Information on the Processing of Personal Data of natural persons with whom companies from the USP Group conclude commercial contracts

In connection with the implementation of the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), we inform you about the rules for processing your personal data and your rights.

I. Information about the administrator:

The data controller becomes one of the companies listed below belonging to the USP Group, which is holding discussions with you regarding the establishment of a business cooperation or has signed a relevant cooperation agreement:

USP Zdrowie sp. z o.o. located in Warsaw at ul. Poleczki 35, postal code 02-822, registered in the business register maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under the number KRS 0000347815, NIP: 7010219241.

US Pharmacia sp. z o.o. based in Wrocław, ul. Ziębicka 40, postal code 50-507, registered in the register of entrepreneurs maintained by the District Court for Wrocław-Fabryczna in Wrocław, VI Economic Department of the National Court Register under the KRS number 0000046646, NIP: 8991432896.

EU Pharmacia sp. z o.o. based in Warsaw at ul. Poleczki 35, postal code 02-822, registered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, XIII Commercial Division of the National Court Register, under KRS number 146899, NIP: 951 20 68 112.

If you would like to contact us regarding matters related to the processing of personal data, please:

  1. sending an email to: [email protected],
  2. sending a letter to the address: USP Zdrowie sp. z o.o., ul. Poleczki 35, 02-822 Warsaw.

II. Purpose and legal basis for processing your personal data:

The Administrator processes your personal data for the following purposes:

  1. in order to perform the cooperation agreement or take actions at the request of the data subject before concluding the agreement (legal basis: Article 6(1)(b) GDPR);
  2. in order to verify the contractor of the USP Group, including the assessment of the financial situation of your company, constituting the legitimate interest of the Administrator (legal basis: Article 6(1)(f) GDPR);
  3. for the purpose of establishing, pursuing, or defending against claims, which constitutes the fulfillment of the Controller’s legitimate interest (legal basis: Article 6(1)(f) GDPR);
  4. for the purpose of fulfilling the legal obligations incumbent on the Administrator in the scope of tax law and accounting regulations (legal basis: Article 6(1)(f) GDPR);
  5. for purposes related to internal reporting within the USP Group or business analyses, which constitutes a legitimate interest of the Administrator (legal basis: Article 6(1)(f) of the GDPR);
  6. for the purposes explicitly indicated in the content of the consent to the processing of personal data (if such consent has been obtained) (legal basis: Article 6(1)(a) of the GDPR).

III. Categories of processed personal data:

Administrator, in fulfilling the purposes of personal data processing, will process, in particular, the following categories of information:

  1. identification data and registration data,
  2. address and contact information,
  3. data on the function performed,
  4. data on the type and scale of conducted activities,
  5. business experience data,
  6. ownership structure with connections, capital and personal connections, employment size, servicing banks, indicators and financial data, legal events, liability payment ratio, assessment of the company’s financial situation.

IV. Source of obtaining personal data:

In the event that we did not obtain personal data directly from you, we inform you that personal data was obtained from our business partner who may have been in business contact with you, as well as from our employee or associate, or from publicly available sources such as the National Court Register, the Central Registration and Information on Business.

Your personal data will also be obtained from entities engaged in assessing the financial situation of companies, conducted in connection with the verification of USP Group’s contractors. This data comes from publicly available sources, such as: the National Court Register, the Central Registration and Information on Business, or is provided by specialized entities (e.g., business intelligence agencies).

V. Obligation to provide personal data:

Providing your personal data is voluntary, however, it is necessary for the conclusion or execution of the contract. In cases where we collect your personal data based on consent, providing personal data is voluntary, and the given consent may be withdrawn at any time without affecting the possibility of executing the contract.

VI. Information about the recipients of your personal data:

We will transfer your personal data to:

  1. entities processing personal data on behalf of a company from the USP Group, including:
    1. external IT service providers used by companies from the USP Group;
    2. to contractors supporting the business processes of companies within the USP Group (e.g., providers of insurance services, telecommunication services, postal and courier services, and business financial situation assessment services);
    3. our partners responsible for providing physical security at our facilities and video monitoring;
  2. entities affiliated within the USP Group for administrative and reporting purposes;
  3. state administration bodies within the limits arising from legal regulations.

VII. Periods of personal data processing:

Your personal data will be stored for the duration of the contract and after its termination for the period of limitation of claims, or another period designated by the administrator for storing contracts.

The above periods of personal data storage will apply most often. Due to the multitude of possible situations, your data may be stored for either longer or shorter periods than described above. Any questions regarding personal data storage periods should be directed to the address specified in point I of this Information.

VIII. Profiling and Automated Decision-Making:

Your personal data will be used for profiling that includes assessing economic situations or verifying the USP Group’s contractor. However, during the profiling operations, we will not make any automated decisions.

IX. Rights of the Data Subject:

You are entitled to a number of rights under GDPR. In connection with the processing, you may submit your request for:

  1. access to your personal data (in response, we will provide information on how we process your data and you will receive a copy of the data from us);
  2. rectification of personal data – in case the data is incorrect or incomplete;
  3. deletion of personal data (known as the “right to be forgotten”). You can exercise this right, for example, when:
    1. we process personal data unlawfully,
    2. an objection to the processing of data based on the legitimate interest of the Administrator has been submitted and the objection proves to be justified,
    3. data must be deleted in order for us to fulfill an obligation resulting from legal regulations;
  4. restriction of the processing of personal data (e.g., suspension of data operations or not deleting data due to certain circumstances);
  5. transfer of personal data: to another controller, and when it is technically impossible, receiving from us a copy of the data that has been provided to us.

From the right to data portability mentioned in point 5 above, you may only exercise this right when the processing is carried out by automated means, and additionally: (a) based on a contract that binds us, or (b) based on expressed consent.

To exercise the above rights, you can submit an application to the email address [email protected], or by sending a letter to our correspondence address: USP Zdrowie sp. z o.o., ul. Poleczki 35, 02-822 Warsaw.

X. Right to Object:

At any time, you may object to the processing of personal data if the basis for processing is our legitimate interest or when we act in the public interest. Upon receiving such a request, we will no longer be able to process the personal data covered by the request unless we demonstrate: a) the existence of valid legitimate grounds for processing that override your interests, rights, and freedoms, or b) grounds for establishing, pursuing, or defending claims.

XI. The right to withdraw consent to the processing of personal data:

To the extent that you have given consent for the processing of personal data, you have the right to withdraw it. Withdrawal of consent does not affect the legality of processing carried out based on consent before its withdrawal.

XII. Right to lodge a complaint with a supervisory authority:

In the event that the processing of personal data by companies from the USP Group violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority.