The NRA Head privacy notice - IKK

Information clause regarding the processing of personal data by the Head of the National Revenue Administration in the SPOE KAS system

Pursuant to Art. 13 of the GDPR[i] I hereby inform you that:

Administrator

The Head of the National Tax Administration based in Warsaw, 00-916, Świętokrzyska 12, is the administrator of your personal data.

Data Protection Officer

In matters of exercising the rights under the GDPR, in connection with the processing of personal data, you can contact the Data Protection Officer by sending an e-mail to the following address:  IOD@mf.gov.pl.

Purposes and basics of processing

Your personal data is processed for the purpose of:

  • collecting tolls for the use of toll roads, i.e., tolls within the meaning of the Toll Motorways Act and the National Road Fund and electronic tolls within the meaning of the Act on Public Roads, using mobile devices - performance of the legal obligation incumbent on the Administrator - art. 6 par. 1 letter c of the GDPR,
  • monitoring the transport of goods under the System of Electronic Transport Supervision (SENT) pursuant to the Act on the monitoring system of road and rail transport of goods and trading in heating fuels - fulfilling the legal obligation incumbent on the Administrator - art. 6 par. 1 letter c of the GDPR, towards entities obliged to transfer data to the SENT system
  • sending information materials on the toll collection system for the use of toll roads and on road infrastructure - based on the consent of the data subject - art. 6 par. 1 letter a of the GDPR.

Providing personal data when registering in the Online Customer Account and collecting tolls for the use of toll roads is a statutory requirement - failure to do so will result in the inability to register with the OCA and pay the electronic toll or toll in the SPOE KAS System.

Providing your e-mail address is necessary to register online. Failure to provide it will result in the inability to register in this form.

Providing the data necessary to send information materials (e-mail address and / or telephone number) is voluntary.

Recipients of personal data

Entities authorized to obtain personal data pursuant to legal provisions will be recipients of your personal data. A separate category of recipients to whom your data may be disclosed are entities processing personal data at the request of the Administrator, those with whom we have concluded contracts for the provision of maintenance services for the IT systems we use.

If you use the fleet card system, the recipients will also be the relevant fleet card suppliers and the entity intermediating in the transfer of data between the SPOE KAS System and the fleet card suppliers. Your data will be transferred to third countries only if you use services of a fleet card provider established outside the European Economic Area.

Data storage period

Your personal data will be stored until the purpose of processing is achieved, considering the limitation period for claims, as well as the archiving period in accordance with applicable regulations. In particular:

  • data processed pursuant to art. 6 par. 1 letter c of the GDPR - is stored in the system for a period not longer than 36 months from the end of the calendar year in which the toll road was used as defined in the Public Roads Act and for a period not longer than 24 months from the end of the calendar year in which the drive took place a toll motorway, within the meaning of the Act on toll motorways and the national road fund
    - unless there are legal grounds obliging the Administrator to process personal data for a longer period before the expiry of the period,
  • personal geolocation data - are stored for no longer than 9 months from the date of completion of a given drive on national roads
    - unless, before the expiry of that time limit, administrative or misconduct proceedings are initiated in which the data is necessary; in this case, the data is stored until the end of the given procedure;
  • data processed on the basis of consent - will be processed until the consent to the processing is withdrawn.

Rights of data subjects

You have the right to:

  • access to the content of the data, pursuant to art. 15 of the GDPR, with the provision that the shared personal data may not disclose classified information or violate legally protected secrets which the Administrator is obliged to keep, and subject to art. 5 of the Act of May 10, 2018 on the protection of personal data;
  • rectification of data, pursuant to art. 16 of the GDPR;
  • deletion of data, pursuant to art. 17 of the GDPR;
  • restriction of data processing, pursuant to art. 18 of the GDPR;
  • withdraw consent to processing at any time (for data processed on the basis of consent), with the provision that the withdrawal of consent does not affect the processing carried out before its withdrawal.

If you believe that the processing of your personal data by the Administrator violates the provisions, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.

Automated decision making and profiling

Your data processing may be automated, which may involve automated decision-making, including profiling, which is performed by the Administrator under applicable law.

 

 

[i] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Journal of Laws UE. L 119 of 04/05/2016, p. 1, as amended),

 

​