczyka 5/II p., 53-633 Wrocław;
• by writing to the address of the Data Protection Inspector: iod@hmmh.pl
Which sources does your personal data come from?
We obtain personal data directly from you. If you are acting on behalf of our contractor, your data is provided to us by the entity you represent.
We may also obtain information about you from publicly available sources, such as the electronic list of VAT entities maintained by the Head of the National Tax Administration (in order to check whether you are on the list and to confirm your data), the National Court Register (in order to confirm representation and to verify data), the Central Register and Information on Business Activity (in order to verify data).
What information about you do we process?
In the case of our contractors (natural persons), we process the following personal data: name, surname, address, company, VAT number, bank account number, bank name, information related to the conclusion and execution of the contract (including contractual terms and conditions, correspondence) billing data (data from invoices, bills, amount of remuneration), information on payments and overdue payments, information on the designations used in the systems used by us.
In the case of representatives of our contractors, we process the following personal data: name, position, function, entity represented, business contact details, information contained in correspondence, and information relating to the conclusion and performance of the contract with our contractor.
Do you have to give us your personal information?
The provision of data is necessary for the conclusion and performance of the contract, as well as in the case of a contract with our contractor. Failure to provide data or the provision of incorrect data may prevent the conclusion of the contract and its proper execution.
For what purpose and on what basis do we process your data?
Your personal data will be processed for:
• conclude and perform the contract (legal basis: article 6(1)(b) GDPR – in case you are a party to the contract);•- conclude and perform the contract (legal basis: Article 6(1)(b) GDPR – in case you are a party to the contract);
• entering into and executing a contract with our contractor, which is our legitimate interest (legal basis: Article 6(1)(f) GDPR where you are not a party to the contract but are acting on behalf of our contractor);
• to comply with our legal obligations, e.g. accounting and taxation (legal basis: Article 6(1)(c) GDPR);
• the fulfillment of our legitimate interest in the form of: establishing and asserting claims, defending against claims, ensuring the organization of work and the flow of information within our group of companies, fulfilling reporting obligations (e.g. to our shareholders), performing services for our group of companies, maintaining business relationships, verifying the reliability of the counterparty (legal basis: Article 6(1)(f) GDPR).
Who do we share your data with?
We will share your personal data with entities providing services to us in connection with the conclusion and performance of a contract (e.g. IT services, legal services, consulting, banks); our shareholders/shareholders; companies in our group affected by a contract concluded with the entity you represent. In addition, where necessary, your personal data may be shared with audit firms and other entities providing services to us in connection with obligations imposed by law.
Your personal data may be transferred to a recipient in a third country (i.e. outside the European Economic Area, or “EEA” for short), due to the use of third-party providers’ IT solutions (e.g. cloud and email services provided by Google Google Ireland Limited, Barrow St, Dublin 4, Ireland, or other communicators, among others). Where providers receive personal data outside the EEA or transfer personal data outside the EEA, then the transfer is based on the safeguards set out in Chapter V of the GDPR, in the form of, inter alia, standard contractual clauses, European Commission Decisions.
How long will we be processing your data?
Your personal data will be processed for the time necessary for the conclusion and performance of the contract and for archiving purposes, but no longer than 6 years from the end of the calendar year of the performance of the contract, unless otherwise provided by the relevant law. Due to tax and accounting regulations, your personal data will be stored for 6 years. For the purpose of establishing and asserting claims or defending against claims, your data will be stored until the statute of limitations for claims or the conclusion of proceedings. In the event of proceedings by public authorities, your personal data will be stored until the proceedings are concluded.
What rights do you have?
You are entitled to:
a. access your personal data and receive a copy of the personal data we process;
b. to have your personal data rectified or completed;
c. request the erasure of your data (i.e. the right to be forgotten) in the circumstances provided for in Article 17 of the GDPR;
d. request the restriction of the processing of your personal data in the cases indicated in Article 18 GDPR;
e. to object to the processing of your personal data in the cases indicated in Article 21 GDPR;
f. lodge a complaint to the President of the Office for Personal Data Protection, to the address: ul. Stawki 2, Warsaw.
