1. Declaration of the Board of Directors of BEST Systemy Grzewcze Group

Świdnica, 25-05-2018 r.

„Declaration of the Board of Directors of „BEST” Systemy Grzewcze Group based in Świdnica on the security and protection of personal information processed by our group to the extent necessary to run our business”

„BEST” Systemy Grzewcze, being fully aware of the importance of personal data safety and protection, adopts the following declaration to ensure the highest standards of personal data safety and protection.

On behalf of the Board of Directors, I hereby set the following aims for personal data safety and protection:

• regular verification of legal requirements and compliance to the lawful basis for maintaining the highest standards of personal data safety and protection,
• support for personal data safety and protection programmes and events,
• providing necessary resources to implement safety systems,
• special protection of personal data, which are processed to run our business,
• developing employees’ awareness of the importance of processed personal data.

On behalf of the Board of Directors of „BEST” Systemy Grzewcze Group
Mariusz Koba

2. Information for Customers

1. Personal data protection under the General Data Protection Regulation (GDPR).
The following information concerns personal data, collected and processed by BEST Systemy Grzewcze Group (BEST Systemy Grzewcze as well as Przedsiębiorstwo Handlowo Usługowe Mariusz Koba ), as an administrator of personal data, manners of processing, as well as rights of the parties to which personal data refer. If you have any questions or comments on our data protection policy, you can write to us: rodo@systemy-grzewcze.pl
BEST Systemy Grzewcze Group collects and process personal information of legal persons (including our customers) only to the extent necessary to run our business.

To the extent required by law, we will inform you about:

a) the reason and manner of your personal data collection, processing, and storage
b) the legal basis of personal data collection
c) the rights of the parties to which personal data refer, as well as our obligations regarding personal data processing.

2. Personal information subjects
Through this statement, we inform about the possible manners of processing of personal information of legal persons in Poland by BEST Systemy Grzewcze, including:
a) our customers (even possible ones)
b) our business partners, employees, statutory representatives, proxy, or customers’ representatives
c) other persons, whose personal data are processed in order to issue or pay invoices within the partnership with our customers.

3. Personal data categories
3.1. Personal data provided by our customers
In connection with our collaboration, i.e.:
– BEST’s products delivery to our customers or to the subjects cooperating with our customers,
– sale and promotion of our products,
as well as in case of the cooperation through an intermediary, we may process your personal information you provide us, which may include:
a) name, surname, company name, company address, postal address,
b) registration numbers (e.g. tax number (NIP) or national business registry number (REGON)
c) PESEL number,
d) contact information: e-mail address, telephone or fax number,
e) job title,
f) bank account number.

When signing a contract between you and BEST, personal data providing is voluntary, nevertheless it is necessary to for contract performance, as well as for collaboration between BEST and our customers.
Unless you enter into contract directly with BEST Systemy Grzewcze Group, personal data provision may be your official duty.
Unless you provide us with your personal information, we are not entitled to perform aforementioned actions, for example to make a payment when bank account number is not provided.

3.2. Third-party sources
We may collect your personal data from other third-party sources, including publicly available sources (e.g. CEIDG – Central Registration and Information on Business or KRS – National Court Register), to verify information you provided us. Solely the data available in those sources are to be processed.

We may also collect your personal data from your employers or the entity you represent. The processed data will include solely the data necessary for an employment process, contact data or job title change.

4. Legal basis, purposes, and periods of your personal data processing
4.1. Legal basis for your personal data processing
The legal basis is necessary to process personal information. Therefore, we process personal data solely when it is necessary:
a) to perform the contract between BEST Systemy Grzewcze Group and You (You are the part of the contract or You order our products or/and services);
b) due to legal obligations, e.g. to issue an invoice or the other documents in compliance with law (court or institutions order);
c) for justified business of BEST Systemy Grzewcze Group or the third party provided that it does not influence Your business, basic rights, and freedom.

It is worth noticing that when processing personal data on the basis of justified business, we keep the balance between our justified businesses and Your privacy.

Justified businesses include:
I. entering into and performing contracts with customers, being non-corporate entities or legal entities;
II. establishing, exercising, or defending legal claims by BEST Systemy Grzewcze Group;
III. verifying customers in publicly available sources;
IV. keeping contact with Customers, including keeping internal records for staying in contact with Customers;

4.2. Purposes and periods of personal data processing
How long we keep your personal information will depend on the purpose of information you provided us. There are legal requirements according to which we keep some types of data for specific periods, for the purposes for which the data was collected. Those purposes and periods include.

PURPOSE OF PERSONAL DATA PROCESSING	PERIOD OF PERSONAL DATA PROCESSING
Performance of the contract	During the performance of contract
Data archivisation, in compliance with legal requirements, e.g. The Accounting Act or The Tax Ordinance Act.	In compliance with legal requirements; as a matter of principle this is a period of 5 years from the end of the calendar year, when e.g. the invoice was issued, or the contract was ended.

Regardless of those periods, we may process your personal data in order to establish or exercise legal claims within the scope of our business. BEST Systemy Grzewcze may also process your personal information to defend legal claims on the basis of limitation period which, as a matter of principle, is maximum 6 years from the date of the occurrence of the event which may be the reason of the legal claim.

5. Security
Our staff who processes personal data is obliged to adhere to the regulations of the company regulations in terms of personal data processing in order to provide the privacy and security of personal data. They are also obliged to obey technical and organizational measures for personal data protection.

We take all necessary technical and organizational measures in order to ensure the appropriate standard of protection and to protect your data administered by us especially from the risks of unintentional or unlawful destruction, loss, alteration, unauthorized use, unauthorized disclosure, unauthorized access, and any other unlawful forms of personal data processing. Our security measures were implemented according to technological development, costs, and risks of personal data processing, with particular consideration given to sensitive information.

6. Transfer of personal data
BEST Systemy Grzewcze Group may transfer your data to the recipients or third parties solely whether it is necessary to perform the purposes mentioned in a point 4.2, to the extent that is necessary to perform the contract, whether it is necessary to comply with legal regulations, or if there is any other lawful basis for personal data processing.

Aforementioned data recipients or third parties may include:
a) entities processing personal information due to the contract with BEST Systemy Grzewcze Group, e.g. IT systems providers or archivisation services providers. Aforementioned entities are not entitled to decide independently on the manner of processing your personal information. They process your personal data solely to the extent necessary to run the business of our group. Those entities are obliged to adhere to legal specifications in a contract, in order to protect your privacy;
b) public administration (e.g. Police), authorities of the member states of European Union (e.g. personal data protection authorities), or courts, due to the national or EU law or the court order;

c) courier and postal services providers;
d) transport and forwarding companies;
e) other persons in the organization of a particular customer.

7. Rights of Customers with respect to personal data and how to exercise them
7.1. Rights of Customer
You have the right to access to your personal data that are processed by BEST Systemy Grzewcze Group. Whether you consider your personal data as inaccurate or incomplete, you have the right to make a request to correct your personal information, as it is described below in a point 7.2. We will respond to your request immediately.
Moreover, you have the right to:
a) withdraw your consent, whether you gave us the consent for processing your personal data (provided that this withdrawal complies with the law of personal data processing which was prior to the withdrawal decision);
b) erase your personal data, in accordance with GDPR;
c) restrict the processing of your personal data, in compliance with GDPR;
d) object to your personal data processing:
– due to your unique situation
– due to the manner of personal data processing, if it is processed for public interest to perform justified business of our group or third party;
e) data portability, e.g. to receive your personal information you provided to BEST Systemy Grzewcze Group in a structured, commonly-used, and machine-readable format and to request transferring of your personal data to a different data administrator, without hindrance from our Group, and in compliance with our privacy policy.
We will verify your request and objections, in accordance with personal data protection law. Aforementioned rights of personal data subjects are not absolute.

When responding to your request, we may ask you for your identity verification or providing us with for more information. If your request will be refused, we will provide you with the comprehensive explanation.

7.2. Exercising your rights
To exercise your rights, please contact us by writing to us:
– rodo@systemy-grzewcze.pl or
– BEST Systemy Grzewcze, ul. Towarowa 15, 58-100 Świdnica, with a note „Personal Data Protection”.

Whether you are not satisfied with the manner of your personal data protection by our Group, please inform us, using the aforementioned contact data. Therefore, we will verify your request.

We will use our best efforts to respond to your request. In addition, you have the right to submit an appeal to the competent protection data authority. In Poland, it is the President of the Personal Data Protection Office.
In order to ensure the accuracy of your personal data, from time to time we may ask you for verification and confirmation of your personal data that we store, as well as for providing u with information about the change of your personal data (e.g. the change of e-mail address).

We really recommend regular verification of the accuracy, validity, and integrity of your personal information that we process.

3. Information for Suppliers

1. Personal data protection under the General Data Protection Regulation (GDPR).
The following information concerns (I) personal data, which may be collected BRST Systemy Grzewcze Group when coming into contact with supplier/contractor, making contract with supplier/contractor or placing order (each person named as „Group” or „We„), (II) manners of processing, as well as rights of the parties to which personal data refer. In case of aforementioned situations, BEST Systemy Grzewcze is an administrator of personal data.

BEST Systemy Grzewcze Group collects and processes personal information of legal persons (including our suppliers and contractors) only to the extent necessary to run our business. Whether you have any questions or comments on our personal data protection policy, you can write to us: rodo@systemy-grzewcze.pl

To the extent required by law, we will inform you about:

• the reason and manner of your personal data collection, processing, and storage
• the legal basis of personal data collection
• the rights of the parties to which personal data refer, as well as our obligations regarding personal data processing.

2. Personal information subjects
Through this statement, we inform about the possible manners of processing of personal information of legal persons in Poland by BEST Systemy Grzewcze, including:
a) our suppliers or contractors (even possible ones)
b) our business partners, employees, statutory representatives, proxy, or customers’ representatives
c) other persons, whose personal data are processed in order to issue or pay invoices (“You” or “Contractors”).

3. Personal data categories
3.1. Personal data provided by our contractors

In connection with our collaboration, i.e.: 
– providing services by you or an organization you represent

– delivering materials to BEST Systemy Grzewcze Group

as well as in case of cooperation through an intermediary, we may process your personal information you provide us, which may include:

a) name, surname, company name, company address, postal address,
b) registration numbers (e.g. tax number (NIP) or national business registry number (REGON)
c) PESEL number,
d) contact information: e-mail address, telephone or fax number,
e) job title,
f) specific business ID numbers,
g) bank account number.

When signing a contract between you and BEST, personal data providing is voluntary, nevertheless it is necessary to for contract performance, as well as for collaboration between BEST and our contractors.

Unless you enter into contract directly with BEST Systemy Grzewcze Group, personal data provision may be your official duty.

Unless you provide us with your personal information, we are not entitled to perform aforementioned actions, for example to make a payment when bank account number is not provided.

3.2. Third-party sources
We may collect your personal data from other third-party sources, including publicly available sources (e.g. CEIDG – Central Registration and Information on Business or KRS – National Court Register), to verify information you provided us. Solely the data available in those sources are to be processed.
We may also collect your personal data from your employers or the entity you represent. The processed data will include solely the data necessary for an employment process, contact data or job title change.

4. Legal basis, purposes, and periods of your personal data processing
4.1. Legal basis for your personal data processing
The legal basis is necessary to process personal information. Therefore, we process personal data solely when it is necessary:
a) to perform the contract between BEST Systemy Grzewcze Group and You (You are the part of the contract or You order our products or/and services);
b) due to legal obligations, e.g. to issue an invoice or the other documents in compliance with law (court or institutions order);
c) for justified business of BEST Systemy Grzewcze Group or the third party provided that it does not influence Your business, basic rights, and freedom.

It is worth noticing that when processing personal data on the basis of justified business, we keep the balance between our justified businesses and Your privacy.

Justified businesses include:
I. entering into and performing contracts with customers, being non-corporate entities or legal entities;
II. establishing, exercising, or defending legal claims by BEST Systemy Grzewcze Group;
III. verifying customers in publicly available sources;
IV. keeping contact with Customers, including keeping internal records for staying in contact with Customers;

4.2. Purposes and periods of personal data processing
How long we keep your personal information will depend on the purpose of information you provided us. There are legal requirements according to which we keep some types of data for specific periods, for the purposes for which the data was collected. Those purposes and periods include:

PURPOSE OF PERSONAL DATA PROCESSING	PERIOD OF PERSONALDATA PROCESSING
Performance of the contract	During the performance of contract
Verifying the identity of the employees of the collaborators	During the performance of contract or until the contract of employment is ended
Exchanging the data of collaborators	In compliance with legal requirements
Data archivisation, in compliance with legal requirements, e.g. The Accounting Act or The Tax Ordinance Act.	In compliance with legal requirements; as a matter of principle this is a period of 5 years from the end of the calendar year, when e.g. the invoice was issued, or the contract was ended.

Regardless of those periods, we may process your personal data in order to establish or exercise legal claims within the scope of our business. BEST Systemy Grzewcze may also process your personal information to defend legal claims on the basis of limitation period which, as a matter of principle, is maximum 6 years from the date of the occurrence of the event which may be the reason of the legal claim.

5. Security
Our staff who processes personal data is obliged to adhere to the regulations of the company regulations in terms of personal data processing in order to provide the privacy and security of personal data. They are also obliged to obey technical and organizational measures for personal data protection.
We take all necessary technical and organizational measures in order to ensure the appropriate standard of protection and to protect your data administered by us especially from the risks of unintentional or unlawful destruction, loss, alteration, unauthorized use, unauthorized disclosure, unauthorized access, and any other unlawful forms of personal data processing. Our security measures were implemented according to technological development, costs, and risks of personal data processing, with particular consideration given to sensitive information.

6. Transfer of personal information
6.1. Transfer of personal information within BEST Systemy Grzewcze Group
We may transfer your personal data to our employees, as well as to other entities connected with BEST. When transferring personal information within our group, it may include:
a) providing and running IT systems and solutions, used for the processing of personal data of contractors and entities connected with BEST;
b) transferring personal data of contractors to third parties, in order to perform services by those parties for BEST Systemy Grzewcze Group, e.g. financial services, accounting services, IT services, or legal services.

6.2. Transfer of personal information outside BEST Systemy Grzewcze Group
BEST Systemy Grzewcze Group may transfer your data to the recipients or third parties solely whether it is necessary to perform the purposes mentioned in a point 4.2, to the extent that is necessary to perform the contract, whether it is necessary to comply with legal regulations, or if there is any other lawful basis for personal data processing.

Aforementioned data recipients or third parties may include:
a) entities processing personal information due to the contract with BEST Systemy Grzewcze Group, e.g. IT systems providers or archivisation services providers. Aforementioned entities are not entitled to decide independently on the manner of processing your personal information. They process your personal data solely to the extent necessary to run the business of our group. Those entities are obliged to adhere to legal specifications in a contract, in order to protect your privacy;
b) public administration (e.g. Police), authorities of the member states of European Union (e.g. personal data protection authorities), or courts, due to the national or EU law or the court order;

c) courier and postal services providers;
d) transport and forwarding companies;
e) other persons in the organization of a particular customer.

7. Rights of Collaborators with respect to personal data and how to exercise them
7.1. Rights of Collaborator
You have the right to access to your personal data that are processed by BEST Systemy Grzewcze Group. Whether you consider your personal data as inaccurate or incomplete, you have the right to make a request to correct your personal information, as it is described below in a point 7.2. We will respond to your request immediately.
Moreover, you have the right to:
a) withdraw your consent, whether you gave us the consent for processing your personal data (provided that this withdrawal complies with the law of personal data processing which was prior to the withdrawal decision);
b) erase your personal data, in accordance with GDPR;
c) restrict the processing of your personal data, in compliance with GDPR;
d) object to your personal data processing:
– due to your unique situation
– due to the manner of personal data processing, if it is processed for public interest to perform justified business of our group or third party;
e) data portability, e.g. to receive your personal information you provided to BEST Systemy Grzewcze Group in a structured, commonly-used, and machine-readable format and to request transferring of your personal data to a different data administrator, without hindrance from our Group, and in compliance with our privacy policy.
We will verify your request and objections, in accordance with personal data protection law. Aforementioned rights of personal data subjects are not absolute.

When responding to your request, we may ask you for your identity verification or providing us with for more information. If your request will be refused, we will provide you with the comprehensive explanation.

7.2. Exercising your rights
To exercise your rights, please contact us by writing to us:
– rodo@systemy-grzewcze.pl or
– BEST Systemy Grzewcze, ul. Towarowa 15, 58-100 Świdnica, with a note „Personal Data Protection”.

Whether you are not satisfied with the manner of your personal data protection by our Group, please inform us, using the aforementioned contact data. Therefore, we will verify your request.

We will use our best efforts to respond to your request. In addition, you have the right to submit an appeal to the competent protection data authority. In Poland, it is the President of the Personal Data Protection Office.
In order to ensure the accuracy of your personal data, from time to time we may ask you for verification and confirmation of your personal data that we store, as well as for providing u with information about the change of your personal data (e.g. the change of e-mail address).

We really recommend regular verification of the accuracy, validity, and integrity of your personal information that we process.