As a global supplier, MHC Mobility understands the value of information, both for us and our customers. We protect any data we obtain from you and have strict policies in place with respect to privacy issues, as detailed below. We would like to declare that we process your data in accordance with national and European legal regulations and under conditions which ensure its security. In order to ensure the transparency of the processing carried out by us, we present the applicable data protection rules at MHC Mobility Sp. z o.o. (hereinafter referred to as “MHC Mobility”) on the principles of personal data protection as established by the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as “GDPR”).
MHC Mobility processes various types of information, including its own technical information and information provided by its customers, as a full-service provider with global reach. With this in mind, MHC Mobility has always strived to establish and fully enforce a system of information management principles to respect the value of the aforementioned information. Given the above mentioned grounds, MHC Mobility will make every effort to define appropriate policies and establish a data protection management system within the company, as well as to establish a privacy policy and promote it to its board members and employees. In addition, MHC Mobility will take appropriate steps to make its privacy policy public. MHC Mobility will rely on the aforementioned policy for the adequate protection of personal data.
In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (RODO), I inform you that:
1. The controller of your personal data is MHC Mobility sp. z o. o. with its registered office in Warsaw (02-797), ul. Franciszka Klimczaka 1. For matters relating to the processing of your personal data, you can also contact us by email at the following email address: iodo@mhcmobility.pl
2. MHC Mobility gives considerable attention to the protection of personal data and has therefore appointed a Data Protection Officer who can be contacted at the following email address: iodo@mhcmobility.pl. The Controller invites you to contact the DPO with any concerns regarding the processing of your personal data.
3. Your personal data will be processed by MHC Mobility for the following purposes:
| Purposes of processing | Legal basis and data retention period | Legitimate objective, if any |
| Entering into and performing an agreement with a client or customer. | Article 6(1)(b) and (f) of the GDPR For the duration of the agreement, and after its termination until the expiry of the time limits for claims arising therefrom, in principle 3 years, maximum 6 years. | MHC Mobility, in connection with activities undertaken for the purpose of entering into an agreement or performing an agreement, contacts employees/collaborators of clients and customers for a legitimate purpose. |
| Handling of complaints and claims. | Article 6(1)(b) and (f) of the GDPR For 1 year after the warranty expires or the claim is settled. | The controller, in connection with the processing of complaints, contacts the customers' employees/co-workers for a legitimate purpose. |
| Pursuit or defence of legal claims | Article 6(1)(c) of the GDPR For the periods indicated by the law or, if no such periods are indicated for certain documents, for the period in which their retention falls within the legitimate purpose of the controller regulated by the time of the possible redress. | The controller in connection with the assertion or defence of legal claims for a legitimate purpose may process the data of employees/co-workers of clients or contractors. |
| Archiving of documents, i.e. contracts and billing documents | Article 6(1)(c) of the GDPR For the periods indicated by the law or, if no such periods are indicated for certain documents, for the period in which their retention falls within the legitimate purpose of the controller regulated by the time of the possible redress. | - |
| Maintenance of statistics | Article 6(1)(f) of the GDPR. Until such time as another processing operation, as indicated in this table, is carried out. We do not store personal data exclusively for statistical purposes. | Having information on the statistics of the Controller's activities allows it to improve its operations |
| Conducting marketing activities without the use of electronic communications | Article 6(1)(f) of the GDPR Until you object, i.e. show us in any way that you do not wish to stay in contact with us and to be informed about our activities. | Conducting marketing activities to promote the business. |
| Conducting marketing activities without the use of electronic communications | Article 6(1)(a) of the GDPR These activities, due to other applicable laws, in particular the Telecommunications Act and the Act on Provision of Electronic Services, are carried out on the basis of the consents held. Until or unless you withdraw your consent, i.e. you show us in any way that you do not wish to be contacted and informed about our activities, and once withdrawn for the purpose of demonstrating the correctness of our legal obligations to Hits and related claims (up to 6 years from withdrawal of consent). | |
| Controlling access, including monitoring, on the premises of the data controller for the purpose of increasing the security of employees and the protection of property and the confidentiality of information. | Article 6(1)(c) and (f) of the GDPR Until an objection is lodged, not more than one year. Video recordings shall only be processed for the purpose for which they were collected and shall be kept for a period not exceeding 3 months from the date of the recording, unless the recording constitutes evidence in a legal proceeding, in which case it shall be kept until the legal conclusion of the proceeding or until any objection is raised. | Maintaining access control for persons on the controller's premises is its legitimate purpose and, in the case of employees, stems from a legal provision (Article 22 2 of the Labour Code). The controller may obtain the basic data of the employee/co-worker (name, place of employment or co-operation, telephone number and in certain situations the number of the document with photograph) prior to the arrival of the data subject from the entity with which the data subject is employed or co-operates. |
| Recruitment | Article 6(1)(a), (c) and (f) of the GDPR Up to 6 months from the end of the recruitment process and, in the case of consent for further recruitment processes, no longer than one year. | The controller without the additional consent of the data subject may keep the data of job applicants who have not been hired for up to 6 months after the end of the recruitment process as a legitimate purpose of the controller on the grounds that the hired employee/co-worker may not prove himself or herself in the job or may resign. |
| Management of human resources - employees and associates | Article 6(1)(a), (b), (c) and (f) of the GDPR Article 9(2)(b) of the GDPR In accordance with the current legislation requiring the archiving of labour law documents, i.e. personnel files for 50 years, in some cases for 10 years. A 10-year retention period for documentation on matters relating to the employment relationship and the employee's personal file will apply to all employees hired after 1 January 2019. For employees hired after 31 December 1998 and before 1 January 2019, the documentation related to the employment relationship and the employee's personal file will be kept for a period of 50 years from the date of termination or expiry of the employment relationship, unless the employer declares its intention to provide information reports for all employees and contractors hired during that period and actually submits the reports. If the retention period for the selected documents is shorter, the controller will respect this shorter period. In the case of civil law contracts, these contracts will be stored until the expiry of the limitation periods for claims arising from them. | The controller uses the image only on the basis of the employee's/co-worker's consent. |
| Maintaining a contact form on a website | Article 6(1)(b) of the GDPR | Responding to requests and enquiries made using the contact form or in any other form, including storing sensitive requests and responses in order to maintain accountability |
4. Your personal data will not be transferred outside the European Union to a third country or international organisation.
5. Your data will not be processed in a way that leads to a decision which is based solely on automated processing, including profiling, and produces legal effects in relation to you or similarly significantly affects you.
6. In accordance with Article 21(4) of the GDPR, I inform you that you have the right to object to the processing of personal data concerning you. The objection shall be submitted to the Data Protection Officer, whose contact details are indicated under point 2. In accordance with Article 21(1) of the GDPR, when submitting an objection, you must indicate the reasons related to your particular situation.
7. In connection with its operations, MHC Mobility will disclose your personal data to the following entities, among others:
8. You have the right of access to your data and the right to rectify, erase, restrict processing, the right to data portability, the right to object, and if processing is based on consent: the right to withdraw consent at any time without affecting the legality of processing carried out on the basis of consent before its withdrawal.
More information on data subjects' rights is available in Articles 12-23 of the GDPR, the text of which can be found at https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX:32016R0679
9. Provision of data is necessary for the conclusion of agreements and settlement of business and in situations provided for by law. Otherwise, the provision of data is voluntary.
10. If you consider that the processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.
11. Personal data will not be processed by automated means (including profiling) in such a way that any decision could be made as a result of such automated processing, that any other legal effect would be produced or that it would otherwise materially affect our customers, contractors and their employees/co-workers.
MHC MOBILITY
Royal Wilanów, entrance E
ul. Franciszka Klimczaka 1
02-797 Warsaw
