Privacy and cookies policy

1. General information

This Privacy Policy sets out the rules for processing personal data of users of the website www.petrobaltic.orlen.pl (hereinafter: “Website”). The data controller is:

ORLEN Petrobaltic S.A.
ul. Stary Dwór 9, 80-758 Gdańsk
e-mail: orlen.petrobaltic@orlen.pl
phone: +48 58 301 30 61

Website architecture – OP

The Controller processes data in accordance with applicable laws, in particular with the Regulation of the European Parliament and of the Council (EU) 2016/679 (GDPR).

2. Contact details of the Data Protection Officer

A Data Protection Officer has been appointed, who can be contacted on any matters related to the processing of personal data:

Wiesław Sobolewski
e-mail: iod.lpb@energa.pl
mailing address: ORLEN Petrobaltic S.A., ul. Stary Dwór 9, 80-758 Gdańsk,
with the note “Data Protection Officer” [“Inspektor ochrony danych”].

• Contact to DPO for subsidiaries:
• SPV Baltic Sp. z o.o. — iod.spvbaltic@energa.pl
• SPV Petro Sp. z o.o. — iod.spvpetro@energa.pl

3. Scope of processed data

Depending on how the Website is used, we process the following personal data:

a) Data collected automatically

• IP address,
• device specifications,
• server logs,
• cookies (described below).

b) Data provided voluntarily

• data provided via contact forms,
• data provided as part of recruitment processes (CVs, cover letter, candidate details),
• data provided in applications for internships and traineeships.

4. Purposes and legal bases for data processing

1) Ensuring the operation and security of the Website

• technical logs, essential cookies, error analysis, visitor statistics, fraud protection.
  Legal basis: Article 6(1)(f) GDPR (legitimate interest of the Controller).

2) Contact with Users
If a User contacts the Company via forms or e-mail addresses, we process the data to handle such inquiries.
Basis: Article 6(1)(f) GDPR.

3) Conducting recruitment processes (sending resumes)
Use the Career section to access a form and submit application spontaneously.
Basis:

• Article 6(1)(b) GDPR (actions aimed at concluding a contract),
• Article 6(1)(c) GDPR (legal obligations),
• Article 6(1)(a) GDPR (consent – for spontaneous applications and consent for future recruitment),
• Article 9(2)(a) GDPR (consent for special categories of data – if voluntarily disclosed by the candidate).

4) Fulfilment of legal obligations
Including obligations under labour laws, the Commercial Companies Code, tax and accounting regulations.
Basis: Article 6(1)(c) GDPR.

5) Establishment, exercise or defence of legal claims
Basis: Article 6(1)(f) GDPR.

5. Data recipients
Data may be disclosed to:

• entities within the ORLEN Group,
• providers of IT, hosting, and Website services,
• providers handling recruitment processes (such as eRecruiter),
• public authorities under applicable law,
• subsidiaries, with respect to data submitted in recruitment or contact processes.

The Controller does not transfer data to third countries, unless it results from the tools used (such as analytics). Relevant information is provided in the Cookies section.

6. Data retention period

• contact details – for the period necessary to respond and a maximum of 12 months,
• recruitment documents – up to 6 months after the end of recruitment, and up to 24 months with consent for future recruitment,
• system logs – up to 12 months,
• data processed based on consent – until such consent is withdrawn,
• data necessary for evidentiary purposes – until the limitation period for claims expires.

7. Rights of data subjects
The User has the following rights:

• access data,
• rectify data,
• delete data (“right to be forgotten”),
• request restriction of processing,
• transfer data (data portability),
• object to processing,
• withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal),
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

8. Cookies and tracking technologies
The Website uses cookies:

1) Essential cookies
They ensure the proper functioning of the website – they cannot be disabled.

2) Analytical / statistical cookies
They are used to improve the quality of the service (such as analytical tools).

3) Functional cookies
They allow you to remember your preferences.
Users can manage cookies in their browser settings. Restricting the use of cookies may affect the operation of the Website.

9. Recruitment and submitting CVs through the Website
Within the Career section and via the “Submit your resume” form, personal data of candidates will be processed. The submitted documents (including CVs) should contain only data required by law. The Controller does not require the submission of sensitive data.
If the application is made spontaneously, the candidate’s consent for processing data for future recruitment is required.

10. Data security
The Controller applies organisational and technical measures that meet GDPR requirements, including server security, access procedures, communication encryption (SSL), access restrictions, and ongoing security monitoring.

11. Changes to the Privacy Policy
The Policy may be updated from time to time. The current version will be published on the Website.

12. Controller’s registration data

ORLEN Petrobaltic S.A.
ul. Stary Dwór 9, 80-758 Gdańsk
District Court for Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register
KRS: 0000171101
Tax ID (NIP): 583-000-30-42
REGON: 002881387
Share capital: PLN 111,233,370.00 (fully paid)