Privacy policy

PRIVACY POLICY
of the National Chamber of Commerce for Dual-Use and Defence Solutions
“Polish Dual Use Chamber”

Protecting personal data is very important to us. We take care of the personal data of everyone who works with us or with whom we are in contact. This policy explains how we process your personal data and what rights you have.

§ 1.
Who is responsible for protecting your personal data (data controller)?

We, the National Chamber of Commerce for Dual-Use and Defence Solutions “Polish Dual Use Chamber” (address: Rondo ONZ 1, floor 27, 00-124 Warsaw, KRS: 0001218876) are responsible for protecting your personal data. We decide what data to collect, for what purposes and in what way. We are the controller of your data (hereinafter referred to as “PIDU” or “we”).

§ 2.
How can you contact us?

If you have any questions or wish to submit a request concerning your data, please contact us by e-mail at: k.michalski@izbadualuse.pl

§ 3.
What personal data do we process and from what sources?

We process the personal data of the following individuals:

  • members of PIDU or their representatives,
  • experts cooperating with PIDU,
  • suppliers or their representatives,
  • representatives of public administration,
  • journalists or other press representatives,
  • other persons who wish to be in contact with us.

We process personal data in the following scope:

  • identification data (first name, surname),
  • contact data (e-mail or telephone),
  • place of employment (name of organisation, position),
  • in the case of experts or suppliers cooperating with PIDU under a civil-law contract, we additionally process the personal data necessary to perform the contract, including: PESEL (national identification number), NIP (tax identification number), residential address / address of the place of business, information on remuneration, bank account or other data needed to settle the contract,
  • in the case of representatives of our suppliers, we may additionally process the personal data necessary to perform the contract with the given supplier.

We receive your personal data either directly from you or from the organisation that you represent, i.e. you are an employee or other representative of such an organisation.

We always indicate which personal data is necessary for specific purposes, e.g. to conclude a contract or to take part in the work of PIDU. Providing such data will be mandatory. Providing other data is voluntary.

§ 4.
For what purposes and on what legal bases do we process your personal data?

We process your personal data for the following reasons:

  • to contact you regarding PIDU matters, if you are our member or a representative of a member organisation, an expert, a representative of public administration, a journalist or someone who wishes to be in contact with us. We process your personal data for this purpose on the basis of our legitimate interest (Article 6(1)(f) GDPR), consisting in informing you about the activities of PIDU and maintaining the relationships necessary for effective cooperation with PIDU,
  • to properly perform the contract concluded with you (Article 6(1)(b) GDPR), if you cooperate with us under a civil-law contract, e.g. as an expert or supplier,
  • to properly administer and secure personal data in accordance with legal requirements or good practice. We process your personal data for this purpose on the basis of our legitimate interest (Article 6(1)(f) GDPR), consisting in ensuring the effective and secure management of personal data at PIDU,
  • to fulfil our legal obligations (tax and accounting) related to the performance and proper settlement of the contracts concluded (Article 6(1)(c) GDPR),
  • to respond to your complaints or requests and, at times, also to defend ourselves or to claim certain things from you (civil-law claims). For these purposes, we process your personal data on the basis of our legitimate interest (Article 6(1)(f) GDPR), in properly handling your complaints or requests and effectively pursuing or defending against claims.
  • to contact you regarding PIDU matters and to keep you informed about the Chamber’s activities, in particular about initiatives, projects, events, publications, cooperation opportunities and meeting invitations, as well as sending you newsletters and other information materials related to PIDU activities. We process your personal data for this purpose on the basis of our legitimate interest (Article 6(1)(f) GDPR), consisting in informing about PIDU activities and maintaining the relationships necessary for cooperation with the Chamber’s members, partners and stakeholders.
  • to send you our newsletter. We process your personal data for this purpose on the basis of the consent you have given (Article 6(1)(a) GDPR), which you may withdraw at any time.

In the case of our special initiatives or projects, we will inform you separately of the details of how we process your data for the purposes of the specific initiative or project.

§ 5.
How long do we keep your personal data?

  • We process the personal data that we use to contact you (in the various roles described in § 4) for as long as we remain in contact with you, i.e. while we cooperate with you or while we have a legitimate interest in informing you about our activities, and while you do not object to the processing of your data.
  • We process the personal data used to perform a contract with you or with the organisation you represent (e.g. if you are a supplier representative) for the duration of the contract and for a maximum period of 6 years counted from the end of the calendar year in which such a contract was terminated or expired.
  • We process your personal data that is processed in order to fulfil obligations arising from legal provisions, to ensure the security and proper administration of personal data, and to handle complaints and requests, as well as to establish, pursue or defend against claims. We do this for the period necessary to achieve these purposes, but no longer than until the expiry of the time limits resulting from legal provisions or limitation periods for claims.

§ 6.
To whom may we disclose your personal data?

We may disclose your personal data to the following:

  • entities providing services on our behalf or for us, in particular IT service providers, including cloud service providers or providers of e-mail automation tools,
  • postal operators and courier companies,
  • entities authorised under the law to receive your data, including institutions authorised to inspect our activities.

§ 7.
What rights do you have?

You have the following rights concerning your personal data:

  • access to your data, including obtaining a copy of the data,
  • rectification of the data (where it is incorrect) or completion of incomplete data,
  • restriction of the processing of the data,
  • erasure of the data, if there are no reasons for which we are obliged or have a legitimate interest to keep it,
  • data portability (this right applies to data that we process on the basis of your consent or that is necessary to conclude and perform a contract with you),
  • objection to the processing of your data, where we process it on the basis of our legitimate interest. We will uphold your objection if it is justified (after weighing our interests and rights against yours),
  • lodging a complaint with the President of the Personal Data Protection Office. A complaint may be submitted by post to: Urząd Ochrony Danych Osobowych (Personal Data Protection Office), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, or electronically via the ePUAP inbox. The complaint form addressed to the President of the Personal Data Protection Office can be found on the Office’s website HERE.

If you submit a request concerning your data, we may ask you to answer some questions to help us verify your identity.

§ 8.
Do we transfer your personal data outside the EEA?

We process your personal data within the EEA. The EEA (European Economic Area) comprises the European Union (EU) and countries such as Iceland, Norway and Liechtenstein.

We use service providers that operate within the EEA and do not transfer your data outside the EEA. However, some of our IT tool providers may process your data outside the EEA, given the global nature of such services. In such a case, we safeguard such a transfer of data outside the EEA in accordance with personal data protection law and the required agreements with these providers. If you would like to learn more about the safeguards we apply to transfers of data outside the EEA (including to obtain a copy of such safeguards), please contact us.

§ 9.
Do we make automated decisions or carry out profiling based on your personal data?

We do not use automated decision-making or profiling based on your personal data.

As at: July 2026