GDPR information clause

1. Data Controller

The controller of your personal data is Montochem – Oświęcim Sp. z o.o., with its registered office in Oświęcim at ul. Chemików 1, 32-600 Oświęcim, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number: 0000163859, NIP (tax ID): 549-215-79-09, REGON (statistical number): 356704113.

For all matters relating to the protection of personal data, you may contact the Controller electronically at: t.szafran@m4eg.com, or in writing at the company's registered office address.

2. Purposes and Legal Bases for Processing

Your personal data may be processed for the following purposes:

• Establishing contact and handling correspondence: to respond to enquiries sent by email, phone or via the Service's contact form (legal basis: Article 6(1)(f) GDPR — the Controller's legitimate interest in handling correspondence and customer relationships).
• Preparing a commercial offer: at your request, prior to a possible contract (legal basis: Article 6(1)(b) GDPR).
• Carrying out recruitment processes: to evaluate candidates and conduct recruitment for a vacant position (legal basis: Article 6(1)(c) GDPR to the extent required by the Labour Code, and Article 6(1)(a) GDPR — your voluntary consent given in your CV to processing data beyond the statutory catalogue, or for future recruitment).
• Concluding and performing a contract: in the event of establishing a commercial or contractual relationship (legal basis: Article 6(1)(b) GDPR).
• Fulfilling the Controller's legal obligations: e.g. issuing and retaining invoices, tax settlements, and maintaining employee records (legal basis: Article 6(1)(c) GDPR).
• Establishing, pursuing or defending against claims: in the event of legal disputes (legal basis: Article 6(1)(f) GDPR — the Controller's legitimate interest).

3. Recipients of Personal Data

Your personal data may be shared with external entities cooperating with the Controller to ensure the proper functioning of the company and the Service. Recipients of data may include:

• hosting, email and IT support service providers;
• the accounting office handling the Controller's finances and taxes;
• law firms and debt-collection companies (for the purpose of pursuing claims, where applicable);
• providers of analytical tools (Google LLC, for traffic statistics and reCAPTCHA anti-spam protection).

4. Transfer of Data outside the EEA

As a rule, personal data is not transferred outside the European Economic Area (EEA). However, in connection with the use of Google Analytics and Google reCAPTCHA, some data (e.g. IP address) may be transferred to Google's servers in the USA. Google LLC holds a certification under the Data Privacy Framework (the EU-US data protection framework), which guarantees a level of personal data protection equivalent to the standards applicable in the European Union.

5. Data Retention Period

Your data will be retained only for as long as necessary to achieve the purposes for which it was collected:

• Contact / Enquiries: until the commercial correspondence is concluded or an effective objection to processing is raised.
• Recruitment: until the recruitment process for the given position is completed, or for a period of 2 years where consent has been given for future recruitment.
• Contracts and transactions: for the term of the contract, and after its conclusion, for as long as necessary for claims to lapse and to fulfil tax and accounting obligations (typically 5 years from the end of the tax year).

6. Rights of Data Subjects

Under GDPR, you have the following rights:

• the right to access the content of your personal data and to obtain a copy of it;
• the right to rectification of your data;
• the right to erasure of data ("the right to be forgotten"), where there is no other legal basis for its processing;
• the right to restriction of the processing of your data;
• the right to data portability;
• the right to object to the processing of your data (applicable to purposes arising from the Controller's legitimate interest);
• the right to withdraw consent to processing at any time (without affecting the lawfulness of processing carried out before withdrawal).

To exercise your rights, you may send an appropriate request to the email address: t.szafran@m4eg.com.

You also have the right to lodge a complaint with the supervisory authority responsible for personal data protection — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) — if you consider that the processing of your data infringes applicable law.

7. Voluntary Provision of Data

Providing your personal data for contact, recruitment or commercial purposes is voluntary, but in many cases necessary to process your message, respond to your enquiry, carry out a recruitment process, or conclude and perform a contract.

8. Profiling and Automated Decision-Making

Your personal data will not be used for automated decision-making producing legal effects, and will not be subject to profiling within the meaning of GDPR.