Purposes and legal basis of personal data processing

1. considering by Paneltech of an offer of a contract or pre-offer activities,
   Legal basis: consent of the data subject; necessity in order to take steps at the request of the data subject prior to entering into a contract;
2. performing by Paneltech of activities connected with entry into, performance or termination of a contract and with other contract-related activities, including activities prior to entering into a contract;
   Legal basis: necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. compliance by Paneltech with obligations relating to guarantee of quality or commercial warranty for defects, arising from a contract performed or provisions of law,
   Legal basis: necessity for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject;
4. 4. issuing by Paneltech of VAT invoices or other accounting documents;
   Legal basis:
   1. accounting books and other accounting devices specified by the provisions of law regulating accounting matters
   2. necessity for compliance with a legal obligation to which Paneltech is subject;
5. keeping by Paneltech of:
   1. accounting books and other accounting devices specified by the provisions of law regulating accounting matters;
   2. records of transactions required by the provisions of law regulating tax matters;

   Legal basis: necessity for compliance with a legal obligation to which Paneltech is subject;

6. ensuring safety of persons or protection of property or control of production or confidentiality of information which, if disclosed, could expose Paneltech to a threat of damage, by introducing special oversight over the area of the working establishment or the workplace in the form of technical measures allowing for video recording (video surveillance) – if Paneltech uses video surveillance, with respect for privacy and dignity of persons and in connection with the applicable provisions of law;
   Legal basis: necessity for the purposes of the legitimate interests pursued by Paneltech, consisting in ensuring safety of persons or protection of property or control of production or confidentiality of information which, if disclosed, could expose Paneltech to a threat of damage;
7. exercise or defence of claims or rights of Paneltech;
   Legal basis: necessity for the purposes of the legitimate interests pursued by Paneltech, consisting in the right to defend its position and participate in proceedings;
8. handling of your potential complaints and reported claims;
   Legal basis: necessity for the purposes of the legitimate interests pursued by Paneltech, consisting in handling claims giving rise to a complaint and defending potential claims,
9. archiving of your data after termination of legal relations arising from the above-stated purposes of processing;
   Legal basis:
   1. necessity for the purposes of the legitimate interests pursued by Paneltech;
   2. necessity for compliance with a legal obligation to which Paneltech is subject.

Categories of personal data processed

Paneltech processes your personal data in the following scope:

1. data identifying a person who is an entrepreneur:
   1. name, surname, NIP number and REGON number;
   2. address and contact details:
      1. address of the place of business;
      2. service address – if different from the address referred to in item i),
   3. tephone number,
   4. e-mail address.

   Provision of data listed in 1(a) and 1(b) is mandatory. The other data are provided voluntarily and the lack thereof does not produce any negative consequences.

2. data identifying a person who is a consumer
   1. name and surname;
   2. address details
      1. residence address,
      2. service address – if different from the address referred to in item i),
   3. telephone number,
   4. e-mail address.
   5. NIP number or PESEL number;

   Provision of data listed in 2(a) and 2(b) is mandatory. The other data are provided voluntarily and the lack thereof does not produce any negative consequences.

3. data identifying a person who is a representative/attorney/agent/natural person designated as a contact person by customers of Paneltech Sp. z o.o. who are commercial companies or partnerships or act in other legal forms:
   1. name and surname;
   2. telephone number;
   3. e-mail address.

   Provision of data listed in 3(a) is mandatory. The other data are provided voluntarily and the lack thereof does not produce any negative consequences.

4. biometric data in the form of image of persons present at business premises of Paneltech – if Paneltech uses a video surveillance system.

Source of personal data

Paneltech obtains your data:

1. directly from the data subject
2. from publically accessible registers or data bases, such as:
   1. Central Registration and Information on Business;
   2. National Court Register;
   3. REGON Register.
3. if Paneltech has an appropriate, legally required, authorisation from you – from economic information bureaus;
4. from customers of Paneltech who are commercial companies or partnerships or act in other legal forms;
5. from the video surveillance system used at business premises of Paneltech.

Period of personal data processing

The period of processing of your personal data depends on the purpose for which the data was collected and is processed, on the provisions and on your consents. Paneltech processes data connected with:

1. a contract or other act in law – for a period necessary to consider an offer, prepare for performance of a given act and, if the act materialises, for the time necessary to perform it. If the act did not materialise, data are processed for a period of 3 years from the date of data collection;
2. archived data – after termination of a given legal relation (e.g. a contract), personal data relating to acts of such persons as entrepreneurs or on behalf of an entrepreneur, institution or organisational unit are processed for a period of 6 years and other personal data of natural persons (consumers) are processed for a period of up to 10 years, unless the provisions of law provide for a shorter period. If a dispute, legal process or other proceedings (in particular criminal proceedings) are pending, the archiving period shall be counted from the date of final and non-appealable conclusion of the dispute or, in the case of multiple proceedings, final and non-appealable conclusion of the last of them, unless the provisions of law provide for a longer data retention period or a longer period of limitation for the claims/rights to which the proceedings relate;
3. court ruling – data may be processed for a period of up to 10 years from the date of issuance of a final and non-appealable ruling concluding the proceedings;
4. consent of the data subject – for a period indicated in the statement of consent, in each case until the consent is withdrawn;
5. obtaining of data from publically accessible registers or economic information bureaus. The period of processing of so obtained data depends on the purpose of processing and is subject to the rules set forth hereinabove in this Section of the Information Clause; however, data obtained from economic information bureaus are removed after expiration of 90 days;
6. biometric data in the form of image obtained in connection with the use a video surveillance system at business premises of Paneltech – data are retained for a period of up to 3 months and, in cases where data constitute evidence in proceedings or Paneltech learns that they may constitute evidence in proceedings, the period of retention is extended until final and non-appealable conclusion of the proceedings.

Categories of personal data recipients

Paneltech may provide personal data to entities or authorities:

1. which are entitled under the provisions of law,
2. to which provision of data is necessary for performance of a specific act connected with a contract entered into by the data subject, e.g. contract for specific work, carriage or shipment,
3. to which data may also be provided on the basis of your consent or authorisation,
4. which operate economic information bureaus, if conditions for data provision as specified by the provisions of law are met.

Rights of the data subject

You have the right to request access to and rectification, erasure or restriction of processing of your personal data.
Within the scope in which your personal data are processed on the basis of legitimate interests of the controller, you have the right to object to the processing of your personal data.
Within the scope in which your personal data are processed on the basis of your consent, you have the right to withdraw your consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before it is withdrawn.
Within the scope in which your personal data are processed for the purpose of entry into and performance of a contract or on the basis of your consent, you also have the right of data portability, i.e. to receive your personal data from Paneltech in a structured, commonly used and machine-readable format. You may transmit those data to another data controller. The right to data portability does not apply to data constituting a trade secret.
You also have the right to lodge a complaint with the supervisory authority relevant for personal data protection.

Supervisory authority relevant for personal data protection

President of the Office for Personal Data Protection;
Address: Biuro Prezesa Urzędu Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa
tel. 22 531 03 00
fax. 22 531 03 01