Generalna Dyrekcja Dróg Krajowych i Autostrad

This information concerns the processing of the personal data of:

1. employees and partners of the Contractors with whom Contracts have been concluded,
2. employees or partners of Subcontractors and further Subcontractors involved in the execution of Contracts,
3. natural persons, including entrepreneurs, who are parties to Contracts.

The personal data of employees or partners of Contractors, Subcontractors and further Subcontractors (your personal data) is processed exclusively in connection with the execution of the Contracts under which it was
obtained.

The processing of your personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as "GDPR".

The controller of your personal data is the General Director of National Roads and Motorways, ul. Wronia 53, 00-874 Warsaw,

tel. (022) 375 8888, e-mail: kancelaria@gddkia.gov.pl

In matters related to personal data processing, you can contact the Data Protection Officer at: iod@gddkia.gov.pl

Your personal data is processed:

1. in order for the Data Controller to fulfil its legal obligation imposed by the provisions of the Accounting Act, the Public Procurement Law, the Public Finance Act, the Public Roads Act and the National Archival Resources and State Archives (Article 6(1)(c) of the GDPR),
2. in connection with the performance by the Data Controller of tasks carried out in the public interest or exercising of public authority entrusted to the Data Controller pursuant to the laws referred to in point 1 (Article 6(1)(e) of the GDPR),
3. for the purposes of the legitimate interests pursued by the Data Controller, including maintaining direct contact with employees and partners of Contractors, Subcontractors and further Subcontractors related to the performance of the Contract (Article 6(1)(f) of the GDPR).

The Data Controller collects and processes the following types of personal data:

• Given name and surname;
• Email address;
• Telephone number;
• Position
• Name and address of your employer, or other entity with which you cooperate;
• Your documents, opinions and positions directly related to the execution of the Contract;
• In the case of meetings or videoconferences, your image and your opinions and positions.

Under certain types of Contracts, the Data Controller may also process:

• number of professional licence (e.g. for designers and site managers);
• identity card/passport number and PESEL number (if this data is included in the content);
• powers of attorney,
• professional experience or education (if certain level of professional experience or education of employees is required in the contract);
• NIP number, REGON number, bank account number (applies to natural persons who are parties to the Contracts).

The Data Controller receives your personal data directly from you or from Contractors, Subcontractors or further Subcontractors under the Contract.

Recipients of your personal data may include, in particular:

1. Contractors, Subcontractors or further Subcontractors under the Contract,
2. public administration bodies issuing decisions required for the performance of the COntract,
3. entities to which the Data Controller has entrusted personal data processing, e.g. IT service providers.

In connection with the operation of the Data Controller's ICT systems, your personal data may be transferred to a third country. Such transfer shall be based on standard contractual clauses (Article 46(2)(c) of the GDPR).

You may request detailed information concerning the conditions for the transfer of your personal data to third countries from the Data Protection Officer at: iod@gddkia.gov.pl.

Your personal data will be stored for the period necessary to perform and settle the Contract, for the purpose of which it was collected, and then for the period resulting from the provisions of the Act Page 3 of 4 of 14 July 1983 on the National Archival Resources and State Archives (Journal of Laws of 2019, item 553, as amended) and regulations issued based on this Act.

As data subjects, you have the following rights:

1. the right of access and rectification of personal data You may enquire the Data Controller whether your personal data is processed, what kind of personal data is processed and how the Data Controller obtained it, as well as what the purpose of the processing, its legal basis and data retention period is. If the data processed is out of date, you may request the Data Controller to update it.
2. the right to request the restriction of data processing (provided the conditions set out in Article 18 of the GDPR are met) If the processing of your personal data is restricted, the Data Controller will only be permitted to store your personal data. The Data Controller will not be allowed to transfer the data to other entities, modify or delete it. The restriction of personal data processing is temporary and lasts until the Data Controller assesses whether the personal data is correct, processed in accordance with the law and necessary for the purpose of the processing. The processing of personal data is also restricted in the event an objection is made to the processing of the data (until the said objection has been considered by the Data Controller).
3. the right to request personal data deletion (if the conditions set out in Article 17 of the GDPR are met) Personal data may be deleted when its further processing is no longer necessary for the purpose of which it was collected or when it was processed unlawfully. The detailed conditions for exercising this right are set out in Article 17 of the GDPR.
4. the right to object to the processing of personal data - in cases when the basis for data processing is the fulfilment of the Data Controller's public tasks or pursuing its legitimate interests (Article 6(1)(e) or (f) of the GDPR). Lodging an objection results in the cessation of personal data processing by the Data Controller, unless the Data Controller demonstrates the existence of compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, assertion or defence of claims.
5. right to lodge a complaint with the President of the Office for Personal Data Protection.

To Whom It May Concern:

1. it is not necessary to sign a declaration that you have read this information,
2. information on personal data processing by GDDKiA can be found on GDDKiA website, at: https://www.gov.pl/web/gddkia/ochrona-danych-osobowych