The administrator of your personal data is Quality and Human Services sp. z o.o. based in Tychy at ul. Fabryczna 2, entered into the register of entrepreneurs of the National Court Register under number 0000564567 (hereinafter also referred to as the “Administrator”). The given address is also the Administrator’s address for contact; contact is possible via email at: [email protected]

The purpose of processing your personal data obtained by the Administrator – depending on the circumstances in which your data was obtained – is:

1. in the case of the Administrator’s contractors or persons acting on behalf of such a contractor – performance of contracts concluded with entities you represent or contracts concluded directly with you, including the execution of rights and obligations arising from these contracts,
2. in the case of service providers or suppliers other than the Administrator’s contractors or persons acting on their behalf – coordination of the service or delivery performed for the Administrator,
3. in the case of persons providing their data to the Administrator for the purpose of establishing possible cooperation or other relationships – potential business cooperation or other relationships, or the possibility of concluding a contract in the future,
4. in the case of representatives of public authorities, government and local administration, law enforcement agencies, courts, inspections, or other controlling institutions – cooperation in the implementation of rights and obligations imposed on the Administrator by universally binding regulations,
5. in the case of persons not listed above who make inquiries or seek another form of contact with the Administrator – determining the subject of the inquiry or need for contact,
6. in the case of persons recorded by video surveillance devices – ensuring security and protection of the Administrator’s property.

In each case, your personal data is processed for the protection of the Administrator against possible claims or obligations arising or which may arise from universally binding regulations.

The legal basis for processing your personal data are the regulations relating to the relationship between you and the Administrator or the entity you represent and the Administrator. Your personal data is processed on the basis of:

1. in relation to the persons indicated in points I and II above – Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”) (as necessary for the performance of a contract or to take action at your request prior to entering into a contract) and Article 6(1)(f) GDPR (as processing necessary for the purposes of the legitimate interests pursued by the Administrator, namely the ongoing conduct of business operations),
2. in relation to the persons indicated in points III and V above – Article 6(1)(a) GDPR (as consent expressed – through actions taken solely at your initiative – for the processing of personal data) and Article 6(1)(f) GDPR (as processing necessary for the purposes of the legitimate interests pursued by the Administrator, namely the ongoing conduct of business operations),
3. in relation to the persons indicated in point IV above – Article 6(1)(c) GDPR in conjunction with legal provisions empowering you to act on behalf of the entity you represent and obliging the Administrator to cooperate with entities represented by you (as processing necessary for compliance with a legal obligation incumbent on the administrator),
4. in relation to persons indicated in point VI above – Article 6(1)(f) GDPR (as processing necessary for the purposes of the legitimate interests pursued by the Administrator, namely security and protection of the Administrator’s property).

At the basis of processing your personal data, regardless of the circumstances of their acquisition by the Administrator or the category of persons to which you belong, lies necessity for the purposes resulting from the legitimate interests of the Administrator, such as protection against potential claims or obligations that may be imposed as a result of universally binding provisions of law (Article 6(1)(f) GDPR).

Your personal data may be transferred as necessary for a given purpose – to the following entities: clients of Quality and Human Services sp. z o.o.; entities providing services for Quality and Human Services sp. z o.o., including HR, payroll, legal, IT support, occupational health, safety, suppliers, public or local government authorities, law enforcement, courts, supervisory and controlling entities and institutions.

Your personal data will be stored for the period necessary for the relationships linking you with the Administrator, and the periods listed below are maximum periods. In all cases, personal data derived from video surveillance will be stored for a period of 3 months, unless it constitutes evidence in proceedings conducted under law or the Administrator becomes aware that it may constitute evidence in such proceedings – in which case the period of storage of your personal data from video surveillance may be extended until the final resolution of such proceedings. In all cases (except for data recorded by video surveillance), for the purposes of protection against possible claims or obligations resulting from universally binding provisions of law, the Administrator may store your data for a period of up to 11 years, calculated as follows:

1. for persons specified in point I above – from the end of validity or performance of contracts with entities you represent,
2. for persons specified in point II above – from the completion of service or delivery for the Administrator,
3. for persons specified in points III and V above – from the moment of data provision, unless another basis for processing arises, indicating another initial date for calculating the storage period,
4. for persons specified in point IV above – from the completion of activities, unless they result in further civil, administrative, or criminal proceedings, including court proceedings – in that case, this period will be counted from the moment of delivery of the final and binding decision in the case.

Under applicable regulations, you are entitled to:

1. request from the Administrator access to personal data concerning you,
2. rectification of such data,
3. deletion of such data,
4. restriction of processing concerning your personal data,
5. object to the processing of data, and
6. data portability – on the terms, extent, and in the situations specified in Articles 15 to 22 GDPR.

If you have given your consent to the processing of personal data, you are entitled to withdraw this consent at any time, and withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

If you believe that your personal data is being processed in violation of GDPR or other legal acts, you are entitled to lodge a complaint with the competent supervisory authority. In the Republic of Poland, the authority competent for matters concerning personal data is the President of the Personal Data Protection Office (Office of the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

Providing your personal data is obligatory to the extent that relevant regulations require you to do so or entitle the Administrator to request its provision. In other cases, providing your personal data is voluntary. If you do not provide your personal data, the potential consequences may be the inability to exercise rights or obligations arising from concluded contracts, the inability to establish a relationship or provide requested information or respond to an inquiry. An indirect consequence – if you act as a representative of another entity – of not providing your personal data may be the disciplinary consequences imposed on you by this entity.
Your personal data will not be used for the sole purpose of automated decision-making regarding you, including profiling.