Data protection at Enea S.A. in connection with the Bałtyk dla pokoleń – „Baltic for generations” project

In connection with the Controller’s legal obligation under article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), please be advised as follows:

1. The Controller with respect to your personal data is Enea S.A. with its registered office in Poznań (ul. Górecka 1, 60-201 Poznań).
2. A Data Protection Officer has been appointed at Enea S.A. and can be contacted by e-mail at: iod@enea.pl or by writing to EneaS.A. ul.  Górecka 1, 60-201 Poznań.
3. We will process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR). Data will be processed in particular on one of the following types of legal bases:
   – your consent (art. 6(1)(a) GDPR), which can be withdrawn at any time:
   – to ensure compliance with legal obligations of Enea S.A. (art. 6(1)(c) GDPR);
   – in the legitimate interests of Enea S.A., except where your interests or fundamental rights override those interests (art. 6(1)(f) GDPR);
   (The list above is indicative in nature, and not exhaustive).
4. The envisaged recipients of your personal data are external vendors and consultants to us:
   a. operating as providers of postal, courier, payment, payment processing, legal, and debt recovery services;
   b. subsidiaries and affiliates in Grupa Enea; a full list of these companies can be found here: https://www.enea.pl/bip/grupa-kapitalowa-enea, and also firms operating our ICT systems and providing the following services to us: IT, advisory, consultancy, audit, legal advice, tax advice, accounting, agency, advertising, printing, warehouse storage and logistics, and document archiving;
   c. with respect to marketing campaigns, the recipients of your data may be social networking sites used to organize events, competitions, and promotional campaigns, such as Facebook, Instagram, Twitter, and so on;
   d. Your data may be disclosed to state bodies on the basis of a legitimate request;
   e. The Enea foundation in the context of social responsibility activities.
   Your data will not be transferred to third countries, and will not be subjected to profiling operations.
5. The period for which personal data are processed and stored:
   a. Your personal data will be processed until the Call (with the list of supporters), as part of the „Baltic for generations” initiative, is submitted and examined by the European Commission.
   b. Your personal data will be stored for the period required by law, for example under tax regulations.
   c. In any case – for a period necessary to achieve the objectives described in point 3, and once they are achieved – for a period necessary for legally justified archiving until any possible claims expire under the statute of limitations.
6. You have the following rights in connection with processing of your personal data:
   a. to access your data – subject to limitations under article 15 GDPR,
   b. to rectify your data – subject to limitations under article 16 GDPR,
   c. to erase your data – subject to limitations under article 17 GDPR,
   d. to restrict processing of your data – subject to limitations under article 18 GDPR,
   e. data portability – subject to limitations under article 20 GDPR,
   f. right to object – subject to limitations under article 21 GDPR,
   g. the right to lodge a complaint with the President of the Polish Personal Data Protection Office if you consider that the Controller breaches data protection laws when processing personal data.
7. If personal data are processed on the basis of consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
8. The rights described above can be exercised by sending the appropriate request by e-mail to: esa.iod@enea.pl or using the methods of contacting Enea specified on the website https://www.enea.pl/pl/dladomu/obsluga-klienta-i-kontakt/kontakt.