RODO

In connection with the implementation of the requirements of Art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - general regulation on data protection (hereinafter: "GDPR"), we would like to inform you about the principles of personal data processing and your rights in connection with the processing of personal data by the Lukasiewicz Research Network - Automotive Industry Institute. The following rules apply from May 25, 2018.

1. The controller of your personal data is the Lukasiewicz Research Network - Automotive Industry Institute, ul. Jagiellońska 55, 03-301 Warsaw, (hereinafter: the Controller), who can be contacted at the following e-mail address: instytut@pimot.lukasiewicz,gov.pl, or phone number +48 22 7777 015.
2. The Controller has appointed a Data Protection Officer, who can be contacted at the following e-mail address: iod@pimot.lukasiewicz.gov.pl.
3. The Controller processes your personal data as part of the contracts being implemented, on the basis of applicable law, in the legitimate interest of the Controller and on the basis of your consent.
4. Your personal data is processed for the purpose/purposes:
   
   1. performance of concluded contracts, based on the provisions of point (b) of article 6 (1) of GDPR,
   2. fulfilment of legal obligations incumbent on the Controller (e.g. implementation of tax law), based on the provisions of point (c) of article 6 (1) GDPR,
   3. arising from legitimate interests pursued by the Controller or by a third party, related to the marketing and information activities undertaken and actions taken to protect the interests of the Controller or a third party, based on the provisions of point (f) of article 6 (1) GDPR,
   4. necessary to protect the vital interests of the data subject or of another natural person, based on the provisions point (d) of article 6 (1) of GDPR,
   5. other, only on the basis of your prior consent,
   6. based on the provisions of point (a) of article 6 (1) GDPR, to the extent and purpose specified in the consent.
5. In connection with the processing of data for the purpose / purposes referred to in point 4 recipients of your personal data may be:
   
   1. public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes that result from the provisions of generally applicable law;
   2. other authorized bodies and entities,
   3. entities performing tasks and providing services to the Controller.
6. Your personal data will be kept for the period necessary to achieve the purposes set out in point 3, and after that time to the extent and for the period necessary or required by the provisions of generally applicable law or resulting from the legitimate interests of the Controller.
7. In connection with the processing of personal data by the Controller, you have the following rights:
   
   1. right to access personal data, including the right to obtain a copy of this data;
   2. the right to request the rectification (correction) of personal data - if the data is incorrect or incomplete.
   3. the right to request the deletion of personal data (the so-called right to be forgotten) - if:
      
      • the data are no longer necessary for the purposes for which they were processed,
      • the data subject has objected to the processing of personal data,
      • the data subject has withdrawn consent to the processing of personal data, which is the basis for data processing and there is no other legal basis for data processing,
      • personal data is processed unlawfully,
      • personal data must be removed to fulfil the obligation arising from the provisions of the law.
   4. right to request restriction of personal data processing - if:
      
      • the data subject questions the accuracy of the personal data,
      • the processing of data is unlawful and the data subject opposes the deletion of data, requesting their restriction instead,
      • the controller no longer needs the data for his purposes, but the data subject needs them to establish, defend or pursue claims,
      • the data subject has objected to the processing of data pending the verification whether the legitimate grounds of the controller override the grounds of objection.
   5. right to transfer data - if the following conditions are jointly met:
      
      • data processing takes place on the basis of an agreement concluded with the data subject or on the basis of the consent expressed by that person,
      • the processing is carried out by automated means.
   6. right to object to the processing of data - if the following conditions are jointly met:
      
      • there are reasons related to your particular situation, in the case of data processing on the basis of a task carried out in the public interest or as part of the exercise of public authority by the Controller,
      • processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular when the data subject is a child.
8. If you become aware of the unlawful processing of your personal data by the Controller, you have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO).
9. In a situation where the processing of personal data takes place on the basis of the consent of the data subject (article 6 (1) (a) of GDPR), providing your personal data to the Controller is voluntary, and the withdrawal of consent to processing may take place at any time, which does not affect the lawfulness of the processing of personal data that was carried out before its withdrawal. Withdrawal of consent will make it impossible to take specific actions on your behalf.
10. Providing data is obligatory when the premise for the processing of personal data is a legal provision or an agreement concluded between the parties.
11. Your data may be processed in a traditional and automated manner but will not be profiled.
12. Detailed information on the processing of personal data will be published on the website available at: http://www.aaejournal.com/RODO,3143.html.
13. The Controller can be contacted by sending correspondence to the address indicated in point 1.