Privacy Policy

GDPR Information Clause

Pursuant to Art. 13 and Art. 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR), we provide the following information regarding the processing of your personal data.

The following applies depending on the relationship between you and us:

• Visitors entering the premises of INNOVATOR Sp. z o.o. (Institute of Non-Ferrous Metals – Łukasiewicz Research Network)
• Job applicants
• Contractors who are natural persons
• Personnel or subcontractors of our contractors
• Persons contacting INNOVATOR Sp. z o.o.
• Other persons contacted by INNOVATOR Sp. z o.o.

1. Processing of personal data of persons entering the premises of INNOVATOR Sp. z o.o. (Łukasiewicz Research Network – Institute of Non-Ferrous Metals)

1. The data controller for data collected to register entries and exits is Łukasiewicz Research Network – Institute of Non-Ferrous Metals (address: ul. Sowińskiego 5, 44-100 Gliwice; tel. +48 32 2380 200, e-mail: imn@imn.gliwice.pl) – hereinafter “IMN Controller”.
2. The IMN Controller has appointed a Data Protection Officer, available via iod@imn.gliwice.pl or by mail at ul. Sowińskiego 5, 44-100 Gliwice.
3. Data is collected on the basis of the Controller’s legitimate interest (Art. 6(1)(f) GDPR) to ensure the security of persons and property, protect confidential information, and for the establishment, exercise or defense of legal claims. Data is also processed to comply with obligations under the Classified Information Protection Act (Art. 6(1)(c) GDPR).
4. Recipients of your data may include security service providers and IT service providers, only on the basis of data processing agreements and exclusively under IMN Controller’s instructions.
5. Data will be stored for the necessary period to achieve the above purpose, and then archived for 3 years.
6. Providing your personal data is required to access our premises.
7. You have the right to access your data, request rectification, deletion, or restriction of processing. Where processing is based on legitimate interest, you may also object on grounds relating to your particular situation.
8. You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO) in Poland.

2. Processing of personal data of job applicants at INNOVATOR Sp. z o.o.

1. The data controller is INNOVATOR Sp. z o.o. (address: ul. Sowińskiego 5, 44-121 Gliwice; tel. +48 32 2380 245, e-mail: innovator@innovator.com.pl) – hereinafter “Controller”.
2. The Controller has appointed a Data Protection Officer, available via innovator@innovator.com.pl or by mail at ul. Sowińskiego 5, 44-121 Gliwice.
3. Data is processed to assess qualifications, skills and legal compliance of candidates. Legal basis: Art. 221 §1 of the Labour Code (name, surname, date of birth, contact details, education, professional qualifications) and candidate’s consent for optional data.
4. Data recipients may include supervisory institutions, authorized public bodies, IT, legal and accounting service providers, and security services if needed for access to premises.
5. Data will be stored for the recruitment period and then for 3 months after employment of the selected candidate, to allow potential rehire. Afterwards, data will be deleted.
6. Providing personal data is voluntary but necessary for recruitment. Without it, the candidate cannot be considered.
7. You have the right to access, rectify, delete or restrict processing of your data. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
8. You have the right to lodge a complaint with the supervisory authority.

3. Processing of personal data of contractors (natural persons)

1. The Controller is INNOVATOR Sp. z o.o. (address as above), which has concluded a contract with you.
2. The Controller has appointed a Data Protection Officer, available as above.
3. Data is processed for the conclusion and performance of contracts, to comply with tax obligations, for direct marketing of our products/services (legitimate interest, Art. 6(1)(f) GDPR), and for defense or pursuit of legal claims. Marketing may involve profiling based on your previous contracts.
4. Data will be stored for the duration of the contract and for the limitation period of claims, and data included in tax/financial records will be stored according to applicable law.
5. Recipients may include IT, legal, accounting, or security service providers, and authorized supervisory/public bodies.
6. Data may be transferred outside the EEA only if related to a project requiring it or if you are located outside the EEA, with appropriate safeguards in place.
7. Providing data is necessary to conclude and perform the contract.
8. You have the right to access, rectify, erase, restrict, object, and data portability (where automated processing applies). You may object absolutely to marketing-related processing. You also have the right to lodge a complaint.

4. Processing of personal data of personnel or subcontractors of our contractors

1. The Controller is INNOVATOR Sp. z o.o. (address as above).
2. DPO contact as above.
3. Your data was provided by your employer, contracting entity, or yourself. Data includes identifiers (name, position, sometimes PESEL), contact data, and possibly qualifications (e.g., training, certificates).
4. Data is processed for legitimate interest (Art. 6(1)(f) GDPR) – proper contract performance, communication, marketing to your employer via you, and legal/tax obligations.
5. Data will be stored during the contract and for claim limitation periods, or longer where tax/accounting law requires.
6. Recipients: IT, legal, accounting, or security providers, supervisory bodies, or public authorities.
7. Data may be transferred outside the EEA only if a project requires it, with safeguards.
8. You have the same GDPR rights as described above.

5. Processing of personal data of other persons contacting INNOVATOR Sp. z o.o. (by phone, email)

This applies if you contact us but are not a contractor or employee of INNOVATOR or its partners.

1. The Controller is INNOVATOR Sp. z o.o. (address as above).
2. DPO contact as above.
3. Data is processed to reply to your inquiry, maintain communication, and for direct marketing (legitimate interest, Art. 6(1)(f) GDPR), or on the basis of your consent.
4. Data is stored for the period necessary to respond, maintain relations, or for limitation of potential claims. Data processed under consent is stored until withdrawal of consent.
5. Recipients: IT, legal, accounting providers, supervisory/public authorities.
6. You have the right to access, rectify, erase, restrict, port, object (depending on legal basis), and to withdraw consent at any time. You may lodge a complaint with the supervisory authority.

6. Processing of personal data of other persons contacted by INNOVATOR Sp. z o.o.

This applies if INNOVATOR Sp. z o.o. contacts you and you are not our contractor, employee, or subcontractor.

1. The Controller is INNOVATOR Sp. z o.o. (address as above).
2. DPO contact as above.
3. Data is processed to communicate with you, build cooperation, or maintain business relations (legitimate interest, Art. 6(1)(f) GDPR), or on the basis of your consent.
4. Your data may come from your employer, business partners, or publicly available sources. Data includes identifiers (name, position, contact info) and professional responsibilities.
5. Data is stored for the duration of contact/relations or limitation period of claims. Data processed under consent is stored until withdrawal of consent.
6. Recipients: IT, legal, accounting providers, supervisory/public authorities.
7. You have the same GDPR rights as above, including the right to lodge a complaint.