Personal details

Protection of personal data is one of the crucial processes executed by Krajowa Spółka Cukrowa S.A. with its registered office in Torun, at Kraszewskiego 40. We will regularly inform you about important changes in legal regulations, including rights of data subjects. In 2016 the European Parliament published Regulation 2016/679 concerning personal data protection, called GDPR. It will apply throughout the European Union since 25 May 2018.



The most frequently asked questions concerning the information requirement

What is GDPR?

It is an abbreviation standing for General Data Protection Regulation. GDPR means new rights for Customers. One of the obligations of the controllers processing personal data is informing Customers about processing of their personal data.


Why KSC S.A. processes my personal data?

KSC S.A.  processes your personal data as the part of its statutory operations, for example, to conduct activities related to handling of employment-related matters, processing of shareholder matters, contracting of raw materials, production, sales and distribution of sugar, arranging for safety and security of people and property at facilities belonging to KSC S.A., and management of Company property. KSC S.A. also conducts marketing activities and informing about current activities and product range.


Can I access my personal data?

Yes. You can have full access to your personal data. You can also manage your consents to processing of your personal data, including marketing consents.


Who is a controller of my personal data?

The controller of your personal data is Krajowa Spółka Cukrowa S.A. with its registered office in Torun, at Kraszewskiego 40.  KSC S.A. is responsible for their processing in a safe way, in accordance with concluded agreements and relevant legal regulations. You can contact the Data Protection Officer at KSC S.A. for all issues related to  personal data protection.


How can I contact the Data Protection Officer?

You can contact the Data Protection Officer at KSC S.A. at the following e-mail address:


What is the purpose for which KSC S.A. processes my personal data?

Your personal data are processed by KSC S.A. for the following purposes:

  • managing employment-related matters;
  • managing matters related to shareholders and management of our Joint Stock Company
  • raw materials contracting and deliveries, production, sale and distribution of sugar;
  • arranging safety and security for people and property at KSC S.A. facilities;
  • managing of commercial cooperation;
  • specified in the content of consent granted by you.


Who is a recipient of my personal data?

KSC S.A. does not intend to disclose your personal data to any entities other than those which were entrusted by the Company with processing of personal data under agreements concerning personal data processing (so-called processing entities) or who are legally authorised to obtain information about you.


Will my personal data be transferred to any third country or international organisation?

At the moment we do not plan to transfer your data outside the European Economic Area.


How long will your personal data be stored by KSC S.A.?

Your personal data will be stored for the term of the agreement and after its expiry, to fulfil the legal obligations of KSC S.A., including possible claims, as provided for in relevant legislation, and then they will be deleted or anonymised.

When you give your consent to processing for the purpose of direct marketing of our products and services after termination of the agreement, we will process that data until your consent is withdrawn.


What are my rights?

You have the following rights related to processing of your personal data by KSC S.A.:

  1. access to your personal details (Article 15 GPDR);
  2. withdraw your consent to processing of your personal data when that consent was given (Article 7.3, GPDR);
  3. amend your data (Article 16, GPDR);
  4. delete your data (Article 17,GPDR);
  5. limit processing of your data (Article 18,GPDR);
  6. transfer your data (Article 20,GPDR);
  7. object to processing of your data (Article 21,GPDR);
  8. not to be subject to a decision based solely on automated processing, including profiling (Article 22,GPDR).


Where I can register my complaint?

When you decide that processing of your data is in breach of GDPR, you have a right to complain to the supervisory authority, President of the Personal Data Protection Office.


Is providing of my personal data voluntary or obligatory?

Providing of your personal data is voluntary, however, it is necessary to conclude and perform the agreement. Lack of your data in some cases may hinder or completely prevent handling of the matters according to your expectations.


Where KSC S.A. obtained my personal data?

The source of your data are applications and agreements concluded with KSC S.A., whereas, when personal data is obtained from sources other than data subjects, the source of that data are third persons or generally available sources, including data available at websites. In that case, KSC S.A. is obliged to inform these persons about the source of their data.


Will my personal data be processed in an automated way?

Your personal data will not be processed in the automated way, including profiling.



An individual Customer and an institutional Customer (a natural person managing business operations, a natural person managing an individual farm, a civil law company, a partnership, or a general partnership) of KSC S.A. is entitled to submit a request concerning handling of the Customer rights resulting from GDPR, and KSC S.A. is obliged to handle it in accordance with the following rules:

  1. The Customer can submit their request to KSC S.A. at any time following May 25, 2018.
  2. KSC S.A. will handle a request submitted by the KSC S.A. Customer or a person acting on their behalf
    1. within one month, starting with a day of receiving the request; when the request or a number of the Customer requests is of comprehensive nature, the date for response can be prolonged for two more months; within one month of receiving the request the Data Protection Officer will inform the Customer about prolonged date stating the reasons for the delay, when the actions related to the Customer request are not initiated,
    2. the Data Protection Officer will immediately, no later than within one month of receiving the request, inform the Customer in writing about the reasons of not initiating the activities and about their right to register a complaint with a supervisory authority and obtain judicial relief.

  3. The Customer can submit a request concerning execution of their rights and freedoms. The Customer request should include address details with a type and details of the request.
  4. The Customer can submit the completed form to KSC Headquarters or Branch, or send it by email to The time limit runs from the date on which KSC S.A. receives  the Customer request.
  5. The Customer is entitled to lodge a complaint when the date for KSC S.A. response is not met.
  6. On behalf of KSC S.A. the Data Protection Officer will reply to the Customer’s written request, by a registered letter with a receipt acknowledged or by e-mail, if the Customer requests so.
  7. KSC S.A. does not charge any fees or commissions for receiving and handling of the first request. When the frequency of the Customer’s requests exceeds one request in three months,  KSC S.A. may charge a fee corresponding to administrative costs of providing the answer.


The supervisory authority responsible for personal data protection competent for KSC S.A. is the President of the Personal Data Protection Office.

If you have any questions regarding the request, please contact the Data Protection Officer at


Legal background: 

Regulation (EU) 2016/679 of The European Parliament and of The Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the European Union, L 119 of 04 May 2016)