Information on the processing of personal data of the Contractor and persons representing the Contractor (employees, associates)

The controller of your personal data, therefore the entity determining the purposes and means of processing your data, is Polskie Centrum Bada? i Certyfikacji S.A. (POLISH CENTRE FOR TESTING AND CERTIFICATION) (hereinafter referred to as ?we? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw.

How can you contact us?

You may contact us by post at the registered office address: :  Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl.

In matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at 535 999 739 or by e-mail at iod@pcbc.gov.pl.

For what purposes and on what legal basis do we process your data?

1. For the purpose of taking steps to conclude or to perform contracts, where you are a party to such a contract (applies to natural persons who are parties to a contract), on the basis of Article 6(1)(b) of the GDPR;
2. If you are a representative or associate of an entity with which we cooperate, your personal data are processed on the basis of Article 6(1)(f) of the GDPR, where the legitimate interest consists in the proper performance of the contract binding us with your employer/principal and maintaining contact in connection with the cooperation. In such a case, if you do not contact us directly, your data may have been provided to us by the entity you represent or with which you cooperate;
3. To enable e-mail communication with us (our employees and associates), to initiate contact with recipients, and to document arrangements made with contractors via electronic correspondence, on the basis of Article 6(1)(f) of the GDPR, where our legitimate interest consists in conducting correspondence and being able to demonstrate arrangements made in the course of such correspondence;
4. To document concluded contracts and to settle them, on the basis of tax law provisions and the Accounting Act (including Articles 21 and 74(1) of the Accounting Act). Our organisation is also obliged to maintain archival documentation in paper form in order to document correspondence conducted with the Contractor and, in this respect, is subject to the provisions of the Act on the National Archival Resource and Archives. To the extent that legal provisions oblige us to process personal data, the legal basis for processing your data is Article 6(1)(c) of the GDPR;
5. For purposes related to internal organisational and administrative activities aimed at ensuring the efficient functioning of our organisation, on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR;
6. For the purposes of establishing, pursuing or defending claims, constituting the implementation of our legitimate interest, as well as for archival purposes, on the basis of Article 6(1)(f) of the GDPR.

We inform you that providing personal data is voluntary; however, it is necessary for the exchange of correspondence and the performance of the contract. Failure to provide data will result in the inability to conduct electronic communication and to conclude a contract. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to other recipients entrusted with the processing of personal data on our behalf and for our benefit, including entities providing IT services, financial controlling services, and archival services. Your personal data may also be disclosed to law firms providing legal assistance to us or made available for inspection to verification entities such as certification bodies or statutory auditors. Your data will also be disclosed to authorised public administration authorities.

Your personal data will not be transferred to third countries or international organisations.

How long will we process your personal data?

Your personal data will be processed for the duration of the contract binding the parties, for the period necessary to pursue any potential claims, i.e. 3 years from the date of termination of the contract, as well as for archival and accounting purposes specified in separate legal provisions, such as tax law and the Accounting Act (in the case of accounting documents ? for a period of 6 years). In the case of archival documentation, data are processed for a period of 10 years from the end of the year in which the paper documentation was transferred to the archive.

What rights do you have?

By contacting our Data Protection Officer at the e-mail address: iod@pcbc.gov.pl, you may exercise the following rights:

1. the right to access your personal data and to obtain a copy of the personal data being processed;
2. the right to rectify inaccurate personal data;
3. the right to request erasure of data (the right to be forgotten) in the circumstances provided for in Article 17 of the GDPR. In some cases, we may refuse to erase data if their processing remains necessary, e.g. to comply with a legal obligation, to establish, pursue or defend claims, to exercise the right to freedom of expression and information, or for reasons of public interest, such as archival, research or statistical purposes;
4. the right to request restriction of processing in the cases indicated in Article 18 of the GDPR;
5. the right to object to the processing of data in the cases indicated in Article 21 of the GDPR;
6. the right to data portability of data provided by you and processed by automated means, where the legal basis for processing is consent or the performance of a contract;
7. the right to lodge a complaint ? you have the right to lodge a complaint with the President of the Personal Data Protection Office (For citizens - UODO) if you consider that the processing of your personal data infringes the provisions of the GDPR.

Information on the Processing of Personal Data of Clients and Persons Representing the Client (employees, associates)

The controller of your personal data, therefore the entity determining the purposes and means of processing your data, is Polskie Centrum Bada? i Certyfikacji S.A. (POLISH CENTRE FOR TESTING AND CERTIFICATION) (hereinafter referred to as ?we? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw

How can you contact us?

You may contact us by post at the registered office address:  Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl.

In matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at 535 999 739 or by e-mail at iod@pcbc.gov.pl.

For what purposes and on what legal basis do we process your data?

1. For the purpose of taking steps prior to entering into a contract or performing a contract to which you are a party (applies to natural persons being parties to a contract), pursuant to Article 6(1)(b) GDPR;
2. If you act as a representative or associate of an entity with which we cooperate, your data are processed on the basis of Article 6(1)(f) GDPR, where the legitimate interest pursued is the proper performance of the contract between us and your employer or principal, as well as ensuring contact regarding cooperation. In such a case, if you do not contact us directly, your data may have been provided to us by the entity you represent or cooperate with, or obtained during the performance of services by PCBC
3. To enable the exchange of e-mail correspondence (with our employees and associates), initiate contact with addressees, and document arrangements made with contractors via e-mail, pursuant to Article 6(1)(f) GDPR, where the legitimate interest pursued consists in maintaining correspondence and being able to demonstrate arrangements made during such correspondence;
4. For the purpose of documenting contracts and settling them in accordance with tax law and the Accounting Act (including Articles 21 and 74(1) of the Accounting Act). Our organisation is also legally obliged to keep certain documentation in paper form for archival purposes in order to document correspondence with Clients and is subject in this respect to regulations concerning the national archival resource and archives. Where processing is required by law, the legal basis is Article 6(1)(c) GDPR;
5. For internal organisational and administrative purposes aimed at ensuring the efficient functioning of our organisation, on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR;
6. For the establishment, exercise or defence of claims, which constitutes our legitimate interest, and for archival purposes, pursuant to Article 6(1)(f) GDPR.
7. We inform you that providing personal data is voluntary but necessary for the exchange of correspondence and the performance of a contract. Failure to provide such data will result in the inability to conduct electronic communication and conclude a contract. Personal data are not subject to profiling.

Who will we share your personal data with?

We may disclose your personal data to other recipients entrusted with processing personal data on our behalf, including entities providing IT support services, financial controlling services, and archival services. Your personal data may also be made available to law firms providing legal assistance to us or made available for review to verification bodies such as certification bodies or statutory auditors. Your data will also be made available to authorised public administration authorities.

Your data will not be transferred to third countries or international organisations.

How long will we process your personal data?

Your personal data will be processed for the duration of the contract concluded between the parties, for the period of pursuing possible claims, i.e. 3 years from the date of termination of the contract, as well as for archival and settlement purposes specified in specific regulations such as tax law and the Accounting Act (in the case of accounting documents for a period of 6 years). With regard to archival documentation, data are processed for a period of 10 years from the end of the year in which the paper documentation was transferred to the archive.

What rights do you have?

By contacting our Data Protection Officer at the e-mail address: iod@pcbc.gov.pl, you may exercise the following rights:

1. the right to access your personal data and obtain a copy of the data undergoing processing;
2. the right to rectify inaccurate personal data;
3. the right to request erasure of data (?right to be forgotten?) in the circumstances set out in Article 17 GDPR. In some cases, we may refuse erasure if the data remain necessary, e.g. to comply with a legal obligation, establish, exercise or defend claims, exercise the right to freedom of expression and information, or for reasons of public interest, e.g. for archiving, research or statistical purposes;
4. the right to request restriction of processing in the cases referred to in Article 18 GDPR;
5. the right to object to processing in the situations referred to in Article 21 GDPR;
6. the right to data portability with respect to data provided by you, processed by automated means, where the legal basis for such processing is consent or performance of a contract;
7. the right to lodge a complaint with the President of the Personal Data Protection Office (Moniuszki street 1A, 00-014 Warsaw, https://uodo.gov.pl/pl/p/dla-obywatela) if you consider that the processing of your personal data infringes the GDPR.

Information clause for a potential Client and their representatives (employees and collaborators)

The controller of your personal data, i.e. the entity determining the purposes and means of processing your personal data, is Polskie Centrum Bada? i Certyfikacji S.A. (hereinafter referred to as ?We? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw.

How can you contact us?

By post to the registered office address: Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl, or by phone at +48 22 464 52 00.

For matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at +48 535 999 739 or by e-mail: iod@pcbc.gov.pl.

For what purpose and on what legal basis do we process your data?

? if you are the applicant, your personal data provided in the application submitted to PCBC will be treated as data necessary to prepare an offer for concluding a contract for verification/assessment/certification/extension of certificate validity, and providing them is required in order to determine and verify your identity and thus document the contract concluded in writing, on the basis of Article 6(1)(b) of the GDPR;

? if you are a person representing the applicant indicated in the introductory part of the application, your data will be processed in order to determine and verify your authorization to represent that entity (Article 6(1)(f) of the GDPR);

? if you are a person designated by the applicant for contact in connection with the submitted application, your data will be processed in order to properly examine the application and ensure ongoing contact during its consideration, on the basis of our legitimate interests consisting in the proper organization and communication within the application and offer preparation process, pursuant to Article 6(1)(f) of the GDPR;

? for the possible establishment, investigation or defence of claims arising from PCBC?s business activity, on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR;

? in order to fulfil archival obligations imposed on us, the legal basis for processing your data is Article 6(1)(c) of the GDPR.

Please note that the provision of personal data is voluntary but necessary for further processing of the application. Failure to provide the data will result in the inability to consider the application and proceed with further cooperation. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to entities that process personal data on our behalf and on our instructions, including entities providing IT services, financial controlling services and archival services to us.

Your personal data may also be disclosed to law firms providing legal assistance to us or made available for inspection to verification entities such as certification bodies or statutory auditors.

Your data will also be disclosed to authorized public administration authorities.

Your data will not be transferred to third countries or international organizations.

How long will we process your personal data?

Your personal data will be processed for the duration of the contract binding the parties, for the period necessary to pursue potential claims, i.e. 3 years from the date of termination of the contract, as well as for archival and accounting purposes required by specific legal provisions such as tax law regulations and the Accounting Act (in the case of accounting documents ? 6 years).

In the case of archival documentation, data are processed for 10 years from the end of the year in which the paper documentation was transferred to the archive.

What rights do you have?

By contacting our Data Protection Officer at iod@pcbc.gov.pl, you may exercise the following rights:

? the right of access to your personal data and to receive a copy of the personal data being processed;

? the right to rectification of inaccurate personal data;

? the right to request the erasure of data (right to be forgotten) in the circumstances provided for in Article 17 of the GDPR. In certain cases we may refuse to erase data if their processing is still necessary, for example to comply with a legal obligation, to establish, pursue or defend legal claims, to exercise the right to freedom of expression and information, or for reasons of public interest such as archival, research or statistical purposes;

? the right to request the restriction of processing in the cases specified in Article 18 of the GDPR;

? the right to object to the processing of data in the cases indicated in Article 21 of the GDPR;

? the right to data portability with regard to the data you have provided, processed by automated means, where the legal basis for processing is consent or the performance of a contract;

? the right to lodge a complaint with the President of the Personal Data Protection Office (For citizens - UODO) if you believe that the processing of your personal data violates the provisions of the GDPR.

Information clause for a potential Client and their representatives (employees and collaborators)

The controller of your personal data, i.e. the entity determining the purposes and means of processing your personal data, is Polskie Centrum Bada? i Certyfikacji S.A. (hereinafter referred to as ?We? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw.

How can you contact us?

By post to the registered office address: Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl, or by phone at 22 464 52 00.

For matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at 535 999 739 or by e-mail: iod@pcbc.gov.pl.

For what purpose and on what legal basis do we process your data?

? If you are the applicant, your personal data provided in the application submitted to PCBC will be treated as data necessary to prepare an offer for concluding a contract for verification/assessment/certification/extension of certificate validity, and providing them is required in order to determine and verify your identity and thus document the contract concluded in writing, on the basis of Article 6(1)(b) of the GDPR;

? If you are a person representing the applicant indicated in the introductory part of the application, your data will be processed in order to determine and verify your authorization to represent that entity (Article 6(1)(f) of the GDPR);

? If you are a person designated by the applicant for contact in connection with the submitted application, your data will be processed in order to properly examine the application and ensure ongoing contact during its consideration, on the basis of our legitimate interests consisting in the proper organization and communication within the application and offer preparation process, pursuant to Article 6(1)(f) of the GDPR;

? For the possible establishment, investigation or defence of claims arising from PCBC?s business activity, on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR;

? In order to fulfil archival obligations imposed on us, the legal basis for processing your data is Article 6(1)(c) of the GDPR.

Please note that the provision of personal data is voluntary but necessary for further processing of the application. Failure to provide the data will result in the inability to consider the application and proceed with further cooperation. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to entities that process personal data on our behalf and on our instructions, including entities providing IT services, financial controlling services and archival services to us.

Your personal data may also be disclosed to law firms providing legal assistance to us or made available for inspection to verification entities such as certification bodies or statutory auditors.

Your data will also be disclosed to authorized public administration authorities.

Your data will not be transferred to third countries or international organizations.

How long will we process your personal data?

Your personal data will be processed for the duration of the contract binding the parties, for the period necessary to pursue potential claims, i.e. 3 years from the date of termination of the contract, as well as for archival and accounting purposes required by specific legal provisions such as tax law regulations and the Accounting Act (in the case of accounting documents ? 6 years).

In the case of archival documentation, data are processed for 10 years from the end of the year in which the paper documentation was transferred to the archive.

What rights do you have?

By contacting our Data Protection Officer at iod@pcbc.gov.pl, you may exercise the following rights:

? the right of access to your personal data and to receive a copy of the personal data being processed;

? the right to rectification of inaccurate personal data;

? the right to request the erasure of data (right to be forgotten) in the circumstances provided for in Article 17 of the GDPR. In certain cases we may refuse to erase data if their processing is still necessary, for example to comply with a legal obligation, to establish, pursue or defend legal claims, to exercise the right to freedom of expression and information, or for reasons of public interest such as archival, research or statistical purposes;

? the right to request the restriction of processing in the cases specified in Article 18 of the GDPR;

? the right to object to the processing of data in the cases indicated in Article 21 of the GDPR;

? the right to data portability with regard to the data you have provided, processed by automated means, where the legal basis for processing is consent or the performance of a contract;

? the right to lodge a complaint with the President of the Personal Data Protection Office (For citizens - UODO) if you believe that the processing of your personal data violates the provisions of the GDPR.

Information on the Processing of Personal Data for B2B Contractors

The controller of your personal data, i.e. the entity determining the purposes and means of processing your personal data, is Polskie Centrum Bada? i Certyfikacji S.A. (hereinafter referred to as ?we? or ?PCBC?) with its registered office at 469 Pu?awska Street, 02-844 Warsaw.

How can you contact us?

By post to the registered office address: 469 Pu?awska Street, 02-844 Warsaw, by email at pcbc@pcbc.gov.pl, or by phone at +48 22 464 52 00.

In matters related to the processing of your data, you may contact our Data Protection Officer by phone at +48 535 999 739 or by email at iod@pcbc.gov.pl.

For what purposes and on what legal basis do we process your data?

1. For the purpose of taking steps to conclude or perform contracts, if you are a party to such a contract, pursuant to Article 6(1)(b) GDPR;
2. For the purpose of cooperation and communication, your data is processed pursuant to Article 6(1)(f) GDPR, where the legitimate interest is the proper performance of the contract binding us with you, conducting correspondence, and the possibility of demonstrating arrangements made during such correspondence.
3. For the purpose of documenting concluded contracts and their settlement, on the basis of tax law provisions and the Accounting Act (including Articles 21 and 74(1) of the Accounting Act). To the extent that legal provisions oblige us to process data, the legal basis for processing is Article 6(1)(c) GDPR.
4. For purposes related to internal organisational and administrative activities ensuring the efficient functioning of our organisation, such as granting access to our IT systems, organising audit, certification and verification processes, on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR.
5. For the establishment, exercise or defence of claims constituting our legitimate interest, and for archival purposes, pursuant to Article 6(1)(f) GDPR.

We inform you that providing personal data is voluntary; however, it is necessary for correspondence and contract performance. Failure to provide data will result in the inability to conclude a contract and carry out cooperation. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to other recipients entrusted with the processing of personal data on our behalf and for our benefit, including entities providing IT support services, financial controlling services, and archival services. Your personal data may also be disclosed to law firms providing legal assistance to us or made available for inspection to verification entities such as certification bodies or statutory auditors. Your data will also be disclosed to authorised public administration authorities.

How long will we process your personal data?

Your personal data will be stored for the duration of the agreement concluded with us. After this period, for evidentiary purposes and for documenting compliance with legal obligations, the documentation will be retained for a period of 6 years from the end of the year in which the cooperation was terminated.

What rights do you have?

By contacting our Data Protection Officer at iod@pcbc.gov.pl, you may exercise your rights, including:

? the right of access to your personal data and to obtain a copy of the personal data being processed;

? the right to rectify inaccurate personal data;

? the right to request erasure of data (the right to be forgotten) in the circumstances provided for in Article 17 GDPR. In some cases, we may refuse erasure where processing remains necessary, e.g. for compliance with a legal obligation, the establishment, exercise or defence of claims, the exercise of the right to freedom of expression and information, or for reasons of public interest, such as archival, research or statistical purposes;

? the right to request restriction of processing in the cases indicated in Article 18 GDPR;

? the right to object to processing in the cases indicated in Article 21 GDPR;

? the right to data portability of data provided and processed by automated means, where the legal basis for processing is consent or performance of a contract;

? the right to lodge a complaint with the President of the Personal Data Protection Office when you believe that the processing of your personal data violates GDPR provisions.

Information on the processing of personal data of recruitment participants

The controller of your personal data, i.e. the entity determining the purposes and means of processing your personal data, is Polskie Centrum Bada? i Certyfikacji S.A. (hereinafter referred to as ?We? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw.

How can you contact us?

By post to the registered office address: Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl, or by phone at 22 464 52 00.

For matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at 535 999 739 or by e-mail: iod@pcbc.gov.pl.

For what purpose and on what legal basis do we process your data?

? If you are a candidate applying for employment under an employment contract, your personal data will be processed in order to conduct the recruitment process and to take steps to conclude or perform a contract, on the basis of Article 6(1)(b) of the GDPR and Article 6(1)(c) of the GDPR in connection with the provisions of the Polish Labour Code (Article 22(1) §1 and §2).

? If you are a candidate applying for cooperation under a mandate contract, contract for specific work, or B2B cooperation, your personal data will be processed for the purpose of conducting the recruitment process and taking steps to conclude or perform a contract, on the basis of Article 6(1)(b) of the GDPR and Article 6(1)(f) of the GDPR.

? Data concerning your qualifications, education and professional experience will be processed in order to verify candidates and select those with the appropriate competencies to perform work of a given type or in a specific position, as necessary for concluding a contract in accordance with Article 6(1)(b) of the GDPR.

? For the purpose of cooperation and communication, your data are processed on the basis of Article 6(1)(f) of the GDPR, where the legitimate interest consists in maintaining contact regarding the recruitment process, conducting correspondence and documenting arrangements made in the course of such correspondence.

? For the establishment, investigation or defence against claims, as well as for archival purposes, on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR.

? Additionally, we may process your data on the basis of Article 6(1)(f) of the GDPR, where the legitimate interest of the controller consists in protection against potential claims arising from Article 123 of the Act of 20 April 2004 on the Promotion of Employment and Labour Market Institutions (applies only to recruitment for employment contracts).

? If you consent to the processing of your personal data for the purposes of future recruitment processes, the legal basis for processing is your consent, i.e. Article 6(1)(a) of the GDPR. You have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

? If you provide additional personal data that are not required under the Labour Code or other legal provisions and are not necessary for the conclusion of a contract or recruitment process (e.g. your image, interests), the legal basis for processing such data is your consent pursuant to Article 6(1)(a) of the GDPR. Providing such additional information will be treated as consent to their processing. If you do not wish us to process such additional data, please do not include them in your application documents.

Please note that providing personal data is voluntary but necessary in order to participate in the recruitment process. Failure to provide the data will result in the inability to conclude a contract and establish cooperation. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to entities processing personal data on our behalf and on our instructions, including entities providing IT services and archival services to us.

Your personal data may also be disclosed to law firms providing legal assistance to us.

Your data may also be disclosed to authorized public administration authorities.

How long will we process your personal data?

We will process your personal data for purposes related to the recruitment process until the end of the recruitment procedure in which you participate, and for archival purposes, but not longer than 1 year from the completion of the recruitment process.

If you consent to the processing of your personal data for future recruitment processes, your data will be processed until the withdrawal of consent, but no longer than 5 years from the date the consent was given.

What rights do you have?

By contacting our Data Protection Officer at iod@pcbc.gov.pl, you may exercise the following rights:

? the right to withdraw your consent to data processing;

? the right of access to your personal data and to receive a copy of the personal data being processed;

? the right to rectification of inaccurate personal data;

? the right to request the erasure of data (right to be forgotten) in the circumstances provided for in Article 17 of the GDPR. In certain cases we may refuse to erase data if their processing is still necessary, for example to comply with a legal obligation, to establish, pursue or defend legal claims, to exercise the right to freedom of expression and information, or for reasons of public interest such as archival, research or statistical purposes;

? the right to request the restriction of processing in the cases specified in Article 18 of the GDPR;

? the right to object to the processing of data in the cases indicated in Article 21 of the GDPR;

? the right to data portability with regard to the data you have provided, processed by automated means, where the legal basis for processing is consent or the performance of a contract;

? the right to lodge a complaint with the President of the Personal Data Protection Office (For citizens - UODO) if you believe that the processing of your personal data violates the provisions of the GDPR.

The controller of your personal data, i.e. the entity determining the purposes and means of processing your personal data, is Polskie Centrum Bada? i Certyfikacji S.A. (hereinafter referred to as ?We? or ?PCBC?), with its registered office at Pu?awska Street 469, 02-844 Warsaw.

How can you contact us?

By post to the registered office address: Pu?awska Street 469, 02-844 Warsaw, by e-mail at pcbc@pcbc.gov.pl, or by phone at 22 464 52 00.

For matters related to the processing of your personal data, you may contact our Data Protection Officer by phone at 535 999 739 or by e-mail: iod@pcbc.gov.pl.

For what purpose and on what legal basis do we process your data?

? In order to take steps to conclude or perform contracts concluded with you, if you are a party to such a contract, on the basis of Article 6(1)(b) of the GDPR;

? For the purpose of cooperation and communication, your data are processed on the basis of Article 6(1)(f) of the GDPR, where the legitimate interest consists in the proper performance of the contract binding us with you, maintaining correspondence and documenting arrangements made during such correspondence;

? For the purpose of documenting concluded contracts and their settlement, pursuant to tax law provisions and the Accounting Act (including Articles 21 and 74(1) of the Accounting Act), the Company is obliged to maintain paper archival documentation documenting correspondence conducted by the Company with its collaborators, in particular correspondence concerning the establishment of cooperation involving the performance, on behalf of PCBC, of functions such as auditor, reviewer, expert or verifier. In this respect, the Company is subject to the provisions of the law on the national archival resources and archives. Where legal provisions oblige us to process data, the legal basis for processing is Article 6(1)(c) of the GDPR;

? In the case of contracts concluded with natural persons, personal data will be processed in order to fulfil statutory obligations imposed on us as a withholding agent for advance income tax payments, as well as obligations resulting from regulations concerning the Social Insurance Institution (ZUS) and the payment of social security and health insurance contributions. Where legal provisions require the processing of data, the legal basis is Article 6(1)(c) of the GDPR;

? For purposes related to internal organizational and administrative activities ensuring the efficient functioning of our organization, such as granting access to IT systems or organizing audit, certification and verification processes, on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR;

? Personal data concerning competencies and professional experience will be processed in order to verify skills and maintain a high level of qualifications of personnel cooperating in the field of certification and auditing, on the basis of Article 6(1)(b) and (f) of the GDPR;

? For the establishment, investigation or defence against claims, as well as for archival purposes, on the basis of our legitimate interests pursuant to Article 6(1)(f) of the GDPR;

? Your personal data, subject to a separate consent granted before the first login to the PCBC BC e-learning platform, may be made available to auditors cooperating with PCBC. In addition, if you consent, your data may be processed for marketing purposes by PCBC. In the case of consent to receive marketing content or consent to make data available on the PCBC BC e-learning platform, the legal basis for processing is Article 6(1)(a) of the GDPR.

Please note that providing personal data is voluntary but necessary for correspondence and for the performance of the contract. Failure to provide the data will result in the inability to conclude a contract and establish cooperation. Personal data will not be subject to profiling.

To whom will we disclose your personal data?

We may disclose your personal data to other recipients processing personal data on our behalf and on our instructions, including entities providing IT services, financial controlling services and archival services.

Your personal data may also be disclosed to law firms providing legal assistance to us or made available for inspection to verification entities such as certification bodies or statutory auditors.

Your data will also be disclosed to authorized public administration authorities.

Your personal data will also be made available to other auditors who have access to the PCBC BC e-learning platform, if you consent to this when logging into the platform for the first time.

Your personal data may be transferred to third countries outside the EEA where certification, audit or verification agreements are concluded with entities located in such countries and you are designated as the person responsible for performing that cooperation.

How long will we process your personal data?

Your personal data will be stored for the duration of the contract concluded with us. After this period, if no separate contract for specific work has been concluded, the documentation in paper form will be stored for 10 years from the end of the year in which the agreement was terminated, in accordance with the Company?s regulations concerning the national archival resources and archives.

Documentation concerning authorization to process personal data will be stored for 20 years from the end of the year in which such authorization was withdrawn.

Documentation concerning the creation of user accounts and granting access rights to the Company?s ICT resources, including access to the FTP server, will be stored in the archive for 20 years from the end of the year in which such access rights were withdrawn.

Personal data processed on the basis of consent will be processed until the consent is withdrawn or the purpose of processing ceases to exist.

What rights do you have?

By contacting our Data Protection Officer at iod@pcbc.gov.pl, you may exercise the following rights:

? the right of access to your personal data and to receive a copy of the personal data being processed;

? the right to rectification of inaccurate personal data;

? the right to request the erasure of data (right to be forgotten) in the circumstances provided for in Article 17 of the GDPR. In certain cases we may refuse to erase data if their processing is still necessary, for example to comply with a legal obligation, to establish, pursue or defend legal claims, to exercise the right to freedom of expression and information, or for reasons of public interest such as archival, research or statistical purposes;

? the right to request the restriction of processing in the cases specified in Article 18 of the GDPR;

? the right to object to the processing of data in the cases indicated in Article 21 of the GDPR;

? the right to data portability with regard to the data you have provided, processed by automated means, where the legal basis for processing is consent or the performance of a contract;

? the right to lodge a complaint with the President of the Personal Data Protection Office (For citizens - UODO) if you believe that the processing of your personal data violates the provisions of the GDPR.

1. Addressees of information on the processing of personal data

1) A person who has signed an agreement on the will to establish cooperation consisting in performing the functions of an auditor, reviewer, clinical specialist, etc. on behalf of PCBC.

2. Data Controller

2.1. Identity: Polish Centre for Testing and Certification S.A. with its registered office in Warsaw, hereinafter referred to as "PCBC"

2.2. Address: 469 Pu?awska Street, 02-844 Warsaw

2.3. Contact details: 22 464 52 00; pcbc@pcbc.gov.pl

Additional clarification According to the GDPR, "controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

3. PCBC Appointed Data Protection Officer

3.1. Contact details: +48 535 999 739; iod@pcbc.gov.pl

Additional clarification According to the recitals of the GDPR, a data protection officer is a person with expertise in data protection law and practices, appointed by the controller, to provide advice to the controller and to the data subjects whose data it processes.

4. Types and categories of data

4.1. Data provided directly by the data subject.

Some of your data, including your name and surname, e-mail address, telephone number, data concerning your qualifications. Your data that we collect in connection with the signing of the cooperation agreement between you and PCBC includes data on your ID/passport number, address of residence and address for correspondence.

4.2. Data Obtained from Other Sources

Not applicable

4.3. Special categories of data

Not applicable

Additional clarification According to Article 9 of the GDPR, special categories of data are data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person or data concerning that person's health, sex life or sexual orientation

5. Purposes and legal bases of data processing and obligation to provide data.

5.1. Legal Bases for Processing

Additional clarification One of the principles of the GDPR is the processing of data based on one of the legal bases indicated in the regulations. They are generally defined in Article 6(1) and Article 9(2) of the GDPR. Reference to these regulations means that PCBC ensures that the collection and processing of data complies with the conditions set out in these regulations.

5.1.1. the processing is based on your consent to the processing of your personal data (Article 6(1)(a) of the GDPR); providing personal data for these purposes is voluntary.

Not applicable.

5.1.2. processing is necessary for the fulfilment of contractual obligations to you, if you are or will be a party to a contract concluded with PCBC, or to take certain steps prior to entering into a contract, e.g. to prepare a draft contract (Article 6(1)(b) of the GDPR). The provision of personal data for these purposes is mandatory.

Your personal data is needed to prepare a draft cooperation agreement and will be used to establish and confirm your identity as a party to this agreement, i.e. a kind of agreement.

Additional clarification The Agreement will not be the basis for the processing of personal data if the party to it (client) is a legal person or another entity that is not a natural person. The protection afforded by the GDPR should apply to natural persons, regardless of their nationality or place of residence, with regard to the processing of their personal data. The GDPR does not apply to the processing of personal data relating to legal persons, in particular companies that are legal persons, including data about the company and legal form and contact details of the legal person

5.1.3. processing is necessary for compliance with PCBC's legal obligations or is expressly required by law (Article 6(1)(c) of the GDPR).The provision of personal data for these purposes is mandatory.

The Company is obliged to keep archival documentation in paper form in order to document the correspondence conducted by the Company with its Associates, in particular the correspondence concerning the establishment of cooperation consisting in performing the functions of an auditor, reviewer and clinical specialist on behalf of PCBC, and the Company is covered in this respect by the provisions of the law on the national archival resource and archives.

5.1.4. the processing is necessary for the purposes of the legitimate interests pursued by PCBC or a third party and does not unduly affect your interests or fundamental rights and freedoms (Article 6(1)(f) of the GDPR). The provision of data for the implementation of the legitimate interests of PCBC is not mandatory.

Your personal data, including your full name and email address, will also be used to create an account and grant access rights to the Company's IT resources, specifically the FTP server resources. Additionally, your personal data, including your name and information regarding cooperation with PCBC, will be used to grant you authorization to process personal data that you may access as part of this cooperation, particularly personal data concerning our Clients, Suppliers, or their employees.

Furthermore, the personal data you provide may also be subject to internal audits within PCBC and may be used in the course of pursuing or defending against claims that may arise in the event of improper performance of the agreement.

5.2. PCBC's legitimate interests

We process your data for the purposes of the following legitimate interests:

Assessment of the correctness of processes performed within PCBC, protection of the Company's economic interests, ensuring accountability of personal data processing and ensuring the security of PCBC's ICT resources.

6. Data sources

We obtain your personal data from you.

6.1. Publicly available sources

Not applicable

Additional clarification "Publicly available sources" include, first of all, data contained in various types of public registers, such as CEiDG, KRS, REGON, if the entity maintains a website on the Internet, also this website

7. Recipients of the data

Additional clarification According to the GDPR, "recipient" means a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether or not a third party. However, public authorities that may receive personal data in the context of a specific procedure under Union or Member State law are not considered recipients; The processing of those data by those public authorities must comply with the data protection rules applicable accordingly to the purposes of the processing.

7.1. PCBC employees or collaborators

PCBC authorizes the processing of your personal data of its employees or associates from departments responsible for establishing cooperation with persons who have expressed their willingness to establish cooperation consisting in performing the functions of auditor, reviewer, clinical specialist, etc. on behalf of PCBC.

7.2. PCBC Contractors (Processors)

PCBC outsources some of the processing of personal data of qualified personnel to other entities ? it entrusts them with the processing of such data. Entities acting on behalf of PCBC include entities providing IT services, mailroom services, financial controlling services, archiving services, data deletion, as well as legal services. Outsourcing these activities does not mean that the above-mentioned entities will always gain access to your data, but according to the service contract, they can obtain such access, which is why PCBC informs about such a possibility.

Additional clarification According to the GDPR, "processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, which means that they must return the data or delete it when they end their relationship with the PCBC.

7.3. Non-PCBC entities (other data controllers)

Additional clarification

According to the GDPR, "third party" means a natural or legal person, public authority, agency or body other than the data subject, controller, processor or persons who, under the authority of the controller or processor, may process personal data.

7.3.1. Statutory auditors

Not applicable

7.3.2. Economic information offices

Not applicable

7.3.3. Courier or postal service providers

The data entered on registered or courier shipments of PCBC addressed to the addressees are transferred to the IT systems of postal or courier operators. Of course, the content of the correspondence remains a secret

7.3.4. Law Firms

In the event of legal disputes related to the implementation of the cooperation agreement, data and all documentation related to the implementation of the agreement, including the agreement itself, are transferred to the law firm representing PCBC in a dispute with an associate. Ultimately, this data may be sent to the competent court, and in the event of problems with the enforcement of the court decision ? to the bailiff's office.

7.3.5. Entities accrediting the Company's activities.

Your data may be accessed by designating/supervisory authorities specified by law.

8. Transfers of data to a third country or international organization

Currently, PCBC does not plan to transfer your data to third countries.

Additional clarification A third country is a country whose territory lies outside the European Economic Area or outside the area comprising the EU Member States, Iceland, Liechtenstein and Norway.

An international organisation under the GDPR means an organisation and its subordinate bodies operating under public international law or any other body established by or on the basis of an agreement between two or more States

9. Data retention periods

Your personal data will be stored for the duration of the agreement between you and PCBC. After this period, if no separate contract for specific work has been concluded, the documentation in paper form will be stored for 10 years from the end of the year in which such agreement was terminated, in accordance with the regulations on national archival resources and archives in force in the Company.

Documentation concerning the authorization of your authorization to process personal data will be stored for 20 years from the end of the year in which such authorization was withdrawn.

Documentation regarding the creation of an account and granting authorizations to the Company's ICT resources, i.e. to the FTP server resources, will be stored in the archive for 20 years from the end of the year in which the authorization to the ICT resources was revoked.

If, in the performance of the agreement concluded now, an agreement is signed with you in the future with PCBC for participation in the medical device evaluation process, then the data provided by you will be stored for the period necessary to determine that the medical device evaluation process carried out with your participation was carried out by appropriately qualified personnel.

10. Rights of individuals in relation to the collection of their data

Additional clarification The deadlines within which the controller is obliged to respond to the requests of persons whose data it collects are set out in Article 12 of the GDPR

Where the controller has reasonable doubts as to the identity of the natural person making the request referred to in Articles 15 to 21, it may request additional information necessary to confirm the identity of the data subject.

The rights of individuals in connection with the collection of their data may be limited or excluded by the provisions of the GDPR, e.g. the right to object to the processing of data if the objector is subject to proceedings to pursue claims against him or her

10.1. request access to your personal data,

Additional clarification The right to request access to your data is governed by Article 15 of the GDPR

As a general rule, it consists in obtaining a copy of the data processed about the personal data.

The first copy of the data is free of charge, for any subsequent copies the controller may charge a reasonable fee resulting from the administrative costs. If the data subject requests a copy by electronic means, and unless otherwise stated, the information shall be provided by electronic means which are generally used.

In addition, such a person may request information on the conditions under which his or her data is processed.

10.2. Request rectification

Additional clarification The right to request rectification is governed by Article 16 of the GDPR

If you believe that any information about you is incorrect or incomplete, please submit a request for rectification in the manner set out in the section Exercising Your Rights. PCBC will promptly correct such information or delete outdated and redundant data.

10.3. request erasure of your personal data

Additional clarification The right to request the deletion of your data (right to be forgotten) is defined in Article 17 of the GDPR. In accordance with Article 17(1)(c) of the GDPR, PCBC S.A. may refuse to delete data even if the data subject objects to processing under Article 21(1) of the GDPR, due to the fact that, in PCBC S.A.?s assessment, there are overriding legitimate grounds for processing.

10.4. request the restriction of the processing of your personal data.

Additional clarification According to the GDPR, "restriction of processing" means marking the personal data stored in order to restrict its future processing.

The right to restriction of processing is set out in Article 18 GDPR

10.5. Request data portability

Additional clarification Pursuant to the GDPR, a data portability request means the right to receive the personal data provided to controller in a structured, commonly used and machine-readable format and to request the transmission of such personal data to another personal data controller, without hindrance from controller and subject to its own confidentiality obligations.

The right to data portability is defined in Article 20 of the GDPR

10.6. Right to withdraw consent to data processing

In the case of processing your personal data for the above-mentioned purposes, this right does not apply (we do not collect personal data based on your consent)

Additional clarification According to the GDPR, "consent" of a data subject means a free, specific, informed and unambiguous indication of the data subject's will, by which he or she consents to the processing of personal data concerning him/her, in the form of a statement or a clear affirmative action

10.7. Right to object to processing

Additional clarification The right to object to data processing is set out in Article 21 GDPR

You have the right to object ? for reasons related to your particular situation ? to the processing of your personal data only in those cases where the purpose of data processing is based on the legitimate interests of PCBC ? i.e. those indicated in section 5.2

10.8. Exercising Your Rights

To exercise the above rights, you may send an e-mail to the following address: iod@pcbc.gov.pl or send a notification in writing to the address of PCBC's registered office indicated in point 2.2

10.9. Right to lodge a complaint with a supervisory authority

If you become aware of unlawful processing of your personal data by PCBC, you have the right to lodge a complaint with the supervisory authority competent for the protection of personal data, i.e. the President of the Office for Personal Data Protection.

Additional clarification More information on filing complaints with the Personal Data Protection Office can be found at https://uodo.gov.pl/pl/493/155

11. Automating decision-making, including profiling

PCBC does not intend to perform operations on your data that would lead to automated decision-making, including profiling, which would produce legal effects or similarly significantly affect the data subject.

Additional clarification Automated decision making is a decision that has been made through technical means without human intervention.

According to the GDPR, "profiling" means any form of automated processing of personal data that involves the use of personal data to evaluate certain personal aspects of a natural person, in particular to analyse or predict aspects relating to that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements