INFORMATION CLAUSE CONCERNING THE PROCESSING OF PERSONAL DATA

FOR PERSONS ACTING FOR OUR BUSINESS PARTNER

1. Identity and contact details of the controller

The Controller of your personal data is Grupa MCC spółka z ograniczoną odpowiedzialnością, with registered seat at Warsaw,  address ul. Omulewska 27, 04-128 Warsaw, Poland, entered into the Register of Entrepreneurs of the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, XIV Economic Department of the National Court Register under the number (KRS): 0000118542, NIP: 1130114553, REGON: 011340575, BDO: 301307 share capital: 21 029 000,00 PLN. Contact with the Controller is possible also by phone: +48 22 611 67 79 or by e-mail: info@mcc.pl

2. Purposes of processing

Your personal data are processed for the purposes of our legitimate interests, including the conclusion and performance of the agreement with our business partner (your principal, employer, contractor or entity you co-operate with), as well as for compliance with legal obligations to which we are subject, in particular for:

1. ensuring reliable identification of our business partner and persons who act for him, as well as documenting the conclusion and performance of the agreement,
2. contact with employees, associates, representatives, power of attorneys of our business partner as well as those designated as contact persons by our business partner,
3. management, exercise and defence of reciprocal claims regarding our business partner,
4. ensuring compliance with our accounting and tax obligations,

3. Source from which the data are originating

Personal data are mainly collected directly from you. We also process personal data which have not been collected directly from you. Such data is collected from our business partner and from a publicly available source, that is the National Court Register (KRS) and Central Registration And Information On Business (CEIDG) (refers to persons entered in those registers).

4. Legal basis of data processing

The legal basis for processing personal data is:

- Article 6 sec. 1 letter c) of GDPR^[1]: processing is necessary for compliance with a legal obligation to which the controller is subject - ensuring compliance with our accounting and tax obligations,

- Article 6 sec. 1 letter f) of GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller, which are:

1. ensuring reliable identification of our business partner and persons who act for him, as well as documenting the conclusion and performance of the agreement,
2. contact with employees, associates, representatives, power of attorneys of our business partner as well as those designated as contact persons by our business partner,
3. management, exercise and defence of reciprocal claims regarding our business partner,

5. Information about the categories of recipients of personal data

The recipients of personal data are entities cooperating with us, including: providers of software which supports business processes, suppliers of hosting services, postal operators and couriers, accounting offices, legal offices, financial advisors, IT companies which manage our hardware and software.

6. Categories of personal data processed (whenever personal data are collected not from the data subject)

We processes the following categories of personal data, which have not been collected directly from you: name and surname, contact details (phone number, e-mail address), position, other data forwarded to us by our business partner in the course of the co-operation, if necessary therefore, data available publicly in the KRS and CEIDG.

7. Criteria used to determine the period for which the personal data will be stored

Your personal data are processed:

• within the scope of complying with legal obligations to which we are subject - personal data shall be processed during the time period specified in respective provisions, especially accounting and tax provisions, or until we have complied with those obligations.
• within the scope of our legitimate interests - personal data shall be processed as long as those interests exist, or until you file an effective objection.

Your personal data shall be stored at least for the period of negotiation and performance of the agreement with our business partner and the lapse of the limitation periods connected with this agreement.

8. Information about the rights of data subjects

You have the right to:

1. access to your personal data,
2. request rectification, erasure, or restriction of processing of your personal data,
3. object to the processing of personal data,
4. data portability (the right to have personal data transmitted directly from one controller to another),

as provided for in the GDPR.

10. Information about the right to lodge a complaint with a supervisory authority

You have a right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

9. The right to object to processing

To the extent your personal data are processed on the basis of article 6 sec. 1 letter f), you have the right to object at any time – on grounds relating to your particular situation. We are then longer allowed to process those personal data, unless we are able to demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms or grounds for the establishment, exercise or defence of legal claims. To the extent that personal data are processed for the purposes of direct marketing, you have the right to object at any time to such processing. We are then longer allowed to process data for such purposes.

11. Information about automated processing of data

We do not use your personal data for automated decision-making, including profiling, in a way which would produce legal consequences for you or influence you in other significant manner.

12. Information about whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and about the possible consequences of failure to provide such data

Providing personal data is voluntary, however without providing them, the conclusion and/or performance of the agreement with our business partner will not be possible.

Territorial scope of data processing

We do not forward personal data outside the European Economic Area.

[1] Regulation of the European Parliament and the Council of the EU 2016/679 of 27th of April 2016 r. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [GDPR]