The controller of personal data processed in connection with the implementation of the tasks referred to in Articles 12-13 of the Act of 5 September 2008 on the commercialisation of the state-owned public utility enterprise "Poczta Polska" and in the Act of 21 April 2005 on subscription fees is Poczta Polska, a joint-stock company with its registered office in Warsaw at ul. Rodziny Hiszpańskich 8, 00-940 Warsaw.

Contact with the Personal Data Protection Officer: Michał Prószyński, Data Protection Officer of Poczta Polska SA, ul. Rodziny Hiszpańskich 8, 00-940 Warsaw, e-mail address: inspektorodo@poczta-polska.pl

1. Personal data obtained in connection with the provision of services may be processed for the following purposes:

• their implementation (detailed information on the purpose of personal data processing, the categories of personal data processed, their source and the period or criteria for determining the period of processing of such data are available in the regulations of individual publicly available services. In the case of services that do not have separate regulations, personal data are processed to the extent necessary for their implementation on the basis of the contract concluded with the sender),

• conducting complaint and appeal proceedings,

• issuing invoices and accounting documents in order to fulfill obligations arising from tax and accounting law,

• establishing, defending and pursuing claims (including debt collection or sale of receivables),

• fulfillment of legal obligations incumbent on Poczta Polska SA, resulting from the Act of 1 March 2018 on counteracting money laundering and terrorism financing – until these obligations are fulfilled,

• presenting a shipment sent from abroad for customs control and declaring the goods contained therein for the procedure of admission to postal circulation, as well as handling a shipment sent from abroad intended for further customs procedure carried out by the addressee,

• research on the opinions, needs and satisfaction of customers regarding products and services, subject to the anonymity of the research results, which constitutes the legitimate interest of the data controller,

• carrying out internal audit and control activities (in particular including verification of the quality of services, process efficiency, security of postal transactions, detection and prevention of abuse), which constitutes the legitimate interest of the data controller,

• ensuring the security of networks and IT systems, including protection against activities violating the confidentiality, integrity, availability and authenticity of data, to the extent necessary and proportionate, which constitutes the legitimate interest of the data controller,

• document archiving,

pursuant to Article 6 paragraph 1 letters b, c, d, f of the GDPR, respectively.

Personal data will be stored for the period of:

• service implementation,

• 5 years for documentation generated and collected in connection with the provision of the service, including proof of posting and proof of receipt, quantity and value statements of shipped shipments, records of accepted and delivered shipments (starting from the year following the year in which the shipment was posted) in accordance with the appropriate archival category specified in the Uniform Material List of Files of Poczta Polska SA

• necessary to conduct complaint proceedings and in the case of a complaint, for a period of 5 years (starting from the year following the year in which the complaint was considered) in accordance with the appropriate archival category specified in the Uniform Material List of Files of Poczta Polska SA (in the case of separating selected documentation as part of an archival expertise into archival materials, the storage period will be no longer than 25 years, in accordance with the Regulation of the Minister of Culture and National Heritage of 20 October 2015 on the classification and qualification of documentation, transfer of archival materials to state archives and the disposal of archival documentation),

• storing evidence – in the case of the public registered electronic delivery service (PURDE) for 36 months from the date of issuance of the evidence, and in the case of the public hybrid service (PUH) for 18 months from the date of sending the shipment,

• resulting from the provisions of tax and accounting law for financial and accounting documents (applies to persons receiving an invoice or other accounting document),

• after which the claims become time-barred,

• 5 years in the case of a customs declaration made by Poczta Polska SA, i.e. the presentation of a shipment sent from abroad for customs control and the declaration of the goods contained therein for the procedure of admission to postal circulation and the handling of a shipment sent from abroad intended for further customs procedure carried out by the addressee (starting from the year following the year in which the case was concluded) in accordance with the appropriate archival category specified in the Uniform Material List of Files of Poczta Polska SA,

• 5 years in the case of complaint proceedings (starting from 1 January of the year following the date of closing the case) in accordance with the appropriate archival category specified in the Uniform Material List of Files of Poczta Polska SA, and in the case of separating selected documentation as part of an archival expertise into the category of archival materials, the storage period will be no longer than 25 years, in accordance with the Regulation of the Minister of Culture and National Heritage of 20 October 2015 on the classification and qualification of documentation, transfer of archival materials to state archives and the disposal of archival documentation,

• until an objection is raised, if the basis for the processing of personal data is the legitimate interest of Poczta Polska SA,

• 5 years, in accordance with Article 39, paragraph 6 of the Act on the National Cybersecurity System, in order to ensure the security of networks and IT systems, including protection against activities violating the confidentiality, integrity, availability and authenticity of data,

• no longer than for a period of 5 years from the first day of the year following the year in which all receivables are settled or extinguished in another manner.

2. Personal data of persons obliged or exempt from paying subscription fees will be processed for the purpose of carrying out tasks arising from the Act of 21 April 2005 on Subscription Fees, pursuant to Article 6 paragraph 1 letter c of the GDPR.

Personal data of individuals deregistered after a receiver is deregistered will be deleted after 5 years from the end of the calendar year in which the receiver was deregistered, provided there are no outstanding subscription fees and no pending subscription fee arrears or enforcement proceedings. If the outstanding subscription fee arrears are repaid or the pending proceedings are concluded, personal data will be deleted after 5 years from the end of the calendar year in which the obligation expired.

3. Video monitoring

Post offices that use video surveillance (closed-circuit television) to protect people and property (pursuant to Art. 6.1.f of the GDPR) are appropriately marked at the entrance. The image is recorded and stored for up to 3 months (unless it constitutes evidence in proceedings conducted by law enforcement authorities, in which case this period is extended until the proceedings are finally concluded) and used if necessary to analyze security incidents.

4. Personal data of persons authorized to conclude the contract, contact persons and persons implementing the contract

will be processed for the purposes of activities necessary to conclude and perform the contract, to comply with the legal obligations incumbent on the controller (i.e. issuing and storing invoices and accounting documents) and – within the scope of the controller's legitimate interest – to assess the risks related to concluding the contract, for archival purposes, and may be processed for the purpose of establishing, pursuing, or defending against claims arising from the contract, pursuant to Article 6 paragraph 1 letter b or Article 6 paragraph 1 letter f of the GDPR, respectively.
The source of the data is the entity with which the contract is concluded and may be publicly available registers (CEIDG, KRS). The categories of data processed may include:
– current data contained in extracts from these registers,
– contact persons: first name and last name, telephone number, email address, position,
– persons performing the contract, and additionally, depending on the scope of the contract: ID card series and number, professional qualifications, including authorization number, company name,
– persons co-habiting with the tenant in a residential unit owned by Poczta Polska SA: first name and last name, relationship, PESEL number.
Personal data will be stored for the duration of the contract and subsequent settlements, the period required to fulfill obligations arising from tax and accounting law, and for the archiving period from the date of its expiration.
Providing personal data is necessary to conclude and perform the contract.

Source of personal data:

• persons using the services of Poczta Polska SA are the sender (e.g. parcel, money order, postal item, PURDE or PUH) to the extent necessary to provide a specific service,

• persons using PURDE and PUH are the minister responsible for computerization and the minister responsible for the economy, in accordance with the Act of 18 November 2020 on electronic deliveries,

• in the case of acknowledging receipt on a mobile device, parameters such as the x and y coordinates of the point, the time of marking the point, force and pressure, and approximate geolocation data are recorded,

• persons obliged or exempt from paying subscription fees are subscribers (persons registering an RTV receiver), the register of the Universal Electronic System for Registration of the Population (PESEL) under the principles specified in the Act of 24 September 2010 on the population register (Poczta Polska SA verifies or supplements the categories of data in its subscriber database in the scope of: first name, last name, address of residence, PESEL number, date of birth), and the National Broadcasting Council (in the scope of information on the cancellation of arrears in the payment of subscription fees, interest for late payment and the fee imposed in the event of finding the use of an unregistered radio or television receiver and interest for late payment),

• in connection with the presentation of a shipment sent from abroad for customs control and the declaration of the goods contained therein for the procedure of admission to postal circulation and the handling of a shipment sent from abroad intended for further customs procedure carried out by the addressee is the sender, the operator of the country of origin and the National Tax Administration in the scope of the Certified Customs Declaration,

• processed to ensure the security of networks and IT systems, including protection against activities violating the confidentiality, integrity, availability and authenticity of data is the person reporting the incident,

• processed for the purpose of establishing, defending, and pursuing claims may be publicly available sources (i.e.: CEIDG, KRS, MSiG, KRZ, EUKW, business information offices, credit information offices), the PESEL register, the REGON register, authorities conducting enforcement proceedings (civil and administrative), administrative, court-administrative, judicial, bankruptcy, reorganization, restructuring, and criminal proceedings. The categories of personal data include current data contained in extracts from these registers and information contained in documents confirming the existence of receivables.

Providing personal data is voluntary but necessary to use the services provided by Poczta Polska SA and to consider and process requests, applications and other submissions, as well as to effectively manage cybersecurity incidents.

The obligation to provide personal data may result from legal provisions: the Act of 21 April 2005 on subscription fees and the Act of 1 March 2018 on counteracting money laundering and terrorism financing.

The supervisory authority competent for data protection, to which you have the right to lodge a complaint, is the President of the Personal Data Protection Office.

The recipients of personal data may be:

• • sender (receiving the data of the recipient of the shipment in the event of their using the option of confirmation of receipt or electronic confirmation of receipt (EPO - containing, among others, the x and y coordinates of the point, the time of marking the point, force and pressure, approximate geolocation data), in the case of proof of receipt in the PURDE service, as well as in connection with the response given to the submitted complaint, if justified, and in the event of the return of shipments if they were not collected by the addressee,

  • postal agents (if you use the services of a postal agency),

• • subcontractors of Poczta Polska SA in the case where the service is performed with the participation of a processor (sorting, transporting, delivering parcels, operating the ICT system),

  • entities providing legal, advisory and audit services on behalf of Poczta Polska SA,

• other postal operators in order to provide information about changes of address (based on your consent) and to forward returns to the relevant postal operators who have included information on the shipments confirming their acceptance of the postal service fee (based on the provisions of the Act of 23 November 2012 – Postal Law),

• other providers of registered electronic delivery services in the event that the addressee of a shipment sent under PURDE has an address for electronic delivery with a given provider,

• payment service providers in the event that the service is provided through another payment service provider within the meaning of the Payment Services Act,

• The National Revenue Administration and the European Commission for the purpose of making a customs declaration by Poczta Polska SA,

• tax authorities (in the case of collecting advance payments on personal income tax, including pensions and annuities received from foreign institutions by Polish tax residents in accordance with the relevant legal provisions),

• The General Inspector of Financial Information or the Prosecutor’s Office (in the case of performing duties arising from the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing),

• entrepreneurs providing services related to debt management and claim collection, debtor registers (BIG, KRD),

• entrepreneurs providing services related to debt management and debt collection, legal services, advisory and audit services, debt purchasers, debtor registers (i.e.: KRZ, business information offices, credit information offices), bodies conducting enforcement proceedings (civil and administrative), court, court-administrative, administrative, bankruptcy, reorganisation, restructuring and criminal proceedings, tax administration authorities and other state authorities, as well as other entities based on legal provisions,

• heads of tax offices in the event of the need to enforce subscription fees, as well as judicial authorities in the course of proceedings,

• The National Broadcasting Council, pursuant to the Act of 21 April 2005 on licence fees, in order to write off arrears in the payment of licence fees, interest for late payment thereof and a fee imposed in the event of the use of an unregistered radio or television receiver and interest for late payment thereof,

• Telewizja Polska Spółka Akcyjna with its registered office in Warsaw (TVP) in connection with the access of a subscriber or a person exempt from the obligation to pay subscription fees to the VoD service operated by TVP (data is transferred to TVP only if the data subject gives consent),

• state archives – in the case of the creation of archival materials intended for perpetual storage,

• control authorities (in the event of control of a given personal data processing operation by the Supreme Audit Office, the Office of Electronic Communications or another authorized body),

• The Social Insurance Institution and the Tax Office for the purpose of deducting social security contributions from remuneration and advance payments on personal income tax (in particular in the case of civil law contracts) as well as entities and bodies to which Poczta Polska SA is obliged to provide personal data on the basis of generally applicable legal provisions, including for the purpose of carrying out statutory tasks related to ensuring security and responding to incidents,

• persons who become familiar with the documentation (especially the design documentation) in the contract notice published by Poczta Polska SA – until the contract award procedure is completed.

Personal data may be transferred to a third country, i.e.:

• postal operators in the case of foreign shipments (country of destination or origin) for the purpose of:

• service implementation,

• obtaining information necessary to consider a complaint under the Universal Postal Convention (done in Doha on 11 October 2012, Journal of Laws of 2015, item 1522),

• postal operators and banks in the case of foreign transfers (country of destination or origin) for the purpose of:

– service provision,

– obtaining information necessary to consider the complaint,

• on the basis of the Universal Postal Convention (done in Doha on 11 October 2012, Journal of Laws of 2015, item 1522) and on the basis of the Act of 19 August 2011 on payment services,

• customs authorities in the country of destination (in order to fulfil the obligation imposed on Poczta Polska SA as the data controller under the law),

• The United States of America, based on the European Commission's decision of July 10, 2023, establishing the adequacy of the EU-US Data Privacy Framework in connection with the controller's use of cloud solutions provided by Microsoft. The list of entities that have joined the EU-US Data Privacy Framework is available at: Participant Search (dataprivacyframework.gov)

• Access to personal data. To exercise this right, you must submit a request to receive information about whether Poczta Polska SA processes your personal data. The request should include data enabling the applicant's identification: in the case of using Poczta Polska SA services: first name and last name, address, and optionally also: telephone number, email address, type of service: letter, parcel, courier, money order, payment service, bank account deposit, philatelic services, post office box, other – depending on the service to which the request pertains. In the case of persons obligated or exempt from paying subscription fees: first name and last name, PESEL number, and INI number (8-digit subscriber identification number); in the absence of an INI number: first name and last name, PESEL number, and address. Note: In the case of archival documentation, the right of access to personal data (i.e. confirmation of whether personal data are being processed and obtaining a copy of such data) applies to the extent that the personal data subject to disclosure can be determined using existing record-keeping measures.

• To rectify personal data. However, if you use Poczta Polska SA services, you can exercise this right by requesting a change to the service agreement regarding returns, a change of address, or a change of addressee within the timeframe specified in the Postal Law. For individuals required or exempt from paying subscription fees, information about changes to personal data is provided on a separate form, available at post offices and on the Poczta Polska SA website in the "TV Subscription" tab.

• To delete personal data (the right to be forgotten). To exercise this right, you must indicate the process to which the request relates and the circumstances justifying the deletion of the data, e.g., the data is no longer necessary for the complaint process for which it was collected and there is no legal basis for further processing (archiving periods have expired). The right to delete personal data will only be exercised if Poczta Polska SA has no legal basis for further processing. Personal data cannot be deleted, for example, if the processing of your personal data is necessary to provide the service of paying subscription fees or for archival purposes.

• to restrict the processing of personal data. To exercise this right, you must indicate the process to which the request relates and the occurrence of one of the grounds specified in Article 18 of the GDPR.

• to transfer your personal data. To exercise this right, please submit a request to receive your personal data that you have provided to Poczta Polska SA. The right to transfer your personal data will only be exercised if Poczta Polska SA processes your personal data on the basis of consent or a contract and in an automated manner.

• to withdraw consent. If the processing of your personal data is based on consent (Article 6(1)(a) of the GDPR), you may withdraw it at any time (this will not affect the lawfulness of processing based on consent before its withdrawal). Consent must first be withdrawn in the manner indicated when it was expressed (e.g., to a dedicated email address). If you do not remember how to withdraw consent, please indicate the process by which the consent was obtained, e.g., consent to future recruitment.

• To object. To exercise this right, you must object to the processing of your personal data if the personal data is processed for direct marketing purposes. In specific situations, you may object to the processing of personal data (including profiling) if the basis for their processing is the performance of a task carried out in the public interest or the legitimate interest of Poczta Polska SA (in such a situation, your personal data may be processed only if it is demonstrated that there are compelling legitimate interests that override your interests, rights and freedoms, or grounds for establishing, pursuing, or defending claims).