Privacy notice for contractors concerning the processing of personal data in the National e-Invoicing System
Under Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L of 2016, No. 119, p. 1, as amended), hereinafter referred to as the “GDPR”, please be informed that:
- The controller of your personal data entered into and received from the National
e-Invoicing System (KSeF) is the Head of the National Revenue Administration, with its registered office at ul. Świętokrzyska 12, 00-916 Warsaw (electronic submission box on the ePUAP platform: /bx1qpt265q/SkrytkaESP, email: kancelaria@mf.gov.pl, telephone 22 330 03 30 — from mobile phones), 801 055 055 — from landlines, +48 22 330 03 30 — from abroad). - The controller of your personal data entered into and received from the National
e-Invoicing System (KSeF), insofar as it directly concerns the Regional Centre for Cultural Animation as an issuer or recipient of structured invoices, is the Regional Centre for Cultural Animation (address: 65-431 Zielona Góra, ul. Sienkiewicza 11, address AE:PL-89381-32209-WSDDG-10, email: sekretariat@rcak.pl, telephone: 501 577 329 - The controller, the Head of the National Revenue Administration with its registered office in Warsaw, has appointed a Data Protection Officer whom you may contact on all matters concerning the processing of personal data by email at IOD@mf.gov.pl or by writing to the controller’s postal address.
- The controller, the Regional Centre for Cultural Animation in Zielona Góra, has appointed a Data Protection Officer whom you may contact on all matters concerning the processing of personal data by email at inspektor@cbi24.pl or by writing to the controller’s postal address.
- Your personal data will be processed for the purpose of issuing and receiving structured invoices as part of operations carried out in the Head of the National Revenue Administration’s IT system, the National e-Invoicing System (KSeF), because this is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c) of the GDPR), in connection with the Act of 11 March 2004 on tax on goods and services (consolidated text: Journal of Laws of 2025, item 775, as amended) and the Regulation of the Minister of Finance and Economy of 12 December 2025 on the use of the National e-Invoicing System (Journal of Laws of 2025, item 1815).
- Your personal data will be retained until the tax liability becomes time-barred. Personal data contained in invoices will also be stored in KSeF for 10 years from the date the invoices are issued.
- Your personal data will be processed by automated means, but will not be subject to automated decision-making, including profiling.
- Your personal data will not be transferred outside the European Economic Area, which comprises the European Union, Norway, Liechtenstein and Iceland.
- In connection with the processing of your personal data, you have the following rights:
a) the right to access your data and receive a copy of it;
b) the right to rectify (correct) your personal data;
c) the right to restrict the processing of personal data;
d) the right to erasure in the circumstances specified in the GDPR;
e) the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of personal data infringes the General Data Protection Regulation (GDPR). - Providing your personal data in connection with the controller’s legal obligation is mandatory. Failure to provide it will prevent the purpose referred to in point 5 from being fulfilled.
- Your personal data processed in connection with invoices issued and received may be transferred to external entities under a personal data processing agreement, including the provider of the financial management IT system with its KSeF module, service providers carrying out IT system maintenance or providing legal advice, and entities or authorities authorised by law, including tax authorities. Data will be disclosed to the Head of the National Revenue Administration in connection with the issuing of structured invoices in KSeF. Personal data connected with an issued invoice may be disclosed to court enforcement officers or enforcement authorities.