Personal Data Protection (GDPR)

Where the processing of your personal data is based on consent, you have the right to withdraw it at any time.

Withdrawal of consent:

• does not affect the lawfulness of processing carried out before its withdrawal,
• does not result in any negative consequences for you.

You have the right to request access to your personal data, including in particular information about:

• whether we process your personal data,
• what scope of data we hold,
• for what purpose or purposes we process your personal data,
• to which recipients we have disclosed your personal data,
• how long we will process your personal data,
• your rights,
• the source of the data where it was not collected directly from you,
• the intention to transfer data to third countries or international organisations (if applicable),
• the safeguards applied when transferring data outside the European Economic Area (if applicable).

You also have the right to receive a copy of your personal data. Based on the submitted request, we will provide you with the information free of charge (except in cases of burdensome or repetitive requests for further copies of data) and without undue delay, no later than within one month of receiving the request. Due to the complex nature of the request or the number of requests, this period may be extended by a further two months, of which you will be informed within one month of receipt of the request, together with the reasons for the delay.

If the personal data we hold about you is inaccurate, outdated or incorrect, you have the right to request its rectification. You also have the right to request that incomplete personal data be completed. Based on the submitted request, we will promptly verify the data and — in justified cases — correct or complete it. We may ask you to provide additional information or documents confirming the accuracy of the personal data if this is necessary to fulfil the request.

You also have the right to obtain information on whether the rectification of the data has been carried out and — where possible — about the recipients to whom the data has been disclosed.

You have the right to request the erasure of personal data if one of the following circumstances applies:

• the personal data is no longer necessary for the purposes for which it was collected,
• you have effectively objected to the processing,
• the personal data was processed unlawfully,
• the personal data must be erased in order to comply with a legal obligation,
• you have withdrawn your consent to the processing of personal data, the personal data was processed on the basis of consent, and there is no other legal basis for its processing.

Based on the submitted request, we will verify the validity of the request and — if the conditions are met — promptly erase your personal data.

Please note that the right to erasure is not absolute and will not apply, in particular, where the processing of data is necessary:

• to comply with a legal obligation incumbent on the controller,
• to establish, pursue or defend legal claims,
• to pursue the legitimate interests of the controller, insofar as they override your interests, rights and freedoms.

In the event of data erasure, we will take reasonable steps to inform other controllers processing this data (if applicable) that you have requested its erasure.

You have the right to request the restriction of the processing of personal data in the following cases:

• if you contest the accuracy of the personal data — for a period enabling the accuracy of that data to be verified,
• the processing is unlawful and you oppose the erasure of the personal data, requesting instead the restriction of its use,
• we no longer need the personal data, but you need it to establish, pursue or defend legal claims,
• if you have lodged an objection — until it is determined whether our legitimate grounds override the grounds of your objection.

Restriction of processing means that personal data may be stored but, as a rule, will not be used for other purposes. During the period of restriction, the data may only be processed:

• with your consent,
• to establish, pursue or defend legal claims,
• to protect the rights of another natural or legal person,
• for reasons of important public interest.

We will inform you before the restriction of processing is lifted. If the request for restriction of processing is granted, we will also take reasonable steps to inform the recipients of the data about the restriction imposed, where possible and where this does not require disproportionate effort.

You have the right to receive your personal data in a structured, commonly used, machine-readable format and the right to transmit this data to another controller, provided that the processing is based on consent or on a concluded contract and, at the same time, is carried out by automated means. You also have the right to request that the personal data be transmitted directly to another controller, where technically feasible.

The right to data portability covers only personal data provided by you and data generated in connection with your use of our services. Exercising the right to data portability does not affect other data processing operations; in particular, it does not automatically lead to the erasure of the data.

Please remember that:

• the right to data portability may not adversely affect the rights and freedoms of others,
• this right does not apply to data processed on the basis of legal provisions or in the performance of tasks carried out in the public interest,
• when responding to a data portability request, we are not responsible for the further processing of the data by the data subject or by the controller to whom the data is transferred.

You have the right to object at any time to the processing of your personal data where we process it on the basis of our legitimate interest. You should justify your objection with your particular situation, i.e. indicate why you do not want the data to be processed further. Upon receipt of the objection, we will cease processing the data unless we can demonstrate that there are compelling reasons why we must continue to process it (e.g. related to pursuing or defending against legal claims). An objection may be submitted in any form, e.g. by e-mail or in writing.

If personal data is processed for direct marketing purposes, you may object to such processing at any time. In that case, we will stop using the data for marketing purposes without the need for any additional justification. An objection to direct marketing (including profiling for marketing purposes) is always effective.

The data subject has the right not to be subject to a decision which:

• is based solely on automated processing of data, including profiling,
• produces legal effects concerning you or similarly significantly affects you.

This concerns situations where a decision is made automatically, without human involvement (e.g. by a system or an algorithm). In some cases, however, such decisions are permissible — if they:

• are necessary for the conclusion or performance of a contract,
• are authorised by law,
• are based on your explicit consent.

In such situations, we ensure appropriate measures to protect your rights, in particular the possibility to obtain human intervention, to express your point of view, and to contest the decision.

Note: if a human being takes part in the decision-making process (i.e. has a real influence on its outcome), it is not a decision based solely on automated processing and the above rules do not apply.

You have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that we process your personal data in breach of the law. A complaint may be lodged regardless of the exercise of your other rights (e.g. the right to object or the right to erasure). Detailed information on how to lodge a complaint is available on the website of the Personal Data Protection Office:

www.uodo.gov.pl

Please remember that before you decide to lodge a complaint with the President of the Personal Data Protection Office, you may raise your concerns with the Data Protection Officer.