Information Clause

GDPR INFORMATION CLAUSE for persons whose personal data is processed by Chińsko-Polskie Towarzystwo Okrętowe S.A. in Shanghai, Gdynia Branch

1. Controller of the personal data
The Controller of the personal data is Chińsko-Polskie Towarzystwo Okrętowe S.A. 
in Shanghai, Gdynia Branch, with its registered office at ul. Śląska 17, 81-319 Gdynia, 
NIP (Tax Identification Number): 5860104523, REGON (Business Statistical Number): 001372525.

2. Data Protection Officer
The controller has appointed a Data Protection Officer. 
Contact e-mail: cp-gdpr@chipolbrok.com.pl

3. Purposes and legal basis for the processing of personal data
In particular, personal data is processed for the following purposes:
- contact and partnership with business partners, customers, suppliers and institutions,
- Execution of transport, commercial and shipping contracts – including handling 
and performing charter, freight, agency, forwarding and 
logistics contracts, organising cargo transport, planning voyages, managing ship schedules, and settlement of transport services.
Handling orders, purchases and payments – including the purchase of goods, spare parts, equipment, consumables and services necessary for the exploratory operation of ships and the shipowner’s activities, implementation of purchasing procedures, invoicing and financial settlements, payment processing, control of receivables, liabilities and settlements,
- maintenance of transport, complaint and insurance documentation,
- preparation and filing of accounting, tax and transport documentation,
- maintenance of corporate documentation and records, as well as organisation of internal and management meetings,
- organisation of company events, business trips, as well as handling of business trips,
- publication of advertisements and industry articles in the media (including social media),
- publication of images on the website and in promotional channels,
- conducting marketing and promotional activities,
- handling requests for quotations, tender procedures, and verification of bids,
- conducting court, claim and mortgage cases,
- assertion and defence of claims,
- fulfilling legal obligations under tax, customs, accounting, maritime and insurance law.

Legal basis for data processing:
- Article 6(1)(a) of the GDPR – consent (e.g. marketing, image),
- Article 6(1)(b) of the GDPR – performance of an agreement or taking steps prior to entering into an agreement,
- Article 6(1)(c) of the GDPR – legal obligation,
- Article 6(1)(f) of the GDPR – legitimate interests of the controller

4. Categories of personal data
The data includes: first name, last name, company name, position, contact details (telephone, e-mail), address of residence, identification data (including, for example, PESEL [Personal Identification Number]), financial data, HR data, image.

5. Data source
Data is obtained from the persons to whom it relates, as well as from agreements, invoices, correspondence (including e-mail), agencies, brokers, partner companies, cargo managers, charterers and other partner entities.

6. Recipients of data
Data may be transferred to partner entities such as insurers, law firms, IT service providers, banks, agents, business partners, logistics companies, tax, customs and insurance authorities.
7. Transfers of data outside the EEA
Data may be transferred to third countries in connection with the company’s activities. 
In such cases, we ensure an adequate level of data protection, including through the use of standard contractual clauses approved by the European Commission.

8. Data retention period
Data is stored for the period necessary to achieve the purposes for which it was collected, in accordance with the law and internal data retention policy. 
In the case of data processed on the basis of consent, until such consent is withdrawn.

9. Rights of data subjects
You have the right to:
- access your data,
- rectify it,
- delete it or restrict its processing,
- object to its processing,
- transfer your data,
- withdraw consent (if the data is processed on its basis),
- lodge a complaint with the President of the Personal Data Protection Office.

10. Automated decision-making
Data is not processed in an automated manner and is not subject to profiling.

11. IT systems
The data is processed in such IT systems as SAP, MS Excel, e-mail systems, electronic banking systems, Lotus Domino, Incata, and accounting software.