Keen to comply with the information obligation under Article 13 of RODO, we come with answers to the most key questions that may have arisen when the new law came into force.

Who is the administrator of your personal data?

The Administrator, i.e. the entity that decides for what purpose and in what way your personal data will be processed, is Pojazdy Szynowe PESA Bydgoszcz S.A., whose registered office is located in Bydgoszcz, at 11 Zygmunta Augusta Street (hereinafter referred to as „PESA S.A.” or „Administrator”). You can contact the Administrator in writing, by post, writing to the address of our registered office or by e-mail to: pesa@pesa.pl and by telephone (52) 586 81 00.

How can you contact us for more information about the processing of your personal data?

We have appointed a team of specialists to represent us in RODO matters -> RODO Team at PESA Bydgoszcz S.A., whose duty it is to supervise the correctness of personal data processing at PESA S.A.. You can contact them via e-mail address: iod@pesa.pl, or postal address: RODO Team at PESA Bydgoszcz S.A., 11 Zygmunta Augusta Street, 85-082 Bydgoszcz.

What is the purpose and legal basis for the processing of your data by PESA S.A.?

The legal basis for processing your personal data is:

1. Article 6(1)(b) RODO, stating that your personal data is processed on the basis of your consent;
2. Article 6(1)(b) of the RODO, stating that the processing of your personal data is necessary for the performance of obligations arising from contracts concluded with you;
3. Article 6(1)(c) of the RODO, stating that we need to process your personal data in order to comply with legal obligations incumbent on us, such as fiscal obligations;
4. Article 6(1)(f) RODO, stating that the processing of your personal data is necessary for legitimate interests pursued by the Controller or by a third party (e.g. investigation and defence in the event of counterclaims).

What rights do you have vis-à-vis the Company in respect of the data processed?

Please be advised that, in accordance with the RODO, you have the right to access, rectification and erasure of your data, restriction of processing, the right to data portability, not to be subject to automated decision-making, including profiling, and the right to object to the processing of your personal data.

In doing so, however, we must also inform you that if you object to the processing of your personal data and your data is deleted, it will not be possible to log in to the SCM Logistics Portal and it will be impossible to fulfil the obligations arising from the contracts concluded with you.

We would also like to inform you that you have the right to lodge a complaint in relation to our processing of your personal data to the supervisory authority, which is the General Inspector for Personal Data Protection (address: General Inspector for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw).

You can exercise the above-mentioned rights in the following situations, for example:

1. with regard to a request for rectification of data: when you notice that your data is incorrect or incomplete;
2. with regard to a request for erasure: in situations where you notice that:
   1. your data will no longer be necessary for the purposes for which it was collected by the Company,
   2. you withdraw your consent to data processing or object to data processing,
   3. when your data will be processed unlawfully,
   4. data should be deleted in order to comply with a legal obligation,
   5. the data was collected in connection with the provision of electronic services offered to the child;
3. with regard to a request for restriction of data processing: in situations where you notice that:
   1. your data is inaccurate – you may request that we restrict the processing of your data for a period of time to allow us to check the accuracy of the data;
   2. your data will be processed unlawfully, but you will not want it deleted;
   3. your data will no longer be needed by us, but may be needed by you to defend or assert a claim; or you object to the processing – until we determine whether the legitimate grounds on our side override the grounds for the objection;
4. with regard to a request for data portability: in situations where you notice that the processing of your data is based on your consent or a contract and where this processing is carried out by automated means.
5. with regard to objecting to the processing of your personal data: in situations where:
   1. the processing of your personal data is carried out on the basis of a legitimate interest or for statistical purposes, and the objection is justified by the particular situation in which you find yourself,
   2. your personal data is processed for direct marketing purposes, including being profiled for this purpose.

With whom do we share your personal data?

The recipients of your personal data are the entities to which the Administrator subcontracts the performance of activities that require data processing (processors): authorised employees of the Administrator, entities in the Group, entities providing the following services: facility security, IT support and IT systems supply, payment system operators, payment operators, law firms, consulting entities.

For other persons/companies, we would like to inform you that your personal data will not be shared with others without your consent.

They will also neither be transferred to third countries, i.e. outside the European Economic Area (EEA), nor to international organisations, unless this is necessary for the purposes listed in Article 6(1) of the DPA. However, when such a situation arises, you will be notified.

How long do we store your personal data?

We keep your personal data for the duration of the contracts concluded with you, and also after its termination for the purposes of:

1. the assertion of claims in connection with the performance of the contract, 2)
2. to comply with legal obligations, including in particular tax and accounting obligations,
3. prevention of fraud and abuse,
4. statistics and archiving,
5. for a maximum period of 10 years from the date of completion of the contract.

Do we process your personal data automatically (including through profiling) in a way that affects your rights?

Your data will not be processed in an automated manner without your separate consent, including on the basis of profiling