PRIVACY POLICY – 4Cell Therapies

PRIVACY POLICY 4CELL THERAPIES S.A.

This privacy policy contains information about the processing of by the following personal data 4CELL THERAPIES S.A.:

Contractors of 4CELL THERAPIES S.A.;
Persons submitting bids in response to requests for proposals from 4CELL THERAPIES S.A. in competitive procedure;
Representatives of the contractors and bidders and persons designated by the contractors and bidders of 4CELL THERAPIES S.A.;
Applicants or candidates for employment at 4CELL THERAPIES S.A.;
Other persons contacting 4CELL THERAPIES S.A. (by e-mail or by telephone) and persons contacted by 4CELL THERAPIES S.A. (by telephone or by e-mail).

This privacy policy fulfils the obligation referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter: the “GDPR“.

Information on processing of personal data of contractors of 4CELL THERAPIES S.A.

Personal data controller

The controller of your personal data is 4CELL THERAPIES Spółka Akcyjna with its registered office in Gliwice, Bojkowska 59C Street, 44-100 Gliwice, Poland; e-mail: biuro@4celltherapies.com (hereinafter: the “Controller“).

Purposes of processing your personal data
1. We will process your personal data if you are an individual who is our contractor or intends to enter into a business relationship with us.
2. We will process your personal data for the purpose of contacting you in day-to-day matters, including the execution of contracts between us, presenting offers, receiving orders, answering questions, for the purpose of fulfilling other obligations and purposes such as for accounting, public funds or the control rights of institutions and entities entitled to account for public funds (if cooperation with you will be financed with public funds), fulfilling company’s reporting or tax obligations. We will provide information on our activities and possible forms of cooperation.
3. We will exercise our rights under the contract concluded with you, as well as defend ourselves against possible claims or assert possible claims relating to the contract concluded with you – if a dispute arises regarding or in connection with this contract. The scope of our claims may include, among other things, claims concerning settlements or intellectual property rights created and acquired on the basis of the contract, if the performance of the contract results in the creation of creations that are the subject of such rights.

Scope of data processed

We will process the following of your data: first name, surname, business name, personal identity number (Polish: PESEL), statistical number (Polish: REGON), tax identification number, postal address, telephone number, address contact details (place of business, e-mail), billing details (e.g. bank account number).

Legal basis for processing

The legal basis for processing your data is:

Article 6(1)(b) of GDPR – processing is necessary for the performance of a civil law contract;
Article 6(1)(b) and (c) of GDPR – processing is necessary for the fulfilment of legal obligations incumbent on the Controller, such as tax or reporting obligations;
and Article 6(1)(f) of GDPR – i.e. the legitimate legal interest of the Controller, inter alia, in the fulfilment of obligations incumbent on the Controller in connection with the implementation of a publicly funded project public (if cooperation with you will be financed with such funds), the assertion of contractual or related claims or the defence against such claims.

Source of the data and profiling

We process data that we have received directly from you. Provision of personal data is voluntary; however, failure to do so may prevent the establishment of a business relationship with you, including the conclusion of a contract. Personal data are not used for automated decision-making, including not subject to profiling.

Retention period of your personal data

Your data your will be processed until the termination of cooperation with us and, after the termination of your cooperation, also for the period necessary for the fulfilment of the Controller’s legal obligations and purposes (e.g. resulting from tax regulations, as well as those resulting from the obligation to account for public funds and fulfilment of other obligations incumbent on the Controller in connection with the implementation of a project financed from public funds, if cooperation with you is involved) and for the period necessary for the exercise of any contractual rights, the limitation period for claims settlements related to or connected with the contract between us and you, including, in particular, claims concerning intellectual property rights created and acquired pursuant to the contract, if the performance of the contract results in the creation of creations that are the subject of such rights.

Recipients of your personal data
1. Your personal may be shared by data us with entities that provide services to us (e.g. external IT, courier, human resources, accounting, auditing, billing, debt collection), as well as the National Centre for Research and Development (hereinafter: “NCBiR“), the Polish Agency Enterprise Development (hereinafter: “PARP”) for the purpose of exercising control rights related to the accountability of the project financed with public funds and other entitled entities or institutions (if cooperation with you will be financed with public funds), as well as entities entitled to obtain them under the provisions of law.
2. Personal data may also be passed on to other interested parties (including those independent ) if of you provide it to us in a form from which it is clear that you wish to be contacted by third parties on business matters.
3. The Controller does not intend to transfer personal data to third countries or international organizations. Exceptionally, personal data may be transferred to third countries in connection with the IT solutions used. In the case of the indicated transfer, all principles of lawful transfer shall be observed, including the use of adequate and appropriate safeguards required by data protection regulations.

Rights in relation to the processing of your personal data
1. You have the right:

to obtain information on the processing of personal data, including the categories of processed personal data and the possible recipients of the data,
to request the correction of inaccurate personal data or the completion of incomplete personal data,
to request the erasure or restriction of the processing of personal data – whereby the request will be complied with if the legal requirements for such a request are met,
to object to the processing of data on the grounds of your particular situation, in case of processing based on Article 6(1)(f) GDPR,
to transfer of your personal data – by receiving the data from the Controller in a format that enables it to be transferred to a third party of your choice,
to submit a complaint with the supervisory authority – the of the President Office for the Protection of Personal Data, 2 Stawki Street, 00 – 193 Warsaw, Poland – if it is found that personal data is being processed in violation of the law.

1. All requests, questions and demands related to the processing of personal data should be addressed to: biuro@4celltherapies.com.

II.

Information on the processing of personal data of persons submitting bids in response to requests for proposals from 4CELL THERAPIES S.A. in competitive procedure

Personal data controller

Purposes of processing your personal data

1. We will process your personal data if you are an individual submitting a bid in response to a request for proposal, including for the performance of a task carried out with public funds (hereinafter: the “Contractor“).
2. We will process your personal data to:

1. carry out a tender procedure, including a competitive procedure to select a Contractor for a service or task, including a service or task carried out with public funds, and to evaluate the tender submitted by you;
2. in the case of a bidding procedure conducted through a competitiveness database, post information about the submitted bids in the competitiveness database and about the selected Contractor on the website of the competitiveness database at: https://bazakonkurencyjnosci.funduszeeuropejskie.gov.pl and on the Controller’s website.

Scope of data processing

We will process the following of your data: first name, last name, personal identity number (Polish: PESEL), tax identification number, contact details (place of business, postal address, telephone number, e-mail address).

Legal basis for processing

The legal basis for processing your data is:

Article 6(1)(b) of GDPR – activities aimed at concluding a contract with the Contractor;
Article 6(1)(c) of GDPR, i.e. fulfilment of the Controller’s legal obligations arising from the Guidelines of the Ministry of Development on the eligibility of expenditure under the European Regional Development Fund, the European Social Fund and the Cohesion Fund, issued on the basis of regulations including, inter alia, the Act of 11 July 2014 on the principles for the implementation of programmes in the field of cohesion policy in the financial perspective 2014-2020 financed or the Act of 28 April 2022 on the principles for the implementation of tasks financed from European funds in the financial perspective 2021-2027;
and Article 6(1)(f) of GDPR – i.e. the legitimate legal interest of the Controller, including fulfilling obligations incumbent on the Controller in connection with the implementation of a publicly funded project.

Source of the data and profiling

We will process data obtained directly from you. Provision of personal data is voluntary; however, failure to provide such data may prevent you from submitting an offer, participating in a bidding procedure or establishing a business relationship with you, including entering into a contract. Personal data are not used for automated decision-making, including not subject to profiling.

Retention period of your personal data

Your data will be stored for the duration of the procedure used to select the Contractor, and thereafter:

in the event of failure to conclude a contract – for a period of 10 years from the conclusion by the Controller of a contract for the implementation of a project financed from public funds , under which the offer was submitted;
in the event of the conclusion of a contract – the rules applicable to our contractors described in point. I of this Privacy Policy.

Recipients of your personal data

1. Your personal data may be made available by us to entities that provide services to us (e.g. that provide services to us (inter alia, external IT companies, courier companies, auditors, contractors) made available was submitted as part of a project to us by entities , as well as to entities authorised to obtain them by law, , the Polish Agency Enterprise Development (hereinafter: “as well as to the National Centre for Research and Development (hereinafter: “NCBiR“) or Polish Agency for Enterprise Development (hereinafter: “PARP”) and other authorized entities or institutions for the purpose of exercising control rights related to the accountability of the project financed with public funds (if the offer was submitted as part of a project financed with public funds), as well as entities entitled to obtain them under the provisions of law.
2. The Controller does not intend to transfer personal data to third countries or international organizations. Exceptionally, personal data may be transferred to third countries in connection with the IT solutions used. In the case of the indicated transfer, all principles of lawful transfer shall be observed, including the use of adequate and appropriate safeguards required by data protection regulations.

Rights in relation to the processing of your personal data

1. You have the right:

to obtain information on the processing of personal data, including the categories of personal data processed and the possible recipients of the data,
to request the correction of inaccurate personal data or the completion of incomplete personal data,
to request the erasure or restriction of the processing of personal data – whereby the request will be complied with if the legal requirements for such a request are met,
to transfer of your personal data – by receiving the data from the Controller in a format that enables it to be transferred to a third party of your choice,
to object to the processing on the grounds of your particular situation, in case of processing based on Article 6(1)(f) of GDPR,
to submit a complaint with the supervisory authority – the President of the Office for the Protection of Personal Data, 2 Stawki Street, 00 – 193 Warsaw, Poland – if it is found that personal data is being processed in violation of the law.

1. All requests, questions and demands related to the processing of personal data should be addressed to: biuro@4celltherapies.com.

III.

Information on the processing by 4CELL THERAPIES S.A. of personal data of representatives of contractors and bidders and persons indicated by contractors and bidders

Personal data controller

The controller of your personal data is 4CELL THERAPIES Spółka Akcyjna with its registered office in Gliwice, ul. Bojkowska 59C, 44-100 Gliwice; e-mail: biuro@4celltherapies.com (hereinafter: the “Controller“).

Purposes of processing your personal data

1. We will process your personal data if you are a representative of our contractor/bidder or a member of the contractor’s or bidder’s team, regardless of the form of employment – references below to employer also mean, respectively, an entity with which you work on a basis other than an employment relationship) or an individual who is an employee (or an associate of our contractor/bidder who has been designated by the contractor/bidder as the person responsible for contacting, working with or establishing a relationship with us.
2. We will process your personal data in order to contact you in current matters, including the establishment or execution of contracts between us and your employer/entity you represent, presenting offers, receiving orders, answering questions, and in order to fulfil other purposes and obligations of the Controller such as accounting for public funds or the exercise of control rights of institutions and entities entitled to account for public funds (if the cooperation will be financed with public funds), the fulfilment of reporting or tax obligations of the company. We will provide information about our activities and possible forms of cooperation.
3. We shall defend ourselves against or assert possible claims relating to the contract concluded with the entity you work for or which you represent, if a dispute arises in connection with this bid or contract. The scope of our claims may include, among other things, claims concerning settlements or intellectual property rights created and acquired on the basis of the contract, if the performance of the contract results in the creation of creations that are the subject of such rights.

Scope of data processing

We will process the following data about you: first name, last name, place of work, job title, contact details (postal address, telephone number, e-mail address).

Legal basis for processing

The legal basis for the processing of your data is our legitimate interest (Article 6(1)(f) GDPR), consisting of the possibility to establish and continue cooperation or contact with you, as well as the fulfilment of obligations incumbent on the Controller in connection with the implementation of a publicly funded project public funds (if the cooperation will be carried out and finance from the public funds), the possibility to defend against claims or to assert claims.

Source of the data and profiling

We have received your data from the employer/entity you represent or which has nominated you as a contact person or team member. Provision of personal data is voluntary; however, failure to provide such data may prevent you from submitting an offer, participating in a bidding procedure or establishing a business relationship with you, including entering into a contract. Personal data are not used for automated decision-making, including not subject to profiling.

Retention period of your personal data

1. Your data will be retained for the duration of the tender procedure in the context of which your data was provided to us, and thereafter, in the event that no contract is concluded, for a period of 10 years from the conclusion of the contract by the Controller for the publicly funded project for which the tender was submitted.
2. Your data will be processed until the definitive termination of the cooperation with us and, after termination of the cooperation, also for the period of statute of limitations for claims related to the contract between us and your employer/entity that you represent or that has nominated you as a team member or contact person. In the event that the contract linking us with your employer/entity represented by you or which has nominated you as a team member or contact person is carried out as part of a publicly funded project, also for a period of 10 years or from the conclusion of the contract for the publicly funded project by the Controller.
3. Data may be deleted at an earlier date – in the event that we receive your objection to the processing, or in the event that we consider that we no longer need the data to achieve our legitimate purpose.

Recipients of your personal data

1. Your personal data may be made available by us to entities that provide services to us (e.g. your personal data may be made available to external IT, courier, human resources, accounting, auditing and contractor services companies as well as to the National Centre for Research and Development (hereinafter: “NCBiR“), the Polish Agency Enterprise Development (hereinafter: “PARP“) for the purpose of exercising control rights related to the accountability of the project financed from public funds and other authorised entities or institutions (if applicable), as well as to entities authorised to obtain such data by law.
2. The Controller does not intend to transfer personal data to third countries or international organizations. Exceptionally, personal data may be transferred to third countries in connection with the IT solutions used. In the case of the indicated transfer, all principles of lawful transfer shall be observed, including the use of adequate and appropriate safeguards required by data protection regulations.

Rights in relation to the processing of your personal data
1. You have the right:

to obtain information on the processing of personal data, including the categories of personal data processed and the possible recipients of the data,
to request the correction of inaccurate personal data or the completion of incomplete personal data,
to request the erasure or restriction of the processing of personal data – whereby the request will be complied with if the legal requirements for such a request are met,
to object to the processing of your data on the grounds of your particular situation,
to transfer of your personal data – by receiving the data from the Controller in a format that enables it to be transferred to a third party of your choice,
to submit a complaint with the supervisory authority – the President of the Office for the Protection of Personal Data, 2 Stawki Street, 00 – 193 Warsaw, Poland – if it is found that personal data is being processed in violation of the law.

1. All requests, questions and demands related to the processing of personal data should be addressed to: biuro@4celltherapies.com.

IV.

Information on the processing of personal data of job candidates or applicants at 4CELL THERAPIES S.A.

Personal data controller

Purposes of processing personal data of the applicants and candidate
1. We will process personal data provided by the applicant or candidate (hereinafter: the “Candidate“) in order to assess the qualifications for the position for which the Candidate is applying, to select a suitable person to work for our company, i.e. in order to perform activities aimed at concluding a contract of employment for the position (regardless of the form of employment – under an employment relationship or a civil law relationship).
2. In the case of a recruitment for a position settled with public funds – also to document proper execution of the contract with the financing institution, i.e. e.g. with the National Centre for Research and Development (hereinafter: “NCBiR“) or the Polish Agency for Enterprise Development (hereinafter: “PARP“).
3. With the Candidate’s separate consent, we will process the Candidate’s personal data for future recruitment processes.

Scope of data processed

We will process the following personal data of the Candidate: first and last name; parents’ names, date of birth; place of residence (postal address); educational background; previous employment history; and data in addition to the above if provided voluntarily by the Candidate on his/her own initiative.

Legal basis for processing

The legal basis for processing your data is:

Article 6(1)(c) of GDPR in conjunction with Article 22¹§ 1 of the Labour Code, with regard to the processing of personal data in the context of the employment relationship;
Article 6(1)(b) and (c) of GDPR, in respect of the processing of personal data under a civil law contract;
Article 6(1)(a) of GDPR for the processing of personal data for possible future recruitment, if the Candidate agrees;
Article 6(1)(a) pf GDPR, in the event that you provide us with other data in cover other than your name; parents’ names; date of birth; place of residence (correspondence address); education; previous employment history your application documentation, i.e., inter alia, your CV or , letter- (e.g., an image of the Candidate), which other data we process on the basis of the Candidate’s consent;
Article 6(1)(f) of GDPR in respect of the data collected during the interview – i.e. our legitimate legal interest to assess whether the Candidate is a suitable person for the position applied for, as well as to fulfil the obligations incumbent on the Controller in connection with the implementation of a publicly funded project.

Source of the data and profiling

We will process data obtained directly from Candidates. Provision of personal data is voluntary; however, failure to do so may prevent participation in the recruitment process. Personal data are not used for automated decision-making, including not subject to profiling.

Data retention period
1. We will retain ‘s personal data of the Candidate until the recruitment for the position for which is applying has ended.
2. If the recruitment for a job position will take place within the framework of a publicly funded project implemented by the Controller, the Candidate’s personal data will be stored for a period of 10 years from the conclusion by the Controller of a contract for the implementation of a publicly funded project, within the framework of which the application has been submitted, in accordance with the obligations that the Controller is obliged under to observe such a contract.
3. In any case, where has been given separate consent to process the data for future recruitment purposes, the Candidate’s data will be kept for this purpose for period of a maximum 2 years after collection.

Recipients of data

The Candidate’s personal data may be made available by us to entities that provide services to us (e.g. external IT companies, accounting and HR service companies), as well as to entities entitled to obtain them under the provisions of law, as well as PARP, NCBiR and other authorised entities or institutions, in order to document proper execution of the agreement for public funding (if applicable). The Controller does not intend to transfer personal data to third countries or international organizations. Exceptionally, personal data may be transferred to third countries in connection with the IT solutions used. In the case of the indicated transfer, all principles of lawful transfer shall be observed, including the use of adequate and appropriate safeguards required by data protection regulations.

Rights in relation to the processing of personal data
1. The Candidate is entitled to:

obtain information on the processing of personal data, including the categories of processed personal data and the possible recipients of the data,
request the correction of inaccurate personal data or the completion of incomplete personal data,
request the erasure or restriction of the processing of personal data – whereby the request will be complied with if the legal requirements for such a request are met,
object to the processing on the grounds of s particular situation the Candidate’- in case of processing based on Article 6(1)(f) of GDPR ,
withdraw consent at any time to the extent that the Candidate’s data is processed on the basis of consent, without affecting the lawfulness of the processing we have carried out on the basis of consent prior to its withdrawal,
transfer of personal data – by receiving the data from the Controller in a format that enables it to be transferred to a third party of your choice,
submit a complaint with the supervisory authority – the President of the Office for the Protection of Personal Data, 2 Stawki Street, 00 – 193 Warsaw, Poland – if it is found that personal data is being processed in violation of the law.

1. All requests, questions and demands related to the processing of personal data should be addressed to: biuro@4celltherapies.com.

V.
Information on the processing of personal data of other persons who contact 4CELL THERAPIES S.A. (by e-mail or by telephone) and persons who are contacted by 4CELL THERAPIES S.A. (by telephone or by e-mail)

Personal data controller

Purposes of processing your personal data

1. We will process your personal data if you are not any of the entities indicated in points. I – IV of this Privacy Policy, but you contact us on any matter by e-mail or telephone, or 4CELL THERAPIES S.A. contacts you on any matter.
2. We will process your personal data in order to contact you with ongoing matters, including answering questions and making enquiries, as well as for the purpose of possible cooperation (of a business or scientific nature), as well as for the purpose of establishing a relationship of a purely informational or educational nature.

Scope of data processing

We will process the following data about you: first name, surname, place of work, job title, contact details (mailing address, telephone number, e-mail address) and other data voluntarily provided to us by you in the course of correspondence or conversation.

Legal basis for processing

The legal basis for the processing of your data is our legitimate interest (Article 6(1)(f) of GDPR), consisting of:

the opportunity to ask you questions and answer your questions,
establishing and maintaining relationships within the business.

Source of data and profiling

We will process your data obtained directly from you. Provision of personal data is voluntary, however, failure to do so may prevent us from interacting with you, including responding to your inquiry. Personal data is not used for automated decision-making, including not subject to profiling.

Retention period of your personal data
1. Your data will be processed for the duration of the relationship (of a business or informational, scientific, educational nature), and for a period of one year after the relationship has ended. After this period, we may contact you to enquire about the possibility of further data processing.
2. Data may be deleted at an earlier date – in the event that we receive your objection to the processing, or in the event that we consider that we no longer need the data to achieve our legitimate purpose.

Recipients of your personal data

1. Your personal data may be made available by us to entities that provide IT or contractor services usto as well as to entities entitled to obtain them by law.
2. Personal data may also be passed on to other interested parties (including those independent of us) if you provide it in a form from which it is clear that you wish to be contacted by third parties.
3. The Controller does not intend to transfer personal data to third countries or international organizations. Exceptionally, personal data may be transferred to third countries in connection with the IT solutions used. In the case of the indicated transfer, all principles of lawful transfer shall be observed, including the use of adequate and appropriate safeguards required by data protection regulations.

8 Rights in relation to the processing of your personal data

1. You have the right:

to obtain information on the processing of personal data, including the categories of processed personal data and the possible recipients of the data,
to request the correction of inaccurate personal data or the completion of incomplete personal data,
to request the erasure or restriction of the processing of personal data – whereby the request will be complied with if the legal requirements for such a request are met,
to object to the processing of your data on the grounds of your particular situation,
to transfer of personal data – by receiving the data from the Controller in a format that enables it to be transferred to a third party of your choice,
to submit a complaint with the supervisory authority – the President of the Office for the Protection of Personal Data, 2 Stawki Street, 00 – 193 Warsaw, Poland – if it is found that personal data is being processed in violation of the law.

1. All requests, questions and demands relating to the processing of personal data should be addressed to: biuro@4celltherapies.com.