Information on the processing of personal data - performance of contracts | US Bydgoszcz | GUS - Portal Informacyjny

Information regarding the processing of personal data in connection 
with the conclusion and performance of a contract to which a natural person is a party

Below, we provide information about the principles and your rights related to the processing of your personal data. [1]

1. Controller

The controller of your personal data is the Statistical Office in Bydgoszcz, with its registered office in Bydgoszcz (85-066) at ul. Ks. Stanisława Konarskiego 1-3, hereinafter referred to as the ‘Controller’.

1. Data Protection Officer

You can contact the Data Protection Officer (DPO):

1. by post; address: IOD Urząd Statystyczny w Bydgoszczy, ul. Ks. Stanisława Konarskiego 1-3, 85-066 Bydgoszcz;
2. by email; email address: iod_usbdg@stat.gov.pl .
3. Purposes and legal basis for personal data processing

The purpose of processing your personal data is:

1. conclusion and performance of the contract to which you are a party,
2. fulfilling the legal obligations incumbent on the controller, which result from legal provisions (including tax, social security, access to public information, archiving),
3. pursuing possible claims or defending against claims arising from the concluded Contract.

The legal basis for processing your personal data is:

1. necessity of processing for the performance of the contract [2] ,
2. fulfillment of the legal obligation incumbent on the controller [3] ,
3. the necessity of processing personal data for the purposes of the legitimate interests pursued by the controller consisting in pursuing claims or defending against claims arising from the concluded Contract [4] .
4. Data categories

We will process your personal data to the extent necessary to conclude, perform and settle the contract, including ensuring contact.

1. Recipients of personal data

Your personal data may be made available to entities and persons who are entitled to access data under generally applicable law [5] .

A separate category of recipients are entities with which the Controller has concluded an agreement entrusting the processing of personal data (including technical support of systems, including HR and payroll, financial and accounting, and email systems).

1. Period of storage of personal data

Your personal data will be processed during the term of the contract and then for the periods resulting from the provisions on archiving: office and archiving regulations [6] and the Uniform Subject File Plan for statistical offices [7] .

1. Rights of the data subject

You have the right to:

1. access to personal data, including the right to obtain a copy thereof;
2. request rectification (correction) of personal data;
3. request the erasure of personal data if they are not erased by the Controller within the above-mentioned period;
4. request to limit the processing of personal data;

Furthermore, you have the right to object, for reasons relating to your particular situation, to the processing of personal data under Article 6(1)(f) of the GDPR (i.e. processing that is necessary for the purposes of the legitimate interests pursued by the controller).

You have the right to lodge a complaint with the President of the Personal Data Protection Office if, in your opinion, the processing of your personal data violates the provisions of the GDPR.

1. Voluntary provision of/obligation to provide personal data

Providing your personal data is voluntary, but necessary for the conclusion and performance of the contract.

1. Automated decision-making, including profiling

Your personal data will not be:

1. profiled;
2. subject to automated decision-making.

[1] Based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as: GDPR) (OJ EU L 119, 04.05.2016, p. 1, as amended).

[2] Article 6(1)(b) of the GDPR.

[3] Article 6(1)(c) of the GDPR in conjunction with the Act of 23 April 1964 – the Civil Code (Journal of Laws of 2025, item 1071, as amended),  the Act of 13 October 1998 on the Social Insurance System (Journal of Laws of 2026, item 199, as amended), the Act of 26 July 1991 on Personal Income Tax (Journal of Laws of 2025, item 163, as amended), the Act on Goods and Services Tax (Journal of Laws of 2025, item 775, as amended), the Act of 14 July 1983 on the National Archival Resources and Archives (Journal of Laws of 2020, item 164, as amended), the Act on Access to Public Information (Journal of Laws of 2022, item 902).

[4] Article 6(1)(f) of the GDPR.

[5] including, amongst others, tax authorities, courts, supervisory bodies, and persons requesting access to public information (to a limited extent).

[6]  The Act of 14 July 1983 on the National Archival Resources and Archives (consolidated text: Journal of Laws of 2020, item 164, as amended) and the Regulation of the Minister of Culture and National Heritage of 20 October 2015 on the classification and categorisation of records, the transfer of archival materials to state archives and the disposal of non-archival records (Journal of Laws of 2019, item 246, as amended).

[7] Annex to Order No. 17 of the President of Statistics Poland of 19 December 2019 on the introduction of the Records Management Instruction for organisational units of the official statistics services and the Uniform Subject File Plan for Statistics Poland and statistical offices.