Implementing the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (general data “GDPR”), we inform you about the principles of processing your personal data and about your rights related to it.

1) The administrator of your personal data is Państwowe Gospodarstwo Wodne Wody Polskie with its registered office in Warsaw 00-848, ul. Żelazna 59a.

2) Contact with the Data Protection Officer is possible at the address – iod@wody.gov.pl.

3) your personal data may be processed for the purpose of:

fulfillment of legal obligations arising from the Act of 20 July 2017 Water Law (i.e. Journal of Laws 2018 item 2268 as amended) (legal basis: Article 6 (1) (c) of the Regulation);

performance of contracts (legal basis: Article 6 (1) (b) of the Regulation);

in other cases, your personal data will be processed only on the basis of the prior consent to the extent and purpose specified in the consent (legal basis: Article 6 (1) (a) of the Regulation).

4) The recipient of your personal data may be public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for purposes that result from the provisions of generally applicable law.

5) your personal data will be processed for the period necessary for the implementation indicated in point 3 purposes of processing, and after that time for the period and to the extent required by the provisions of generally applicable law.

6) In connection with the processing of your personal data, you have the following rights:

1. the right to access personal data, including the right to obtain a copy of this data;
2. the right to request the rectification (correction) of personal data – if the data is incorrect or incomplete;
3. the right to request the deletion of personal data (the so-called right to be forgotten), if:
   1. the data is no longer necessary for the purposes for which it was collected or otherwis processed,
   2. the data subject has objected to the processing of personal data,
   3. the data subject has withdrawn consent to the processing of personal data, which is the basis for data processing and there is no other legal basis for data processing,
   4. personal data is processed unlawfully,
   5. personal data must be removed in order to fulfill the obligation resulting from legal provisions;
4. the right to request the restriction of the processing of personal data – if:
   1. the data subject questions the correctness of personal data,
   2. data processing is unlawful, and the data subject opposes the deletion of data, requesting their restriction instead,
   3. The administrator no longer needs the data for his purposes, but the data subject needs them to establish, defend or pursue claims,
   4. the data subject has objected to the processing of data until it has been determined whether the legitimate grounds on the part of the administrator override the grounds of objection;
5. the right to transfer data – if the following conditions are jointly met:
   1. data processing takes place on the basis of an agreement concluded with the data subject or on the basis of the consent expressed by that person,
   2. processing is carried out in an automated manner;
6. the right to object to data processing – if the following conditions are jointly met:
   1. there are reasons related to your special situation, in the case of data processing on the basis of a task carried out in the public interest or as part of the exercise of public authority by the Administrator,
   2. processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the data subject, requiring the protection of personal data, in particular when the data subject is a child.

7) If the processing of personal data is based on the consent of the person to the processing of personal data (Article 6 (1) (a) of the GDPR), you have the right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of the processing which was carried out on the basis of your consent before its withdrawal.

8) If you believe that the processing of your personal data by the Administrator violates the law, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.

9) Providing your personal data by you is obligatory, if the premise for the processing of personal data is a legal provision or an agreement concluded between the parties, if the processing is based on consent, providing personal data to the Administrator is voluntary.

10)  Your data may be processed in an automated manner and will not be profiled