Information clause for the whistleblower or person assisting in making the report (Article 13 of the GDPR)

In accordance with Article 13 paragraphs 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”, we inform you that:

1. The administrator of your personal data, i.e. the entity deciding on the purposes and methods of their processing, is Zakłady Chemiczne “UNIA” Spółdzielnia Pracy with its registered office in Poznań (61-005), ul. Główna 14, entered into the register of entrepreneurs of the National Court Register maintained by the District Court of Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS number 0000115949, NIP 7770001803, (hereinafter referred to as the “Administrator”, “We” or “DPO”), which can be contacted at the following correspondence address: Zakłady Chemiczne “UNIA” Spółdzielnia Pracy, 61-005 Poznań, or by e-mail: iod@unia.pl.

2. The contact person in all matters concerning the protection of personal data and your rights is the Personal Data Protection Inspector. You can contact the Personal Data Protection Inspector by sending an e-mail to the following address: iod@unia.pl or by traditional mail to the above-mentioned correspondence address of the DPO with the note “To the Data Protection Inspector”.

3. We will process your personal data to the extent resulting from the content of the Report on irregularities, for the purposes resulting from the provisions of the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws, item 928, as amended; hereinafter referred to as the UOS), related to the implementation of the obligations of the ADO referred to in this Act, i.e. on the basis of art. 23 sec. 1-3 UOS and art. 6 sec. 1 letter c GDPR, i.e. to the extent necessary to fulfill the legal obligation incumbent on the Administrator.

4. By authorizing us to contact you at the e-mail address or telephone number provided by you, you grant us consent to such contact and the processing of your personal data to the extent necessary to carry out such contact (e-mail address, telephone number). In such a situation, the legal basis that allows or obliges us to process personal data is:

a) art. 6 sec. 1 letter c GDPR – i.e. a provision of law – when processing is necessary to fulfill the legal obligations incumbent on the Administrator, which result, among others, from: from the provisions of the Personal Data Protection Act;

b) Article 6, paragraph 1, letter f of the GDPR – when, as the ADO, we pursue our legitimate interest, including in particular when: – we place your data in the register of Reports of irregularities and forward them to the Compliance Officer in order to enable communication regarding the Report; – we retain data for archival (evidence) purposes to secure information in the event of a legal need to demonstrate specific facts during the Proceedings concerning the Report or the implementation of Follow-up Actions; – we process your data in order to determine, pursue or defend against claims;

c) Article 6, paragraph 1, letter a of the GDPR – i.e. your consent (processing for the purpose specified in such consent, if you decide to grant it in connection with the selected method of communication).

5. Providing personal data is voluntary, but necessary for the purposes related to the receipt and handling of the Internal Report regarding irregularities, referred to in the provisions of the Personal Data Protection Act. This means that failure to provide your data will exclude the possibility of accepting and recognizing your Report. In turn, in the scope of personal data for which we will ask you for consent – their provision is fully voluntary and depends on your discretion. Failure to provide consent or withdrawal of previously granted consent will not involve any negative consequences in the scope of your Report, although it may affect the possibility of contacting you in connection with the Report made.

6. The recipients of your personal data, i.e. entities to which we may share your data are:

a) entities cooperating with us or supporting the ADO in conducting matters concerning Whistleblower Reports (so-called processors who may process your personal data for the purposes designated by us);

b) other administrators, if they have a legal basis to process the above-mentioned personal data. The recipients of your personal data may therefore be entities that provide us with accounting and bookkeeping services or HR and payroll services, provide software necessary for data processing and cloud systems in which data is stored, provide IT, telecommunications, consulting, training, auditing, legal, hotel, transport, postal, courier, security or health and safety services, as well as our intermediaries and contractors, if it is justified by the content of the Report or the conditions of the Explanatory Proceedings triggered by the Report submitted.

7. We may transfer your personal data outside the European Economic Area, subject to the obligation to ensure compliance with legal requirements.

8. Your personal data will be stored for a period of 3 years after the end of the calendar year in which the Follow-up Actions were completed, or after the completion of the proceedings initiated by these actions.

9. If audio-video or audio recordings are made during the Proceedings triggered by the Notification, they will be stored by the ADO for a period not longer than the one indicated in point 8 above; however, in the event that the image or sound recordings constitute evidence in proceedings conducted on the basis of law or the Administrator has become aware that they may constitute evidence in the proceedings, the deadlines referred to above shall be extended until the final conclusion of the proceedings or the limitation of claims or liability periods concerning a specific infringement. After the expiry of the above periods, the image and sound recordings containing personal data shall be destroyed, unless separate provisions provide otherwise.

10. Your personal data will not be processed in an automated manner (including in the form of profiling).

11. In the scope of your personal data, you have the right to access, rectify or delete them, limit their processing, the right to transfer them, the right to object, the right to withdraw consent to their processing (whereas the withdrawal of consent does not affect the legality of data processing carried out before such withdrawal). You can exercise all of the indicated rights by contacting us in writing (to the address indicated in point 1 with the note “Personal data”) or by e-mail at: iod@unia.pl.

12. If you believe that we are processing your personal data incorrectly, you also have the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection (address: ul. Stawki 2, 00 – 193 Warsaw).