Data Privacy

I. Personal Data Controller

The personal data controller is AMALYTICA sp. z o.o. with registered office in Lodz, at Kilińskiego 66, 90-118 Lodz, entered in the register of entrepreneurs of the Polish Court Register maintained by the District Court for Lodz-Srodmiescie in Lodz, XX Commercial Division of the Polish Court Register, under the KRS number 0000853961 (“AMALYTICA”). AMALYTICA’s contact details are available at www.amalytica.com. Personal Data Inspector has not been appointed.

II. Purpose of personal data processing

Personal data are processed for the following purposes, based on the following legal grounds:

1. to promote and conduct direct marketing of AMALYTICA’s services, with prior consent (GDPR Article 6(1)(a); for marketing carried out by electronic means of communication — taking into account Article 398 of the Act of 12 July 2024 — Electronic Communications Law, Journal of Laws item 1221, with consent collected separately for each communication channel);
2. to conclude and perform a service agreement (GDPR Article 6(1)(b)); with respect to data of persons representing the client and of the client’s employees and collaborators, the basis is the legitimate interest of the controller and the client (GDPR Article 6(1)(f));
3. for recruitment or cooperation (GDPR Articles 6(1)(a), (c));
4. to comply with the legal obligations imposed on a personal data controller under EU law or applicable domestic (including Polish) law (GDPR Article 6(1)(c)), and in particular the obligation to disclose personal data of a data subject, whenever AMALYTICA is obliged by law, including the Polish acts on: Counteracting Money Laundering and Terrorist Financing, on Accounting, on restructuring, on trading in financial instruments;
5. to protect the vital interests of the data subject or of another natural person (GDPR Article 6(1)(d)); and
6. to protect the legitimate interests of AMALYTICA (GDPR Article 6(1)(f)), and in particular to pursue, establish and defend claims, monitor the use of AMALYTICA’s resources, identify conflicts of interests and ethics violations, fraud prevention, and for archival and statistical purposes.

III. Scope of data processing

AMALYTICA processes personal data to the extent necessary to provide its services and to comply with legal obligations, in particular the following categories of data:

• identification and contact data — e.g. first name and surname, company, position, address, e-mail address, telephone number;
• billing and payment data — data necessary to issue an invoice (including tax ID), transaction identifiers and payment information;
• order and contract data — information on ordered reports, purchase history and correspondence relating to the provision of the service;
• user-account data — where an account is created, including the login and a password stored in secured form;
• data arising from legal obligations — including data processed for accounting and tax documentation and, to the extent applicable, data used to fulfil anti-money-laundering obligations;
• technical and usage data — e.g. IP address, device data, logs and cookie identifiers, to the extent indicated in the cookie policy;
• data provided by the client — necessary to provide services in a specific case.

IV. Data retention period

Personal data are stored for no longer than necessary to achieve the purposes for which they are processed, in particular:

• data relating to the conclusion and performance of an agreement — for the term of the agreement and, after its termination, for the limitation period of claims;
• data in accounting and tax records — for the period required by law (as a rule, 5 years from the end of the relevant year).

V. Recipients of personal data

AMALYTICA takes care to keep personal data safe and does not transfer them to any person or entity not authorized to receive the same. Therefore, in addition to partners, employees and collaborators who are authorized to process personal data as part of the services provided by AMALYTICA, personal data may be made available to:

1. entities providing accounting, IT, tax and audit services to AMALYTICA;
2. government agencies, state authorities or authorities entrusted with public services (courts, court enforcement officers, mediators, probation officers, tax inspection authorities and other legal protection agencies);
3. notarial and legal offices, to an extent necessary to draft legal documents; and
4. other entities, with data subjects’ consent.

VI. Transfer of data outside of the European Economic Area

As a rule, AMALYTICA does not transfer any personal data outside of the European Economic Area.

However, please be informed that it can prove necessary to transfer personal data to a third country in a manner and on the terms and conditions set out in the applicable provisions of law. This can be the case, for example, whenever:

• services are provided to or with participation of a party registered outside of the European Economic Area,
• specific IT services or tasks are entrusted to contractors with registered offices outside of the European Economic Area.

Any such transfer will take place only where the conditions set out in Chapter V of the GDPR are met, i.e. on the basis of a European Commission adequacy decision (GDPR Article 45), subject to appropriate safeguards, in particular standard contractual clauses (GDPR Article 46), or on the basis of the derogations provided for in GDPR Article 49. Information on the safeguards applied and on how to obtain a copy of them can be obtained by contacting AMALYTICA.

VII. Data subject’s rights

Any data subject whose personal data are processed has the right to access their personal data, have them rectified or erased or have their processing restricted any time, and the right to data portability in line with Article 20 GDPR, subject to the limitations stipulated by the provisions of law and to the extent to which this does not constitute a breach of any professional secrecy.

Furthermore, every data subject whose data are processed has the right to lodge a complaint with the supervisory authority competent for personal data protection, in Poland — to the President of the Personal Data Protection Office, and also, pursuant to GDPR Article 21, the right to object to the processing of their personal data, whenever the data are processed for the purposes of the legitimate interests pursued by the controller or by a third party, i.e. on the basis of GDPR Article 6(1)(f). To exercise the rights referred to above please contact AMALYTICA as indicated in Section I.

VIII. Right to withdraw consent

Whenever data are processed based on a data subject’s consent, the data subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of the data processing based on the consent before its withdrawal.

IX. Information on required or voluntary data provision

To the extent personal data is processed to execute and perform a service agreement, provision of data is a contractual requirement, whereas in most other cases, it is a statutory requirement. Personal data is provided on a voluntary basis, but in the event of refusal to provide the same, the execution and performance of an agreement will not be possible.

X. Automated data processing

AMALYTICA does not use automated decision-making and profiling or automated personal data profiling.

XI. Changes to the data privacy policy

Any changes to this Policy will be published at www.amalytica.com and apply from the date of their publication. AMALYTICA will give notice of material changes by appropriate means.