Dear Sir/Madam, this Privacy Policy will help you make thoughtful and informed decisions regarding the processing of your personal data in the activities carried out by Valmet Automotive Sp. z o.o., located at Transportowa 1 in Żary. We kindly ask you to carefully read its content.

Introduction

This document contains Our Privacy Policy, i.e., the principles we follow in the processes of personal data processing. It also includes the content of informational obligations that, according to the law, must be presented to individuals whose data is being processed, i.e., to you. Before we go into the details, we would like to highlight some of the key principles of data protection. These are important to us, and we believe they are important to you as well.

The Privacy Policy serves four main purposes, namely:

1. explaining how the organization processes the information you provide to better tailor its products and services to your expectations,
2. ensuring that all information about the process of processing your data is presented in a clear and transparent manner,
3. assuring you that the personal data processed by the organization is secure in relation to the threats arising during its processing,
4. ensuring transparency in communications with representatives of the organization, so that your right to privacy is always guaranteed.

All information collected from you is directly or indirectly related to the organization's activities, i.e., the serial production of spare parts for motor vehicles. The company is the controller of your personal data, which means that it decides on the purposes and means of processing your data. In practice, it should be noted that as the data controller, the organization is responsible for your personal data. For any questions or concerns regarding your personal data, please contact the Data Protection Officer at the following address:

In general, all personal data within the organization is divided into processes, where they are processed based on the main purpose of the processing and the category of individuals whose data is concerned. These will be as follows:

1. Recruitment

The personal data of job candidates is processed for the purpose of selecting the most suitable candidates for specific positions, for both current and future recruitments. Your personal data in this process is processed based on your consent (in the case of sensitive data that may be included in application documents), or for the purpose of entering into an employment contract or another civil law contract, as well as based on labor law regulations. Additionally, the legal basis for processing personal data in this process is also the legitimate interest of the processing, i.e., statistical actions related to reporting and quality control. Providing personal data in this process based on your consent is voluntary, but failure to provide the data will hinder the smooth conduct of the recruitment process. In accordance with labor law regulations, the provision of certain personal data is mandatory, while others are optional. In the recruitment process, if you are not selected but you consent to the processing of your personal data for future recruitment processes, your personal data will be stored for 2 years from the last response to a proposal for a new recruitment. After this period, your data will be completely removed from the company's resources. Your personal data in this process may be entrusted to external entities participating in the recruitment process (e.g., job search portals), but we note that these entities remain under the company's constant supervision and ensure at least the same level of personal data security.

2. Employment

The personal data of employees and collaborators is processed for the purpose of managing the employment process and providing support for the execution of civil law contracts handled in other personal data processing processes, as well as ensuring the safety of persons and property. Your personal data in this process is processed based on the provisions of law regarding sensitive data when processing is necessary for health prevention or occupational medicine purposes, for assessing the employee's ability to work, ensuring healthcare or social security, when processing is necessary for fulfilling obligations and exercising specific rights by the company or by you, in the field of labor law, social security, and social protection, and when processing is necessary for establishing, pursuing, or defending claims. Additionally, your personal data may also be processed for the purpose of executing an employment contract or another civil law contract. Ultimately, your personal data is processed based on the so-called legitimate interest of the company in terms of protecting people and property, statistics, reporting, and quality control. Providing personal data in this process is mandatory, and failure to provide data may result in an inability to establish cooperation. In the employment process based on an employment contract, your personal data will be stored for 10 years from the last action on personal data related to employment (except for individuals employed before January 1, 2019 – in this case, the period is 50 years). In the employment process based on civil law contracts, your personal data will be processed for 6 years from the last action on the data. After this period, your data will be completely removed from the company's resources. Your personal data in this process may be entrusted to external entities involved in the employment process, but we note that these entities remain under the company's constant supervision and ensure at least the same level of personal data security. Additionally, your data may be shared with data recipients (e.g., entities providing social package services), and you will be informed by them.

3. Sales and Customer Service Process

The personal data of customers and customer representatives (in the case of institutional customers) are processed for the purpose of performing all settlements with customers, suppliers, as well as ensuring the company's compliance with tax regulations. Your personal data in this process is processed based on legal provisions arising, among others, from the Accounting Act of September 29, 1994, and the Goods and Services Tax Act of March 11, 2004. Additionally, the legal basis for processing your personal data is the execution of the contract that was concluded, as well as the so-called legitimate interest of the data controller, i.e., statistical data analysis and preparation of accounting balances. Providing personal data in this process is mandatory, and failure to provide the data may result in an inability to properly settle the services. In the accounting process, data will be processed for 6 years from the last action with the data related to the settlement of accounting documents. After this period, your data will be completely removed from the company's resources. Your personal data in this process may be entrusted to external entities participating in the accounting process (e.g., external accounting offices), but we note that these entities remain under the company's constant supervision and ensure at least the same level of personal data security. Additionally, your data may be shared with data recipients (e.g., tax authorities or auditors), and you will be informed by them in case of contact.

4. Delivery Fulfillment Process

The personal data of suppliers and supplier representatives (in the case of using institutional suppliers, e.g., drivers) are processed for the purpose of fulfilling a supply agreement or providing services. Your personal data in this process is processed based on the purpose of executing the agreement that was concluded, as well as for the so-called legitimate interest of the data controller, i.e., fulfilling the customer agreement when they use third-party services for deliveries, complaints, and warranty for defects. Providing personal data in this process is mandatory, and failure to provide the data may result in an inability to use the suppliers' services. In the data processing process for suppliers by the company, data will be stored for 6 years from the last action with the data related to the delivery or service execution. After this period, your data will be completely removed from the company's resources. Your personal data in this process may be entrusted to external entities involved in the process (e.g., entities cooperating with the company), but we note that these entities remain under the company's constant supervision and ensure at least the same level of personal data security. Your personal data, including data of drivers making deliveries, may be shared with data recipients, i.e., entities verifying the drivers' identities in connection with the issuance and receipt of goods.

5. Video Monitoring and Call Recording

The personal data of individuals entering the monitored area are processed to ensure the safety of people and property, as well as to protect the vital interests of guests, staff, and the company. Your personal data in this process is processed based on the so-called legitimate interest, which is the possible pursuit of claims or defense against claims. Additionally, the data of individuals may also be processed for the protection of the vital interests of the person to whom the data pertains. In the process, we store your personal data for a period of 90 days from its recording, i.e., from the moment of making a recording on the surveillance footage. Providing personal data is voluntary (entering a monitored area). Your personal data in this process may be entrusted to external entities involved in the process (e.g., companies providing security services for people and property), but we note that these entities remain under our constant supervision and ensure at least the same level of personal data security as the company.

Your Rights

We would like to emphasize that we guarantee every individual whose data we process the possibility to exercise the following rights:

• Right to access data – you can request a description of the data processing process specifically regarding your personal data and request the provision of all personal data collected about you. However, we note that excessive use of this right may hinder the organization's work, so we ask you to use this right judiciously,
• Right to rectify data – we take every precaution to always process the most up-to-date data about you, but if it turns out that the data we process is inaccurate, you can always request its correction,
• Right to delete data – if you no longer want the organization to process your personal data, you can always request its deletion. However, we note that this right may not be exercised in every case, as some data must be retained by the organization due to binding legal regulations,
• Right to restrict processing – if you find that the data being processed by the organization should not be deleted after the aforementioned retention periods (data retention), you can request their further storage,
• Right to data portability – if it turns out that your personal data will be processed in IT systems, you can request their transfer to another service provider or directly to you. However, I note that this right only applies to data that you have provided yourself,
• Right to object – you can always raise an objection to the processing of specific personal data for a specific purpose. In each such case, the objection will be considered, and your comments will be taken into account in future data processing activities,
• Right to withdraw consent – you can withdraw your consent to the processing of personal data at any time, but any actions taken on your data before its withdrawal will remain valid,
• Right to lodge a complaint – if you believe that the organization violates your privacy rights, you can always file a complaint with the President of the Personal Data Protection Office. However, we encourage you to resolve your doubts with us before taking this step.

Summary

In summary, the organization and all its personnel take special care to ensure that the processes of processing your personal data intrude as little as possible into your privacy. However, if at any stage of processing your personal data, doubts arise regarding the compliance of these actions with the legal regulations, please contact: [email protected]