GDPR and Inforamtion clauses

General information

Respecting the right to privacy of persons who provided Polish Airports S.A. with their personal data, we inform you that the obtained personal data are processed in accordance with national and European law and in conditions that guarantee their security.
In order to ensure the transparency of the processes in which operations on personal data take place, below we present personal data processing regulations applicable at Polish Airports S.A., established in accordance with the GDPR.


What is GDPR and what are its benefits

The GDPR is the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "GDPR").
The GDPR provides the data subject with greater control over their personal data and information about what is happening with their data.


Personal data controller

The controller of personal data within the meaning of art. 4 point 7 of the GDPR, is Polish Airports S.A. with its registered office at ul. Żwirki i Wigury 1, 00-906 Warsaw. You can contact the personal data controller through the following:
  • e-mail kontakt@ppl.pl,
  • contacts available on the website https://www.polish-airports.com/en/contact-details.html
  • by post at Polish Airports S.A., ul. Żwirki i Wigury 1, 00-906 Warsaw.

Data Protection Officer

Based on Article. 37 sec. 1 of the GDPR, Polish Airports S.A. (as the personal data controller) appointed Mr. Michał Kłoda to act as the Data Protection Officer.

Data subjects may contact the Data Protection Officer in all matters regarding the processing of their personal data and exercising rights related to data processing, to which they are entitled under the Regulation, via e-mail at iodo@ppl.pl or in writing to the following address: Polish Airports S.A., ul. Żwirki i Wigury 1, 00-906 Warsaw with the note "Data Protection Officer".

The Data Protection Officer ensures full confidentiality of communication with data subjects.

Data collection processes, purpose of data processing and data retention period

As part of its business actrivity Polish Airports S.A. processes personal data for the following purposes:
 
 
 
 
Process name Purpose of the processing of personal data Legal basis for the processing of personal data Data storage period  
Legitimate interest (Art. 6 sec. 1 letter (f) of the GDPR, if applicable
 		  
Content of the information obligation
Conclusion and execution of contracts/orders with contractors Actions taken to conclude and execute a contract/order with a contractor Art. 6 sec. 1 letter (b) of the GDPR
(taking steps to conclude and execute a contract/order)
Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A. related,
inter alia, to tax and accounting regulations)
Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)		 The data are processed for the duration of the performance of the contract/order and, after its termination, until claims related to the contract/order expire and for the time stipulated by law, including tax and financial reporting regulations The need to contact the contractors' employees/associates in connection with actions taken for the purpose of concluding a contract/order or its execution Information on the processing of personal data intended for the contractor and persons representing the contractor used in the contract/order
 
Processing complaints, applications, claims and the establishment, pursuit and defence of claims Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)		 The data are processed until the expiry of the claim/complaint Processing of personal data in connection with the establishment, pursuit and defence of claims arising from a contract/order
Accounting, bookkeeping and financial reporting Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of the Polish Airports S.A.) relating to, inter alia, tax and accounting regulations		 Data are processed for a period of time prescribed by law, including tax and financial reporting regulations  
Contact form Contacting an interested party in order to reply to a message Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)		 The data specified in the Contact Form are stored for a period of 1 year after the message is sent Ensuring that incoming enquiries from the interested parties are answered Information on the processing of personal data intended for persons using the contact form of the Polish Airports S.A.
Limited use area Taking action in relation to the processing in respect of the limited use area Art. 6 sec. 1 letter (b) of the GDPR,
(taking action to conclude and execute a settlement)
Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)
 		 Personal data will be stored for the period necessary to fulfil an objective Processing of personal data in connection with the establishment, pursuit and defence of claims relating to the limited use area Information on data processing for the limited use area
Video surveillance in Sonata building Ensuring the protection and safety of employees and visitors to the premises administered and monitored by the controller Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)		 Video surveillance records are kept for a maximum period of 30 days after the recording was made Protection of persons and property and ensuring security on the premises of the Polish Airports S.A.
The area covered by the video surveillance is: the area of the Sonata building, including entrance doors, entrance gates, premises and car parks		 Information on the processing of Sonata building video surveillance data
Recording of emergency calls Ensuring security, and the proper coordination of airport security services
 		 Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.)		 Data will be stored for a period of 30 days from the time the call is registered.
If the recording constitutes evidence in legal proceedings, the storage period is extended until the final conclusion of the proceedings		   Information on data processing - recording of emergency calls of the Warsaw Chopin Airport manager
Control of access to restricted areas (personal and vehicle passes) Processing of an application for a single-entry personal or vehicle pass to fulfil a legal obligation, National Civil Aviation Security Programme Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.) in connection with Art. 68, 80, Art. 188a sec. 1 of the Act of 3 July 2002 – Aviation Law, § 23 of the attachment of the Regulation of the Minister of Infrastructure of 2 December 2020 on the National Civil Aviation Security Programme		 Data will be stored for a period enabling authorised bodies to carry out security audits and quality control checks concerning civil aviation security   Information on data processing for the purpose of issuing a single-entry personal pass
Trainings Provision of qualification improvement and maintenance training, ensuring airport security and safety, implementation of the National Civil Aviation Security Programme and the National Quality Control Programme Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.) in connection with Regulation (EU) 2018/1139 of the European Parliament and of the Council of 4 July 2018		 Personal data will be stored for as long as necessary to demonstrate the correct performance of civil aviation security and safety tasks   Information on data processing for training purposes
Complaints, requests, inquiries and other correspondence
 		 Processing of submitted enquiries, requests, complaints Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)
 
Art. 9 sec. 2 letter (f) of the GDPR
(establishment, pursuit or defence of health-related claims)		 
Personal data will be stored for the duration of the application, and after its completion for the time related to the limitation of claims arising from it, but not longer than 3 years from the moment of making the final decision closing the application procedure.
 Processing of personal data in connection with the due processing of a claim and the establishment, pursuit and defence of claims arising from a complaint Information on data processing in complaints and claims
Clause on activities carried out by Operations Control Ensuring that the activities carried out by the Operations Control Team are carried out in accordance with the provisions of the Operational Manual Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.) in connection with Annex III, Subpart C (ADR.OR.C.005) of Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to aerodromes pursuant to Regulation (EC) No. 216/2008 of the European Parliament and of the Council.		 Personal data will be stored for the period necessary to achieve the stated purpose.   Information on data processing related to the operations of the Management Department, the Operations Department and the Airport Security Guard Department
Emergency response Ensuring proper coordination of actions carried out by competent organisations, institutions and services in response to emergency situations occurring at Warsaw Chopin Airport or in its vicinity Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.) in connection with Annex IV Subpart B (ADR.OPS.B.005) of Commission Regulation (EU) No 139/2014 of 12 February 2014 laying down requirements and administrative procedures related to aerodromes pursuant to Regulation (EC) No. 216/2008 of the European Parliament and of the Council.		 Personal data will be stored for a period of 5 years, in accordance with Annex III - Subpart D (ADR.OR.D.035) of Commission Regulation (EU) No 139/2014 of 12 February 2014, from the date of completion of the relevant edition of the document.   Information on data processing related to emergency response
Customer satisfaction survey Conducting customer satisfaction surveys for maintaining high service quality and high levels of customer satisfaction Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)
 		 Personal data will be stored for a period of 2 years counted from the completion of the survey. Conducting customer satisfaction surveys to maintain high service quality and a high level of customer satisfaction Information on data processing in connection with conducting customer satisfaction surveys
Journalists Reporting on relevant events and current activities of PPL Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)
 		 Personal data will be stored for the period necessary to achieve the stated purpose and for the time of cooperation. Reporting on relevant events and current activities of PPL Information on the processing of data for journalists
Control of access to areas reserved for passengers Allowing access to the restricted area of the airport Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of the Polish Airports S.A.) in connection with the application of the civil aviation security rules pursuant to Art. 68, 80, 186b and Art. 188a of the Act of 3 July 2002 – Aviation Law, § 17 of the Regulation of the Minister of Infrastructure of 2 December 2020 on the National Civil Aviation Security Programme		 Passenger data that could potentially be treated as personal data when matched with an identifiable person (image captured via video surveillance) is first and last name.
The data retention period is up to 30 days (storage time of the CCTV footage)
 
Due to the deletion of the video camera system recordings, it is not possible to clearly identify the person afterwards.
 
 		   Information on data processing for passengers
Granting of powers of attorney Granting of a power of attorney and its processing Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.)
 
Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)
 		   Archiving in pursuit of the legitimate interest of safeguarding information in the event of a legal need to prove facts, as well as for the possible establishment, pursuit or defence of claims. Information on the processing of personal data intended for agents of the Polish Airports S.A.
Exercise of data subjects' rights under Art. 15-22 of the GDPR Processing of data subjects' requests for the exercise of their rights under Art. 15-22 of the GDPR.
 		 Art. 6 sec. 1 letter (c) of the GDPR
(fulfilment of legal obligations of Polish Airports S.A.)
related, inter alia, to the fulfilment of the requirements under Art. 15-22 of the GDPR
Art. 6 sec. 1 letter (f) of the GDPR
(legitimate interest of the Polish Airports S.A.)		 The data will be processed for a period of 3 years counted from the date of their transfer by the Polish Airports S.A. Responses to the received requests.
If the Polish Airports S.A. receives more than one application from one person concerning different matters, each of the applications will be treated individually and therefore the personal data processing period will be counted for each of the received applications separately.		 Processing of data subjects' requests for the exercise of their rights under Art. 15-22 of the GDPR.
 		 Information on the processing of personal data intended for data subjects exercising their rights under Art. 15-22 of the GDPR