eB2B GDPR information clause

Processing of personal data on the eB2B Procurement Platform

PROCESSING OF PERSONAL DATA ON THE eB2B PROCUREMENT PLATFORM

Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 (GDPR), we hereby inform you of the rules governing the processing of your personal data to the extent that eB2B acts as the administrator. With respect to data processed in specific procurement proceedings, the administrator is the relevant Contracting Authority (eB2B Client) — see section 9.

1. Data Administrator

The administrator of your personal data in connection with the use of the eB2B Procurement Platform (registration, account management, contractor registry, sharing data with eB2B Clients, platform security) is the eB2B Group, comprising:

Contractor status and the role of eB2B:

2. Data Protection Officer

The eB2B Group has appointed a Data Protection Officer: rodo@eb2b.com.pl — for any matter concerning the processing of data by eB2B.

3. Purposes and legal bases — processing for which eB2B is the administrator

a) maintaining your account and enabling use of the functionalities of the eB2B Procurement Platform — Article 6(1)(b) GDPR (performance of the platform service agreement / steps taken prior to its conclusion);

b) maintaining the contractor registry and — subject to your consent — sharing your data as a public Contractor with eB2B Clients organizing contract awarding procedure — Article 6(1)(a) GDPR (consent) and Article 6(1)(f) GDPR (eB2B’s legitimate interest in operating a platform connecting contractors with Contracting Authorities);

c) notifying you of proceedings opened in the industries or product groups you have indicated (newsletter), which requires separate consent to profiling — Article 6(1)(a) GDPR; this consent may be withdrawn at any time in your User profile, without affecting the lawfulness of processing carried out prior to withdrawal;

d) ensuring the security of the platform: verifying user activity, diagnosing server performance issues, and analyzing security breaches — Article 6(1)(f) GDPR (eB2B’s legitimate interest);

e) establishing, pursuing or defending eB2B’s claims related to the use of the platform — Article 6(1)(f) GDPR.

4. Recipients of the data

Your data may be disclosed to entities providing services to eB2B (IT system and service providers, accounting and legal services) as processors acting on eB2B’s instructions. In respect of a public Contractor, data is shared with eB2B Clients (Contracting Authorities) on the basis of your consent; a Client that incorporates your data into its own proceedings becomes the administrator of that data. Data may also be disclosed to entities authorized under the provisions on access to public information and public procurement law — to the extent provided for by those provisions.

5. Retention period

Your data is processed for the duration of your use of the eB2B Procurement Platform. This period may be extended by the time necessary to defend or pursue eB2B’s claims related to the use of the platform, and thereafter limited to the scope and duration required by law.

6. Your rights

You have the right to access your data, to rectify it, to erase it, to restrict its processing, to data portability, and to object to processing, as well as to withdraw consent (without affecting the lawfulness of awarding procedure carried out prior to withdrawal). Rights concerning the platform layer are handled by eB2B; rights concerning proceedings data are handled by the relevant Contracting Authority as administrator (see section 9). A request addressed to eB2B in a matter for which the Contracting Authority is the administrator will be [forwarded to the relevant Contracting Authority / directed to the relevant administrator].

7. Right to complain

You have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland.

8. Voluntary nature of providing data

Providing your data is voluntary but necessary in order to use the platform’s functionalities; failure to provide data makes it impossible, in particular, to participate in proceedings, submit a bid, have a bid evaluated, receive an award, or conclude a contract.

9. Role of eB2B as a processor (proceedings data)

With respect to data processed within a specific procurement proceeding (including, among others, bid submission and evaluation, award of the contract, conclusion and performance of the contract, fulfilment of obligations arising under public procurement and accounting law, and defense of claims arising from the proceeding):

a) the administrator is the Contracting Authority (eB2B Client) organizing the given awarding procedure;

b) eB2B acts as a processor on that Contracting Authority’s instructions, under a data processing agreement (Article 28 GDPR); eB2B does not determine the purposes of processing proceedings data;

c) the information obligation (Articles 13/14 GDPR) for this layer is fulfilled by the Contracting Authority; the relevant Contracting Authority’s privacy notice is available [in the documentation of the given awarding procedure / on the website indicated by the Contracting Authority / from the Contracting Authority];

d) requests concerning awarding procedure data (rectification, erasure, restriction, portability, objection) are handled by the Contracting Authority as administrator; if you address such a request to eB2B, eB2B — on the Contracting Authority’s instructions — will make the appropriate modification to the account data or forward the request to the relevant administrator.

10. Third countries

eB2B does not intend to transfer personal data to a third country or to an international organization.