PERSONAL DATA PROTECTION INFORMATION NOTICE

I. DATA CONTROLLER

METALBOX Sp. z o.o.  Bogucin Mały 116, 32-300 Olkusz

II. PERSONAL DATA PROCESSED

We process personal data in connection with:

1. MANUFACTURE AND SALE OF METAL PRODUCTS AND RELATED SERVICES

We are a manufacturer of metal products and cooperate with other manufacturers and distributors.

• Data subjects: contractors, potential contractors, as well as their employees and persons cooperating with them.
• Data processed: first and last names, business details, contact details, address details, bank account numbers, registration and identification data (e.g. PESEL). If the sale involves transport, we may additionally process vehicle registration numbers, the driver's ID card or passport number, as well as the driver's licence number.

2. RECRUITMENT

• We conduct recruitment processes for employees.
• Data subjects: individuals applying for employment.
• Data processed: personal data provided by the applicant or recruitment agency, such as first and last name, date of birth, contact details, correspondence address, education, employment history and professional qualifications.
• Personal data obtained as part of the recruitment process is processed on the basis of consent. A person who has given consent has the right to withdraw it at any time, without affecting the lawfulness of processing carried out prior to its withdrawal.

3. BUSINESS OPERATIONS

• We process personal data as part of the day-to-day operation of our business.
• Data subjects: entities contacting the company, as well as their employees and persons cooperating with them, and persons present on our premises and in our buildings in connection with video surveillance.
• Data processed: first and last names, business details, contact details, address details, registration and identification data, vehicle registration numbers of vehicles entering the company premises, in accordance with applicable laws, as well as video surveillance footage (stored for up to 14 days). In the event of a security breach, surveillance footage may be retained for the purposes of any proceedings conducted by public authorities.

Legal Basis and Purposes of Data Processing:

1. consent during the recruitment process;
2. entering into and performing a contract;
3. compliance with legal obligations, including:
   a. retaining data for the purposes of potential future proceedings by authorised authorities;
   b. settlement of public-law charges and taxes;
   c. submitting and handling complaints;
   d. investor relations.
4. legitimate interest:
   a. documenting the performance of transactions;
   b. recruitment;
   c. establishing, pursuing and defending claims;
   d. direct marketing
   e. preparing reports, analyses and statistics, including turnover and sales, as well as for internal purposes;
   f. verifying the payment reliability of contractors;
   g. preventing and detecting criminal offences / verification and identification of contractors.

III. SOURCE OF PERSONAL DATA

The personal data we process is provided directly by the data subjects or obtained from publicly available sources.

IV. NO OBLIGATION TO PROVIDE PERSONAL DATA

Providing personal data is generally voluntary; however, providing certain data may be a prerequisite for entering into a contract.

V. RECIPIENTS OF PERSONAL DATA

We may disclose the personal data we process, including through authorised persons, to:

1. processors acting on our behalf:
   a) entities acting as intermediaries in transactions entered into by us;
   b) subcontractors;
   c) entities providing advisory, consulting, auditing and IT services, as well as legal, tax and accounting assistance, and other entities acting on our behalf.
2. other data controllers processing data on their own behalf, whose involvement is necessary to carry out the relevant process, including:
   a) other parties to transactions;
   b) transport companies;
   c) freight forwarders;
   d) customs agencies;
   e) insurers;
   f) state and local government authorities and offices;
   g) courts;
   h) bailiffs;
   i) business information agencies;
   j) postal operators and courier companies;
   k) banks;
   l) entities cooperating with us in accounting, tax, legal, occupational health and safety matters, to the extent that they act as data controllers.
    

VI. DATA RETENTION PERIOD
We process personal data for as long as necessary to achieve the purpose for which it was collected. Once the purpose has been fulfilled, we archive the personal data in accordance with applicable laws. Due to the statutory limitation periods for civil and public-law claims, personal data is deleted after 10 years from the end of the year in which the purpose of processing was fulfilled.

VII. RIGHT TO OBJECT TO DIRECT MARKETING
A person whose personal data is processed for direct marketing purposes has the right to object to the processing of their personal data for marketing purposes. An objection may be submitted by email to biuro@metalbox.com.pl or by post to the address provided below.

VIII. AUTOMATED DECISION-MAKING
We do not make decisions based solely on automated processing, including profiling, of personal data.

IX. TRANSFER OF PERSONAL DATA OUTSIDE THE EEA
If it is necessary to enter into a transaction with a contractor outside the EEA, it may be necessary to transfer personal data outside the EEA.

We may transfer data relating to drivers or employees of entities involved in the transaction.

As a general rule, transfers of personal data outside the EEA will be carried out on the basis of Standard Contractual Clauses approved by the European Commission.

X. RIGHTS OF DATA SUBJECTS
Data subjects have the right to:

1. rectification (correction) of their data, within the scope and under the conditions specified in Article 16 of the GDPR;
2. erasure of their data, within the scope and under the conditions specified in Article 17 of the GDPR;
3. restriction of processing (suspension of data processing operations or retention of data, as applicable to the request), within the scope and under the conditions specified in Article 18 of the GDPR;
4. access to their data (including obtaining information about the data we process and a copy of the data), within the scope and under the conditions specified in Article 15 of the GDPR;
5. data portability, within the scope and under the conditions specified in Article 20 of the GDPR;
6. object to the processing of their personal data (including profiling), where the legal basis for processing is our legitimate interest, within the scope and under the conditions specified in Article 21 of the GDPR.

To exercise any of the above rights, please submit a request specifying the scope of the data covered by the request by email to biuro@metalbox.com.pl or by post to the address provided below.

To protect personal data against unauthorised access, we may request additional identification of the data subject or additional information.

The possibility of exercising each of the above rights is determined by applicable law and may depend, for example, on the legal basis and purpose of processing.

XI. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY
Data subjects have the right to lodge a complaint with the supervisory authority regarding the processing of their personal data, as indicated at www.giodo.gov.pl.

XII. CONTACT AND INFORMATION
Our contact details:

METALBOX Sp. z o.o.

Bogucin Mały 116

32-300 Olkusz

Poland

For any questions regarding personal data protection, please contact us at biuro@metalbox.com.pl.

 Personal Data Protection Information Notice.

The controller of your personal data is METALBOX Sp. z o.o., Bogucin Mały 116, 32-300 Olkusz, Poland.

Your personal data is processed, among other things, for the purpose of establishing or maintaining business relationships and for the direct marketing of products or services offered by METALBOX Sp. z o.o.

The legal basis for the processing of your personal data is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, commonly referred to as the General Data Protection Regulation (GDPR).

The legitimate interests pursued by the controller include establishing or maintaining business relationships with you and conducting direct marketing of METALBOX Sp. z o.o. products or services.

You have the right to object to the processing of your personal data for marketing purposes. An objection may be submitted by email to biuro@metalbox.com.pl.

You have the right to access your personal data, rectify, erase or restrict the processing of your data, as well as the right to object to processing and the right to data portability, within the scope and under the conditions specified by applicable law.

You also have the right to lodge a complaint with the supervisory authority concerning the processing of your personal data.