Privacy policy

Home page Company Privacy policy Print page

Privacy policy

PRIVACY POLICY FOR TRAKCJA’S CONTRACTORS

BEING NATURAL PERSONS AND EMPLOYEES/CO-WORKERS OF TRAKCJA’S CONTRACTORS

Privacy protection is important for us. We make all efforts to properly secure your personal data and present how we process it in a clear manner.

As of 25 May 2018 we have been applying the European provisions on personal data protection i.e. the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (general regulation on personal data) (OJ EU L 119 of 04.05.2016, p. 1) (“GDPR”) and the Act on data protection of 10 May 2018 (Journal of Laws of 2018, item 1000).

Therefore, we would like to inform you of processing your personal data and principles of processing thereof within Trakcja.

Our policy (“Privacy Policy”), drawn up by Trakcja S.A. (hereinafter referred to as the “Administrator” or “we”, “us”, “Trakcja”) is directed at Trakcja’s contractors (including business partners, suppliers, clients, contractors) being natural persons and at those contractors’ contact persons appointed for maintaining contact with Trakcja (irrespectively of the legal form) (including employees/co-workers of Trakcja’s contractors).

The aim of this Privacy Policy is to provide information on the principles and rules applied for processing personal data of the aforementioned persons.

1. Who is responsible for your personal data? (Administrator)

Your personal data is administered by Trakcja S.A al. Jerozolimskie 100 2nd floor, 00-807 Warsaw.

2. How can you contact the Administrator?

In matters regarding processing your personal data by the Administrator contact us to the address indicated in point 1 above, via email to the address: rodo@grupatrakcja.com or by telephone: +48 22 350 94 44.

3. On what grounds and for what purposes do we process your personal data?

In the scope in which we process your personal data obtained directly from you, we process it for one or several of the following purposes and on one or several of the following grounds:

  1. in order to draw up, conclude or perform the agreement as well as for contact with regard to drawing up, conclusion or performance of the agreement, i.e. on the grounds of Article 6 section 1 letter b) of the GDPR;
  2. in order to pursue the Administrator’s legally justified interest related with direct marketing executed by the Administrator or third parties, i.e. on the grounds of Article 6 section 1 letter f) of the GDPR, whereas, if you have no business relations with the Administrator – on the grounds of your voluntary consent, i.e. Article 6 section 1 letter a) of the GDPR;
  3. in order to fulfil the Administrator’s legal obligation comprising archiving documentation concerning, among others, concluded agreements, deliveries, settlements, complaints, accounting records, i.e. pursuant to Article 6 section 1 letter c) of the GDPR (among others, with regard to the provisions of the Accountancy Act and the Tax Ordinance);
  4. in the scope, in which you are a person with the access to the confidential information pursuant to the MAR, in order to fulfil the Administrator’s legal obligation related with information obligations of the Administrator as a public company, i.e. pursuant to Article 6 section 1 letter c) of the GDPR (in relation to, among others, provisions of the MAR i.e. the Regulation (EU) no. 596/2014 of the European Parliament and of the Council of 16 April 2014 on market abuse and the Ordinance of the Minister of Finance of 29 March 2018 on current and periodical information forwarded by issuers of securities and terms of considering as equivalent the information required pursuant to the legal provisions of a non-Member State;
  5. in the scope, in which the Administrator processes specific categories of personal data, it is processed in order to fulfil legal obligations imposed on the Administrator (among others, with regard to ensuring safe and healthy working conditions) as well as in order to stipulate, assert or defend claims, i.e. pursuant to Article 9 section 2 letter b) or f) of the GDPR, respectively;
  6. in the scope, in which the Administrator uses CCTV or other forms of monitoring, the Administrator processes your personal data in order to pursue the Administrator’s legally justified interest related with ensuring organisation of the work process, protection of persons staying within the premises managed by the Administrator, protection of the property and information belonging to the Administrator, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  7. in order to pursue the Administrator’s legally justified interest related with determining, asserting or defending against claims under extrajudicial, judicial or enforcement proceedings i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  8. in the scope in which we process your image in order to improve internal communication and conduct marketing activity, the legal grounds for processing thereof comprise your consent i.e. Article 6 section 1 letter a) of the GDPR;
  9. in order to pursue the Administrator’s legally justified interest related with confirmation of meeting the requirements of participating in the public procurement proceedings in conjunction with the provisions of the Public Procurement Law, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  10. in the scope of data concerning sentences and violation of the law in order to pursue the Administrator’s legally justified interest related with confirmation of meeting the requirements of participating in the public procurement proceedings, the Public Procurement Law and executory provisions, i.e. pursuant to Article 6 section 1 letter f) of the GDPR and in compliance with Article 10 of the GDPR;
  11. in order to pursue the Administrator’s legally justified interest related with demonstrating necessary qualifications and experience of the Administrator’s staff in order to confirm meeting the terms and requirements of the Administrator’s potential contractors with regard to his application for a contract in the mode other than pursuant to the Public Procurement Law including, in particular, within threshold tenders, invitations for offers, bids and negotiations i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  12. in order to pursue the Administrator’s legally justified interest related with improving the communication inside the organisation as well as in communication with the Administrator’s contractors, i.e. pursuant to Article 6 section 1 letter f) of the GDPR.

The Administrator’s legally justified interest should be understood as: conducting direct marketing of the Administrator or third parties; ensuring safety of the persons staying within the premises managed by the Administrator and ensuring safety of the property, data and secrets belonging to the Administrator; stipulating and asserting the Administrator’s claims and defence against claims; confirmation of meeting the terms of participation in the public procurement procedure; demonstrating necessary qualifications and experience of the Administrator’s staff with regard to the application for a contract in the mode other than pursuant to the Public Procurement Law; improving communication inside the company and external communication.

In the scope in which personal data is collected directly from you, the Administrator processes it in the following scope, for one or several of the following purposes and on one or several of the following legal grounds:

  1. in the scope of the name and surname, position, company, business phone number, email address, correspondence address, education, qualifications, titles, course of the hitherto employment, experience (implemented projects) - in order to pursue the Administrator’s legally justified interest related to the confirmation of meeting the terms of participating in the public procurement proceedings in conjunction with the provisions of the Public Procurement Law, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  2. in the scope of the name and surname, position, company, business phone number, email address, correspondence address, education, qualifications, titles, course of the hitherto employment, experience (implemented projects) in order to pursue the Administrator’s legally justified interest related to the confirmation of meeting the terms of participating in the public procurement proceedings and the criminal record (in the scope of data regarding sentences and violations of the law) in conjunction with the provisions of the Public Procurement Law and executive orders, i.e. pursuant to Article 6 section 1 letter f) of the GDPR and in compliance with Article 10 of the GDPR;
  3. in the scope of the name and surname, position, company, business phone number, email address, correspondence address, education, qualifications, titles, course of the hitherto employment, experience (implemented projects) - in order to pursue the Administrator’s legally justified interest related to the confirmation of meeting the terms and requirements of the Administrator’s potential contractors in conjunction with his application for a contract in the mode other than pursuant to the Public Procurement Law including, in particular, within threshold tenders, invitations for offers, bids and negotiations, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  4. in the scope of the name and surname, company, address of conducting business activity, TIN, bank account number, correspondence address, email address - in order to fulfil the Administrator’s legal obligations in conjunction with the performance of the agreement, i.e. pursuant to Article 6 section 1 letter c) of the GDPR (in conjunction with, among others, provisions of the Accountancy Act and the Tax Ordinance);
  5. in the scope of the name and surname, correspondence address, telephone number, email address and other forwarded data, in the scope in which it is necessary for the purposes of cooperation/performance of the agreement with the Administrator - in order to pursue the Administrator’s legally justified interest comprising in facilitating the cooperation or performance of the agreement, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  6. in the scope of the name and surname, telephone number, email address, in the scope in which it is necessary to stipulate, assert or defend claims in judicial, administrative or other, non-judicial proceedings - in order to pursue the Administrator’s legally justified interest comprising in stipulating, asserting the Administrator’s claims or rights or defending against such claims, i.e. pursuant to Article 6 section 1 letter f) of the GDPR;
  7. in the scope, in which the Administrator processes forwarded to him specific categories of personal data, it is processed in order to fulfil legal obligations imposed on the Administrator (among others, with regard to ensuring safe and healthy working conditions) as well as in order to stipulate, assert or defend claims, i.e. pursuant to Article 9 section 2 letter b) or f) of the GDPR, respectively.

The Administrator’s legally justified interest should be understood as: stipulating and asserting the Administrator’s claims and defence against claims; confirmation of meeting the terms of participation in the public procurement procedure; demonstrating necessary qualifications and experience of the Administrator’s staff with regard to the application for a contract in the mode other than pursuant to the Public Procurement Law; improving communication inside the company and external communication.

4. The source of data origin

In the scope, in which the Administrator processes your personal data indirectly collected, it is processed with regard to forwarding it to the Administrator by a contractor, including your employer or principal with whom the Administrator cooperates.

5. Personal data recipients and categories of recipients

We can share your personal data with the following data recipients or categories of recipients:

  1. service providers, among others:
  • entities providing services in the scope of medicine, including occupational medicine;
  • entities providing accounting and payroll services;
  • entities providing legal services;
  • entities providing IT services;
  • suppliers of non-payroll benefits for employed persons (e.g. sports card, private health care, life insurance or pension insurance);
  1. other subcontractors;
  2. consortium members;
  3. the ordering party in conjunction with applying for contracts within public procurement or other;
  4. if such obligation results from mandatory legal provisions, the Administrator can also share your personal data with authorised state bodies: the Tax Office; the Polish Social Insurance Institution; the Chief Labour Inspectorate; the Office of Rail Transport; the Polish Financial Supervision Authority; the Police and the Public Prosecutor’s Office;
  5. to entities from the Trakcja capital group.

6. What are your rights regarding personal data?

In the scope permitted under GDPR provisions you have the following rights with regard to your personal data:

  1. Access to personal data. You can exercise the right to access your data at any time.
  2. Rectification and supplementation of data. You have the right to demand the Administrator to immediately rectify your personal data, which is incorrect as well as to demand supplementing incomplete personal data.
  3. The right to delete data. You have the right to demand the Administrator to immediately delete your personal data in each of the following cases:
  • personal data is no longer necessary for the purposes for which it has been collected or otherwise processed;
  • the person whom the data concerns has withdrawn their consent on which the processing is based and there are no other legal grounds for processing;
  • when you object processing data referred to in point e) below and there are no superior, legally justified grounds for processing such data;
  • when personal data is not processed in compliance with the law;
  • when personal data must be deleted in order to fulfil the legal obligation under the European Union law or the Polish law.

However, the Administrator shall not delete your personal data in the scope in which processing thereof shall be necessary to: (i) exercise the right to the freedom of speech and information, (ii) to fulfil the legal obligation requiring processing pursuant to the European Union law or the Polish law, (iii) for statistical purposes, in compliance with the principles stipulated in the GDPR, (iv) to stipulate, assert or defend claims.

  1. The right to limit data processing. You have the right the demand from the Administrator to limit processing in the following cases:
  • you question the correctness of personal data – for a period allowing the Administrator to verify the correctness of this data;  
  • processing is not compliant with the law and you object deleting personal data demanding limiting use thereof instead;  
  • the Administrator no longer needs your personal data for processing purposes, but you need it to stipulate, assert or defend claims;
  • you have objected processing referred to in point e) below – until stating, if the Administrator’s legally justified grounds are superior to your grounds of objection;
  • when your personal data has been collected with regard to offering information society services referred to in the GDPR.
  1. The right to object. You have the right to object processing your personal data, if the Administrator processes this data to pursue legally justified interest, including direct marketing. In the scope in which data is processed for purposes other than direct marketing, the data Administrator may not take into consideration the objection, if he demonstrates existence of important, legally justified grounds for processing superior to your interests, rights and freedoms or grounds for stipulating, asserting or defending claims.
  2. The right to withdraw the consent. In the scope in which your personal data is processed on the grounds of your consent, you have the right to withdraw the consent at any time. The withdrawal of the consent does not influence the compliance with the right of processing conducted on the grounds of the consent prior to withdrawal thereof.
  3. The right to transfer data. In the scope in which your data is processed for the purposes of conclusion and performance of the agreement or processed on the grounds of the consent and the data is processed in an automated manner – you have the right to obtain the personal data, which you have forwarded to Trakcja, from the Administrator in a structured, commonly used, machine-readable format. Furthermore, you have the right to send this personal data to other administrator.
  4. The right to complaint. You have the right to lodge a complaint concerning processing personal data by the Administrator to a supervisory body, which in Poland is the President of the Office for Personal Data Protection.

Rights referred to in points a) - g) above can be exercised by contacting the Administrator in a manner stipulated in point 2 above.

The right to complaint referred to in point h) above can be exercised by contacting directly the Office for Personal Data Protection.

7. Processing of sensitive personal data and data regarding sentences and violations of the law

Some categories of personal data are deemed as sensitive in compliance with the provisions on personal data and as such are subject to higher level of protection and safety. In compliance with the provisions, the following categories of personal data are deemed as sensitive: (1) race or ethnical origin; (2) political opinions; (3) religious or philosophical beliefs; (4) trade unions’ membership; (5) sex life or sexual orientation; (6) physical or psychological health or determinants; (7) genetic data and biometric data; as well as a separate category of data, that is, (8) data concerning sentences and violations of the law.

The Administrator collects and processes sensitive personal data and data regarding sentences and violations of the law in very limited cases and only, if it is permitted by the law.

8. Giving personal data

We can obtain personal data directly from you as a contractor or personal data of the contractor’s contact person, including employees/co-workers, indirectly from the contractor. Giving personal data by you as a contractor for the purposes of performing the agreement with Trakcja in the scope of name and surname, company name, address data, TIN comprises the condition of concluding the agreement. A failure to give such data shall prevent us from achieving the objective of processing, for which the data has been collected. If data is given in other scope, it is voluntary.

9. Forwarding personal data to third countries

In the case of forwarding your personal data to third countries, i.e. to recipients with registered office outside of the European Economic Area or Switzerland, in the countries, which according to the European Commission do not ensure sufficient data protection (third countries not providing an adequate level of protection), the Administrator forwards it by using mechanisms compliant with the binding law which include, among others: (1.) “Standard Contractual Clauses” of the EU, (2.) obtaining the certificate of compliance with the Privacy Shield by a third party (in the case of having a registered office in the United States of America), (3) when data is forwarded to a third country with regard to which the European Commission has stated under a decision that the third country fulfils an adequate level of protection. More information on existing security measures implemented by the Administrator in order to ensure processing personal data in compliance with relevant provisions and on the possibilities of obtaining a copy of data or a place of sharing data, can be obtained by contacting us in a manner indicated in point 2 above.

10. How long do we store your personal data?

The Administrator makes all efforts so that your personal data is processed in an adequate manner and as long as necessary for purposes for which it has been collected. Having the aforementioned in mind, Trakcja stores your personal data for a period not longer than necessary for achieving objectives for which data has been collected or, if necessary, in order to comply with the binding law, in particular for a binding period of the agreement and the limitation period of claims.

11. Automated decision taking

The Administrator does not take decisions automatically, including profiling on the grounds of personal data forwarded by you.

12. Amendments to the Privacy Policy

This Privacy Policy can be amended, in particular, in the case the need or obligation to introduce such amendments results from the amendment of relevant legal provisions, including changing data recipients.

Persons, whose data is processed in compliance with this Privacy Policy shall be informed of amendments hereto in due advance, before introducing amendments to the Privacy Policy, through the agency of the Administrator.