In accordance with the requirements of the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR), we would like to inform you about the following rules regarding the processing of personal data:

Data Controller (DC)
OILB.IO P.S.A
8 Powstańców Sejneńskich Street
16-500 Sejny, Poland

Data Protection Officer (DPO)
Agata Czuper
agata@oilb.io

The DC processes your data for the following purposes:

  1. Recruitment of employees
    • Legal basis: Article 6(1)(b) GDPR, Article 22(1) of the Labour Code, and Article 9(2)(b) GDPR (sensitive data). Providing this data is a statutory requirement necessary for recruitment purposes. You are obliged to provide this data; failure to do so will result in the inability to participate in the recruitment process. Other personal data not required by law (e.g., interests) is processed based on Article 6(1)(a) GDPR, i.e., based on your voluntary consent, and providing it does not affect your ability to participate in recruitment.
    • Data retention period: Your personal data will be processed until the recruitment process is completed, and if you have consented to participate in future recruitments, no longer than 12 months from the date of submission of application documents.
  2. Employee hiring
    • Legal basis: Article 6(1)(b) GDPR, Article 22(1) of the Labour Code, and Article 9(2)(b) GDPR (sensitive data) – processing is necessary for the performance of a contract, Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation, Article 6(1)(f) GDPR – the legal basis for processing is the legitimate interest of the Controller, and Article 6(1)(a) GDPR – in the case of personal data not required by law – the legal basis for processing is your consent.
    • Data retention period: Depending on the purpose for which the personal data is processed, the retention period is: 50 years or 10 years for contracts concluded after January 1, 2019 (depending on the date of employment) from the end of the year in which the employment relationship ended.
  3. Collaboration with external companies with which the DC has signed a service agreement
    • Legal basis for processing: Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or taking steps prior to entering into a contract; providing data is necessary for cooperation.
    • Data retention period: For the duration necessary to fulfill the agreements made and the rules contained therein. A minimum of 5 years from the end of the year in which the last invoice/accounting document was issued.
  4. Contract execution
    • Source: Data of employees and collaborators provided in the course of cooperation by the entity that is a party to the contract.
    • Legal basis for processing: Article 6(1)(f) GDPR, for contacting in matters related to the execution of the main Agreement, for administrative purposes, including related to the organization of cooperation and supervision over the performance of Services, or the fulfillment of other obligations or rights under the main Agreement, for evidentiary purposes related to the execution of the main Agreement, to pursue claims related to the execution of the main Agreement.
    • Data retention period: Your personal data will be stored by the Controller for at least the duration of the agreements concluded between the companies, and if necessary for evidentiary purposes, personal data may also be stored until the expiration of claims arising from business activity or the conclusion of court proceedings related to the aforementioned agreements.
  5. Service sales
    • Legal basis for processing: Article 6(1)(b) GDPR – processing is necessary for the performance of the contract between you and the Office, Article 6(1)(c) GDPR – for keeping accounting and tax documentation, and Article 6(1)(f) GDPR – for achieving the goal related to possible determination, pursuit of claims or defense against claims.
    • Data retention period: Your data will be retained for the duration of the contract. A maximum of 6 years from the end of the accounting year in which the last invoice was issued.
  6. Future claims
    • Legal basis for processing: Article 6(1)(f) GDPR.
    • Data retention period: For the period of limitation of claims under the appropriate type of contract: contract for work, commission – 2 years, cooperation agreement – 3 years.
  7. Conducting marketing activities related to the conducted business
    • Legal basis for processing: Article 6(1)(a) GDPR and Article 6(1)(f) GDPR. Providing data is voluntary.
    • Data retention period: Until consent is withdrawn or an objection is raised by the data subject.
  8. Responding to inquiries sent via email
    • Legal basis for processing: Article 6(1)(f) GDPR – legitimate interest of the DC. Providing data is voluntary.
    • Data retention period: Until a response to the inquiry is provided, up to a maximum of 12 months.
  9. Protection of persons and property present on the premises of the DC
    • Source of data: Data from monitoring.
    • Legal basis for processing: Article 6(1)(f) GDPR.
    • Data retention period: From the moment of recording for a maximum of 3 months.

Rights related to the processing of personal data:

If the legal basis is Article 6(1)(a) or (b) GDPR:

  • Right to access data
  • Right to rectify data
  • Right to erasure (right to be forgotten)
  • Right to restrict processing
  • Right to data portability

If the legal basis is Article 6(1)(c) GDPR:

  • Right to access data
  • Right to rectify data
  • Right to restrict processing

If the legal basis is Article 6(1)(e) or (f) GDPR:

  • Right to access data
  • Right to rectify data
  • Right to erasure (right to be forgotten)
  • Right to restrict processing
  • Right to object to processing

Right to withdraw consent:

If processing is based on your consent (Article 6(1)(a) GDPR), data will be processed until consent is withdrawn. Consent can be withdrawn at any time by sending an email to the address provided above or in person at the Administrator’s office. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Upon withdrawal of consent, data will be processed for the purpose of protecting against claims (Article 6(1)(f) GDPR) for the period in accordance with applicable law, for a maximum of 3 years.

Right to lodge a complaint with the supervisory authority:

If you notice violations by the DC regarding the security of data processing, you have the right to lodge a complaint with the supervisory authority responsible for personal data protection, i.e. the President of the Personal Data Protection Office. The current address of the supervisory authority is: President of the Personal Data Protection Office, Stawki 2, 00-193 Warsaw.

Data Security:

Your personal data will be processed in accordance with the provisions of GDPR, in writing or electronically, for the purposes stated above and using appropriate methods to ensure the security and confidentiality of personal data in accordance with Article 32 of GDPR. The cooperation between our company and business entities is regulated by the relevant legal provisions.

Data Recipients:

In connection with the processing of data, your personal data may be shared with other recipients or categories of recipients, such as:

  • Authorities and institutions, as well as relevant public and municipal administration entities in the scope and for purposes arising from applicable law.
  • Companies providing services to the DC, particularly in the areas of: personal data protection, entities performing audit services, IT support, computer software, finance, insurance, device servicing, correspondence.
  • Other entities that process personal data for the Administrator based on relevant agreements.

Your data will not be processed in an automated manner, including profiling. Your data will not be processed outside the EEA.