INFORMATION CLAUSE FOR CONTRACTORS (PUBLIC PROCUREMENT)

Version of 15.03.2024.

By the provisions of Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, we implement the information obligation

We inform you that the abbreviations used in this information clause mean:

1. Personal data/data - means information about an identified or identifiable natural person ("data subject"); an identifiable natural person is a person who can be directly or indirectly identified, in particular, based on an identifier such as a name and surname, an identification number, location data, an internet identifier or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person;
2. Recipient of data – means a natural or legal person, a public authority, an entity or another entity to whom personal data are disclosed, regardless of whether it is a third party. Public authorities that may receive personal data as part of a specific procedure by generally applicable law are not, however, considered recipients - the processing of such data by these public authorities must comply with the data protection regulations applicable to the purposes of processing; whereby the term "third party" means a natural or legal person, a public authority, an entity or an entity other than the data subject, the controller, the processor or persons who - with the authorization of the Controller or the processor - may process personal data.
3. Processing - means an operation or set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as collecting, recording, organizing, sorting, storing, adapting or modifying, downloading, browsing, using, disclosing by transmission, disseminating or otherwise making available, matching or combining, limiting, deleting or destroying;
4. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
5. Consent of the data subject - means a voluntary, specific, conscious and unambiguous demonstration of the will by which the data subject, in the form of a declaration or a clear confirmatory action, consents to the processing of personal data concerning him or her.

The obligation to provide personal data directly concerning them is a statutory requirement specified in the provisions of the Act of 11 September 2019 - Public Procurement Law (Journal of Laws of 2019, item 2019, of 2020, item 288, 875,1492, 1517, 2275, 2320), related to participation in the public procurement procedure and the implementation of the public procurement; the consequences of failure to provide certain data result from the aforementioned Act.

1. Information about the Personal Data Controller and the Data Protection Inspector

The Personal Data Controller is the Institute of Geophysics of the Polish Academy of Sciences (hereinafter "Controller") ul. Księcia Janusza 64, 01-452 Warsaw, tel. tel. 22 6915-950, e-mail: office@igf.edu.pl .

In matters concerning the collection, processing and protection of data, you can contact the designated Data Protection Officer at the following address: Institute of Geophysics, Polish Academy of Sciences, ul. Księcia Janusza 64, 01-452 Warsaw, e-mail: iod@igf.edu.pl .

2. Information about collected/collected data:

1) Purpose of processing: conducting a public procurement procedure according to the requirements of the Act of 11 September 2019, Public Procurement Law, implementing acts to this Act and internal regulations in force at the Institute of Geophysics, Polish Academy of Sciences.

2) The basis for the processing of your personal data is art. 6 sec. 1 letter b and c of the GDPR. The data is processed to conduct a public procurement procedure and conclude a contract. We received your personal data directly from you (in the submitted offer, application, inquiry, appeal or information sent). Categories of relevant personal data:

1. A contractor who is a natural person,
2. A contractor who is a natural person running a sole proprietorship,
3. A proxy of a contractor who is a natural person (e.g. personal data included in a power of attorney),
4. A member of the management body of the contractor who is a natural person.

3) The scope of data required by generally applicable law is specified in the Public Procurement Law and implementing acts to this Act.

4) Information on the conclusion of a data processing entrustment agreement: The Institute of Geophysics of the Polish Academy of Sciences may conclude entrustment agreements in the scope of:

1. third parties/entities involved in the public procurement process (including, among others, law firms, and advisory entities);
2. service providers supplying the Institute of Geophysics of the Polish Academy of Sciences with technical and organizational solutions ensuring efficient management (in particular, IT service providers, equipment suppliers, courier and postal companies).

5) Information on the recipients of personal data or categories of recipients, if any: the recipients of personal data will be persons or entities to whom the documentation of the proceedings will be made available based on the Act of 6 September 2001 on access to public information (Journal of Laws of 2020, item 2176) or Article 74 of the Public Procurement Law. In addition, the documentation is made available to authorized control bodies.

6) The period for which personal data will be stored, and if this is not possible, the criteria for determining this period: personal data will be stored for the period necessary to conduct the procedure, award the order, conclude the contract and its implementation (if applicable) - by the provisions of Article 78 of the Public Procurement Law, and then, in the case of archival materials, for the time resulting from the provisions of the Act of 14 July 1983 on the national archival resources and archives (Journal of Laws of 2020, item 164) and internal regulations in force at the Institute of Geophysics of the Polish Academy of Sciences (no less than 4 years).

7) Profiling information (profiling means any form of automated processing of personal data, which involves the use of personal data to assess certain personal factors of a natural person, in particular, to analyse or forecast aspects concerning the effects of that natural person's work, their economic situation, health, personal preferences, interests, credibility, behaviour, location or movement): not applicable.

3. Information on the rights of the person whose data is processed:

1) You have the right to:

1. access your personal data,
2. rectify your personal data,
3. delete your personal data,
4. limit the processing of your personal data,
5. withdraw your consent to the processing of personal data by submitting/sending a letter to the following address: Institute of Geophysics of the Polish Academy of Sciences, ul. Księcia Janusza 64, 01-452 Warsaw, e-mail: iod@igf.edu.pl – if you have previously given such consent and the processing of your data is based on it,
6. transfer your personal data,
7. object to the processing of your personal data for reasons related to your special situation by Art. 21 of the GDPR.

However, due to the restrictions resulting from the Public Procurement Law - you are not entitled to:

1. in connection with art. 17 sec. 3 letters b, d or e of the GDPR - the right to delete personal data,
2. the right to transfer personal data, referred to in art. 20 of the GDPR,
3. under art. 21 of the GDPR - the right to object to the processing of personal data, as the legal basis for the processing of personal data is art. 6 sec. 1 letter b and c of the GDPR.

2) The person whose data is processed has the right to file a complaint related to the processing of his/her personal data by the Personal Data Controller or the entity/organization whose personal data has been transferred to: the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, tel. 22 531 03 00, fax. 22 531 03 01, https://uodo.gov.pl/pl/p/kontakt