Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we inform you that:

The controller of your personal data will be GREEN Q Spółka Komandytowa. You can contact the controller in the following ways:

• By post at the company’s registered address:
  ul. Wapienna 10, 87-100 Toruń,
• By email: greenq@onet.pl,
• By phone: +48 660 465 911

1. Your personal data will be processed on the basis of:
   • Article 6(1)(c) of the GDPR – for the purpose of fulfilling legal obligations imposed on the controller arising from specific regulations, in particular the Labor Code of 26 June 1974;
   • Article 6(1)(b) of the GDPR – for the purpose of concluding and performing a contract;
   • Article 6(1)(a) of the GDPR – based on your consent. Consent is required when the right to process personal data does not stem directly from the law, e.g., providing a phone number or email address.
2. Your personal data may be disclosed to recipients, including but not limited to:
   • Entities providing telecommunications, postal, banking, insurance services;
   • Organizational units of the controller performing statutory tasks;
   • Courts, law enforcement, tax authorities, notaries, legal advisors;
   • Entities auditing the controller;
   • Other entities legally entitled to access your personal data, but only under applicable laws.

Your data will also be disclosed to the controller’s employees and associates to the extent necessary for the performance of their duties.

We may also transfer your data to entities processing it on behalf of the controller (so-called processors), e.g., IT service providers or specialized service providers. However, this can only occur if they ensure adequate protection of your rights.

1. Your personal data will be processed for as long as the basis for processing exists, including the periods set out by record-keeping and archiving regulations, specifically:
   • 5 to 10 years from the last action related to the data processing, depending on the nature of the activity (e.g., decisions, complaints, financial documentation, contract performance);
   • Until the expiration of any legal claims;
   • For data processed based on consent, until the consent is withdrawn, but not longer than the periods mentioned above.
2. With regard to the processing of your personal data, you have the right to:
   • Access your data (Article 15 GDPR);
   • Rectify your data (Article 16 GDPR);
   • Erase your data (Article 17 GDPR) if:
     1. You withdraw your consent;
     2. The data is no longer necessary for the purposes it was collected or processed for;
     3. The data is processed unlawfully;
   • Restrict processing (Article 18 GDPR) if:
     1. You contest the accuracy of the data;
     2. The processing is unlawful and you object to the erasure, requesting restriction instead;
     3. The controller no longer needs the data, but you need it to establish, exercise, or defend claims;
     4. You have objected to the processing – pending determination whether the controller’s legitimate grounds override your objection;
   • Object to processing (Article 21 GDPR), particularly data processed under Article 6(1)(e);
   • Withdraw consent at any time. Withdrawal does not affect the legality of processing carried out prior to the withdrawal.
3. Providing your data:
   • Is required by law under which the controller operates. Refusal or providing incorrect data may prevent the controller from fulfilling legal obligations;
   • Is necessary for contract conclusion. Without it, we cannot conclude or perform a contract with you;
   • Is voluntary when based on your consent, which may be withdrawn at any time.
4. You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office – if you believe the processing of your personal data violates the General Data Protection Regulation of 27 April 2016.
5. Your data will not be processed in an automated manner, including profiling.
6. The controller does not transfer your personal data to third countries or international organizations.