Information clause
regarding personal data processing
In implementing the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), we inform about the rules for processing your personal data and your rights related to it.
- The controller of your personal data is the State Water Holding Polish Waters (Polish Waters) having its registered office in Warsaw, 00-848 Warszawa, ul. Żelazna 59A.
- The Data Protection Officer can be contacted at the following email address – iod@wody.gov.pl.
- Your personal data can be processed to:
- comply with the legal obligations arising from the Water Law Act of July 20, 2017 (consolidated text U. (Journal of Laws) of 2018 item 2268, as amended) (legal basis: Art. 6(1)(c) of the Regulation);
- perform contracts (legal basis: Art. 6(1)(b) of the Regulation);
- in other cases, your personal data will be processed exclusively based on your previously given consent within the scope and purpose specified in the content of such consent (legal basis: Art. 6(1)(a) of the Regulation).
- The recipient of your personal data can be public authorities and entities performing public tasks or acting on the order of a public authority, within the scope and purposes arising from generally applicable laws.
- Your personal data will be processed for a period necessary to implement the purposes of processing set forth in para. 3 and subsequently for a period and within the scope required by generally applicable laws
- In connection with the processing of your personal data, you have the following rights:
- the right to have access to your personal data, including the right to obtain a copy of such data;
- the right to have your personal data rectified (corrected) – where the data are inaccurate or incomplete;
- the right to have your personal data erased (the so-called right to be forgotten) where:
- the data are no longer necessary in relation to the purposes for which they are collected or otherwise processed;
- the data subject has objected to the processing of his or her personal data;
- the data subject has withdrawn his or her consent to the processing of his or her personal data that is the basis for the processing of such data and there is no other legal basis for processing the data;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation;
- the right to demand restriction of processing of the personal data where:
- the data subject contests the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject;
- the right to data portability– where the following conditions are met jointly:
- the processing is carried out based on a contract entered into with the data subject or based on consent given by such a person;
- the processing is carried out by automated means;
- the right to object to processing of data – where the following conditions are met jointly
- there are grounds relating to your particular situation where the data are processed based on a task performed for reasons of public interest or in the exercise of official authority vested in the controller;
- the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
- Where the personal data are processed based on consent of the data subject to the processing of his or her personal data (Art. 6(1)(a) of the GDPR), you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
- If you consider that the processing of your personal data by the controller infringes any laws, you have the right to lodge a complaint to the President of the Personal Data Protection Office.
- Providing personal data by you is mandatory where a provision of law or a contract entered into between the parties are the grounds for processing the personal data, while where the processing is carried out based on consent, providing personal data to the controller is voluntary.
- Your data may be processed by automated means and will not be profiled.
