HWBAS Groundbreaking

Data Controller

The controller of your personal data is HWBAS Sp. z o.o. with its registered office in Warsaw (ul. Wspólna 47/49, 00-680 Warsaw), entered into the Register of Entrepreneurs of the National Court Register by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register, under the KRS number 0001158137, share capital: PLN 21,800,000.00, fully paid-up, holding NIP (Tax Identification Number): 7011247972, REGON: 541012406.

Contact in data protection matters

The Controller has appointed a Data Protection Officer, who can be contacted in matters regarding the processing of personal data via e-mail at: kontakt@hwbas-groundbreaking.pl, by phone at: [phone to be completed], or by mail to the registered office address of the Controller with the note „IOD" (DPO).

Purposes and legal bases of processing

Your personal data will be processed for the following purposes:

• registration of participation in the Event, handling the application form, preparing participant lists, sending organizational information, ticket/QR code, conducting check-in, and ensuring smooth organization of the event – pursuant to Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in the organization of the event and handling its participants.
• ensuring the safety of persons and property, organizing entry, access control, organizational order, and documenting the course of the event in a general scope – pursuant to Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in ensuring safety and documenting the course of the event; to the extent that processing is necessary to fulfill the Controller's obligations arising from regulations on the safety of persons on the plant premises, rules for organizing entry to the plant premises, property protection, and health and safety (OHS) obligations, the legal basis for processing is also Article 6(1)(c) of the GDPR.
• organizing the factory tour, including verifying participation, communicating entry rules, safety, and movement around the plant – pursuant to Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in the safe organization of the tour; to the extent that processing is necessary to fulfill the Controller's obligations arising from regulations on the safety of persons on the plant premises, rules of movement around the plant, property protection, and health and safety (OHS) obligations, the legal basis for processing is also Article 6(1)(c) of the GDPR.
• free-of-charge recording and dissemination of your individual image in the event report and the Controller's promotional materials, solely if you grant separate consent – pursuant to Article 6(1)(a) of the GDPR, i.e., consent.

Scope of processed data

The Controller processes the data provided in the registration form, in particular: first name, last name, name of the company or institution, e-mail address, phone number, information about participation in the factory tour, meal preferences to the extent provided for in the form, and other organizational data necessary to participate in the event.

Information on photo/video recording

The event will be photographically and filmically documented. The Controller may record the general course of the event, including wide shots of the hall, event space, and participants, for the purpose of event documentation, internal communication, and preparing event reports. The participant's image may also be recorded as an element of the entire event, without exposing a specific person. To the extent that the Controller would like to use the participant's individual image in promotional materials or other materials exposing a specific person, this is done exclusively on the basis of the participant's separate consent.

Data recipients

Your data may be shared with entities cooperating with the Controller in organizing the event, in particular IT service providers, hosting providers, registration system maintenance providers, mailing service providers, event agencies, entities responsible for security and entry control, entities providing photo/video services, entities providing technical facilities, as well as entities providing legal, audit, or advisory services – exclusively to the extent necessary to achieve the indicated purposes and on the basis of appropriate agreements.

Data transfer outside the EEA

Due to the Controller's use of certain services or online platforms, in particular social networking sites or cloud service providers, your data – to the extent related to the publication of materials or the functioning of these services – may be transferred to third countries, in particular to the United States of America. If the data recipient in the United States participates in the EU-U.S. Data Privacy Framework, the transfer takes place on the basis of a European Commission adequacy decision. In other cases, the transfer takes place on the basis of standard contractual clauses or another mechanism provided for in Chapter V of the GDPR. Information on the safeguards applied can be obtained by contacting the Controller or the DPO.

Data retention period

Your personal data will be stored:

• for the period necessary to carry out the registration, organization, handling, and settlement of the event, and then for the period required by law or necessary to establish or defend against claims;
• in the scope of data related to security, entry, and organizational documentation – for the period necessary to achieve these purposes, and then for the limitation period of potential claims;
• in the scope of data processed on the basis of consent – until the consent is withdrawn, but no longer than for the period indicated in the content of the given consent or until the purpose for which the consent was granted ceases to exist.

Rights of the data subject

You have the right to:

• access the data,
• rectify the data,
• erase the data – in cases provided by law,
• restrict processing,
• object to the processing of data based on Article 6(1)(f) of the GDPR, for reasons related to your particular situation,
• data portability – to the extent that processing is based on consent or a contract and is carried out by automated means,
• withdraw consent at any time, if the processing is based on consent; the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To the extent that the legal basis for processing your personal data is Article 6(1)(f) of the GDPR, you have the right to object at any time – for reasons related to your particular situation – to the processing of your personal data. In such a case, the Controller will no longer process this data unless they demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Right to lodge a complaint

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

Voluntary provision of data / obligation to provide data

Providing the data marked as mandatory in the form is necessary to register and participate in the event. Failure to provide this data will make it impossible to register or participate in the event.

Granting consent to the use of your individual image is voluntary and is not a condition for participation in the event.

Automated decision-making

Your data will not be used for automated decision-making, including profiling.