INFORMATION CLAUSE ON THE PROCESSING OF PERSONAL DATA

INFORMATION CLAUSE ON THE PROCESSING OF PERSONAL DATA

Personal Data Controller

The controller of your personal data is MAG Offshore spółka z ograniczoną odpowiedzialnością with its registered office in Gdynia, Poland, 81-341, ul. T. Wendy 15, entered into the National Court Register under KRS number 0000016806, REGON: 001316656 (hereinafter referred to as “MAG Offshore”).

You may contact us:

a) by post at: ul. T. Wendy 15, 81-341 Gdynia, Poland
b) by e-mail: biuro@magoffshore.pl

Data Protection Officer

The Data Protection Officer is Marlena Luleńska. You may contact the Data Protection Officer by e-mail at: iod@magoffshore.pl

Purposes and Legal Bases for Processing

We process your personal data where the processing is:

• necessary for the performance of a contract or for taking steps prior to entering into a contract (including reporting, consulting, operational, advisory, compliance, project and technical services related to cooperation and coordination of operational and project activities for maritime, offshore, energy and infrastructure projects, as well as support in preparing professional documentation relating to safety, project management, regulatory compliance and support for clients’ and business partners’ operations) – pursuant to Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”),
• necessary for conducting recruitment processes and establishing and performing cooperation with sole traders, consultants, specialists and subcontractors, in particular in connection with maritime, offshore, infrastructure, legal, compliance, operational and advisory projects – pursuant to Article 6(1)(b) GDPR and Article 6(1)(f) GDPR,
• necessary for the purposes arising from the legitimate interests pursued by MAG Offshore, in particular in relation to business relationship management, coordination of cooperation with clients, contractors, consultants and subcontractors, ensuring organisational security and compliance, conducting business communication, direct marketing of services, as well as establishing, pursuing or defending legal claims – pursuant to Article 6(1)(f) GDPR,
• carried out on the basis of freely given consent, exclusively where required by law or by the nature of the cooperation, in particular with regard to the use of image/photographs, publication of marketing materials, participation in promotional activities or the use of contact forms – pursuant to Article 6(1)(a) GDPR.

Recipients of Personal Data

Recipients to whom your personal data may be disclosed may include, in particular:

• entities providing IT, hosting, cloud, maintenance and cybersecurity services,
• legal, tax and audit advisors as well as compliance service providers,
• entities providing accounting, administrative, HR and archiving services,
• postal operators, courier companies and communication service providers,
• banks, payment operators, insurance brokers and insurance service providers, including maritime and P&I insurance providers,
• contractors, business partners, consultants, specialists and subcontractors involved in maritime, offshore, energy, infrastructure, operational and advisory projects,
• entities supporting project execution, document management, operational safety and project cooperation management,
• entities authorised to receive personal data pursuant to applicable legal provisions.

Retention Period of Personal Data

The retention period of personal data processed by MAG Offshore depends on the purpose and legal basis of processing. Personal data will be retained:

• where processing is necessary for the performance of a contract or taking steps prior to entering into a contract – for the period necessary to conclude and perform the contract, and thereafter for the period necessary to secure potential claims arising under applicable law,
• where processing relates to recruitment processes and establishing or performing cooperation with contractors, consultants, specialists and subcontractors – for the period necessary to carry out the cooperation process and to secure potential claims (until the expiry of limitation periods provided by law),
• where processing is necessary to comply with legal obligations imposed on the Controller – for the period required under applicable laws, in particular tax, accounting and archiving regulations,
• where processing is based on the Controller’s legitimate interests, including business relations, business communication, direct marketing, organisational security and compliance – for the period necessary to achieve these purposes, in particular until a response to an inquiry has been provided, the business relationship has ended or an effective objection to processing has been raised, and additionally for the period necessary to secure potential claims,
• where processing is based on consent – until the consent is withdrawn, however no longer than necessary for the purpose for which the consent was granted.

Rights of Data Subjects

Pursuant to the GDPR, you have the right to:

• access your personal data and obtain a copy thereof,
• rectify (correct) inaccurate or outdated personal data,
• request deletion of personal data (“right to be forgotten”) in cases provided for by law,
• restrict the processing of personal data,
• object to the processing of personal data based on the Controller’s legitimate interests,
• data portability, where processing is based on consent or a contract and carried out by automated means,
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your personal data violates applicable laws.

Transfers of Personal Data Outside the European Economic Area

Due to the international nature of MAG Offshore’s operations and the execution of maritime, offshore, energy and infrastructure projects, your personal data may be transferred to countries outside the European Economic Area or to international organisations cooperating in the execution of projects and services provided by MAG Offshore.

Such transfers may occur only in cases permitted by the GDPR, in particular where:

• the European Commission has determined that the relevant country ensures an adequate level of data protection,
• appropriate safeguards have been implemented, including standard contractual clauses approved by the European Commission,
• the transfer is necessary for the performance of a contract or for taking steps prior to entering into a contract,
• the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject,
• the data subject has explicitly consented to such transfer,
• the transfer is necessary for the establishment, exercise or defence of legal claims.

Voluntary Provision of Personal Data

Providing personal data is voluntary; however, it may be necessary for entering into or performing a contract, establishing cooperation, handling inquiries, conducting communication or fulfilling legal obligations. Failure to provide personal data may make it impossible to achieve these purposes.

Automated Decision-Making and Profiling

Your personal data will not be used for decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect your situation.