Public procurement conducted under the Public Procurement Law
INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE IMPLEMENTATION OF PUBLIC PROCUREMENT PROCEDURE THE VALUE OF WHICH IS EQUAL TO OR EXCEEDS PLN 170 000 NET
Below, we provide information about the principles and rights you have in connection with the processing of your personal data. [1]
1. Controller
The personal data controller (hereinafter referred to as the ‘Controller’) is the Statistical Office in Bydgoszcz, with its registered office in Bydgoszcz at ul. Ks. Stanisława Konarskiego 1-3, 85-066 Bydgoszcz.
2. Data Protection Officer
You can contact the Data Protection Officer (DPO):
- by post to the following address: Urząd Statystyczny w Bydgoszczy, ul. Ks. Stanisława Konarskiego 1-3, 85-066 Bydgoszcz, with the note IOD
- by email to the email address: iod_usbdg@stat.gov.pl
3. Purposes and legal basis for personal data processing
Your data will be processed for the purpose of:
- conducting public procurement proceedings and awarding the contracts,
- conclusion of a public procurement contract and its implementation,
- documenting the public procurement procedure.
Legal basis: legal obligation of the controller and the performance of tasks in the public interest. [2]
4. Recipients of personal data
- Your data obtained in connection with the public procurement procedure may be transferred to interested entities and persons, as, as a rule, the public procurement procedure is public.
- Access to your data, as referred to above, may be restricted only in specific cases, if justified by privacy protection. [3]
- Your personal data will also be made available to the President of the Public Procurement Office with its registered office in Warsaw, who is the Controller of personal data of users of the e-Zamówienia platform ( https://ezamowienia.gov.pl/pl/ ), on which the Office conducts public procurement procedures.
- Your personal data will be made available to entities and persons who are entitled to access data under generally applicable law and to entities with which the Controller has concluded an agreement entrusting the processing of personal data (including technical support for systems, including financial and accounting systems and the email system).
5. Data sources
If your personal data were not collected directly from you, the Controller informs that your personal data were provided by the Contractor in connection with the fulfillment of the conditions for participation in the procedure or for communication as part of the procedure.
6. Period of personal data storage
In the case of public procurement proceedings, your personal data will be retained for the period designated by the archival category specified in the Uniform Subject File Plan for Statistics Poland and other statistical offices. For documents generated as part of public procurement, this period is 5 years. Civil law contracts, along with documentation related to their implementation, are retained for 10 years. The retention period is calculated from 1 January of the year following the date of completion of the case. After the retention period expires, non-archived documentation is subject to disposal, subject to approval by the director of the relevant state archive.
7. Rights of the data subject
You have the right to:
- access to personal data, including the right to obtain a copy of such data, provided that, in a situation where the exercise of the right would require a disproportionately large effort, the contracting authority may request the data subject to provide additional information, in particular to specify the name or date of the completed contract award procedure;
- rectification (correction) of personal data, provided that it does not change the outcome of the procedure and the provisions of the contract to the extent inconsistent with the Public Procurement Law and does not violate the integrity of the protocol and its annexes;
- restrictions on the processing of personal data, however, submitting such a request does not limit the processing of personal data until the public procurement procedure is completed.
Furthermore, you have the right to lodge a complaint with the President of the Personal Data Protection Office if, in your opinion, the processing of your personal data violates the provisions of the GDPR.
You do not have the right to:
- transfer of personal data, as referred to in Article 20 of the GDPR, as the legal basis for the processing of personal data is the provision of Article 6(1)(c) of the GDPR,
- the right to have personal data erased pursuant to Article 17(3)(b), (d) or (e) of the GDPR,
- object to the processing of personal data referred to in Article 21 of the GDPR, as the legal basis for the processing of personal data is Article 6(1)(c) of the GDPR.
8. Voluntary/Obligation to provide personal data
The obligation to provide personal data is a statutory requirement specified in the provisions of the Public Procurement Law, related to participation in public procurement proceedings. [4] Failure to provide personal data may result in the invalidity of the offer in the proceedings and the inability to conclude a contract.
9. Profiling and automated decision-making
Your data will not be profiled and will not be the basis for automated decision-making.
10. Transfer of personal data to entities outside the European Economic Area (‘EEA’) or international organisations.
The data controller does not intend to disclose data outside the EEA; however, in view of the transparency of the public procurement procedure, your data may be transferred to countries outside the EEA, subject to Article 18(5)(1) and (2) and Article 74 of the Act of 11 September 2019 – Public Procurement Law (Journal of Laws of 2024, item 1320, as amended).
[1] Based on Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as: GDPR) (OJ EU L 119, 04.05.2016, p. 1, as amended).
[2] Article 6(1)(c) and (e) of the GDPR, in particular in conjunction with the Act of 11 September 2019 – Public Procurement Law (Journal of Laws of 2024, item 1320, as amended), the Act of 14 July 1983 on the National Archival Resources and Archives (Journal of Laws of 2020, item 164, as amended), the Regulation of the Minister of Development, Labour and Technology of 23 December 2020 on qualitative means of proof and other documents or statements that might be requested by contracting authority from the contractor (Journal of Laws of 2020, item 2415, as amended), the Act of 11 March 2004 on Value Added Tax (Journal of Laws of 2025, item 775, as amended), and the Act of 6 September 2001 on Access to Public Information (Journal of Laws of 2022, item 902, as amended).
[3] Article 18(5)(1) and (2) and Article 74 of the Act of 11 September 2019 – Public Procurement Law (Journal of Laws of 2024, item 1320, as amended).
[4] the Act of 11 September 2019 – Public Procurement Law (Journal of Laws of 2024, item 1320, as amended), the Regulation of the Minister of Development, Labour and Technology of 23 December 2020 on qualitative means of proof and other documents or statements that might be requested by contracting authority from the contractor (Journal of Laws of 2020, item 2415, as amended).