Information clause for processing personal data

In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as GDPR) and repealing Directive 95/46/EC (General Data Protection Regulation), we provide information regarding personal data. 

I. Joint Data Administration 

We inform you that under the joint data administration agreement and its terms regarding the purposes, scope, and methods of data processing, companies from the Advartis Group jointly process your personal data as co-administrators. Contact details of individual companies serving as co-administrators are available below. 

II. Contact regarding data protection 

1. As part of the joint data administration agreement, the leading entity in the joint administration model is Advartis Business Services sp. z o.o. based in Warsaw (“Leading Entity”) at Hrubieszowska 2 St., and a joint contact point has been established; via the email address: Violetta.Matusiak@crowe.pl and by phone at +48 538 891 008, where anyone can contact regarding the protection of their personal data and the exercise of their rights.
2. Additionally, anyone whose data is processed may also contact any co-administrator, according to the contact details provided below. 

III. Purpose and legal bases 

1. The scope of processed personal data includes primarily the personal data of potential clients, individuals interested in the services provided by the Advartis Group companies, and participants of organized events as well as other marketing activities, or processed in connection with the preparation of individual cooperation offers. 
2. Personal data will be processed to the extent necessary to achieve the purpose for which the data was collected, ensure proper communication, prepare an individual offer, or enable participation in an organized event, as well as the implementation of other undertaken marketing activities. 
3. The legitimate interests pursued by the Controller also include, in addition to marketing activities, ensuring proper communication with potential clients. 
4. Legal bases: 

• Article 6(1)(f) GDPR, i.e., the legitimate interest of the controller, which is considered to be the marketing of its own products and services as well as ensuring proper communication with clients and potential clients of the Advartis Group entities; 
• Article 6(1)(a) GDPR, i.e., the consent given for the processing of personal data, which can be withdrawn at any time, but the withdrawal of consent does not affect the legality of the data processing carried out before its withdrawal; 
• Article 6(1)(b) GDPR, i.e., actions aimed at entering into a contract or the performance of an already concluded contract, which applies to individuals interested in cooperation offers with the Advartis Group company. 

5. Providing personal data is voluntary, not conditioned by external factors, but necessary to prepare an offer or respond to a submitted inquiry or participate in an organized event, prepare a cooperation agreement, provide services. 

IV. Transfer and storage of data 

1. Each employee/associate of the Controller, whose work involves substantive analysis of personal data, contact with the client or potential client, or IT security, has signed the appropriate document authorizing them to process personal data. 
2. Access to personal data may be granted to other entities with which the Controller has signed data processing agreements, securing the integrity and confidentiality of personal data. These entities provide administrative, telecommunication, teleinformatics, advisory, etc., services based on concluded data processing agreements. 
3. Collected data may also be transferred to authorized institutions and offices in connection with a justified request for such disclosure. 
4. Personal data will not be transferred outside the European Economic Area. 
5. Personal data will be stored only for a period appropriate for their intended and lawful use. Personal data may be processed for purposes arising from the legitimate interests pursued by the Controller: 

• in the case of data processed for marketing purposes or response to a submitted inquiry, the data will be processed until a justified objection to further processing is submitted, taken into account by the co-administrator or for a maximum period of 6 years from the last interaction of the data subject with the co-administrator; 
• in the case of data processed based on given consent, the data may be processed until the consent is withdrawn or for a maximum period of 6 years from the last interaction of the data subject with the co-administrator; 
• in the case of data collected in connection with the conclusion of a cooperation agreement or the provision of services, personal data will be processed for the duration of the contract and for a period of 3 years from the end of cooperation. 

6. Personal data that are no longer needed will be deleted in a way that ensures the confidentiality of the data is not compromised. 
7. None of the co-administrators foresee automated data processing, including profiling. 

V. Rights of data subjects 

1. The protection of personal data in accordance with applicable regulations means that every person whose data is processed has the right to: access their data, rectify it, restrict processing, object to its use, withdraw consent, delete data, transfer it, and lodge a complaint with the supervisory authority (President of the Office for Personal Data Protection). 
2. To the extent that the processing of personal data takes place based on the legitimate interest of the controller, as referred to in Article 6(1)(f) GDPR, every natural person whose data is processed has the right to submit a justified objection to further processing at any time, without affecting the legality of the processing carried out before the objection was submitted. 
3. Moreover, according to GDPR, every person whose data is processed has the right to: 

• the right to access their data and receive a copy of it; 
• the right to rectify (correct) their data if it is incorrect or outdated, as well as the right to delete it if the data is not processed for the purpose of fulfilling a legal obligation or within the exercise of public authority; 
• the right to restrict or object to the processing of data; 
• the right to lodge a complaint with the President of the Office for Personal Data Protection (address: Stawki 2, 00-193 Warsaw). 

Content of agreements resulting from the joint data administration agreement 

We inform you that an agreement on joint data administration has been concluded between the companies of the Advartis Group. This means that each entity of the Advartis Group processes personal data for jointly agreed purposes and scope. Pursuant to Article 26(2) second sentence of GDPR, providing this information constitutes making available the essential content of the joint agreements of the co-administrators, whose identity has been indicated in the Personal Data Processing Information Clause above, regarding the joint administration of personal data processing. 

The scope of processed personal data primarily includes contact details and information about the represented entity, concerning clients and potential clients, to present an individually tailored offer for services provided by the individual companies of the Advartis Group, or to provide information about organized industry and educational events. 

As part of the division of responsibilities in the agreed joint data administration process, the co-administrators have agreed that: 

1. each co-administrator is required to ensure the security of personal data processing by implementing appropriate technical and organizational measures, adequate to the identified risk of rights violations of the individuals concerned; 
2. regarding the fulfillment of the informational obligation towards the individuals concerned and responding to requests from the data subject (exercising the right to access data, rectify, delete, restrict processing, transfer, object to the processing of Personal Data), Advartis Business Services sp. z o.o. based in Warsaw will be responsible, which does not exclude the possibility of direct contact with any of the co-administrators; 
3. the co-administrators are required to cooperate with the Leading Entity in responding to requests from the data subject, implementing these requests, and providing all necessary information in this regard; 
4. the co-administrators have agreed that the Leading Entity will be responsible for fulfilling obligations regarding the management of data protection breaches and reporting them to the supervisory authority and the data subject. 

Regardless of the above division of responsibilities, each of the co-administrators is equally responsible for the proper and lawful processing of personal data. 

List of co-administrators – Advartis Group companies: 

1. The Leading Entity in the joint administration model: Advartis Business Services sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 0000004531, with NIP 5251908277 and REGON 012682409 

Tel.: +48 22 295 33 00 

Email: contact@advartis.eu 

2. Crowe Advartis Accounting sp. z o.o., based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 0000067026, with NIP 5252060079 and REGON 012811203 

Tel.: +48 22 295 33 00 

Email: contact@crowe.pl 

3. Crowe Advartis Tax Advisers sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000294572, with NIP 5252411538 and REGON 141180470 

Tel.: +48 22 295 33 00 

Email: contact@crowe.pl 

4. CA Property Services sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000317781, with NIP 5252438508 and REGON 141558187 

Tel.: +48 22 295 33 00 

Email: contact@capspoland.eu 

5. Poland Audit Services sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000421671, with NIP 5272677311 and REGON 146091386 

Tel.: +48 22 295 33 00 

Email: contact@crowe.pl 

6. Crowe Advartis Consulting sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000393728, with NIP 5272661244 and REGON 143148826 

Tel.: +48 22 295 33 00 

Email: contact@crowe.pl 

7. TGC Rogozik Law Firm sp.k. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000663695, with NIP 5272796777 and REGON 366570366 

Tel.: +48 22 295 33 00 

Email: contact@tgc.eu 

8. TGC Ordowska Law Firm sp.k. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000167447, with NIP 5252271480 and REGON 015518202 

Tel.: +48 22 295 33 00 

Email: contact@tgc.eu 

9. TGC Tax Advisers sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000139218, with NIP 5252259680 and REGON 015263386 

Tel.: +48 22 295 33 00 

Email: contact@tgc.eu 

10. Contract Administration sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 00000028831, with NIP 5260012988 and REGON 012548510 

Tel.: +48 22 295 32 00 

Email: contact@ca-staff.eu 

11. Crowe Advartis Assurance sp. z o.o. based in Warsaw (01-209) at Hrubieszowska 2 St., registered in the District Court for the Capital City of Warsaw, 16th Commercial Division of the National Court Register under number 0001053696, with NIP 5273071993 and REGON 526171384 

Tel.: +48 22 295 33 00 

Email: contact@crowe.pl