Suppliers and subcontractors

We process the personal data of our suppliers and subcontractors for various purposes, for example to provide professional services to our customers or to ensure our day-to-day operations. According to our standards, we only collect personal data necessary for our specified purposes, and we encourage our suppliers and subcontractors to only share personal data where it is strictly required for these specified purposes.

Since we may need personal data about employees or other individuals of suppliers or subcontractors with whom we do not have direct communication, we encourage our suppliers and subcontractors to provide the relevant data subjects with information about the use of their data. Subcontractors and suppliers may use the relevant sections of this privacy statement or refer to this privacy statement in their communication with their data subjects if they deem it appropriate.

PwC may process the following personal data:

name and surname;
contact information (e.g. email, phone number);
position in the company of a subcontractor or supplier;
professional and academic experience and skills (for example, for subcontractor employees who participate in the provision of services to our customers);
e-mail communication data (for example, the sender's name, surname, addressee's name, surname, date, time and subject of the e-mail) and calendar invitation data (for example, the name of the organizer of the remote communication, participants, date and time of the event) - if the contact person is included also in PwC CRM.

Legal basis of processing	Purposes of processing	Retention
PwC’s legitimate interests (subsection f) of Article 6(1) of General Data Protection Regulation).	Personal data may be processed for the following purposes (description of legitimate interests): to place orders and receive goods or services from suppliers (for example, if the supplier provides us with cleaning services or other services, we will process the personal data of the person providing the services to us); to provide services to PwC customer (for example, if we use translation services to translate PwC deliverables, if we use subcontractors to provide expert services to clients, etc.); to improve PwC and quality of its services; to carry out security and risk management activities (for example, we have implemented security measures to protect our own and our customers' information (including personal data), which include the detection, investigation and prevention of security threats; personal data may also be processed as part of our security monitoring, for example, by performing automated scans to identify malicious emails); to administer and manage our website, systems and applications (for example, personal data of employees of suppliers who maintain PwC's websites); to prove the provision of services to customers; to provide information about PwC and our services (direct marketing) or to inform about events organized by PwC - if contact details are included in PwC CRM; to enforce legal claims.	As long as the personal data is necessary for the described purposes or as long as there are other legitimate interests of PwC that are considered more important than the interests of the data subject. In the absence of specific regulatory or contractual requirements or other legal basis, we generally keep documents and other documentary evidence resulting from cooperation with subcontractors and suppliers for no longer than 5 years.
Conclusion of agreement with data subject (subsection b) of Article 6(1) of General Data Protection Regulation).	Personal data may be processed to fulfill a contract to which the data subject is a party, for example, to conclude a contract, we may need name, surname, personal identification number, bank account number and other data.	In the absence of specific regulatory or contractual requirements or other legal basis, we generally keep documents and other documentary evidence resulting from cooperation with subcontractors and suppliers for no longer than 5 years.
PwC’s legal requirements (subsection c) of Article 6(1) of General Data Protection Regulation): requirements and guidelines of PwC supervisory authorities; Audit Services Law; Tax laws, etc.	The data of employees or other individuals associated with subcontractors and suppliers may be processed for the following purposes: to fulfill the requirements of laws applicable to PwC (for example, providing evidence of service provision to customers to supervisory authorities, communication with public or municipal authorities, etc.).	As long as the personal data is necessary for the specific purposes, for example five years after the termination of the business relationship.