In this personal data protection policy we would like to provide you with detailed information concerning: the type of data we collect, for what purpose and how we use them, who we are and what are your rights. This policy aims at providing you with the information referred to in Article 13 section 1 & 2 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 r. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as „GDPR” which has been effective since 25 May, 2018. The information presented below is very important, therefore we  ask you to read it carefully.

Who is the controller of your data and contact details:

NEWAG S.A. is the controller, i.e., an entity which decides how your personal data will be used.  Newag S.A. is a company registered under  KRS 0000066315 in the Entrepreneurs’ Register  by Sąd Rejo­nowy [District Court] in Kra­ków, XII Business Division of the National Court Register, NIP [Tax Number] 7340009400, REGON [Corporate Number] 490490757,  Share and paid-in capital PLN 11,250,000.25  (hereinafter “We”)

You can contact us:

• By post at: Newag S.A., Inspek­tor Ochrony Danych Oso­bo­wych, ul. Wyspiań­skiego 3, 33–300 Nowy Sącz
• By e-mail at: iod@newag.pl

The data protection officer and contact details:

We have appointed the data protection officer to whom you can address any questions or requests in all matters related to personal data. You can do it:

• By post at: Newag S.A., Inspek­tor Ochrony Danych Oso­bo­wych, ul. Wyspiań­skiego 3, 33–300 Nowy Sącz
• By e-mail at: iod@newag.pl

Detailed information  about use of your personal data, your rights and conditions of their use is also available at www.newag.pl

What are the purposes of processing your personal data and on what legal basis do we process your personal data ?

We use your personal data obtained prior to entering into a contract and in the duration of the contract for the following purposes:

1. For the performance of a contract binding us (legal basis: art. 6 section 1 b) GDPR e.g.,:

• as part of sales,
• processing complaints,
• granting a warranty,
• preparing product pricing,
• ensuring proper quality of services,
• processing requests addressed to us,
• processing your enquiries which are directed to us with regard to performing the contract.

2. for compliance with a legal obligation to which the controller is subject  (legal basis: art 6 section 1c) GDPR e.g.,:

• providing data upon demand of courts or the police

3. for the purposes of the legitimate interests pursued by us (legal basis: art 6 section 1f) GDPR e.g.,:

• ensuring processing of payment service,
• processing your enquiries which are directed to us with regard to performing the contract,
• collecting receivables: conducting court, arbitration and mediation proceedings,
• storing data for archiving purposes (our compliance with obligations under the law),
• detecting fraud and preventing it,
• verifying financial credibility.

Do you have to give us your personal data?

Providing your personal data is voluntary. We need you to provide personal data which are necessary to enter into and perform a contract, with regard to each transaction. If we do not receive the necessary personal data, unfortunately, we will not be able to enter into a contract with you, and consequently, to start collaborating with you. If we are so required by the provisions of the law, we may need to require from you to provide other necessary data e.g., for tax purposes.

Who can we release your data to?

1) to our employees and associates who must have access to the data in order to perform our obligations;

2) to entities processing data on our behalf which participate in performing of our tasks:

1. other entities which are intermediary in selling our services,
2. maintaining our ICT systems and supplying ICT tools to us,
3. subcontractors supporting us in performing a contract binding us with you e.g., in processing correspondence,
4. entities which provide to us consulting, advisory, auditing, legal, tax and accounting services;

3) to other data controllers processing data on their own behalf:

1. to collaborating entities,
2. entities providing postal and courier services;
3. entities purchasing debts;
4. entities conducting business activities related to payments (banks, payment institutions);
5. entities collaborating with us in dealing with accounting, tax and legal matters – in the scope in which they will become data controllers;

4) to public authorities e.g., courts, prosecutors, tax authorities.

How long can we store your data?

In transactions connected with performance of a contract – for the duration of the contract and for the time as long as it is possible to enforce claims arising out of contract performance, entered into as a result of the transaction, from the date these transactions were done or until the date when the court judgment becomes final and absolute.

Regarding compliance with provisions of the law, your personal data will be stored for the periods set forth in applicable laws e.g., tax laws.

In the period during which we can be liable for non-compliance with an obligation, we will store your data for the duration of this period.

What are your rights?

You have the following rights resulting from our processing of your personal data:

• the right to request from the controller access to your personal data including obtaining information concerning your personal data and obtaining copy of your personal data;
• the right of rectification of your personal data if they are incorrect and the right to supplement incomplete data;
• the right to erase your personal data;
• the right to restrict processing of your personal data;
• the right to data portability;
• the right to lodge a complaint with a supervisory authority for personal data protection i.e., Pre­zes Urzędu Ochrony Danych Oso­bo­wych [Chair of the Personal Data Protection Office] (contact address: ul. Stawki 2, 00–193 War­szawa) in case of finding unlawful processing of your personal data;
• the right to withdraw consent at any time if you grant us such consent without providing reasons;
• the right to object to:
  • our processing of your personal data for marketing purposes if you grant us such consent in the future, including objection to profiling;
  • our processing of your personal data for the purposes of legitimate interests pursued by us – for reasons related to your particular situation.

You can exercise the above listed rights at any time by making an appropriate request. You can send requests concerning the above-described situations to our data protection officer using the contact information provided above.

We have an obligation to inform you on steps undertaken due to your request without undue delay but in any case within one month of receipt of your request.

When necessary, the above period may be extended by two further months due to complexity and the number of requests received. However, we must notify you of such extension within one month providing reasons for the delay.

If we do not undertake any action on your request then we will immediately, without undue delay and in any event within one month of receipt of your request, notify you of the reasons for not undertaking any action and of the possibility to lodge a complaint to Pre­zes Urzędu Ochrony Danych Oso­bo­wych  [Chair of the Personal Data Protection Office] as well as of seeking a judicial remedy before courts.

We will provide you with the information referred to above in writing by, upon our discretion,:

• registered mail sent to the postal address provided by you or
• electronic mail sent to the email address provided by you.

All communication and actions undertaken by us related to your request as set forth above are free of charge. However, if your demands are manifestly unfounded or excessive e.g., because of their repetitive character, we may:

• charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested or
• refuse to act on the request.

We shall inform each recipient of your personal data of the rectification or supplementing or removing or restricting processing of your personal data which we implemented upon your request. We will not be obligated to provide such information only when it proved impossible (e.g., the company was closed down) or if it involved excessive effort (the data was revealed a long time ago and we were unable to contact the recipient despite numerous attempts to do so.) When requested by you, we will inform you about the recipients which we notified of the rectification or erasure or restriction on processing of your personal data as well as of the recipients which we were unable to notify.

Your personal data will not be transferred to any third country or any international organisation.

Your personal data will not be subject to profiling or any automated decision-making.