Privacy policy

Dear Sir/Madam,

We hereby inform you that:

  1. The administrator of your personal data is Nafto Sp. z o.o., with registered office at ul. Igołomska 30, 31-983 Kraków, NIP 954-266-41-32 • REGON 241133639 • KRS 0000326316 in the Regional Court for Kraków-Śródmieście, 11th Commercial Division of the National Court Register (KRS), tel.: +48 12 646 24 20, fax: +48 12 387 02 44, e-mail:
  2. Your personal data will be processed for the following purposes:
    1. establishing business relations and an adequate realisation of a concluded cooperation agreement;
    2. establishing an employment relationship and realisation of rights and obligations resulting from the civil code and executive provisions as well as other regulations concerning realisation of an employment, realisation of obligations of the Employer as a payer of social insurance premiums and personal income tax advances, realisation of the Employer’s obligations in post-accident management, providing access to voluntary employee benefits.
  3. Period of personal data processing:
    1. In the event you are our client, we will store your personal data for the period of duration of our relationship as specified by a concluded agreement or by a business relation. Next, we will keep user personal data in an indirect database for fifteen years, counting from the end of the relationship resulting from a concluded agreement and/or business relation;
    2. In the event you are our employee, we will process your personal data for the period of your employment and after termination of the employment relationship – throughout the entire period of storage specified in detailed provisions;
    3. In the case of job applicants, we would like to point out that if a candidate is not employed, we will delete the information provided by him or her after twelve months from the disclosure at the latest.
  4. Legal basis for processing of your personal data:
    1. GDPR – regulation 2016/679 of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ of 2016, No. 119, page 1).;
    2. Personal Data Protection Act of 10th May 2018. (Journal of Laws 2018, item 1000);
    3. An agreement concluded with you (art. 6 clause 1 b);
    4. Labour code provisions (art. 221 of the Labour Code), art. 6 para. 1 point c and f of GDPR, Social Security System Act, Personal Income Tax Act, Employment Promotion and Labour Market Institutions Act and other provisions of the law imposing legal obligations on the Employer.
  5. Processing of your personal data is necessary to realise the purpose of their processing, and lack of their processing means lack of the possibility of realisation of this purpose.
  6. Your personal data may be transferred to entities entitled to their reception pursuant to the provisions of the law (among others: a tax office, the Social Insurance Institution, occupational health care units, court enforcement officers, control institutions etc.) and entities which have to receive them for the purpose of honouring a binding agreement with the Employer (among others: clients, suppliers, judicial authorities, tax advisors, law offices, training companies, companies realising transport services or hotel firms etc.) for the purposes specified above, except for marketing purposes. When using services of external entities, we make sure that they ensure an adequate level of protection of personal data which are processed by them for us.
  7. In order to protect your personal data, NAFTO makes use of and applies proper technological and procedural means of protection against loss, improper use, change or destruction.
  8. You are entitled, in accordance with art. 15-20 of GDPR, to: access the content of your data and to their correction, deletion, limiting of data processing, their transfer, filing an objection, withdrawal of your consent at any given moment without any effect on the compliance with the right to processing (in the case when the processing is performed on the basis of the consent) which was performed based on the consent prior to its withdrawal.
  9. In accordance with art. 77 of GDPR, in any case provided for under the law, you have a right to file a complaint with a supervising institution – the President of the Personal Data Protection Office, at the address: ul. Stawki 2, 00-193 Warszawa.
  10. We hereby inform you that our Personal Data Protection Officer is Mrs Agnieszka Studnicka, available at the address: 31-983 Kraków, ul. Igołomska 30, e-mail:, tel. +48 12 646 24 35