ECO 2 PORTAL.KOBIZE.PL Service
PLEN
Tło

Information clause of the National Database module - Electronic Center for Support of Climate Protection and Reporting Programs (ECO2PORTAL)

In accordance with Art. 13 para. 1-2 and Art. 14 para. 1-2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1) – hereinafter "GDPR" – the Institute of Environmental Protection-National Research Institute (hereinafter: "IEP-NRI") as the Controller of personal data, informs:

I.The Controller of personal data is IEP-NRI with its registered office in Warsaw, ul. Słowicza 32, 02-170 Warsaw, entered into the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register under KRS number 0000032034. The Director acts on behalf of IEP-NRI.

II. The Controller has appointed a data protection officer (DPO), who can be contacted at iodo@ios.edu.pl

III. Categories of persons/entities whose data are processed and information on the requirements/conditions for providing the data:

  1. Users entering data and information into the National Database - ECO2PORTAL module (including users indicated by the entities they represent):

    Providing data is a requirement resulting from:

    • Art. 64 para. 1 and Art. 86 of the Act of 12 June 2015 on the greenhouse gas emission allowance trading system (hereinafter: the ETS Act),
    • Art. 3 para. 2 of Commission Implementing Regulation (EU) 2019/1842 of 31 October 2019 laying down rules for the application of Directive 2003/87/EC of the European Parliament and of the Council as regards further arrangements for the adjustments to free allocation of emission allowances due to activity level changes (hereinafter: Regulation 2019/1842),
    • and point 1.1(e), point 1.2(a) and point 1.6(c) of Annex IV to Commission Delegated Regulation (EU) 2019/331 of 19 December 2018 determining transitional Union-wide rules for harmonised free allocation of emission allowances pursuant to Article 10a of Directive 2003/87/EC of the European Parliament and of the Council (hereinafter: Regulation 2019/331),
    • and Art. 27 para. 1(t) of Commission Implementing Regulation (EU) 2018/2067 of 19 December 2018 on the verification of data and on the accreditation of verifiers pursuant to Directive 2003/87/EC of the European Parliament and of the Council (hereinafter: Regulation 2018/2067);

    • and Art. 68 para. 3 and point 2 of Annex X to Commission Implementing Regulation (EU) 2018/2066 of 19 December 2018 on the monitoring and reporting of greenhouse gas emissions pursuant to Directive 2003/87/EC of the European Parliament and of the Council and amending Commission Regulation (EU) No 601/2012 (hereinafter: Regulation 2018/2066)

      If you have not provided us with your personal data directly, please be informed that we received them from the entity you represent.

  2. Users of the National Database - ECO2PORTAL module and other persons – in the scope of providing Help Desk, helpline, providing substantive and technical support related to the performance of statutory duties, conducting training, providing information at the request of authorized administrative bodies and courts.

    Providing data is voluntary but necessary to achieve the above-mentioned purposes.

IV. Purpose of processing personal data

Personal data will be processed in accordance with Art. 6 para. 1(c) and (e) of the GDPR – for the purpose and to the extent necessary to fulfill the legal obligations incumbent on the controller and for the purpose and to the extent necessary to perform a task carried out in the public interest:

  • managing the National Database - ECO2PORTAL module in the scope of National Implementation Measures in the category of ordinary data (of entities authorized to enter data and information into the system and users indicated by these entities) based on the following provisions:

    • Art. 64 para. 1 of the Act of 12 June 2015 ETS Act;
    • Art. 3 para. 2 and para. 3 Regulation 2019/1842;
    • and point 1.1(e), point 1.2(a) and point 1.6(c) of Annex IV to Regulation 2019/331;
    • and Art. 27 para. 1(t) Regulation 2018/2067

  • conducting auxiliary and supporting activities for users of the ECO2PORTAL system, in particular for the purpose of:

    • providing substantive and technical support related to the performance of statutory duties (helpline, Help Desk);
    • performing the legal obligation to provide information at the request of authorized public authorities, administrative bodies and courts, and providing environmental information;
    • conducting training.

V. Source of personal data:

  1. For the entities listed in Section III, point 1 of this clause, personal data come from:

    • the application form for gaining access to the entity's account in the National Database - ECO2PORTAL module and/or NIEG (National Identity Electronic Gateway - KWIE),
    • the form for adding a report on the activity level (available for logged-in users),

    The consequence of not providing personal data will be the inability to obtain access to the National Database - ECO2PORTAL module.

  2. For auxiliary and supporting activities for users of the National Database - ECO2PORTAL module, in particular for the purpose of providing Help Desk, call center, providing substantive and technical support related to the performance of statutory duties,

    Personal data are provided directly by the data subjects at the time of achieving the above-mentioned purposes, i.e., when reporting a problem to the Help Desk, helpline, or submitting a request for information. The consequence of not providing personal data will be the inability to achieve the above-mentioned purposes.

VI. Disclosure of personal data

The following may have access to personal data:

  • public authorities authorized to obtain such information based on legal provisions;
  • the European Commission;
  • entities providing IT support authorized on the basis of a processing agreement, including: the ERP electronic correspondence management system, companies providing document archiving and destruction services;
  • statutory auditors, law firms;
  • the controller may disclose personal data, including the name and surname and the correspondence address, to entities providing postal or courier services.

VII. Categories of processed personal data:

  1. for system users entering data and information into the National Database - ECO2PORTAL module and users indicated by these entities: name and surname, PESEL number or date of birth, e-mail address of the authorized person, telephone number, name of the represented institution;

  2. for auxiliary and supporting activities for users of the National Database - ECO2PORTAL module, in particular for the purpose of providing Help Desk, helpline, providing substantive and technical support related to the performance of statutory duties, conducting training, providing information at the request of authorized administrative bodies and courts: depending on the type of activity conducted, these may be the following categories of personal data: surname and name, name of the entity, address, e-mail address, telephone number.

    If the holder or their authorized representatives communicate with IEP-NRI (e.g., via e-mail, fax, telephone) in order to obtain help or in other matters, the controller will record the information related to this fact, including the answers provided.

VIII. Periods of processing personal data:

  1. personal data in the National Database - ECO2PORTAL module system will be stored for the period necessary to fulfill the statutory obligation incumbent on the controller, imposed on KOBiZE and IEP-NRI by Art. 3 and 4 of the Act on the system for managing emissions of greenhouse gases and other substances;

  2. with regard to providing substantive and technical support related to the performance of statutory duties:

    • minimum 2 years in the organizational unit after the conclusion of the case and min. 10 years in the IEP-NRI Company Archive (arch. cat. BE10),
    • due to the possible necessity of defense against claims, no longer than 10 years after providing the answer (Art. 442 (1) § 1 of the Civil Code).

  3. with regard to providing information at the request of authorized public authorities, administrative bodies and courts:

    • legal support of court cases and cases in administrative proceedings is from the provision of information: minimum 2 years in the organizational unit and min. 10 years in the IEP-NRI Company Archive (arch. cat. BE10). The storage period is counted from the date of execution of a final judgment or dismissal of the case.
    • in other cases, the storage time of documents is minimum 2 years in the organizational unit after the conclusion of the case and min. 10 years in the IEP-NRI Company Archive (arch. cat. BE10),
    • in the case of providing public information, the storage period is minimum 2 years in the organizational unit after the conclusion of the case and min. 10 years in the IEP-NRI Company Archive (arch. cat. B10)

  4. with regard to requests from the data subject concerning the exercise of the person's rights referred to in Art. 15-21 of the GDPR:

    • from the closing of the case: minimum 2 years in the organizational unit and 10 years in the IEP-NRI Company Archive (arch. cat. B10).

IX. Rights of data subjects

You have the right to:

  1. access the content of your data and receive a copy thereof, and the right to rectify data (when they are incorrect or incomplete), and in justified cases, to their removal or restriction of processing (this right is limited under Art. 17 para. 3(b), (d) and (e) of the GDPR).
  2. lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates the provisions of the GDPR.

Restrictions:

The controller, while providing appropriate measures to protect the interest or fundamental rights and freedoms of the data subject, does not provide the information referred to in Art. 15 para. 1–3 of the GDPR (right of access to data), if the fulfillment of these obligations:

  • will prevent or significantly hinder the correct performance of a public task, and the interest or fundamental rights or freedoms of the data subject are not overriding over the interest resulting from the performance of this public task, or
  • will violate the provisions on the protection of classified information.

In the event that the fulfillment of the obligations referred to in Art. 15 para. 1 and 3 of the GDPR (right of access to data) requires a disproportionately large effort related to searching for personal data, the controller will call upon the data subject to provide information allowing for the search of these data.

The provision of Art. 64 of the Act of 14 June 1960 – Code of Administrative Procedure (Journal of Laws of 2025, item 1691) shall apply accordingly.

X. Within the processing of personal data, there is no automated decision-making or profiling referred to in Art. 22 para. 1 and 4 of the GDPR. The controller does not foresee transferring personal data outside the European Economic Area (EEA).