Information clause concerning the processing of personal data of participants of webinars organised by PAIH S.A.

Pursuant to Article 13(1) and 13(2) of Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1) (hereinafter referred to as “GDPR”) we inform that:

1. Data Controller
The controller of personal data provided by you in connection with your application to participate in a webinar organised by PAIH S.A. (hereinafter referred to as “Webinar”) is Polska Agencja Inwestycji i Handlu S.A. with its seat in Warsaw at ul. Krucza 50 (00-025 Warszawa), entered into the register of entrepreneurs of the National Court Register by the Capital City of Warsaw District Court, under the number KRS 0000109815 (hereinafter referred to as “Controller”). The Controller can be reached through the contact form on www.paih.gov.pl, by sending an email to: iod@paih.gov.pl, or by traditional mail at the address of the Controller’s seat stated above.

2. Data Protection Officer

The contact person in all matters related to the protection of personal data and your rights is the Data Protection Officer. You can contact the Data Protection Officer by sending an e-mail to iod@paih.gov.pl or by traditional mail at the address of the Controller’s seat stated above with a note saying “c/o the Data Protection Officer.”

3. Purposes and grounds for processing personal data
The Controller processes your personal data to:

1) organise the Webinar, including registering participants for the Webinar, contacting them as part of organisational efforts preceding the Webinar, and providing them with selected materials after the Webinar – the legal basis for data processing is the consent of the data subject (Article 6(1)(a) of the GDPR).
The data subject is entitled to withdraw their consent at any time. Withdrawing consent does not affect the lawfulness of processing based on the consent prior to withdrawal;

2) maintain a list of Webinar participants – the legal basis for data processing is the necessity of processing to achieve a legitimate interest of the Controller. In this case, the legitimate interest of the Controller is maintaining the list of Webinar participants (Article 6(1)(f) of the GDPR);

3) contact the Webinar participants – the legal basis for data processing is the necessity of processing for purposes resulting from legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is contacting the Webinar participants (Article 6(1)(f) of the GDPR);

4) compile statistics and reports and archive the number of Webinar participants for the internal needs of the Controller – the legal basis for data processing is the necessity of processing for purposes resulting from legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is compiling statistics and reports (Article 6(1)(f) of the GDPR);

5) establish, exercise or defend legal claims related to organising the Webinar – the legal basis for processing is the necessity of processing to achieve the legitimate interest of the Controller. In this case, the legitimate interest of the Controller is the establishment, exercise or defence of legal claims (Article 6(1)(f) of the GDPR).

4. Data recipients

The recipients of your personal data are entities to which the Controller entrusted activities that involve the need for personal data processing, especially as regards managing electronic mail, hosting, IT, administrative services, legal services or consulting. The recipients of your personal data may also be entities or authorities that have the right to receive your data, but only in justified cases and in compliance with applicable provisions of law.

5. The time for which personal data are stored

Personal data are stored until:

1) 30 days have elapsed from the end of the Webinar or you request to either: erase your data, withdraw your consent for the processing of personal data, request the restriction of processing, object to the processing of data or data transfer;

2) for the establishment, exercise or defence of claims – until the claims are time-barred according to generally applicable provisions of Polish law;

3) until the legally justified interest of the Controller is achieved.

6. Rights of data subjects
Due to the processing of personal data, a data subject has the right to access data, right to rectify data, right to erase data, right to restrict the processing of data, right to object to the processing of data, right to transfer data, and the right to file a complaint with the Chairman of the Personal Data Protection Office. You are entitled to these rights in the scope provided for in generally applicable provisions of law, in particular provisions of the GDPR.
In addition, pursuant to Article 21 of the GDPR, with respect to processing which takes place pursuant to Article 6(1)(f), data subjects are also entitled to object to processing performed by the Controller in this respect.

7. Information about required/voluntary submission of data

Your submission of personal data is voluntary, but required for participation in the Webinar.

8. Information about automated decision-making, including profiling

The Controller will not use personal data to make automated decisions, including decisions that are the result of profiling.