Dear Sir or Madam,
From 25 May 2018, any organisation, natural or legal person, public authority, entity or other entity located in the European Union, which alone or jointly with others determines the purposes and means of the processing of personal data, is obliged to comply with GDPR, i.e. Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/56/EC (General Data Protection Regulation) (Official Journal of the European Union of 2016 L 119).
Pursuant to GDPR:
1. Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
2. Processing of personal data means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Pursuant to Art. 13(1), 13(2), 14(1) and 14(2) of GDPR, Zespół Elektrociepłowni Wrocławskich KOGENERACJA S.A. ul. Łowiecka 24, 50-220 Wrocław, which within the meaning of GDPR acts as data controller, is obliged to inform you of the fact that it is responsible for the processing of your personal data in accordance with the law and in a manner that ensures the proper security of personal data, and provide you with the following information:
1. We appointed the Data Protection Officer, which can be contacted with regard to the processing of personal data and the exercise of rights related to the processing of data via the postal address: Data Protection Officer, Zespół Elektrociepłowni Wrocławskich KOGENERACJA S.A. ul. Łowiecka 24, 50-220 Wrocław and e-mail address: email@example.com
2. We process personal data in accordance with the provisions of GDPR and the Polish regulations on the protection of personal data:
a. for the purpose of entering into and performance of the contracts (item (b) of Art. 6(1) of GDPR), including for the purpose of determination of technical requirements for connection to the network as well as entering into and performance of the contract for the connection of real estates and facilities to the network, and for the purpose of the provision of energy sales services, energy transmission services, construction contracts for the construction of heat infrastructure and contracts regarding the management of the network assets (repairs, modernizations, maintenance, servicing and troubleshooting);
b. for the purpose of fulfilment of the Company’s legal obligations (item (c) of Art. 6(1) of GDPR) in connection with business operations and performance of the contracts made, resulting from the provisions of the energy law, provisions on official statistics, tax law regulations and other generally applicable legal regulations, in order to ensure the energy security of the network and the continuity of energy supplies;
c. upon your consent (item (a) of Art. 6(1) of GDPR), provided that you have given your consent to the processing of your personal data for the specified purposes. The consent may be withdrawn at any time. The withdrawal of consent shall not affect the lawfulness of processing based on the consent before its withdrawal;
d. for the purposes resulting from legitimate interests pursued by the Company or a third party (item (f) of Art. 6(1) of GDPR) in order to:
3. Your personal data may be received by entities of the following categories:
a) Grupa Kapitałowa PGE,
b) entities authorized to receive them under the applicable provisions of law (e.g. courts, prosecutor’s office, bailiffs, state authorities), including under the provisions of the energy law,
c) entities providing the Company with services regarding the execution and implementation of the connection process,
d) entities providing the Company with advisory, audit, inspection, legal and debt collection services,
e) entities providing the Company with services regarding execution and implementation of the servicing, maintenance, modernization, repairs, troubleshooting, and heat, water and electricity meter reading,
f) energy distributors,
g) business information offices,
4. The data may also be transferred to the entities who process data on our behalf and to their authorized employees, provided that such entities process the data on the basis of a contract with us, only in accordance with our instructions and keeping the information confidential.
5. Your personal data are not transferred to recipients from outside the European Union.
6. We process personal data for the period necessary for the specified purposes of processing as follows:
a. to enter into and perform contracts for the connection of real estates and facilities to the network: for the period of implementation and the duration of the contract and the warranty, and thereafter for the period required by the law or within the scope necessary to pursue possible claims;
b. to enter into and perform contracts for the provisions of energy sales services: for the period of implementation of the contract, and thereafter for the period required by the law or within the scope necessary to pursue possible claims;
c. to enter into and perform construction contracts for the provisions of energy sales services for the construction of heat infrastructure: for the period of implementation of the contract, and thereafter for the period required by the law or within the scope necessary to satisfy any claims;
d. to fulfil the Company’s legal obligations (item (c) of Art. 6(1) of GDPR): for the period required to fulfil these obligations;
e. on the basis of your consent to the processing (item (a) of Art. 6(1) of GDPR), until this consent is withdrawn;
f. for the purposes resulting from legitimate interests pursued by the Company or a third party (item (f) of Art. 6(1) of GDPR) – with respect to your rights and freedoms, until we have fulfilled the legitimate interests on which such processing is based, for the period necessary to satisfy any claims, or until such processing is objected, unless there are legitimate grounds for further processing.
7. You have the right to:
a. request access to and rectification of personal data or restriction of processing, portability or erasure of personal data,
b. to the extent that the processing of personal data is based on your consent, to withdraw your consent at any time,
c. object the processing of personal data at any time:
– for the reasons related to your specific situation, when the Company processes the data for the purposes resulting from legitimate interests (Art. 21(1) of GDPR),
– for the purposes of direct marketing, including profiling for marketing purposes, to the extent that the processing of your data is related to such direct marketing (Art. 21(2) of GDPR),
d. file a complaint with a supervisory authority, i.e. the President of the Office for Personal Data Protection, in the case where you consider that we process your personal data contrary to the provisions of GDPR.
8. In order to enable us to issue technical requirements for network connection, to enter into and perform contracts, and to provide energy sales services, you are obliged to provide us with your personal data. Therefore, as a rule, the personal data we process are obtained directly from you.
9. We may collect categories of personal data that have not been obtained directly from you from the following entities:
a. from the person who represents you on the basis of a power of attorney granted,
b. from the entities to which you have given your consent to transfer of personal data,
c. from the Land and Mortgage Electronic Registration Systems, the Central Registration and Information on Business and the National Court Register.
10. The processing of your personal data is not automated and the data are not profiled by the Company.
In order to request the Company to take a particular action, to submit a request to exercise particular rights or to report a data breach, you may use the questionnaire below: