GDPR Information

Information clause in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council

Personal Data Controller

The controller of your personal data is branch-osprey with its registered office at ul. Reformacka 12/4, 31-012 Kraków (hereinafter: "Controller").

Contact details

In matters related to personal data protection, you can contact the Controller:

• in writing to the registered office address: ul. Reformacka 12/4, 31-012 Kraków
• by email: [email protected]

Purposes and grounds for processing

Your personal data will be processed for the following purposes:

a) Provision of services

Basis: Art. 6 sec. 1 lit. b GDPR — processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

b) Communication and handling of inquiries

Basis: Art. 6 sec. 1 lit. f GDPR — processing is necessary for the purposes of the legitimate interests pursued by the controller (handling correspondence).

c) Fulfillment of legal obligations

Basis: Art. 6 sec. 1 lit. c GDPR — processing is necessary for compliance with a legal obligation to which the controller is subject (e.g., tax and accounting obligations).

d) Pursuit of claims

Basis: Art. 6 sec. 1 lit. f GDPR — processing is necessary for the purposes of the legitimate interests pursued by the controller (establishment, exercise or defense of legal claims).

Data recipients

Your personal data may be disclosed to the following categories of recipients:

• Entities providing IT and hosting services
• Entities providing accounting and legal services
• Payment operators
• Public authorities, when required by law

Data retention period

Your personal data will be stored for the period:

• necessary to achieve the purposes for which they were collected
• required by law (e.g., accounting documentation — 5 years)
• until the statute of limitations for any claims
• until consent is withdrawn — in the case of data processed on this basis

Your rights

You have the following rights related to the processing of personal data:

• Right of access — you have the right to obtain confirmation as to whether or not we are processing your data and to access this data
• Right to rectification — you can demand the immediate rectification of inaccurate data or the completion of incomplete data
• Right to erasure — you can demand the erasure of data if one of the circumstances specified in Art. 17 GDPR applies
• Right to restriction of processing — in certain situations, you can demand the restriction of data processing
• Right to data portability — you have the right to receive your data in a structured format and to transmit them to another controller
• Right to object — you can object to processing based on the legitimate interest of the controller
• Right to withdraw consent — in the case of consent-based processing, you can withdraw it at any time

Right to lodge a complaint

If you believe that the processing of your personal data violates GDPR provisions, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

Voluntary provision of data

The provision of personal data is voluntary, but necessary to use our services, respond to inquiries, or fulfill a contract.

Automated decision-making

We do not make automated decisions, including profiling, as referred to in Art. 22 sec. 1 and 4 GDPR.

Transfer of data to third countries

Personal data may be transferred outside the European Economic Area only if tools are used whose providers are based in third countries. In such cases, the transfer takes place on the basis of standard contractual clauses adopted by the European Commission or other mechanisms provided for in the GDPR.