GDPR — data processing information

Information for individuals whose data is processed by DORA METAL Sp. z o.o.

We hereby wish to inform you that, in connection with the entry into force on 25 May 2018 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation — hereinafter: GDPR), DORA METAL Sp. z o.o. ensures the standards of protection and proper handling of personal data set out in these provisions.

Pursuant to Article 13(1) and (2) of the GDPR, we inform the individuals whose data the Company holds that:

1) Data controller

DORA METAL Sp. z o.o. — registered office: 64-700 Czarnków, ul. Chodzieska 27, entered in the Register of Entrepreneurs of the National Court Register under no.: 0000125512, REGON no.: 572000178, NIP no.: 7630003707, is the Data Controller in respect of data obtained as a result of performing contracts concluded with you or carrying out pre-contractual activities, documenting business transactions (including issuing invoices), maintaining correspondence, substantive handling of applications, complaints, claims and requests submitted to us, and use of video surveillance.

2) Purposes and legal bases for processing

DORA METAL Sp. z o.o. processes your personal data for the purposes indicated below and on the following legal bases:

• for the purpose of taking steps prior to entering into a contract at the request of the data subject (legal basis: Article 6(1)(b) GDPR);
• for purposes arising from the provisions of concluded contracts (legal basis: Article 6(1)(b) GDPR);
• for the purpose of documenting a service performed or a contract concluded, or considering and handling a complaint on the basis of obligations arising from the Accounting Act and tax law provisions, and for the purpose of fulfilling other obligations arising from legal provisions (legal basis: Article 6(1)(c) GDPR);
• for analytical purposes and customer satisfaction surveys regarding the proper delivery of services to our Company's clients and optimisation of service processes, which constitutes a legitimate interest of the Data Controller (legal basis: Article 6(1)(f) GDPR);
• for the purpose of updating and correcting clients' personal data, as well as contacting clients regarding the handling of their requests, within the legitimate interest of the Data Controller (legal basis: Article 6(1)(f) GDPR);
• for evidentiary purposes constituting the realisation of the legitimate interest of the Data Controller consisting in securing information in case of a legal need to prove facts (legal basis: Article 6(1)(f) GDPR);
• for the possible establishment, pursuit or defence of claims constituting the realisation of the legitimate interest of the Data Controller (legal basis: Article 6(1)(f) GDPR);
• for the purpose of ensuring the safety of persons and property on the premises of DORA METAL Sp. z o.o. through the use of video surveillance and control of pedestrian and vehicular traffic;
• for the purpose of marketing own services and promoting the Company's activities and its new initiatives among clients bound to DORA METAL Sp. z o.o. by contracts (legal basis: Article 6(1)(a) GDPR, Article 6(1)(f) GDPR and applicable provisions on electronic communication).

3) Automated decision-making

Your personal data is not subject to automated decision-making by DORA METAL Sp. z o.o., including profiling.

4) Rights of data subjects

• access to your data and obtaining a copy thereof,
• rectification (correction) of data,
• erasure of data (subject to the conditions set out in Article 17 GDPR),
• restriction of processing (subject to the conditions set out in Article 18 GDPR),
• data portability (subject to the conditions set out in Article 20 GDPR),
• objection to processing (subject to the conditions set out in Article 21 GDPR),
• lodging a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (UODO).

5) Data retention period

Furthermore, we will retain proof of consent granted for purposes related to demonstrating facts in the event of possible claims regarding improper processing of personal data by us for 10 years.

• for the period necessary to perform the contract / deliver the service and to pursue or defend against claims, i.e. for a period of 10 years, or until the claims become time-barred;
• in the case of processing data for the purpose of realising the legitimate interest of the Data Controller, until an objection is lodged by the data subject, subject to the necessity of processing data until the end of the period necessary to establish, pursue or defend against claims;
• in the case of processing data on the basis of the data subject's consent, upon withdrawal of consent by that person (in the absence of another legal basis for processing) or upon lodging an objection (we will cease processing data for the purposes specified in the consent declaration).

6) Data recipients

Your personal data may be disclosed to public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes arising from generally applicable law, as well as to subcontractors bound to DORA METAL Sp. z o.o. by data processing agreements, e.g. law firms, companies providing IT services to the Company, debt collection companies, security agencies.

7) Transfer of data outside the EEA

The Company, as Data Controller, declares that it does not transfer and does not intend to transfer personal data to a third country or international organisation.

8) Contact regarding data protection

For matters related to personal data protection, you may contact DORA METAL Sp. z o.o.:

• by phone: (67) 255 34 41
• by e-mail: info@dora-metal.pl
• in person at our Company's registered office, after prior telephone arrangement of a meeting date.

Information for individuals submitting CVs / recruitment materials to the Company

DORA METAL Sp. z o.o., pursuant to Article 13(1) and (2) of the GDPR, informs you that:

1) Data controller

The controller of personal data processed for purposes related to your application for employment with the Company is DORA METAL Sp. z o.o. — registered office: 64-700 Czarnków, ul. Chodzieska 27, entered in the Register of Entrepreneurs of the National Court Register under no.: 0000125512, REGON no.: 572000178, NIP no.: 7630003707.

2) Purposes of processing

The purposes of processing your personal data are exclusively related to the consideration of your candidacy by a potential employer, within the scope you have made available to the Company, as specified in labour law provisions (Article 6(1)(c) GDPR and Article 9(2)(b) GDPR) and arising from your voluntarily expressed consent to the processing of the data provided for recruitment purposes (Article 6(1)(a) GDPR and Article 9(2)(a) GDPR).

3)–9) Rights, retention period and contact

• Your personal data is not subject to automated decision-making, including profiling.
• You have the following rights: access, rectification, erasure, restriction of processing, data portability, objection, and lodging a complaint with the President of the UODO.
• Data is stored for the period specified in labour law provisions; in the event of non-employment — no longer than 90 days from the date of submission of recruitment information.
• Data may be disclosed to entities authorised on the basis of law and to subcontractors (IT support, law firms).
• The controller does not transfer data to third countries.
• Provision of data is voluntary, but is a condition for consideration of the candidacy.
• Contact: tel. (67) 255 34 41, info@dora-metal.pl, Company registered office after arrangement of a meeting date.

Addendum — PIM product library (B2B application)

This addendum supplements the information clause of DORA METAL Sp. z o.o. with details regarding the processing of data in the online PIM (Product Information Management) product library made available to trade partners and Company employees.

Scope of data in the PIM application

• access requests: first name, last name, e-mail address, company name, type of business activity;
• user account data: login, first name, last name, e-mail, company, permissions;
• system login history (date, role, interface language);
• catalog usage analytics (searches, product views, file downloads) — only after consent in the cookie banner;
• correction reports for product cards.

Legal bases (PIM)

• Article 6(1)(b) GDPR — account management and performance of B2B / cooperation agreement;
• Article 6(1)(f) GDPR — system security, technical logs, protection against abuse;
• Article 6(1)(a) GDPR — catalog analytics (after consent in cookie settings).

Recipients and tools (PIM)

• hosting provider / application server infrastructure;
• SMTP service provider (activation e-mails, password reset);
• Cloudflare Turnstile — protection of the access request form (after consent to functional cookies);
• Sentry — monitoring of technical application errors (without transmitting passwords and session content).

Retention period (PIM)

• account data — until account deletion or end of cooperation;
• login logs and analytics — up to 24 months;
• rejected access requests — up to 12 months;
• proof of consent to data processing in the request form — in accordance with the general clause.

Rights in the PIM application

A logged-in user (except for the system administrator account) may download a copy of their data (JSON export) and delete their account in the Profile section. Administrators are asked to contact: info@dora-metal.pl.

Cookies in PIM

• essential — login session (pim_session), required for account operation;
• functional — Cloudflare Turnstile on the access request form;
• analytical — optional, recording of catalog events (search, view, download).