Privacy Policy

I. What is the subject of the Privacy Policy?

This Privacy Policy sets out the principles governing the processing of personal data obtained via the website available at https://www.pcbc.gov.pl/ (hereinafter: the “Website”).

Personal data collected by PCBC via the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). PCBC exercises particular care to respect the privacy of Users visiting the Website.

From this Privacy Policy, you may learn what personal data we collect, how we use it, and what rights you have in connection with the processing of your personal data. If you have any questions or concerns regarding our privacy practices, please contact our Data Protection Officer at: iod@pcbc.gov.pl

II. Who is the data controller?

The owner of the Website and the data controller (the entity determining the purposes and means of processing) is POLSKIE CENTRUM BADAŃ I CERTYFIKACJI S.A., with its registered office in Warsaw (02-844), ul. Puławska 469, entered into the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number: 0000144813, NIP: 9512063356, REGON: 015276609, hereinafter referred to as “PCBC” or “We”.

You may contact us by email at: pcbc@pcbc.gov.pl or by correspondence sent to our registered office address.

III. Contact regarding data protection matters

In matters related to the processing of your personal data, you may contact our Data Protection Officer, Mr. Łukasz Onysyk, at: iod@pcbc.gov.pl or by correspondence sent to our registered office address with the note “personal data protection”.

IV. How and to what extent do we collect your personal data?

We process personal data provided directly by users in connection with the use of our Website or through contact via available forms, email messages, or other communication channels. Personal data may also be processed where its collection is related to our business activities, including establishing or performing business relationships and cooperation with contractors.

If a user uses the Website solely for informational purposes, without engaging in interactions requiring the provision of personal data, we process only technical information automatically transmitted by the user’s web browser to our server. Such data includes, in particular, the IP address, date and time of access, information about the end device, and the browser used. This data is processed solely to ensure proper functioning of the Website, its security, and statistical analysis of how the Website is used.

More detailed information regarding the purposes and types of cookies we collect is described in our Cookies Policy.

V. For what purposes and on what legal basis do we process your personal data?

Depending on the nature of our relationship, the type of interaction undertaken, and the purpose for which you provide your data, your personal data may be processed for different purposes and on different legal bases. Below we present a detailed overview of these purposes together with the corresponding legal bases and retention periods, in order to clearly explain when and on what basis we process your personal data.

1. Correspondence handling

Purpose and legal basis: Your personal data will be processed for communication purposes (including business communication in the case of persons representing other entities), responding to inquiries, and for purposes related to the internal organization of work at PCBC, based on our legitimate interests (Article 6(1)(f) GDPR). Data may also be processed for the establishment, exercise, or defense of legal claims (Article 6(1)(f) GDPR).

Providing personal data is voluntary but necessary for communication. If personal data was not provided directly by you, it may have been provided by an entity cooperating with us, e.g., your employer or principal.

Data retention period: Personal data will be processed for the period necessary to achieve the processing purposes, until the limitation period for claims expires, or until an effective objection to processing is raised.

2. Handling contact forms and inquiries

Purpose and legal basis: If you use the contact form available on our Website, your personal data provided in the form will be processed to respond to your inquiry/request and to conduct further communication related to it. The legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR).

Providing data is voluntary.

Data retention period: Personal data will be processed for the period necessary to respond to the inquiry.

3. Website maintenance and security

Purpose and legal basis: To enable use of the Website, provide additional functionalities, collect statistical and analytical data, and ensure the security of Website usage.

Data contained in cookies relating to user activity on the Website is processed depending on their type:

• in the case of cookies necessary for the functioning of the Website – Article 6(1)(b) GDPR,
• in the case of other cookies – the user’s voluntary consent.

More information about cookies can be found in the Cookies Policy below.

Providing data is voluntary.

Data retention period: Data is processed until the user withdraws consent for cookies or until the processing purpose ceases to exist.

4. Sending marketing content

Purpose and legal basis: If you have consented to receiving marketing content, your data is processed for promotional activities and marketing communication. Where consent has been given for marketing communication, including the provision of commercial information regarding our own products and services, processing is based on our legitimate interests (Article 6(1)(f) GDPR).

Providing data is voluntary.

Data retention period: Data is processed until the user withdraws consent to marketing communication.

5. When you are our client, a collaborator of our client, or have expressed interest in our offer

Purpose and legal basis: If you are an employee or another person acting on behalf of PCBC clients, your personal data may be processed for the provision of management systems certification services, product certification, product testing, and training services based on our legitimate interests (Article 6(1)(f) GDPR).

Where a contract has been concluded directly with you, the legal basis for processing is the performance of a contract (Article 6(1)(b) GDPR). If the contract has not been concluded directly with you, cooperation takes place between us and the entity you represent. In the case of cooperation with employees of our clients, processing is based on our legitimate interests (Article 6(1)(f) GDPR).

Data is also processed for communication and internal administrative purposes based on our legitimate interests (Article 6(1)(f) GDPR), as well as for compliance with legal obligations incumbent upon PCBC, including accounting, tax law, and bookkeeping requirements (Article 6(1)(c) GDPR in conjunction with national law).

Additionally, data may be processed for the establishment, exercise, or defense of claims based on our legitimate interests (Article 6(1)(f) GDPR).

Providing personal data is voluntary but necessary for communication and service performance. If personal data was not provided directly by you, it may have been provided by an entity cooperating with us, e.g., your employer or principal.

Data retention period: Personal data will be processed for the period necessary to achieve the processing purposes, until the limitation period for claims expires, until an effective objection is raised, and for the period required for archiving services provided.

VI. How is your personal data shared?

User data may be shared where cooperation with subcontractors (e.g., auditors) or service providers (e.g., hosting or email service providers) is required. We entrust your data only to verified entities that ensure its security.

Data may also be disclosed to public authorities where required by applicable law and upon submission of an appropriate request.

VII. Your rights – you decide

Depending on the legal basis for processing, you are entitled to various rights. You may exercise them by contacting the Data Protection Officer at: iod@pcbc.gov.pl

A data subject whose personal data is processed has the following rights:

• the right of access to personal data and to obtain a copy of the processed data (commonly known as a “data subject access request”); this allows you to receive a copy of personal data held by PCBC and verify that it is processed lawfully;
• the right to request rectification, correction, or updating of personal data we hold; this enables correction of incomplete or inaccurate information;
• the right to erasure (“right to be forgotten”) in circumstances provided for in Article 17 GDPR – allowing you to request deletion of personal data where there is no justified reason for further processing; if continued processing is required, we will inform you accordingly;
• the right to restriction of processing in cases specified in Article 18 GDPR – allowing you to request suspension of processing, for example where accuracy or legal grounds are contested;
• the right to object to processing in cases specified in Article 21 GDPR, particularly where processing is based on the controller’s legitimate interests; you may object for reasons related to your particular situation;
• the right to data portability where data is processed by automated means;
• the right to withdraw consent where processing is based on consent (e.g., voluntary submission of recruitment documents). Consent may be withdrawn at any time without providing a reason. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

If you believe your personal data is processed unlawfully, you may lodge a complaint with the supervisory authority (UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, https://uodo.gov.pl/pl/p/dla-obywatela).

VIII. Final information

This Privacy Policy is informational in nature and may be subject to periodic updates, particularly in the event of changes in legal regulations, data processing methods, or the scope of our business activities. The current version of the Privacy Policy is always published on the PCBC website.

Users are encouraged to review the Privacy Policy regularly to stay informed about current personal data processing practices.

This Privacy Policy is effective as of the date of its publication.

Date of last update: 03.03.2026