Privacy policy GDPR

PRIVACY POLICY GDPR

Personal Data Protection

”MPW MED. INSTRUMENTS” SPÓŁDZIELNIA PRACY based in Warsaw, Poland, puts particular emphasis on the security of processed personal data. Having regard to that and in accordance with Article 13(1)-(2) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119 4.5.2016, p. 1), hereinafter referred to as GDPR, we would like to inform you of the following:

I. Personal Data Controller

”MPW MED. INSTRUMENTS” SPÓŁDZIELNIA PRACY with an address at 46 Boremlowska Street, Warsaw, Poland 04-347.

II. Personal Data Protection Coordinator (GDPR Coordinator)

We have designated a person in charge for the compliance of the processing of personal data
with the applicable regulations whom you may contact on matters concerning the protection of your personal data by e-mail at rodo@mpw.pl or by letter to the address of our registered office indicated
in Section I.

III. Aims and Lawfulness of Processing

The aims of the processing of your data have been defined. As a Controller, we will process the following data:

The data of the employees:
1. in order to fulfil legal obligations based on Article 6 (1)(c) GDPR – data within
  the required scope of labour law.
The data of the employees, retirees and disability pensioners formerly working at MPW
and their families:
1. in order to fulfil legal obligations based on Article 6 (1)(c) GDPR – data within
  the required scope of Act of 4 March 1994 on Employee Benefit Fund.
The data of contractors, ordering parties, inquiry senders:
1. pursuant to Article 6 (1)(b) GDPR – processing is necessary for the fulfilment
  of contractual obligations to which the data subject is one of the parties or so as to take some action at the request of the data subject before entering into a contract.
The data of the persons being within the range of the MPW surveillance cameras:
1. pursuant to Article 6 (1)(f) GDPR – processing is necessary for the purposes resulting from the controller or a third party’s legitimate interest, whereas the legitimate interest is the protection of the health and property of the MPW employees and other persons staying on the premises of “MPW MED. INSTRUMENTS” Spółdzielnia Pracy.
The data of the persons reporting equipment failures and the service engineers repairing the equipment:
1. pursuant to Article 6 (1)(b) GDPR – processing is necessary for the fulfilment
  of contractual obligations to which the data subject is one of the parties or so as to take some action at the request of the data subject before entering into a contract.
2. pursuant to Article 6 (1)(f) GDPR – processing is necessary for the purposes resulting from the controller or a third party’s legitimate interest, whereas the legitimate interest is the settlement of the MPW customers’ claims.
The data of the job applicants to MPW:
1. pursuant to Article 6 (1)(a) GDPR – upon their consent.

IV. Right to Object

At any time you have the right to object to the processing of your data as defined above. We will stop processing your data for those purposes, unless we can demonstrate important and legitimate grounds for the processing of your data which override your interests, rights and freedoms or your data are necessary for us to determine a possible investigation or for the defence of claims.

V. Data Retention Period

Your personal data will be processed for the following periods:
1. The data of the employees – for 50 years in the event of the employees hired before 1st January 2019.
2. The data of the employees – for 10 years in the event of the employees hired after 1st January 2019.
3. The data of the Employee Benefit Fund – for 5 years as from the end of the calendar year during which data were collected.
4. The data of contractors, ordering parties, inquiry senders – for 5 years as from the end
  of the calendar year during which the last correspondence took place.
5. The data of the MPW surveillance cameras – for 3 weeks after recording.
6. The data of the persons reporting equipment failures – for 5 years as from the end of the calendar year during which the last notification took place..
7. The data of the service engineers – for 5 years as from the end of the calendar year during which the cooperation came to an end.

VI. Personal Data Recipients

Your personal data may be disclosed to: our business partners, that is, the companies
and institutions which we cooperate with in order to carry out business activities.
Your data may also be accessed by our subcontractors (processors), e.g., audit, law, IT, insurance firms, and contractors for commissioned services.
The up-to-date register of the institutions to which we entrust your data may be made available to you upon request to the GDPR Coordinator within a maximum of 30 day.

VII. Data Subject Rights:

According to the GDPR, you have:

a. the right to access your data and to obtain their copy,

b. the right to the rectification (correction) of your data,

c. the right to the erasure of your data and the restriction of their processing,

d. the right to object to the processing of the data,

e. the right to data portability,

f. the right to lodge a complaint with a supervisory authority.

VIII. Information on the requirement of/freely given consent to providing personal data

a. Providing personal data in order to implement point III paragraphs 1, 2 is an obligation resulting from the aforementioned acts.

b. Providing personal data related to point III paragraphs 3, 5 - is connected with the fulfilment of contractual obligations and is voluntary, however, it is necessary for the fulfilment
of contractual obligations.

c. Providing personal data related to point III paragraph 4 – is voluntary, however, it is necessary for staying on the premises of “MPW MED. INSTRUMENTS” Spółdzielnia Pracy.

d. Providing personal data related to point III paragraph 6 – is voluntary, however, it is necessary for the participation in the recruitment process.

IX. Automated Decision-Making

When processing your personal data, we do not make decisions in an automated way, including profiling.

X. Transfer of personal data outside the EEA

The controller does not transfer your personal data outside of the EEA.