{"id":53930,"date":"2019-03-30T20:36:04","date_gmt":"2019-03-30T19:36:04","guid":{"rendered":"https:\/\/www.metalfach.com.pl\/polityka-ochrony-danych-osobowych\/"},"modified":"2023-05-19T09:06:51","modified_gmt":"2023-05-19T07:06:51","slug":"personal-data-protection-policy","status":"publish","type":"page","link":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/","title":{"rendered":"The Metal-Fach Sp. z o.o. Personal Data Protection Policy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t\t\t\t<\/span>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Personal Data Protection Policy is implemented on 1 September 2018, pursuant to Article 24 of Regulation 2016\/679.
\nLegal requirements
\nThe Act of 10 May 2018 on Personal Data Protection (Journal of Laws 2018, item 1000). Regulation of the Minister of Internal Affairs and Administration of 29 April 2004 on personal data processing documentation and technical and organizational conditions that should be fulfilled by devices and computer systems used for personal data processing (Journal of Laws of 2004 No. 100, item 1024).
\nTABLE OF CONTENTS:
\n1. List of main abbreviations
\n2. List of main definitions
\n3. Introduction
\n4. Objectives of the Personal Data Protection Policy
\n5. Data Protection Officer
\n6. Natural persons authorised to process personal data
\n7. Personal data protection principles
\n8. Authorisation to process personal data
\n9. Personal data processing agreement
\n10. Personal data sharing
\n11. Transferring personal data outside Poland
\n12. List of buildings, rooms or parts of rooms forming an area where personal data is processed
\n13. List of filing systems with programs applied to process of the data
\n14. Description of the filing system structure
\n15. Description of the data flow between filing systems
\n16. Definition of the technical and organisational measures necessary to ensure the confidentiality, integrity and accountability of the data processed
\n17. Criminal law and regulations
\n18. Final provisions
\n19. Appendices<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t1. List of main abbreviations<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t
\n\n\n\n\n\n\n\n\n\n\n\n\n
PDPA<\/td>\nAct of 10 May 2018 on Personal Data Protection (Journal of Laws of 2018, item 1000)<\/td>\n<\/tr>\n
GDPR<\/td>\nRegulation 2016\/679 of the European Parliament and of the EU Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95\/46\/EC (general regulation on personal data protection)<\/td>\n<\/tr>\n
MIA&A Regulation<\/td>\nRegulation of the Minister of Internal Affairs and Administration of 29 April 2004 on personal data processing documentation and technical and organizational conditions that should be fulfilled by devices and computer systems used for personal data processing<\/td>\n<\/tr>\n
PDPO<\/td>\nPersonal Data Protection Office<\/td>\n<\/tr>\n
PDC<\/td>\nPersonal Data Controller<\/td>\n<\/tr>\n
DPO<\/td>\nData Protection Officer<\/td>\n<\/tr>\n
ICTSA<\/td>\nICT Systems Administrator<\/td>\n<\/tr>\n
IS<\/td>\nIT System<\/td>\n<\/tr>\n
PDSMS<\/td>\nPersonal Data Security Management System<\/td>\n<\/tr>\n
PDPP<\/td>\nPersonal Data Protection Policy<\/td>\n<\/tr>\n
ITSMM<\/td>\nIT Systems Management Manual<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t2. List of main definitions<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The terms listed below will have the following meanings throughout this Data Security Policy.
\n1. Personal Data Controller means an authority, organisational unit, entity or person deciding on the purposes and means of personal data processing.
\n2. Data Protection Officer means a natural person appointed by the Personal Data Controller referred to in Article 8 of PDPA.
\n3. ICT Systems Administrator means a person or an external entity, appointed by the Personal Data Controller, responsible for the functioning of ICT systems and networks and for compliance with the rules and requirements for the security of ICT systems and networks.
\n4. Authorised person means a person authorised by the Personal Data Controller to process personal data. The authorised user may include an employee of the company, a person performing work under a contract or mandate or another civil law contract, as well as a person doing voluntary work, on-the-job training or internship.
\n5. Personal data means any information about an identified or identifiable natural person. An identifiable person means a person who can be identified, directly or indirectly, in particular, by reference to an identification number or to one or more factors specific to his physical, mental, economic, cultural or social identity.
\n6. Filing system means any structured set of personal data that are accessible according to specific criteria, whether dispersed or divided on a functional basis.
\n7. Personal Data Processing means any set of operations that is performed on personal data, such as collecting, recording, storage, preparing, alteration, disclosing and erasure, and particularly those that are performed in IT systems.
\n8. IT system means a set of devices, programs, data processing procedures and program tools that operate together, used in order to process the data.
\n9. Data protection in the IT system means the implementation and use of relevant technical and organisational means that ensure data protection from unauthorised processing thereof.
\n10. Information Security means a set of principles that must be followed when designing and using systems and applications for processing information so that access to them is consistent with the assumptions in all circumstances.
\n11. Erasure of data means the destruction of personal data or such modification thereof that the identity of the data subject cannot be established.
\n12. Consent of the data subject means a statement of intent containing an agreement to the processing of personal data relating to a person who submits the statement. The consent may not be alleged or implied on the basis of any other statement of intent. The consent may be revoked at any time.
\n13. Recipients of data mean anyone to whom personal data are disclosed, with the exception of
\n\u2022 the data subject
\n\u2022 persons authorised to process personal data
\n\u2022 state authorities or local self-government authorities to whom data are disclosed in connection with any pending proceedings
\n14. Third country means a country belonging to the European Economic Area.
\n15. Password means a sequence of alphabetical, digital or other characters, known only to the user who is authorised to work in an IT system.
\n16. User ID means a sequence of alphabetical, digital or other characters uniquely identifying a person authorised to process data in designated areas of the company’s IT system.
\n17. Data confidentiality means an attribute ensuring the data is not rendered available to unauthorised entities.
\n18. Data integrity means an attribute ensuring the personal data is not changed or destroyed in an unauthorised way.
\n19. Data accountability means an attribute ensuring the actions of a person or entity can be uniquely attributed only to that person or entity.
\n20. IT system user means a person authorised to process personal data in IT systems, who has been assigned a unique ID and password.
\n21. Authentication means the process of correct identifying a user of the IT system to the extent enabling the granting of appropriate rights or privileges in the company’s IT system.
\n22. Incident means an infringement of personal data security in terms of confidentiality, availability and integrity.
\n23. Threat means a possible occurrence of an incident.
\n24. Corrective action means an action taken to eliminate the cause of an incident or other undesirable situation.
\n25. Preventive action means an action that should be taken to eliminate the causes of a threat or other potential undesirable situation.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t3. Introduction<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The Personal Data Protection Policy defines the principles of personal data processing and methods for protecting them, as a set of laws, rules and instructions regulating the system of their management, protection and distribution in \u201cMetal-Fach\u201d sp. z o.o.
\nThe Policy contains information on the recognition of personal data processing processes and the technical and organizational security measures in place to ensure the protection of the personal data processed.
\nThis document is consistent with the applicable laws, including, without limitation, with the Act of 10 May 2018 on the Protection of Personal Data and GDPR.
\nOn the basis of the risk analysis for personal data loss, the risk level was defined as basic.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t4. Objectives of the Personal Data Protection Policy<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The Personal Data Protection Policy has been prepared to define and implement the rules for security and protection of personal data processed in \u201cMetal-Fach\u201d, and in particular to
\n1. Ensure compliance with legal requirements
\n2. Ensure confidentiality, integrity and accountability of personal data processed in the company
\n3. Raise the awareness of persons processing personal data
\n4. Engage persons who process personal data of the company in its protection<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t5. Data Protection Officer (DPO)<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. The Personal Data Controller appoints the Data Protection Officer. The appointment is effected on the basis of a letter of appointment (a specimen of the appointment form is attached as Appendix Z1-PODO hereto).
\n2. The Personal Data Controller may appoint the deputies of the Data Protection Officer.
\n3. The Personal Data Controller authorises the Data Protection Officer to grant authorisations to process personal data.
\n4. The role of the Data Protection Officer is to supervise compliance with the rules and technical and organizational measures that are taken to ensure the protection of personal data processed in \u201cMetal-Fach\u201d.
\n5. The Data Protection Officer has the following tasks
\n(a) informing and advising the controller or the processor and the employees who carry out processing of their obligations and on other Union or Member State data protection provisions
\n(b) monitoring compliance with GDPR (Regulation 2016\/679 of the European Parliament and of the Council), with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits
\n(c) providing advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 35 of GDPR
\n(d) cooperating with the supervisory authority
\n(e) acting as the contact point for the supervisory authority on issues relating to processing, including the prior consultation referred to in Article 36 of GDPR, and to consult, where appropriate, with regard to any other matter.
\nAdditionally, the DPO’s task is to keep a register of personal data processing activities, as well as a register of data processing agreements.
\n6. The DPC may entrust the DPO with other duties that do not prejudice the proper performance of the tasks set out in Clauses 4 and 5.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t6. Natural persons authorised to process personal data<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. The tasks of persons authorised to process personal data are to
\n\u2022 learn the provisions of the law on personal data protection and the provisions of the Personal Data Protection Policy and the IT Systems Management Manual
\n\u2022 comply with the advice of the DPO
\n\u2022 process of personal data only to the extent determined individually by the Personal Data Controller in a written authorisation and only for the purpose of performing imposed official duties
\n\u2022 immediately inform the DPO about any irregularities concerning the security of personal data processed in the company
\n\u2022 protect personal data and the means taken to process personal data from unauthorised access, disclosure, alteration, destruction or distortion
\n\u2022 use the company’s IT systems in a manner consistent with the instructions contained in the manuals of devices comprising the IT systems
\n\u2022 keep personal data and the manners of their protection confidential indefinitely
\n\u2022 exercise special care in the performance of personal data processing operations in order to protect the interests of data subjects.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t7. Personal data protection principles<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. All the personal data in the Company must be processed in accordance with the applicable law.
\n2. With regard to persons whose personal data are processed, the information obligation resulting from the provisions of PDPA must be fulfilled.
\n3. The personal data collected must be processed for specified and legitimate purposes and may not be processed further in a way incompatible with those purposes.
\n4. Carrying out personal data processing in accordance with the principles of substantive correctness and in accordance with the purposes for which it was collected must be ensured.
\n5. Personal data may be processed within the Company for no longer than is necessary to achieve the purpose of their processing.
\n6. The confidentiality, integrity and accountability of personal data processed in the Company must be ensured.
\n7. The personal data processed may not be made available without the consent of the data subjects, unless the data are made available to the data subjects, persons authorised to process personal data, entities to whom the data were transferred on the basis of a data processing agreement, and state or local government authorities in connection with any pending proceedings.
\n8. Processing of personal data in the Company may take place both in IT systems and in the traditional form: card files, indexes, books, lists and other records.
\n9. With respect to personal data processed in systems other than IT systems, the existing provisions on professional secrecy, circulation and security of business documents shall continue to apply.
\n10. All persons whose data are processed have the right to the protection of personal data concerning them, to control the processing of such data and to have them updated, erased and receive all information of their rights.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t8. Authorisation to process personal data<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. Only persons authorised to process personal data (a specimen of the authorisation is attached as Appendix Z2-PODO) issued by the Personal Data Controller or the Data Protection Officer may process personal data and operate IT filing systems containing such data, and only if they have submitted a relevant statement on the proper implementation of the provisions under PDPA (a specimen of the statement is attached as Appendix Z3-PODO).
\n2. The DPO, on behalf of the PDC, keeps a register of persons authorised to process personal data (a specimen of the register is attached as Appendix Z4-PODO).<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t9. Personal data processing agreement<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1) The Personal Data Controller may assign another entity to process personal data in order to perform a specific task.
\n2) In the case of assigning the processing of personal data to an external entity, the personal data processing agreement shall define first of all the purpose and scope of the personal data processing. The list of concluded data processing agreements is maintained by the DPO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t10. Personal data sharing<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The sharing of personal data in the company is permitted on the basis of one of the legal bases specified in the PDPA or on the basis of provisions of other laws.
\nThe DPO maintains a record of sharing personal data to institutions and persons from outside the company (a specimen of the record is attached as Appendix Z5-PODO).<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t11. Transferring personal data outside Poland<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. The Personal Data Controller may transfer personal data to:
\n\u25e6 countries in the European Economic Area
\n\u25e6 other countries (third countries).
\n2. The transfer of personal data within the EEA is interpreted as if they were processed on the territory of Poland.
\n3. In case of the transfer of personal data to a third country, one of the following conditions must be met.
\n\u2022 The target country provides guarantees of personal data protection in force on its territory at least to the same extent as those in force on the territory of the Republic of Poland
\n\u2022 The transfer of personal data results from an obligation imposed by law or by a ratified international agreement
\n\u2022 The transfer of personal data will be approved by the PDPO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t12. List of buildings, rooms or parts of rooms forming an area where personal data is processed<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The DPO shall be responsible for maintaining and storing records containing a list of buildings, rooms or parts of rooms forming an area where personal data is processed, in both paper and electronic form.
\nThe current list of personal data processing areas is attached as Appendix Z6-PODO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t13. List of filing systems with programs applied to process of the data<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The DPO is responsible for maintaining and storing records listing all personal data filing systems and indicating the software applied to the processing of such data. The current list of personal data filing systems is attached as Appendix Z7-PODO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t14. Description of the filing system structure<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The DPO is responsible for maintaining and storing records describing the filing systems structure for personal data processed in the Company.
\nThe current description of personal data filing systems structure is attached as Appendix Z8-PODO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t15. Description of the data flow between filing systems<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The DPO is responsible for maintaining and storing records describing the description of data flow between filing systems.
\nThe current description of the data flow is attached as Appendix Z9-PODO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t16. Definition of the technical and organisational measures necessary to ensure the confidentiality, integrity and accountability of the data processed<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

The DPO is responsible for maintaining and storing records containing the specific technical and organisational measures necessary to ensure the confidentiality, integrity and accountability of the data processed.
\nA current description of the technical and organisational measures in place is attached in Appendix Z10-PODO.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t17. Criminal law and regulations<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

Criminal law and regulations are defined in
\n\u2022 Act of 10 May 2018 on Personal Data Protection (Official Journal of 2018, item 1000), Article 102-108
\n\u2022 Act of 6 June 1997 on Criminal Code (Journal of Laws of 1997, No. 88, item 553, as amended), Article 266
\n\u2022 Act of 26 June 1974 on Labour Code (Journal of Laws of 1998, No. 21, item 94, as amended), Article 52 and 108<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t18. Final provisions<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

With regard to matters not regulated by this Personal Data Protection Policy, the provisions of the Act of 10 May 2018 on the Personal Data Protection (Journal of Laws of 2018, item 1000), and executive regulations to this Act, shall apply.
\nThe measures to be followed in the event of a personal data security infringement are specified in the procedure attached as Appendix 12 hereto, and such infringement is to be recorded in the register of incidents and events, which is attached as Appendix 11 hereto.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t19. Appendices<\/a>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t

1. Z1-PODO \u2013 Appointment to the position of Data Protection Officer
\n2. Z2-PODO \u2013 Authorisation to process personal data
\n3. Z3-PODO \u2013 Statement on the proper implementation of the provisions under PDPA
\n4. Z4-PODO \u2013 The records of persons authorised to process personal data
\n5. Z5-PODO \u2013 Records of personal data sharing
\n6. Z6-PODO \u2013 List of buildings, rooms or parts of rooms forming an area where personal data is processed
\n7. Z7-PODO \u2013 List of filing systems with programs applied to process of the data
\n8. Z8-PODO \u2013 Description of the filing system structure
\n9. Z9-PODO \u2013 Description of the data flow between filing systems
\n10. Z10-PODO \u2013 Description of technical and organisational measures applied
\n11. Z11-PODO \u2013 Register of incidents and events
\n12. Z12-PODO \u2013 Procedure for the event of personal data security infringement<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

The Personal Data Protection Policy is implemented on 1 September 2018, pursuant to Article 24 of Regulation 2016\/679. Legal requirements The Act of 10 May 2018 on Personal Data Protection (Journal of Laws 2018, item 1000). Regulation of the Minister of Internal Affairs and Administration of 29 April 2004 on personal data processing documentation and […]<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-53930","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\nThe Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach<\/title>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach\" \/>\n<meta property=\"og:description\" content=\"The Personal Data Protection Policy is implemented on 1 September 2018, pursuant to Article 24 of Regulation 2016\/679. Legal requirements The Act of 10 May 2018 on Personal Data Protection (Journal of Laws 2018, item 1000). Regulation of the Minister of Internal Affairs and Administration of 29 April 2004 on personal data processing documentation and […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/\" \/>\n<meta property=\"og:site_name\" content=\"Metal-Fach\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.pl\/MetalFachOfficial\" \/>\n<meta property=\"article:modified_time\" content=\"2023-05-19T07:06:51+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/personal-data-protection-policy\\\/\",\"url\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/personal-data-protection-policy\\\/\",\"name\":\"The Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#website\"},\"datePublished\":\"2019-03-30T19:36:04+00:00\",\"dateModified\":\"2023-05-19T07:06:51+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/personal-data-protection-policy\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/personal-data-protection-policy\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/personal-data-protection-policy\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Metal-Fach Sp. z o.o. Personal Data Protection Policy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/\",\"name\":\"Metal-Fach\",\"description\":\"Prasy zwijaj\u0105ce, owijarki bel, \u0142adowacze czo\u0142owe, wozy paszowe, rozrzutniki obornika, przyczepy rolnicze, agregaty uprawowe\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#organization\",\"name\":\"Metal-Fach\",\"url\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.metalfach.com.pl\\\/wp-content\\\/uploads\\\/metalfach-logo-horizontal-r.svg\",\"contentUrl\":\"https:\\\/\\\/www.metalfach.com.pl\\\/wp-content\\\/uploads\\\/metalfach-logo-horizontal-r.svg\",\"width\":777,\"height\":207,\"caption\":\"Metal-Fach\"},\"image\":{\"@id\":\"https:\\\/\\\/www.metalfach.com.pl\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"http:\\\/\\\/www.facebook.pl\\\/MetalFachOfficial\",\"https:\\\/\\\/www.instagram.com\\\/metalfach_official\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/metal-fach\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/metalfach1\",\"https:\\\/\\\/www.tiktok.com\\\/@metalfach_official\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"The Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach","og_description":"The Personal Data Protection Policy is implemented on 1 September 2018, pursuant to Article 24 of Regulation 2016\/679. Legal requirements The Act of 10 May 2018 on Personal Data Protection (Journal of Laws 2018, item 1000). Regulation of the Minister of Internal Affairs and Administration of 29 April 2004 on personal data processing documentation and […]","og_url":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/","og_site_name":"Metal-Fach","article_publisher":"http:\/\/www.facebook.pl\/MetalFachOfficial","article_modified_time":"2023-05-19T07:06:51+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/","url":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/","name":"The Metal-Fach Sp. z o.o. Personal Data Protection Policy - Metal-Fach","isPartOf":{"@id":"https:\/\/www.metalfach.com.pl\/en\/#website"},"datePublished":"2019-03-30T19:36:04+00:00","dateModified":"2023-05-19T07:06:51+00:00","breadcrumb":{"@id":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.metalfach.com.pl\/en\/personal-data-protection-policy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.metalfach.com.pl\/en\/"},{"@type":"ListItem","position":2,"name":"The Metal-Fach Sp. z o.o. Personal Data Protection Policy"}]},{"@type":"WebSite","@id":"https:\/\/www.metalfach.com.pl\/en\/#website","url":"https:\/\/www.metalfach.com.pl\/en\/","name":"Metal-Fach","description":"Prasy zwijaj\u0105ce, owijarki bel, \u0142adowacze czo\u0142owe, wozy paszowe, rozrzutniki obornika, przyczepy rolnicze, agregaty uprawowe","publisher":{"@id":"https:\/\/www.metalfach.com.pl\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.metalfach.com.pl\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.metalfach.com.pl\/en\/#organization","name":"Metal-Fach","url":"https:\/\/www.metalfach.com.pl\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.metalfach.com.pl\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.metalfach.com.pl\/wp-content\/uploads\/metalfach-logo-horizontal-r.svg","contentUrl":"https:\/\/www.metalfach.com.pl\/wp-content\/uploads\/metalfach-logo-horizontal-r.svg","width":777,"height":207,"caption":"Metal-Fach"},"image":{"@id":"https:\/\/www.metalfach.com.pl\/en\/#\/schema\/logo\/image\/"},"sameAs":["http:\/\/www.facebook.pl\/MetalFachOfficial","https:\/\/www.instagram.com\/metalfach_official\/","https:\/\/www.linkedin.com\/company\/metal-fach","https:\/\/www.youtube.com\/user\/metalfach1","https:\/\/www.tiktok.com\/@metalfach_official"]}]}},"_links":{"self":[{"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/pages\/53930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/comments?post=53930"}],"version-history":[{"count":0,"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/pages\/53930\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.metalfach.com.pl\/en\/wp-json\/wp\/v2\/media?parent=53930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}