Personal data

The principles for the processing of personal data in ORLEN S.A.

Format: pdf
Size: 347 KB

Information clause on the processing of personal data

1. Clause for the Company

Controller

The controller of your personal data is ORLEN S.A. with its registered office in Płock at ul. Chemików 7, 09-411 Płock. ORLEN contact numbers: (24) 256 00 00, (24) 365 00 00, (22) 778 00 00 (hereinafter: "Company" or "ORLEN S.A.").

Data Protection Officer

The Company has appointed a Data Protection Officer ("DPO"). The DPO can be contacted by email at: daneosobowe@orlen.pl or in writing at the address of the registered office of ORLEN S.A. indicated above, with the note "Data Protection Officer". The contact details of the Data Protection Officer at ORLEN S.A. are available at www.orlen.pl in the "Contact" tab.

Purposes and legal basis for the processing of personal data by the Company

The Company will process your personal data for the following purposes based on
the legal bases indicated:

conducting marketing activities including providing information about services, products, programmes and promotions, as well as conducting marketing and customer satisfaction surveys. The legal basis for the processing will be Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC ("GDPR"), i.e. the legitimate interest pursued by the Controller consisting in marketing its own products and services, providing information about programmes and promotions, and obtaining information about customer satisfaction by telephone or electronic means, depending on which communication channel you agree to, as well as by traditional mail;
conducting analytical and statistical activities – the legal basis for processing will be Article 6(1)(f) of the GDPR, i.e. the legitimate interest pursued by the Controller consisting in keeping statistics and analysing the results of its marketing activities.

Recipients of personal data

Your personal data may be transferred by the Company to service providers providing services to the Company, in particular entities providing postal or courier services, as well as entities providing telephone customer service, marketing and IT services to the Company, including technological solutions enabling profiling.

The Company may transfer your personal data to service providers providing services to it, in particular entities providing postal or courier services, as well as entities providing customer service, marketing and IT services to the Company.

The Company will store your personal data in cloud solutions within the European Economic Area (hereinafter: "EEA"). In connection with the use of cloud solutions, in exceptional situations (e.g. protection against incidents, service repairs), your personal data may be transferred outside the EEA. The transfer of personal data outside the EEA will be carried out with appropriate legal safeguards, which are, in particular, standard contractual clauses approved by the European Commission, and to the extent that the transfer concerns the United States - mechanisms legalising the transfer of personal data based on EU-U.S. data protection rules, the so-called Data Privacy Framework. In addition, as a security measure, personal data will be transferred to cloud solutions in encrypted form. You can obtain a copy of the security measures in place by contacting the DPO.

Period of storage of personal data

The Company will process your personal data for marketing purposes, including marketing research and customer satisfaction surveys, until you object or withdraw your consent, but no longer than 3 years from your last activity in your relationship with the Company.

Rights of data subjects

You have the right to request access to your personal data, request its rectification, deletion or restriction of processing.

Furthermore, to the extent that your data is processed on the basis of the Controller's legitimate interest, you have the right to object to the processing of your data.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office in connection with the processing of your personal data by the Company if you believe that the processing of your personal data violates the provisions of the GDPR.

Profiling

The Company does not make automated decisions about you.

Your data may be used for profiling purposes to predict your purchasing preferences and to create and present personalised marketing offers tailored to your individual needs. For this purpose, the following variables will be taken into account: name
and surname, contact details, duration of the relationship with the Company, age, gender, place of residence, purchase history (place, products, payments), tailored offers, use of the loyalty programme, including gifts selected in the past, use of the mobile application (including login data), cookie data, IP address of the device used, and the selected channel of contact with the Company. Based on the information it has, the Company will calculate the propensity (probability) to use specific products or services and predict future customer behaviour.

Voluntary nature of providing personal data

Providing your personal data for marketing purposes is entirely voluntary, but necessary for the Company to inform you about services, products, programmes and promotions, as well as to conduct marketing and customer satisfaction surveys.

Information clause on the processing of personal data by joint controllers of personal data

The following clause applies if you give one of the consents to the joint processing of your personal data by entities from the ORLEN Capital Group for marketing purposes or consent to contact (consents No. 2, 3, 4 or 5).

Joint controllers of personal data

If you consent to the joint processing of your personal data by entities from the ORLEN Capital Group for marketing purposes or consent to contact (consents no. 2, 3, 4 or 5), the joint controllers of your personal data will be:

ENERGA-OBRÓT S.A. with its registered office in Gdańsk at Al. Grunwaldzka 472,
80-309 Gdańsk,
ORLEN S.A. with its registered office in Płock at ul. Chemików 7, 09-411 Płock,
myORLEN sp. z o.o. with its registered office in Warsaw at ul. Jana Kazimierza 3,
01-248 Warsaw.

(hereinafter: "Joint Controllers").

Main content of the Joint Controllers' arrangements

The Joint Controllers have agreed that the entity responsible for exercising your rights described in this information clause ("Rights of Data Subjects") will be ORLEN S.A. with its registered office in Płock at ul. Chemików 7, 09-411 Płock, e-mail address: daneosobowe.sgk@orlen.pl, as the contact point designated by the Parties in accordance with Article 26(1) of the GDPR.

The joint controllers undertake to cooperate closely in exercising your rights and making decisions in this regard.

The Joint Controllers undertake to take additional measures to correctly verify your personal data if necessary to fulfil your request. To this end, the Joint Controllers may ask you additional questions or provide you with additional instructions in response to your request.

Notwithstanding the above, you have the right to exercise your rights against each of the Joint Controllers.

The Joint Controller who receives your marketing consents is responsible for providing you with the information clause regarding the processing of your personal data.

Data Protection Officers

Each of the Joint Controllers has appointed a Data Protection Officer (DPO) who can be contacted via the following e-mail address:

ENERGA-OBRÓT S.A. – iod.energa-obrot@energa.pl
ORLEN S.A. – daneosobowe@orlen.pl
myORLEN sp. z o.o. – daneosobowe@myorlen.pl

The Joint Controllers have jointly appointed the following contact pointdaneosobowe.sgk@orlen.pl

Purposes and legal basis for the processing of personal data by the Joint Controllers

If you give your consent:

The Joint Controllers will process your personal data jointly for marketing purposes, including determining your personal shopping preferences and preparing and presenting an individual, tailored marketing offer including information about the Joint Controllers' services, products, programmes and promotions, as well as conducting marketing and customer satisfaction surveys. The legal basis for the processing will be Article 6(1)(a) of the GDPR, i.e. your consent (consent no. 4).
The Joint Controllers will process your personal data jointly for the purposes of conducting marketing activities relating to the Joint Controllers' business partners, including determining your personal shopping preferences and preparing and presenting an individual, tailored marketing offer including information about the services, products, programmes and promotions of these Partners, as well as conducting marketing and customer satisfaction surveys. The legal basis for the processing will be Article 6(1)(a) of the GDPR, i.e. your consent (consent
No. 5). The current list of Business Partners is available at www.orlen.pl/partnerzy
The joint controllers will process your personal data jointly for internal administrative purposes of the ORLEN Capital Group, in particular to identify common customers for whom marketing consents are collected and to verify the validity of consents (consents No. 2, 3, 4 and 5). The legal basis for the processing will be Article 6(1)(f) of the GDPR, i.e. the legitimate interest consisting in the pursuit of the internal administrative purposes of the Joint Controllers in the field of customer data processing.

Period of storage of personal data

Your personal data will be processed for the purposes of marketing activities, including marketing research and customer satisfaction surveys, until you withdraw your consent, but no longer than 3 years from your last activity in your relationship with any of the Joint Controllers.

Rights of data subjects

You have the right to request access to your personal data, request its rectification, erasure, restriction of processing and the right to data portability.

Furthermore, to the extent that your data is processed on the basis of the legitimate interests of the Joint Controllers, you have the right to object to the processing of your data on grounds relating to your particular situation.

You may withdraw your consent to the processing of your personal data at any time, which does not affect the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office in relation to the processing of your personal data by the Joint Controllers if you consider that the processing of your personal data violates the provisions of the GDPR.

Recipients of personal data

The Joint Controllers may transfer your personal data to service providers providing services on their behalf, in particular to entities providing postal or courier services, as well as to entities providing customer service, marketing services, IT services, including technological solutions enabling profiling, to the Joint Controllers.

If you consent to the disclosure of your personal data to entities
from the ORLEN Capital Group, these entities will also be recipients of your data.

The Joint Controllers will store your personal data in cloud solutions within the European Economic Area (hereinafter: "EEA"). Due to the use of cloud solutions, in exceptional situations (e.g. protection against incidents, service repairs) your personal data may be transferred outside the EEA. The transfer of personal data outside the EEA will be carried out with appropriate legal safeguards, which are, in particular, standard contractual clauses approved by the European Commission, and to the extent that the transfer concerns the United States - mechanisms legalising the transfer of personal data based on the EU-U.S. data protection rules, the so-called Data Privacy Framework. In addition, as a security measure, personal data will be transferred to cloud solutions in encrypted form. You can obtain a copy of the security measures in place by contacting the contact point designated by the Joint Controllers.

Profiling and categories of personal data

The Joint Controllers do not make automated decisions about you.

Co-controllers may use your data for profiling purposes in order to predict your purchasing preferences and to create and present personalised marketing offers tailored to your needs. The joint controllers will take into account the following variables (categories of personal data): first name, surname, company name and tax identification number, identification data, date of birth, contact details, duration of the relationship with the joint controller, age, gender, addresses of electricity or gas collection points, purchase history (place, products, payments), use of loyalty programmes, mobile applications (including login data), cookie files, IP address of the device used, selected channel of contact
with the Joint Controllers, source of customer origin (which Joint Controller), data on your participation in loyalty programmes and tailored offers from Joint Controllers. At , based on the information they hold, the Joint Controllers will calculate the propensity (probability) of using specific products or services and predict future customer behaviour. In addition, in order to correctly verify shared customers, the Joint Controllers may use the PESEL number you have provided. This category of data will only be processed by those Joint Controllers who have obtained it directly from you and will not be transferred to other Joint Controllers or processed for marketing purposes.

Voluntary nature of providing personal data

The provision of your personal data for marketing purposes is entirely voluntary, but necessary for the Joint Controllers to inform you about services, products, programmes and promotions, as well as to conduct marketing and customer satisfaction surveys.

Sources of personal data

The Joint Controllers obtain your personal data from the entity within the ORLEN Capital Group with which you have a business relationship or whose services or products you are interested in, and which has obtained your marketing consent and provided you with this information clause. In addition, your data may be obtained from providers of technological solutions in the field of analytics for predicting purchasing behaviour.

I Personal data controllers

The controllers of your personal data are: ORLEN S.A. with its registered office in Płock, ul. Chemików 7 and the company of ORLEN capital group or another entity of ORLEN capital group (the list of entity is annexed as Attachment No. 2 to the Regulations of the Company Social Activity)

The controllers jointly manage your personal data on the basis of the Agreement on co-administration of personal data which is available on the website www.orlen.pl in the "Responsible Business - Personal Data" tab.

II Common arrangements between controllers

Under Agreement on co-administration of personal data, the controllers have jointly agreed on the responsibilities for fulfilling the obligations arising from GDPR, in particular:

a) Each Administrator, at the time of collecting your personal data for purposes related to the Social Benefits Fund, is responsible for the fulfillment information obligation regarding the processing of your personal data,

b) Each Administrator, in terms of collecting personal data, is responsible for enabling you to exercise your rights related to the processing of your personal data,

c) Regardless of the arrangements in point b above, you may submit the right to request access to your personal data to ORLEN S.A. In this case, ORLEN S.A. will provide your request to the competent Controller who will implement it

III Contact point

Each of the Controller has appointed Data Protection Officer or GDPR Coordinator. The Controllers have established a common contact point, through which you can contact us regarding the protection of your personal data:

a) e-mail address: daneosobowe.sgk@orlen.pl,

b) postal address: ORLEN S.A., Data Protection Officer (Inspektor Ochrony Danych), ul. Chemików 7, 09-411 Płock,

c) ORLEN S.A. undertakes to service the above-mentioned contact points, which does not exclude the right to contact the competent Controller.

IV Purposes of processing

Your personal data are processed for the following purposes:

a) You benefit from social benefits or loan guarantees offered by the Social Benefits Fund at ORLEN S.A. and entities that have concluded the Agreement on joint social activity,

b) Archives which are the implementation of the law,

c) Handle, pursue and defence of claims,

d) Satisfaction survey of people using the benefits of the Social Benefits Fund, determining the quality of service and the level of satisfaction with the benefits offered.

V The legal grounds for the processing

The legal grounds for processing by the Controllers of your personal data for the purposes defined in paragraph IV above include:

a) fulfilment of legal obligations (in compliance Article 6(1)(c) of the GDPR), in connection with your use of social benefits offered by the Social Benefits Fund at ORLEN S.A. and the companies of ORLEN capital group under the Act on Employee Benefit Fund (on condition of using these benefits),

b) fulfilment of legal obligations (in compliance Article 6(1)(c) of the GDPR), for archiving purposes,

c) implement the legitimate interest (in compliance Article 6(1)(f) of the GDPR) for the purpose of handling, investigating and defending in the event of mutual claims,

d) implement the legitimate interest (in compliance Article 6(1)(f) of the GDPR) for the purpose of testing the satisfaction of people using the benefits of the Company Social Benefits Fund,

e) the data of the guarantors will be processed in order to guarantee the loan taken by the borrower, in compliance Article 6(1)(b) of the GDPR and Article 6(1)(c) of the GDPR in connection with a loan agreement concluded in accordance with the applicable Regulations of the Company Social Activity.

VI Period of personal data processing

Your personal data will be processed for the period of using the benefits from the Social Benefits Fund or the period required by law in connection with the guarantee and for the period stipulated by law, not less than until the expiry of mutual claims.

VII Data recipients

Your personal data may be disclosed by Controllers to entities cooperating with them (data recipients), in particular:

a) entities and bodies authorized to process this data on the basis of legal provisions,

b) entities processing personal data at the request of the Controller, for the purpose of handling correspondence as well as the implementation and service of social benefits in ORLEN and entities that have concluded the Agreement on joint social activity,

c) members of the Social Committee referred to the Regulations of the Company Social Activity in the scope of its operation and decision-making,

d) The Senior Club, authorized Members of the Senior Club Councils - in terms of activities carried out by them, i.e. organization of meetings and trips

VIII Information Information on the requirement to provide data

The obligation to provide personal data results in particular from the provisions of law, i.e. the Act on company social benefits fund.

IX Rights of data subjects

In connection with the processing of personal data, you are entitled to:

a) the right to access the content of your data,

b) the right to require rectification of your personal data,

c) the right to require erasure of your personal data,

d) the right to limit processing,

e) the right to object due to a special situation - in cases where the data are processed on the basis of a legitimate interest,

f) the right to data portability, i.e. the right to receive from Controller your personal data in a structured, commonly used and machine-readable format. You may send the received data to another controller or request Controller to send your data to another controller. However, this request may only be met by Controller where technically feasible. The right to data portability may be only exercised with regard to the data processed under an agreement concluded with you,

You may file a complaint to the President of the Personal Data Protection Office.

X Exercise of your rights

To use the above rights, please contact the Administrator in the manner indicated in paragraph IV above.

Statement

I hereby declare that:

a) I refer the information clause for of people benefiting from Social benefit fund offered as part of the joint social activity of ORLEN S.A. and entities that have concluded the Agreement on joint social activity,

b) I undertake to immediately provide the content of the information clause to persons / family members whose personal data I provided in order to use the benefits offered under the ORLEN S.A. Social Benefit Fund and entities that concluded the Agreement on joint social activity.

SEE THE LIST OF ENTITIES WHO HAVE SIGNED THE AGREEMENT ON THE COOPERATING OF PERSONAL DATA

READ THE COOPERATING OF PERSONAL DATA STATEMENT

In the document, ORLEN S.A. shall communicates to you information about the principles of personal data processing as part of business cooperation, in accordance with the obligations resulting from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as „GDPR”)

I THE DATA CONTROLLER

1. The data controller of your personal data is Polski Koncert Naftowy ORLEN S.A. with its registered office at ul. Chemików 7, Płock, Poland (hereinafter referred to as „ORLEN S.A.”). . Contact phone numbers to the controller: (24) 256 00 00, (24) 365 00 00, (22) 778 00 00. You can contact the Data Controller:

in writing to the address: Chemików 7, 09-411 Płock;
by e-mail: daneosobowe@orlen.pl.

II THE JOINT CONTROLLERS

2. Due to ownership changes, ENERGA-OBRÓT S.A. with its registered office at ul. Grunwaldzka 472, 80-309 Gdańsk and other companies from our capital group also participates in the processing of your personal data. The joint processing of your personal data takes place for the purposes specified in point 6. The companies belonging to our capital group are joint controllers. The processing of your personal data are based on appropriate arrangements, which specify the principles of achieving common processing purposes and principles of cooperation, which ensure the possibility of effective implementation of your rights and protection of your interests. Detailed information about Joint Controllers can be found at www.orlen.pl in the "Personal Data" tab.

III THE DATA PROTECTION OFFICER

3. The Data Protection Officer was appointed in ORLEN S.A. Detailed information about the Data Protection Officer can be found at www.orlen.pl „Contact” tab. You can contact the Data Protection Officer in ORLEN S.A. by e-mail to: daneosobowe@orlen.pl. You can also contact the Data Protection Officer in writing to the address of the registered office of ORLEN S.A., indicated in item 1 above, with additional information “Inspektor Ochrony Danych” (Data Protection Officer).

4. Information about Data Protection Officers appointed by other Joint Controllers can be found at www.orlen.pl in the "Personal Data" tab.

IV OBJECTIVES AND LEGAL GROUNDS FOR THE PROCESSING

ORLEN S.A. processes your personal data for the purposes and on the basis of the following provisions:

a) For sole proprietorship and representatives or attorneys of commercial law companies and business entities operating in other legal forms - in order to take measures relating to the conclusion and implementation of the relevant economic Agreement (in compliance with Article 6(1)(b) of the GDPR),

b) fulfilment of the legal obligations of ORLEN S.A. under the legal provisions, in particular the obligations under tax and accounting law, the obligations of the obliged institution under the Prevention of Money Laundering and Financing, the obligations related to prevent fraud and irregularities related to anti-corruption laws and prevent abuses and conflicts of interest in business processes (in compliance with Article 6(1)(c) of the GDPR),

c) implement the legitimate interest of ORLEN S.A. in the scope of conducting business in accordance with high ethical standards (in compliance with Article 6(1)(f) of the GDPR),

d) implement the legitimate interest of ORLEN S.A. in scope of establishing or maintaining business relationships, including appropriate correspondence or telephone contact;

e) implement the legitimate interest of ORLEN S.A. in the field of conducting internal business analyzes related to customer service, the conditions of ongoing business cooperation or the possibility of its development (in compliance with Article 6 (1) (f) of the GDPR),

f) direct marketing of ORLEN S.A and our capital group own products or services, to the extent that results from the content of the consents for communication (in compliance with Article 6 (1) (f) of the GDPR),

g) implement the legitimate interest of ORLEN S.A in the form of establishing, investigating and defending against claims (in compliance with Article 6 (1) (f) of the GDPR).

6. ORLEN S.A. and other companies from our capital group are joint controllers and process your personal data for the purposes and on the basis of the following provisions:

a) implement the legitimate interest of ORLEN S.A resulting from intra-group Agreements in the field of customer service, including to provide customer service by a company responsible for a specific segment or group of entrepreneurs (in compliance with Article 6 (1) (f) of the GDPR),

b) implement the legitimate interest of our capital group in the field of conducting internal business analyzes related to customer service, the conditions of ongoing business cooperation or the possibility of its development (in compliance with Article 6 (1) (f) of the GDPR),

c) direct marketing of our capital group own products or services to the extent that results from the content of the consents for communication (in compliance with Article 6 (1) (f) of the GDPR),

d) implement the legitimate interest in the form of establishing, investigating and defending against claims (in compliance with Article 6 (1) (f) of the GDPR).

VII PERIOD OF PERSONAL DATA PROCESSING

9. Your personal data will be processed for the duration of the economic Agreement and the period stipulated by law, not less than until the expiry of mutual claims under the Agreement. Providing personal data are voluntary, but necessary for the conclusion and performance of the Agreement. If the processing of your personal data are based on the consent, personal data are processed until its withdrawal.

VIII RIGHTS

10. In connection with the processing of personal data, you are entitled to:

a) the right to access the content of your data,

b) the right to require rectification of your personal data,

c) the right to require erasure of your personal data,

d) the right to limit processing,

e) the right to transfer data,

f) the right to object, in the event your personal data are processed by ORLEN S.A. or Joint Controllers on the basis of its legitimate interest;

You can also withdraw your consent to marketing communications. Withdrawal of consent is possible during telephone contact with representatives of the ORLEN S.A. sales office conducting marketing communication. The consent may also be withdrawn by sending an e-mail to the address of the relevant ORLEN sales office. Current contact details of our sales offices can be found on the website www.orlen.pl and in the content of the contact forms used to obtain consents for marketing communication.

11. If you want to exercise your rights, please contact ORLEN S.A. or the Data Protection Officer, in accordance with the contact details indicated in item 1 and 3. The provided contact details also enable the direct implementation of the rights resulting from the applicable personal data protection regulations in the field of processing operations carried out jointly by ORLEN S.A. and each of the Joint Controllers.

12. In matters related to the processing of personal data, you may file a complaint to the President of the Personal Data Protection Office.

1. The data controller of your personal data is Polski Koncert Naftowy ORLEN S.A. with its registered office at ul. Chemików 7, Płock, Poland (hereinafter referred to as „ORLEN S.A.”). `Contact phone numbers to the controller: (24) 256 00 00, (24) 365 00 00, (22) 778 00 00. You can also contact the data controller:

in writing to the address: Chemików 7, 09-411 Płock;
by e-mail to: daneosobowe@orlen.pl.

2. Due to ownership changes, ENERGA-OBRÓT S.A. with its registered office at ul. Grunwaldzka 472, 80-309 Gdańsk and other companies from our capital group also participates in the processing of your personal data. The joint processing of your personal data takes place for the purposes specified in point 6. The companies belonging to our capital group are joint controllers. The processing of your personal data are based on appropriate arrangements, which specify the principles of achieving common processing purposes and principles of cooperation, which ensure the possibility of effective implementation of your rights and protection of your interests. Detailed information about Joint Controllers can be found at www.orlen.pl in the "Personal Data" tab.

3. The Data Protection Officer was appointed in ORLEN S.A. Detailed information about the Data Protection Officer can be found at www.orlen.pl „Contact” tab. You can contact the Data Protection Officer in ORLEN S.A. by e-mail to: daneosobowe@orlen.pl. You can also contact the Data Protection Officer in writing to the address of the registered office of ORLEN S.A., indicated in item 1 above, with additional information “Inspektor Ochrony Danych” (Data Protection Officer).

4. Information about Data Protection Officers appointed by other Joint Controllers can be found at www.orlen.pl in the "Personal Data" tab.

5. ORLEN S.A. processes your personal data for the purposes and on the basis of the following provisions: