Processing of personal data

Information on the processing of personal data by Zakłady Chemiczne “NITRO-CHEM” S.A. for the Company’s customers and business partners and their employees

Pursuant to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR), we hereby inform you about the processing of your personal data by Zakłady Chemiczne “NITRO-CHEM” S.A.

1. Who is the controller of your personal data?

The controller of your personal data is Zakłady Chemiczne “NITRO-CHEM” Spółka Akcyjna, with its registered office in Bydgoszcz (hereinafter: the Company), address: ul. Theodora Wulffa 18, 85-862 Bydgoszcz, entered in the National Court Register (KRS) under number 0000006791, District Court in Bydgoszcz, 13th Commercial Division of the National Court Register, Tax Identification Number (NIP): 5540310422, National Business Registry Number (REGON): 091129384, share capital: PLN 15,862,850.00. The Company is part of the PGZ Capital Group S.A.

2. How can I contact the data controller?

For matters relating to the processing of personal data, you may contact the Controller via: Quality and Internal Control Department, ph. 52 374 83 35, email: chronadanych@nitrochem.com.pl.

3. For what purpose do we process your personal data?

Your personal data is processed for the purpose of conducting the Company’s business activities, in particular:

  • concluding and performing contracts,
  • fulfilling tax and accounting obligations,
  • fulfilling obligations arising from legal provisions (including provisions on the control of trade in goods of strategic importance),
  • pursuing claims and defending against claims,
  • fulfilling internal administrative purposes within the PGZ Group.

A. Potential customers and business partners

Data may be processed for the purpose of:

  • conducting commercial negotiations
  • preparing offers
  • establishing business cooperation.

The legal basis for data processing is: Art. 6 sec. 1 b) of the GDPR – pre-contractual measures or Art. 6 sec. 1 f) of the GDPR – the controller’s legitimate interests.

B. The Company’s customers and business partners

Data is processed for the purposes of:

  • performing commercial contracts
  • managing business cooperation
  • conducting financial settlements
  • pursuing claims.

The legal basis for processing is: Art. 6 sec. 1 b) of the GDPR – performance of a contract and Art. 6 sec. 1 c) of the GDPR – compliance with a legal obligation (e.g. tax obligations).

C. Employees or associates of business partners

Data may be processed for the purposes of:

  • performing contracts concluded with their employer
  • maintaining business contacts
  • coordinating the performance of contracts.

Legal basis: Art. 6 sec. 1 f) of the GDPR – the controller’s legitimate interests.

D. Fulfilment of tax and accounting obligations

Personal data may be processed in connection with:

  • issuing accounting documents
  • handling tax settlements
  • maintaining accounting records.

Legal basis: Art. 6 sec. 1 c) of the GDPR

E. National e-Invoice System (KSeF)

Personal data may also be processed for the purpose of issuing, receiving and archiving structured invoices in the National e-Invoice System (KSeF) operated by the Minister of Finance. Legal basis: Art. 6 sec. 1 c) of the GDPR in connection with the provisions of the Goods and Services Tax Act.

4. How long will your personal data be processed?

Your personal data will be processed for the following periods:

A. Data processed for the purpose of conducting commercial negotiations, submitting offers, etc. When negotiations are being conducted regarding the conclusion of a contract with the Company, for the duration of those discussions and for a period of up to one year from the date of their conclusion; however, if cooperation with the Company is established, they will be processed in accordance with the provision set out in point 4 b).

B. Data processed in the context of business cooperation If you are a party to a contract concluded with the Company, for the duration of that contract and until the expiry of the limitation period for claims arising therefrom, which is generally 3 years after the end of the cooperation. Financial settlement data is retained for a period of 5 years (including invoices submitted to KSeF) from the end of the tax year in which the accounting documents were issued or the financial transactions took place, in accordance with tax regulations (Art. 6 sec. 1 c) of the GDPR) regarding personal data contained in documents subject to archiving under the law.

C. Data of Customers’ or Business Partners’ employees If you are an employee or associate of our Customer or Business Partner, we will process your personal data for the duration of the cooperation with the relevant Customer or Business Partner and until the expiry of the limitation period for claims arising from such cooperation, which is generally 3 years after the end of the cooperation.

5. To whom may your personal data be disclosed?

Your personal data may be disclosed to external entities such as:

  1. IT service providers
  2. entities providing legal, audit or advisory services
  3. postal and courier operators
  4. banks and financial institutions
  5. entities involved in the performance of contracts
  6. companies within the PGZ Capital Group
  7. public administration bodies
  8. tax authorities
  9. the National e-Invoice System (KSeF)
  10. entities providing security and property protection.

6. What rights do you have regarding the processing of your personal data?

You have the right to:

  1. access your data,
  2. rectify your data,
  3. restrict processing,
  4. delete data (to the extent permitted by law),
  5. transfer data,
  6. object to data processing based on Art. 6 sec. 1 f) of the GDPR,
  7. lodge a complaint with the President of the Personal Data Protection Office.

7. Further information

The provision of personal data is a condition for the conclusion and performance of the contract and for the fulfilment of statutory obligations (including tax obligations). Failure to provide such data may result in the inability to conclude or perform the contract.

Personal data is not processed by automated means nor is it subject to profiling.

As a general rule, data is not transferred outside the European Economic Area, unless this is necessary in connection with the use of IT service providers’ services or the performance of the contract; in such cases, the transfer will take place in accordance with the appropriate safeguards required by the GDPR.

This information may be subject to updates.