Controller – controller of personal data is an entity that independently or jointly with others determines the purposes and methods of processing personal data.

Newsletter – information, commercial and marketing content about products, services or activities of BR-AG, information about new products and news, that are shared by BR-AG.

Telecommunications Law – Telecommunications Law Act of 16 July 2004 enacted in Poland (Journal of Laws of 2018 f. item 1954, as amended).

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

Website – our website, available at www.br-ag.eu

BR-AG is the Controller. Below you can find full details of BR-AG as the Controller.

BR-AG prosta spółka akcyjna (formerly Business Reporting – Advisory Group spółka z ograniczoną odpowiedzialnością – spółka komandytowa) with its registered office in Poznań (Poland), ul. Jana Matejki 11a, 60-771 Poznań, entered into the Register of Entrepreneurs kept by the District Court Poznań – Nowe Miasto and Wilda in Poznań, 8^th Commercial Division of the National Court Register under National Court Register (KRS) number 0000984561, Statistical Number (REGON) number: 300907601, Tax ID Number (NIP): 7792342517.

A. When you are browsing our website

What personal data do We process and from where do We have it?

We process the personal data you leave Us as part of your browsing of our website (the Website). These is mainly data concerning your activity in the Website, obtained by BR-AG in connection with the use of cookies and other similar technologies (more information can be found in the Cookie Policy), in particular the IP address of the device on which the Website is displayed, the URL of the displayed file or page, date and time of entry, data concerning the device and browser, which you use when visiting the Website, the name of the Internet access provider and any other similar data concerning use, as well as information that may be used in case of attacks on our IT systems.

Information about the rules of processing other data provided by you, e.g. in connection with filling in forms available on the Website, including purposes, recipients of data and the period of its processing – you will find below, in separate tabs relating to particular types of your activity on the Website.

Due to the fact that the services and products offered within the Website are dedicated to adults, BR-AG does not knowingly process personal data of children.

For what purpose do We process your data and on what legal basis?

When you visit the Website, We may process your data for the following purposes:

• pursuing legally justified interests of BR-AG or third parties, related to the management of the Website, including: making available to you the possibility of viewing, retrieving and reading information and materials made available within the Website, ensuring the safety and reliability of services provided within the Website, guaranteeing undisturbed creation of connection, guaranteeing comfortable use of the Website, analysis of security and stability of the system, based on cookies and other similar technologies (legal basis from Article 6 section 1 letter f of the GDPR);
• pursuing legally justified interests of BR-AG or third party consisting in establishment, exercise or defence of legal claims, e.g. providing information necessary for criminal proceedings in the event of a cyber attack (legal basis of Article 6, section 1, letter f of the GDPR);
• analytical, based on cookies and other similar technologies – based on your consent (legal basis of Article 6, section 1, letter a of the GDPR and Article 173, section 2 in conjunction with Article 174 of the Telecommunications Law). Giving consent is voluntary, and disagreement does not affect the ability to use the Website.

More information about cookies and other similar technologies used by BR-AG and how to block them can be found in our Cookie Policy.

The provision of personal data is voluntary, but may be necessary for the purposes stated above, which BR-AG will not be able to achieve if you do not provide personal data.

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also include entities providing analytical and IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms and consulting companies with which We cooperate.

 The processing of your data contained in third party cookies may result in the transfer of your data to the United States. In particular when it is necessary for the performance of the services provided to you. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which data was collected.

Your personal data contained in cookies will be processed by Us depending on the basis of processing – until the consent is withdrawn or an effective objection is raised. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of consent prior to its withdrawal. The principles of cookie management are contained in our Cookie Policy.

Personal data that will be processed for the purpose of establishing, exercising or defending legal claims will be processed until the statute of limitations for claims or dispute resolution.

B. When you give your consent to marketing

What personal data do We process and from where do We have it?

Depending on the scope of your marketing consent, We may process: your name, surname, e-mail address, telephone number, job title or the name of the entity at which you work.

We have collected your data from you when you consented to the processing of your data.

Providing personal data is voluntary, in particular it is not a condition for concluding a contract.

For what purpose do We process your data and on what legal basis?

We may process your data for direct marketing purposes, which is our legitimate interest. These purposes include, in particular, presenting you with offers and promotions that We believe may be of interest to you, as well as other information promoting the BR-AG brand and our products.

If We carry out direct marketing of BR-AG services and products by electronic means of communication (sending e-mails) and by telephone, We always do so on the basis of your consent (e-mail or telephone communication addressed to you takes place on the basis of your consent provided for by the Act on the provision of electronic services and the Telecommunications Law).

You never need to give consent (consent is voluntary). If you give a consent, you have the right to revoke your consent at any time (revoking your consent will not affect the lawfulness of the processing carried out before revocation of your consent) by sending your request to the BR-AG e-mail address indicated in the section How can you contact us?

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis from Article 6, section 1, letter c of the GDPR), as well as for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or obligation to prove the facts (legal basis from Article 6, section 1, letter f of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also include entities providing IT services or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms and consulting companies with which We cooperate, as well as trusted marketing partners of BR-AG (Google LLC and others).

The processing of your data contained in third party cookies may result in the transfer of your data to the United States. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which data was collected.

Your personal data will be processed by Us depending on the basis of processing – until the consent is withdrawn or an effective objection is raised. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of consent prior to its withdrawal.

Personal data which will be processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill these obligations and to demonstrate that our obligations have been fulfilled.

C. When you use our newsletter

D. When you are applying for participation in the recruitment process

What personal data do We process and from where do We have it?

We process your personal data, voluntarily provided by you within the framework of your application and participation in the recruitment process conducted by BR-AG through our website or in any other way.

The scope of personal data that We need for recruitment purposes is indicated in the advertisement. Providing personal data is always voluntary, but the failure to provide data necessary to conduct the recruitment process will prevent your participation in the recruitment process.

For what purpose do We process your data and on what legal basis?

When you apply for participation in our recruitment process, We may process your data in order to conduct the recruitment process:

• when it is necessary to take action at your request before entering with you into a mandate contract, contract of specific work, contract for the provision of services or any other contract of similar nature (legal basis under Article 6, section 1, letter b of the GDPR). Providing personal data is then a condition for acceptance of your application.
• based on the law (legal basis under Article 22¹, clause 1 of the Labor Code in conjunction with Article 6, section 1, letter c of the GDPR), if you apply for employment on the basis of an employment contract. Providing personal data in such a case results from legal regulations and is a condition of participation in the recruitment process.

The remaining data (e.g. image) provided by you in your recruitment application is processed on the basis of your voluntary consent, which you gave Us by sending/providing your recruitment application to Us and the submission thereof does not affect the possibility to participate in the recruitment process.

We process your personal data on the basis of your voluntary consent if you have consented to the processing of your data by Us for the purposes of a future recruitment. We would like to inform you that providing your data is voluntary in such cases, and if you do not give your consent, it will not unable you to participate in the recruitment process.

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis of Article 6, section 1, letter c of the GDPR).

We may also process your data on the basis of our legitimate interest consisting in establishment, exercise or defence of legal  claims if the claims relate to our recruitment process, as well as for archiving and evidentiary purposes fulfilling our legitimate interest in securing information in the event of a legitimate need or duty to establish facts (legal basis of Article 6, section 1, letter f of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also include entities providing IT services (in particular Google LLC), such as hosting or entities providing BR-AG with ICT systems, telecommunications entrepreneurs, providers of job advertisement publication services (in particular the Pracuj.pl Group), providers of recruitment management systems, law firms, companies providing HR and payroll services and consulting companies with which We cooperate.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

If BR-AG concludes a contract with you after the completion of the recruitment process, your personal data will be stored during the term of the employment relationship or any other type of relationship, in accordance with legal requirements.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.

If after the recruitment process BR-AG does not conclude a contract with you, BR-AG removes recruitment documents after the completion of the recruitment process, if no other basis justifies further processing, and in case you have agreed to participate in future recruitment – after 24 months from the end of the first recruitment, unless within this period, after another recruitment process, BR-AG concludes a contract with you.

If the processing of your data is necessary for the establishment, exercise or defence of legal claims, We process your personal data until the statute of limitations for claims or dispute resolution.

E. When you sign up for a webinar

What personal data do We process and from where do We have it?

We process your personal data voluntarily provided by you in the context of your application for participation in the webinar (name, surname, e-mail address, position, name of the entity at which you work and, if necessary, telephone number).

The provision of your data is voluntary, but the provision of an e-mail address is necessary to access the webinar.

For what purpose do We process your data and on what legal basis?

We process your personal data in order to conclude and perform a contract for the provision of electronic services (legal basis of Article 6, section 1, letter b of the GDPR), which you conclude with Us by signing up for our webinar.

We may also process your personal data for archiving and evidentiary purposes that fulfill a legitimate interest in securing information in the event of a legitimate need or obligation to prove facts, as well as for the purpose of fulfilling other legitimate interests of the Controller or a third party such as: marketing of BR-AG products and services, establishing, exercising and defending claims, ensuring resource protection, safety and quality of the service provided (legal basis from Article 6, section 1, letter f of the GDPR).

E-mail and telephone communication addressed to you, containing marketing content, is also based on your consent (more information in the section When you give your consent to marketing).

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation of BR-AG (legal basis of Article 6, section 1, letter c of the GDPR). Processing of your data is necessary in this respect and failure to process your data would prevent Us from fulfilling and demonstrating fulfilment of our obligations.

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms, and consulting firms with which We cooperate, including marketing and advertising agencies.

The processing of your data may result in its transfer to the servers of software and IT services providers in connection with the use by BR-AG of the services/software they provide. In particular when it is necessary for the performance of the services provided to you. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Your personal data will be processed by Us depending on the basis of processing – until the completion of the service, withdrawal of consent or effective objection. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of that consent prior to its withdrawal.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.

Personal data that We process in order to establish, exercise or defend claims, are processed by Us until the statute of limitations for claims or dispute resolution.

F. When you are our customer/ supplier/ business partner or contact person/ attorney/ person representing our customer/ supplier/ contractor

What personal data do We process and from where do We have it?

If you are our customer, supplier or another business partner, being a natural person (including a person conducting business activity), We process your personal data that you have provided to Us for the purpose of concluding and performing the contract and data obtained from publicly available sources (e.g. CEIDG). Providing data is voluntary, however, it is necessary to conclude a contract with Us.

If you have been indicated as a contact person of the organization with which We cooperate (our customer/supplier/business partner), We may process your personal data provided to Us by your organization in order to cooperate with your organization, i.e. name and surname, position, telephone number, e-mail address and other personal data that you provide to Us in direct contact with Us.

If you have been indicated as an attorney or a person representing the organization with which We cooperate (our client/supplier/business partner), We may process your data you provided to Us, i.e. name and surname, position, telephone number, e-mail address, data contained in the National Court Register, and if you are an attorney – personal data contained in the power of attorney, including, but not limited to, the series and number of an identity document. Providing data is a condition of concluding a contract with your organization, and failure to provide data will prevent Us from concluding and executing a contract with your organization.

For what purpose do We process your data and on what legal basis?

If you are our customer, supplier or other business partner, being a natural person (including a self-employed person), We process your personal data:

• in order to conclude and perform a contract with you (legal basis from Article 6, section 1, letter b of the GDPR). Providing personal data by you is a condition for concluding a contract.
• for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or duty to establish facts, and for purposes arising from other legitimate interests pursued by the BR-AG (legal basis of Article 6, section 1, letter f of the GDPR), such as the identification, recovery or defense of claims, satisfaction surveys of services provided and products supplied, direct marketing of BR-AG products and services, selection of appropriate business partners, prevention of criminal offenses.
• on the basis of a separate consent expressed by you, within the scope and purpose specified therein (e.g. e-mail and telephone communication addressed at you, containing marketing content, takes place on the basis of your consent – more information in the section When you give your consent to marketing).
• to ensure and demonstrate compliance with legal obligations imposed on BR-AG where processing is necessary to fulfill a legal obligation on BR-AG (legal basis from Article 6, section 1, letter c of the GDPR).

If you have been indicated as a contact person, attorney or representative of the organization with which We cooperate (our customer/supplier/business partner), We process your data:

• for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or duty to prove the facts, as well as for purposes resulting from other legitimate interests pursued by BR-AG (legal basis from Article 6, section 1, letter f of the GDPR) i.e.: conclusion and implementation of a contract with your organization, establishment, execution or defense of legal claims, satisfaction surveys of services and products provided, direct marketing of BR-AG products and services, prevention of criminal acts.
• to ensure and demonstrate compliance with legal obligations imposed on BR-AG where processing is necessary to fulfill a legal obligation on BR-AG, in particular tax law obligations (legal basis of Article 6, section 1, letter c of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services or providing BR-AG with ICT systems, law firms and tax offices, entities providing courier or postal services, banks – if it is necessary to make settlements, insurance companies and consulting companies with which We cooperate, including marketing and advertising agencies.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Your personal data, obtained in connection with the conclusion and implementation of the contract with you as a customer/supplier/business partner or your organization, which indicated you as a contact person or representative, are processed until the end of the period of limitation of claims that may potentially arise from the contract concluded with Us, and in the case of data required to meet the legal obligation to which BR-AG is subject (in particular obligations under tax law) – for the period resulting from the applicable legal regulations.

G. When you contact us about other matters

What personal data do We process and from where do We have it?

We process your personal data, voluntarily provided by you during contact with Us (personal contact, telephone contact, e-mail contact, contact by means of forms available at the Website, postal contact) i.e. your name, surname, address (correspondence, e-mail), telephone number, as well as other personal data voluntarily provided by you in a message addressed at Us or transmitted by telephone.

Providing personal data is voluntary, but may be necessary for the processing of your request.

The personal information you provide to Us is, of course, treated confidentially.

For what purpose do We process your data and on what legal basis?

• Your personal data is used by BR-AG to contact you and to provide you with information and advice, based on the legitimate interest of BR-AG to respond to your inquiries, to solve possible problems and thus to maintain and increase your satisfaction (legal basis from Article 6, section 1, letter f of the GDPR).
• If you use or wish to use our products or services, your data may be necessary to perform the contract to which you are a party or to take action at your request before the conclusion of the contract (legal basis of Article 6, section 1, letter b of the GDPR).
• Depending on the nature and course of the case you are addressing Us with, your data may also be processed for the purpose of pursuing legitimate interests of BR-AG, which may include, inter alia, the establishment, investigation and defense of claims, prevention and investigation of criminal offenses, management and further development of business activities, including risk management (legal basis from Article 6, section 1, letter f of the GDPR).
• Your personal data may also be processed for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or obligation to prove the facts (legal basis of Article 6, section 1, letter f of the GDPR).
• Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis of Article 6, section 1, letter c of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, as well as law firms, tax and accounting advisors and other trusted entities with whom We cooperate.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Personal data that We have obtained from you in the course of inquiries addressed at Us via the Website, by e-mail, letter or telephone, will be processed by Us until the completion of your request.

Personal data that We process in order to establish, enforce or defend a claim will be processed by Us until the statute of limitations for claims or the dispute resolution.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.

Please be advised that unless otherwise indicated in this Privacy Policy, there may be an automated processing of your data, including profiling, only in connection with our use of third party cookies. However, We would like to point out that under no circumstances do We use these mechanisms to automatically make decisions that would have legal effects on you or similarly materially affect you, e.g. would have an impact on your availability and ability to use the services offered by us. More about cookies can be found in our Cookie Policy.

Statement of rights

To the extent and in the cases provided for by law, you have the following rights:

• the right to withdraw the consent you have given
• the right of access and the right to obtain a copy of your data
• the right to rectify (correct) your personal data
• the right to have your personal data erased
• the right to obtain the restriction of processing of your personal data
• the right to transfer your personal data
• the right to object

BR-AG will implement these rights in accordance with the regulations of GDPR and other applicable regulations.

In order to exercise your rights, please send Us an e-mail to the address indicated in the section How can you contact us?

You are also entitled to lodge a complaint with the competent supervisory authority if you believe that the processing of your data violates the rules of the GDPR. The competent supervisory authority in Poland is the President of the Personal Data Protection Office.

We want the information We provide you with to be clear and understandable to you. Therefore, below you will find a brief description of your rights.

The right to withdraw the consent you have given (Article 7 of the GDPR)

You have the right to withdraw any consent to the processing of your personal data, which you have given both within and outside the use of the Website, including consent to:

• processing your email address for the purpose of receiving email marketing communications from Us to this email address,
• processing of a telephone number for the purpose of receiving electronic marketing communications from Us to this telephone number,
• collection of your data by means of cookies.

Please note that such consent is voluntary (feely given) and may be revoked at any time, without affecting the lawfulness of any processing performed prior to the revocation of consent.

The declaration of withdrawal of consent should be submitted via e-mail to the BR-AG e-mail address indicated in the tab How can you contact us?

In the event that the withdrawal of your consent is based on cookies, please refer to our Cookie Policy for information on how to withdraw.

The right of access and the right to obtain a copy of your data (Article 15 of the GDPR)

You have the right to know whether We are processing your personal data, to access it and to obtain information on:

• the purposes for which your personal data is processed;
• the categories of your personal data that We process;
• the recipients of the personal data or the categories of recipients of the data to whom your data has been or will be disclosed;
• as far as possible, the intended personal data storage period and, where this is not possible, the criteria for determining the storage period;
• the right to rectify (correct) or delete your personal data, the right to limit the processing by the Controller and the right to object to such processing;
• the right to lodge a complaint with the supervisory authority;
• the source of the personal data (if the personal data has not been collected from the data subject);
• automated decision making, including profiling.

If personal data is transferred to a third country (countries outside the European Economic Area) or an international organization, the data subject has the right to be informed of the appropriate safeguards for the transfer.

You have the right to request a copy of your personal data subject to processing, which will be provided to you free of charge. For any subsequent copies you request, We may charge a reasonable fee based on administrative costs.

The right to obtain a copy shall not adversely affect the rights and freedoms of others (including copyright or trade secrets).

The right to rectify (correct) your personal data (Article 16 of the GDPR)

You have the right to request Us to promptly rectify any inaccurate (including outdated) personal data relating to you. With regard to the purposes of processing, you also have the right to request the supplementation of incomplete personal data – also by submitting an additional declaration.

The right to have your personal data erased (Article 17 of the GDPR)

You have the right to request Us to delete your personal data immediately if one of the following events occurs:

• personal data is no longer needed for the purposes for which it was collected or otherwise processed;
• you revoke the consent on the basis of which the processing took place and there will be no other legal basis for the processing of your data by Us;
• you raise an objection under Article 21, section 1 of the GDPR to the processing and there are no overriding legitimate grounds for the processing or you raise an objection under Article 21, section 2 of the GDPR to the processing;
• your personal data has been unlawfully processed;
• deletion of your personal data is required in order to comply with the legal obligation to which the Controller is subject;
• personal data were collected in connection with the provision of the information society services referred to in Article 8, section 1 of the GDPR.

The right to erasure is not an absolute right. This right shall not apply to the extent that the processing is necessary, inter alia, to comply with a legal obligation requiring processing under the law to which the Controller is subject or for the establishment, exercise or defence of legal claims.

The right to obtain restriction of processing of your personal data (Article 18 of the GDPR)

You have the right to request Us to limit your processing in the following cases:

• if you question the accuracy of your personal data that We process – for a period of time allowing Us to verify the accuracy of such data;
• when the processing is unlawful and you object to the deletion of your personal data and demand instead that the use of your personal data be restricted;
• when We no longer need your personal data for processing purposes, but you need it for the establishment, exercise or defence of legal claims;
• when you have raised an objection under Article 21, section 1 of the GDPR to the processing – until it has been determined whether the legitimate grounds on our side override your grounds for objection.

The exercise of your right means that your personal data may be processed, with the exception of storage, only with your consent or for the establishment, exercise or defence of legal claims or protecting the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The right to transfer your personal data (Article 20 of the GDPR)

You have the right to receive from Us your personal data that you have provided to Us, in a structured, commonly used, machine-readable format, and you have the right to send this personal data to another Controller without hindrance from our side if:

• processing takes place on the basis of your consent or on a contract
• processing is carried out by automated means.

You also have the right to request that your personal data be sent directly to another Controller, if technically feasible.

The exercise of your right shall not adversely affect the rights and freedoms of others.

Right to object (Article 21 of the GDPR)

You have the right to object at any time, for reasons connected with your particular situation, to the processing of personal data concerning you based on, inter alia, our legitimate interests, including profiling. We will then no longer process your personal data unless We demonstrate the existence of valid legitimate grounds for processing, overriding your interests, rights and freedoms or grounds for the establishment, exercise or defence of legal claims.

If your data is processed by Us for the purposes of direct marketing, you have the right at any time to object to the processing of your personal data for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing. In this case, We will stop processing your personal data for this purpose.

If you have any questions regarding the processing of your personal data or if you wish to exercise your rights, please contact Us by writing an e-mail to gdpr@br-ag.eu or sending a traditional letter to the following address: Personal Data Coordinator, BR-AG prosta spółka akcyjna (formerly Business Reporting – Advisory Group spółka z ograniczoną odpowiedzialnością – spółka komandytowa), ul. Jana Matejki 11a, 60-771 Poznań, Poland, with the note “Personal Data”.