PRIVACY POLICY

Who is the controller of your data?

The controller of your personal data is INFOV SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered into the register of entrepreneurs maintained by the DISTRICT COURT

FOR THE CAPITAL CITY OF WARSAW IN WARSAW, XIV ECONOMIC DEPARTMENT OF THE NATIONAL COURT REGISTER under KRS number: 0000621574, NIP: 7123313875, REGON: 364635788, place of business and correspondence address: Aleja Krakowska 9, 05-090, Sękocin Nowy, Poland, email address: info@inarms.pl, tel: + 48 22 290 49 05.

1. Why do we process your data?

Your personal data is processed on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation / GDPR) in the following manner:

Regarding clients

1. A. In connection with services for companies provided by the controller, i.e., for the purpose of concluding or performing a contract (Article 6(1)(b) GDPR), your data will be stored until the contract is performed. Providing data is necessary for the conclusion and performance of the contract;
2. Fulfilling all legal obligations arising from the cooperation, e.g., related to accounting, tax law, or anti-money laundering (Article 6(1)(c) GDPR), personal data is processed for the period specified by law;
3. For the purpose of establishing, pursuing, or defending against claims, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred;
4. To ensure the proper provision of services and improve their quality, by monitoring your activities, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred.

Regarding contractors, representatives, and contractor personnel

A. Verification of the correctness of authorization to act on behalf of the Contractor, including verification of data provided in public registers, contacting in matters regarding contract performance, and as legitimate interests pursued by the Controller (basis of Article 6(1)(b) and (f) GDPR). Data will be processed until the contract is performed, and for archiving purposes, until the claims become time-barred. Providing data is necessary for the conclusion and performance of the contract;

B. Fulfilling all legal obligations arising from the cooperation, e.g., related to accounting, tax law, or anti-money laundering (Article 6(1)(c) GDPR), personal data is processed for the period specified by law;

C. Possible establishment, pursuit, or defense against claims, which is a legally

justified interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred; If you have not provided the data directly to the Controller, it has been provided in terms of contact and identification data by the Contractor who is a party to the agreement with the controller.

Regarding subscribers

A. For marketing purposes and promotion of products offered by the controller, which constitutes a legitimate interest of the controller (Article 6(1)(f) GDPR). Your data will be processed until an objection is raised;

B. For the purpose of adapting marketing content to your actions, which constitutes a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred;

C. Possible establishment, pursuit, or defense against claims, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred.

Regarding users of the controller’s websites

A. To ensure the proper provision of services, improve the quality of services, and ensure security, by monitoring user activities, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred;

B. To establish contact and answer questions, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the questions are answered or claims expire. Providing data is voluntary but necessary to establish contact and answer questions;

C. Additional information about the principles of processing user data via cookies is available in the cookie policy.

Regarding persons contacting the Controller

A. To answer questions asked via email or phone, which constitutes a legitimate interest of the controller (Article 6(1)(f) GDPR). Personal data will be processed until claims expire. Providing data is voluntary but necessary to establish contact and answer questions;

B. Possible establishment, pursuit, or defense against claims, which is a legitimate interest of the controller (basis of Article 6(1)(f) GDPR). Data will be processed until the claims become time-barred;

2. To whom will the data be disclosed?

A. Public authorities, to the extent that they do not receive data as part of a specific procedure based on law;

B. Entities that process your personal data on behalf of the controller based on a data processing agreement concluded with the controller (so-called processors). These will include, among others: IT specialists, archiving companies, banking and payment service providers, hosting companies;

C. External data controllers (so-called Parallel Controllers, to whom data is disclosed, e.g., legal advisors and attorneys, courier or postal service providers, entities acquiring receivables – in case you fail to pay our invoices on time);

D. Entities located outside the EEA, but only when necessary and with an appropriate level of protection, primarily through:

a. Cooperation with entities in countries for which an adequate decision of the European Commission has been issued;

b. Application of standard contractual clauses issued by the European Commission.

The Controller always informs about the intention to transfer personal data outside the EEA at the stage of data collection.

3. Automated decisions?

As part of the services provided by the controller, personal data may be subject to profiling. The controller will always inform about such activities before commencing data processing through profiling.

4. What are your rights?

A. The right to access your personal data processed by us (Article 15 GDPR);

B. The right to rectify entrusted personal data, including correcting it (Article 16 GDPR);

C. The right to erase personal data from our systems, the so-called “right to be forgotten” – if, in your opinion, there are no grounds for processing your data, you may request its erasure (Article 17 GDPR);

D. The right to restrict the processing of personal data – you may request the restriction of processing personal data solely to its storage or to performing actions agreed with you, in the event that the controller holds inaccurate data about you, processed unlawfully; or if you do not wish for erasure because you need it for the establishment, exercise, or defense of claims; or for the duration of an objection raised against data processing (Article 18 GDPR);

E. The right to data portability – You have the right to receive from the controller, in a structured, commonly used, machine-readable format (e.g., “.csv” format), personal data concerning you that is held by the controller based on a contract or expressed consent (Article 20 GDPR);

F. The right to withdraw consent to the processing of personal data – you have the right to withdraw consent to the processing of personal data that is processed based on consent at any time. The withdrawal of consent will not affect the lawfulness of processing carried out on the basis of consent before its withdrawal (Article 7(3) GDPR);

G. The right to object – you may object to the processing of your

data if the basis for using the data is a legitimate interest of the controller. In such a situation, after considering your request, your data will not be processed on this basis to the extent covered by the objection, unless the controller demonstrates the existence of legally legitimate grounds for data processing that are considered overriding your interests, rights, and freedoms (Article 21 GDPR);

H. If, in your opinion, the processing of personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority, i.e., the President of the Personal Data Protection Office.

5. Contact

If you require additional information regarding personal data protection or wish to exercise your rights, please contact us at the email address: info@inarms.pl