Personal data processing Policy

Personal data processing Policy
in Lion Environmental Sp. z o.o.

Definitions

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

Company or Administrator - Lion Environmental Limited Liability Company based in Ratuszowa 11, 03-450 Warsaw, Poland, registered in District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register (KRS), KRS ID: 0000830014, TAX ID: 1133011227, REGON: 385612236, share capital 50 000,00 PLN. Contact: tel. 881 331 080, e-mail admin@lionenvironmental.com;

Personal data - any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data;

Subject - an individual to whom personal data processed by the Administrator relates, such as a person visiting the Administrator's premises or making contact with the Administrator.

Information about the processing of personal data on the website

Purpose and basis of data processing

In cases where correspondence is addressed to us, as well as phone calls on matters that are not related to our ongoing cooperation, in particular to the concluded contract, personal data shall be processed solely for the purpose of communication and resolution of the matter to which the contact relates. In this situation, the basis for the processing of personal data is the realization of our legitimate interests involving correspondence (art. 6(1)(f) GDPR);
Personal data may be processed for the purpose of administering the https://www.lionenvironmental.com website. In this situation, the basis for processing personal data is the realization of our legitimate interests consisting in the administration of the website (Article 6(1)(f) GDPR). Our legitimate interests may also consist of the protection and support of our business, our employees and associates, business partners, the prevention and detection of fraud and crime, the promotion of our services, and, when necessary, the investigation and defence of claims.

In connection with the purposes outlined, we collect and process the data contained in communications directed to us: your name, e-mail address, telephone number, details of correspondence we send to you that you open, information about browsing behaviour, cookies, IP address, if necessary, other data sent via standard HTTP(S) requests, and data used to maintain your online session.

Lion Environmental has a public social profile on LinkedIn (https://linkedin.com/company/lion-environmental). Accordingly, as an Administrator, it processes data left by visitors to this profile (including comments, online identifiers). Personal data of such persons is processed for the purposes of:

enabling activity on the LinkedIn profile;
to effectively run the profile by presenting information to portal users about the Administrator's initiatives and activities, and in connection with the promotion of events, services and products;
alternatively, they may be processed for the purpose of investigating and defending against claims.

The basis for the processing of personal data in the situation referred to above is the legitimate interest of the Administrator (Article 6(1)(f) GDPR) consisting of promoting its own brand and the services it provides, increasing its communication reach and supporting the Administrator's internal operations (e.g., conducting the recruitment process), as well as, if necessary, involving the investigation and defence against claims.

Data retention period

Personal data will be kept for the period necessary to fulfil the purpose for which the personal data was collected or for which it is processed, to the extent necessary to ensure compliance with applicable legal requirements.

Recipients of personal data

Recipients of the processed personal data are entities entitled to receive them on the basis of applicable regulations, in case of a request for the data in question, for example, judicial authorities.

The recipients of the data may also be the Company's employees, associates and entities processing the data on our behalf.

Subject’s rights

A subject whose personal data is processed by the Company has the right to:

request:
- access to his personal data;
- correction of the data;
- removal of the data;
- limit the data processing.
object to the processing of his data;
transferring the data;
file a complain to a relevant data protection authority.

Provision of data is entirely voluntary. However, omitting to do so will result in the inability to use the Company's services to the extent that data processing is necessary for their use.

Personal data will not be processed in a purely automated manner that may have negative legal consequences for you.

Processing of personal data of business partners

Purpose and basis of data processing

Signing and execution of the contracts in connection with the Subject is a party of it (Art. 6(1)(b) GDPR);
Fulfilment of the obligations incumbent on the Administrator under the law (Art. 6(1)(c) GDPR);
The fulfilment of the legitimate interests of the Administrator such as the execution of the contract with the business partner that the Subject represents, for the exchange of electronic and written correspondence with business partners, the handling and investigation of claims if they arise, participation in meetings, for marketing purposes, and in connection with the fulfilment of internal administrative purposes of the Company (Art. 6(1)(f) GDPR).

In connection with the aforementioned purposes, the Company collects and processes, in particular: name(s), surname, position in the organization, telephone number, e-mail address, information about the authorizations and qualifications held, Tax Identification Number, REGON, address of the registered office of the business, as well as information confirming the ability to execute the contract.

Data retention period

Personal data will be kept for the period necessary to fulfil the purposes for which they were collected and for which they are processed, no longer than the term of the contract and for the periods specified by law and the periods of limitation of claims or for the realization of the Company's legitimate interests.

Recipients of personal data

Recipients of personal data are entities that process personal data on behalf of the Company, such as subcontractors and entities that provide consulting, accounting, legal, debt collection, IT, courier, financial and insurance services, as well as contractors who are clients or ordering parties.

Subject’s rights

A subject whose personal data is processed by the Company has the right to:

request:
- access to his personal data;
- correction of the data;
- removal of the data;
- limit the data processing.
object to the processing of his data;
transferring the data;
file a complain to a relevant data protection authority.

The data will not be subject to automated processing exclusively.

Provision of personal data is voluntary, but omitting to do so will result in the inability to fulfil the purposes for which they were collected, including the inability to execute the contract.

Transfer of data outside the European Economic Area

In connection with the Company's execution of contracts with business partners, a situation may arise where personal data is shared outside the European Economic Area. In this situation, personal data will be transferred on the basis of a decision of the European Commission, or, in the absence of such a decision, with the help of contractual clauses defined by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

Processing of personal data of employees

Purpose and basis of data processing

Signing and execution of the concluded employment contract (Art. 6(1)(b) GDPR);
Fulfilment of the employer's obligations and the corresponding rights of the employee under the law (Article 6(1)(c) GDPR), in particular for the purpose of settlement and payment of salary, calculation of fees and social security contributions, notification of employees to the Social Insurance Institution (ZUS) and updating of data, fulfilment of obligations and exercise of rights in the field of labour code, as well as improvement of professional qualifications of employees;
Realization of the legitimate interests of the Administrator, i.e. for the purpose of exchanging correspondence with business partners, for marketing purposes, monitoring equipment, controlling access to premises, handling, asserting and defending claims in the event of the occurrence of counterclaims, in connection with the realization of internal administrative purposes related to the mutual transfer of data within the Company, keeping employment statistics, human resources management, centralization of processes in the field of human resources and payroll, management of safety, health and hygiene at work, fulfilment of contractual obligations imposed on the Company by business partners, e.g. in connection with the need to enable access to the place of execution of the contract, to demonstrate the qualifications and authorizations to execute the contracts executed by the Company (Article 6(1)(f) GDPR);

Data retention period

Data shall be kept for the period necessary for the purposes for which they were collected and for which they are processed, but no longer than for the period and to the extent required by law or for the fulfilment of the Company's legitimate interests. If the basis for the processing of personal data is consent, the data will be kept until the purpose to which the consent pertained is completed, but no longer than until the consent is revoked.

Recipients of personal data

Recipients of personal data are:

Entities authorized to maintain them under the law such as Tax Offices, Social Insurance Institution (ZUS);
Entities processing personal data on behalf of the Company, i.e., providing consulting services, business support, accounting, couriers, lawyers, as well as other subcontractors;
Business partners in connection with the Company's business operations, as well as in connection with enabling data subjects to use certain services for example, provision of medical/health and insurance services, financial services and trainings.

Subject’s rights

A subject whose personal data is processed by the Company has the right to:

request:
- access to his personal data;
- correction of the data;
- removal of the data;
- limit the data processing.
object to the processing of his data;
transferring the data;
file a complain to a relevant data protection authority.

For the purpose of fulfilling obligations under the employment contract related to the calculation of salary and other benefits, data may be subject to automated processing. In any case, the Company is oblided to resolve any related potential irregularities in a non-automated manner.

The provision of personal data to the extent required by law is a necessary condition for the signing and execution of the contract. In the remaining scope when the legal basis for the processing of personal data is the consent given, the provision of data is voluntary, and their omitting will result in the impossibility of realization of the purpose for which the data are collected.

Transfer of data outside the European Economic Area

Processing of personal data of associates

Purpose and basis of data processing

Signing and execution of a concluded civil code contract (e.g., commission, assignment, cooperation) (Article 6(1)(b) GDPR);
Execution of the Company's obligations as a customer or ordering party (Article 6(1)(c) GDPR), in particular for the purpose of settlement and payment of remuneration, calculation of charges and social security contributions, notification of associates to the Social Insurance Institution (ZUS) and updating of data;
Realization of the legitimate interests of the Administrator, i.e. for the purpose of exchanging correspondence with business partners, for marketing purposes, monitoring equipment, controlling access to premises, handling, asserting and defending claims in the event of the occurrence of counterclaims, in connection with the realization of internal administrative purposes related to the mutual transfer of data within the Company, keeping statistics of cooperation, management of safety, health and hygiene at workplace, fulfilling contractual obligations imposed on the Company by business partners, e.g., in connection with the necessity to enable access to the place of execution of the contract, to demonstrate the qualifications and authorizations of the Company's business partners, in connection with the need to allow access to the place of execution of the contract, to demonstrate one's qualifications and authorizations to execute the contracts concluded by the Company (Article 6(1)(f) GDPR);
On the basis of consent, for other purposes related to cooperation and execution of the contract (Article 6(1)(a) GDPR, Article 9(2)(a) GDPR).

Data retention period

The data will be kept for the period necessary for the purposes for which they were collected and for which they are processed, but no longer than for the period and to the extent required by law (e.g., data of collaborators are deleted after the expiration of the limitation period for claims, which will vary depending on the type and nature of the contract concluded) or for the realization of the Company's legitimate interests. If the basis for the processing of your personal data is consent, the data will be kept until the completion of the purpose to which the consent pertained, or until it is revoked.

Recipients of personal data

Recipients of personal data are:

· Entities authorized to maintain them under the law such as Tax Offices, Social Insurance Institution (ZUS);

· Entities processing personal data on behalf of the Company, i.e., providing consulting services, business support, accounting, couriers, lawyers, as well as other subcontractors;

· Business partners in connection with the Company's business operations, as well as in connection with enabling data subjects to use certain services for example, provision of medical/health and insurance services, financial services and trainings.

Subject’s rights

A subject whose personal data is processed by the Company has the right to:

request:
- access to his personal data;
- correction of the data;
- removal of the data;
- limit the data processing.
object to the processing of his data;
transferring the data;
file a complain to a relevant data protection authority.

For the purpose of fulfilling obligations under the employment contract related to the calculation of salary and other benefits, data may be subject to automated processing. In any case, the Company will endeavour to resolve any related potential irregularities in a non-automated manner.

Transfer of data outside the European Economic Area

Processing of personal data of job applicants

Purpose and basis of data processing

In the case of potential employment based on an employment contract, in order to perform legal obligations related to the recruitment process, the basis for processing is a legal obligation of the Administrator (Article 6(1)(c) GDPR);
In the case of potential employment based on a civil code contract, the basis for processing the data contained in the application documents is to take action prior to the signing of the contract (Article 6(1)(b) GDPR);
In order to verify one's qualifications and skills and to determine the terms and conditions of cooperation, the legal basis for the processing of personal data is the legitimate interest of the Administrator (Article 6(1)(f) GDPR). The Administrator's legitimate interest is to verify job candidates/co-operation and determine its terms and conditions;
For the purpose of establishing or asserting potential claims or defending against such claims by the Administrator, the legal basis for data processing is the Administrator's legitimate interest (Article 6(1)(f) GDPR).

Data retention period

Personal data will be kept until the end of recruitment, and if consent has been obtained to process data for future recruitment, until they are useful. In both cases, the data will be deleted no later than one year after collection, or until the consent in question is withdrawn.

Recipients of personal data

Recipients of personal data are entities entitled to receive them under the law, in case these entities make a request for data sharing.

Subject’s rights

A subject whose personal data is processed by the Company has the right to:

request:
- access to his personal data;
- correction of the data;
- removal of the data;
- limit the data processing.
object to the processing of his data;
transferring the data;
file a complain to a relevant data protection authority.

The data will not be subject exclusively to automated processing.

The provision of personal data to the extent required by law is, in accordance with the regulations, a necessary condition for the signing and execution of the employment contract, and in the case of employment under a civil code contract is a necessary condition determined by the Company. Provision of personal data is voluntary, however, omitting to do so will result in exclusion from the recruitment process.

Lion Environmental