Information clause concerning the processing of personal data of participants of webinars organised by PAIH S.A.

Pursuant to Article 13(1) and 13(2) of Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1) (hereinafter referred to as “GDPR”) we inform that:

1. Data Controller
The controller of personal data is Polska Agencja Inwestycji i Handlu S.A. with its seat in Warsaw at ul. Krucza 50 (00-025 Warszawa), entered into the register of entrepreneurs of the National Court Register by the Capital City of Warsaw District Court, under the number KRS 0000109815 (hereinafter referred to as “Controller”). The Controller can be reached through the contact form on www.paih.gov.pl, by sending an email to: iod@paih.gov.pl, or by traditional mail at the address of the Controller’s seat stated above.

The contact person in all matters related to the protection of personal data and your rights is the Data Protection Officer. You can contact the Data Protection Officer by sending an e-mail to iod@paih.gov.pl or by traditional mail at the address of the Controller’s seat stated above with a note saying “c/o the Data Protection Officer.”

3. Purposes and grounds for processing personal data
The Controller processes your personal data to:

1) performing tasks as part of the promotion of the Polish economy in accordance with the Act of 7 July 2017 on the performance of tasks in the field of promoting the Polish economy by the Polish Investment and Trade Agency Spółka Akcyjna (i.e. Journal of Laws of 2021, item 633, as amended . amended), in particular in order to answer submitted inquiries and further conduct of the case pursuant to art. 6 sec. 1 lit. e) GDPR, i.e. due to the necessity of processing to perform a task carried out in the public interest;

2) organise the Webinar, including registering participants for the Webinar, contacting them as part of organisational efforts preceding the Webinar, and providing them with selected materials after the Webinar – the legal basis for the processing of personal data is the Administrator's legitimate interest, which is the organization and contact with participants of the Webinar (Article 6(1)(f) of the GDPR). The data subject is entitled to withdraw their consent at any time. Withdrawing consent does not affect the lawfulness of processing based on the consent prior to withdrawal;

3) sending information about the marketing of the Administrator's products and services, i.e. e.g. sending information about planned information and promotion events organized by PAIH S.A., information on PAIH S.A. support for Polish exporters and investors - the legal basis for processing is art. 6 (1) f GDPR in connection with the Act of 18 July 2002 on the provision of electronic services;

4) sending a newsletter in the form of an e-monthly to the indicated e-mail address in the event of consent - the legal basis for processing is art. 6 (1)f GDPR in connection with the Act of 18 July 2002 on the provision of electronic services;

5) promoting the Administrator in social media in connection with the organization and course of the Event - the legal basis for processing is art. 6 (1) f GDPR and based on consent under Art. 81 Act of February 4, 1994 on copyright and related rights - participation in the event means voluntary consent;

6) compile statistics and reports and archive the number of Webinar participants for the internal needs of the Controller – the legal basis for data processing is the necessity of processing for purposes resulting from legitimate interests pursued by the Controller. In this case, the legitimate interest of the Controller is compiling statistics and reports (Article 6(1)(f) of the GDPR);

7) establish, exercise or defend legal claims related to organising the Webinar – the legal basis for processing is the necessity of processing to achieve the legitimate interest of the Controller. In this case, the legitimate interest of the Controller is the establishment, exercise or defence of legal claims (Article 6(1)(f) of the GDPR);

8) implementation of statutory archiving obligations imposed on PAIH - pursuant to art. 6(1)(c) GDPR in connection with with the provisions of the Act of 14 July 1983 on the National Archival Resources and Archives.

The recipients of your personal data are entities to which the Controller entrusted activities that involve the need for personal data processing, especially as regards managing electronic mail, hosting, IT, administrative services, legal services or consulting. The recipients of your personal data may also be entities or authorities that have the right to receive your data, but only in justified cases and in compliance with applicable provisions of law.

In the case of processing for the purpose of pursuing or defending against claims - the data will be processed until the claims expire in accordance with the generally applicable provisions of Polish law.
If the basis for processing is a legitimate interest - the data will be processed until an objection is submitted.
Where the basis for processing is consent until it is withdrawn. The data subject has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of the processing that was made on the basis of consent before its withdrawal.
Until the expiry of the obligation to store personal data resulting from the generally applicable provisions of Polish law, in particular in connection with the Act of July 14, 1983 on national archival resources and archives.

6. Rights of data subjects
Due to the processing of personal data, a data subject has the right to access data, right to rectify data, right to erase data, right to restrict the processing of data, right to object to the processing of data, right to transfer data, and the right to file a complaint with the Chairman of the Personal Data Protection Office. You are entitled to these rights in the scope provided for in generally applicable provisions of law, in particular provisions of the GDPR.
In addition, pursuant to Article 21 of the GDPR, with respect to processing which takes place pursuant to Article 6(1)(f), data subjects are also entitled to object to processing performed by the Controller in this respect.

Your submission of personal data is voluntary, but is necessary for the above purposes.