Regarding the processing of personal data, we kindly inform you that:
CCGT Grudziądz sp. z o.o. makes every effort to protect the data of individuals using the services offered on its websites. In order to ensure lawful, fair, and transparent processing of your personal data while using our services, in accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR), we kindly inform you:
1. Who is the Controller of your personal data?
The administrator of Your personal data (ADO) is CCGT Grudziądz sp. z o.o., based at Dworcowa 47 St., 86-300 Grudziądz. Correspondence address: Grunwaldzka 472 Av, 80-309 Gdańsk
2. You can contact the Data Protection Officer via email:
iod.ccgt-gr@energa.pl or by mail at the Controller’s address (see point 1).
3. For what purposes do we process your personal data?
We process your personal data for the purposes for which you contact us. These may include:
- conclusion and performance of a contract with the Controller, or actions taken at your request prior to entering into a contract;
- handling complaints and requests, responding to inquiries – this includes personal data sent via email or contained in documents attached to your submission, complaint, or request;
- compliance with legal obligations, e.g., issuing and storing invoices and accounting documents;
- purposes indicated in consents, if given – you may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing based on consent before its withdrawal;
- enabling access to website resources;
- establishing, pursuing, or defending legal claims;
- archiving correspondence;
- contacting you.
4. On what legal basis do we process your personal data?
- Article 6(1)(a) GDPR – voluntary consent, which may be withdrawn at any time;
- Article 6(1)(b) GDPR – conclusion and performance of a contract, or actions taken at your request prior to entering into a contract;
- Article 6(1)(c) GDPR – compliance with legal obligations;
- Article 6(1)(f) GDPR – legitimate interests, e.g., marketing of own products, establishing, pursuing or defending claims, archiving correspondence.
5. Providing the data required to correspond with the Controller is voluntary but necessary to handle your case.
6. How long will we process your data?
Data will be processed for the duration necessary to achieve the purposes outlined in point 3:
- for contract performance – until its termination, and thereafter for the period required by law or necessary to establish, pursue or defend claims;
- for compliance with legal obligations – for the duration of those obligations;
- based on consent – until its withdrawal;
- for legitimate interests – until a valid objection to processing is raised.
7. To whom do we disclose your personal data?
- Service providers – we disclose your data to service providers used by the Controller; depending on contractual arrangements, they may act as processors under the Controller’s instructions;
- Public entities and authorities – e.g., Prosecutor’s Office, Courts, Police, President of the Personal Data Protection Office, or President of the Office of Electronic Communications – only if required by law;
- Orlen Group companies, including Energa SA and its subsidiaries, based on internal agreements;
- Entities delivering correspondence;
- Entities providing document destruction services;
- Entities providing legal and litigation advisory services;
- IT service providers managing systems that process your personal data.
8. GDPR grants you numerous rights.
You may submit a request to the Controller or Data Protection Officer (see points 1 and 2) regarding your personal data, including:
- rectification (e.g., correction) if inaccurate;
- erasure;
- restriction of processing;
- access to your data and obtaining a copy;
- withdrawal of consent, if it was the basis for processing – withdrawal does not affect the lawfulness of prior processing;
- objection to processing;
- data portability to another Controller;
- lodging a complaint with the President of the Personal Data Protection Office.
The scope and applicability of each right depend on legal provisions and the basis and purpose of processing.
