Privacy Policy

[General Provisions]

(1) The Privacy Policy sets forth the rules for the processing and protection of personal data of persons using the service available at https://myfundingaccount.com/, hereinafter referred to as Data. The Privacy Policy constitutes an appendix to the Regulations and is an integral part thereof, and all terms used therein have the meaning given to them in the Regulations.

(2) Data means information about an identified or identifiable natural person to whom the data relates, i.e. one who can be identified directly or indirectly, in particular on the basis of characteristics such as name, identification number, location data, Internet identifier or one or more characteristics that define the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.

3 The administrator of the Data is My Funding Account P.S.A. with its registered office in Katowice, Al. Wojciecha Korfantego 138A, 40-156, registered in the National Court Register by the District Court of Katowice-Wschód, VIII Economic Department of the National Court Register under KRS number: 0001023771, with NIP number: 6343021306, with share capital: PLN 2,060,948.00, e-mail: contact@myfundingaccount.com.

4 The Data Controller has appointed a Data Protection Officer, who can be contacted in writing at the Data Controller's registered office address or by e-mail: contact@myfundingaccount.com.

(5) The Data Controller declares that the Data is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as RODO, and the Act of May 10, 2018 on the protection of personal data, as well as in accordance with amending or replacing provisions, implementing acts and other generally applicable laws.

(6) Data Processing, as defined in the Privacy Policy, means an operation or set of operations performed on Data or sets of Data in an automated or non-automated manner, such as collection, recording, organizing, structuring, storing, adapting or modifying, retrieving, consulting.

[Data source]

7. The source of the data shall be information obtained directly from the data subjects, in particular in the context of Registration, Login, Order Placement, Contract Conclusion or Paid Contracts, as well as information obtained from:
- governmental authorities, public records and other publicly available sources - names, gender, date of birth, identification numbers (including, but not limited to, ID card number, TIN, REGON and other numbers in relevant registers of foreign entities), e-mail addresses, telephone and fax numbers, business, residence and mailing addresses (street, house number, city with postal code), website address,
- payment service providers - names and surnames, gender, e-mail addresses, data related to financial transactions (e.g. account numbers, credit or debit card numbers, other unique identifiers),
- internet service providers - location data, internet identifiers (IP addresses), types of internet browsers, devices and systems used by the data subject, pages visited and actions taken on them, content of cookies.

[Purposes and Grounds for Processing Data]

(8) The use of the service by the person whose data are processed is tantamount to the awareness of that person that his/her data may be processed for the following purposes and on the following grounds:
- responding to requests from persons whose data are processed, recording data in cookies, collecting data from websites and mobile applications - on the basis of the consent of the person whose data are processed,
- taking action at the request of the person whose data are processed in order to conclude an Agreement or a Paid Agreement, and its execution, in particular:
- providing electronic services through the website, including enabling Registration, Logging in, placing Orders, entering into Agreements or Paid Agreements, providing information through the website,
- ensuring smooth operation and functioning of the website and safe use of the website,
- creating, maintaining and managing an Account, including providing support for the Account and solving technical problems,
- processing orders,
- settling transactions, including issuing invoices,
- amending, termination or withdrawal from the Agreement or the Paid Agreement,
- communication with data subjects, including handling requests, complaints and other correspondence sent by data subjects to the Data Controller,
- fulfilling the Data Controller's legal obligations, in particular fulfilling accounting, tax, financial and archiving obligations,
- arising from legitimate legal interests pursued by the Data Controller or third parties, as indicated in paragraphs 10-12 below, including for the purposes of:
- establishing, asserting or defending claims of the Data Controller (evidentiary),
- protecting against claims of data subjects (evidentiary),
- direct marketing of the Data Controller's own services, including profiling for customization,
- indirect marketing of services of third parties cooperating with the Data Controller, e.g. in the form of discount coupons, including profiling to match their needs,
- satisfaction surveys of Data Subjects, determining the quality of services and the level of satisfaction of Data Subjects,
- analytical, statistical and management research, including internal reporting and management analysis, statistical and research aimed at developing and improving the services provided by the Data Controller,
- conducting internal audits and inspections,
- implementing business controls,
- managing operations of acquisition, merger, division, transformation.

[Data Scope].

(9) Data processed may include names, surnames, genders, dates of birth, company names, identification numbers (including ID NUMBERS, TIN, REGON and other numbers in relevant registers of foreign entities), e-mail addresses, telephone numbers, fax numbers, business, residence and mailing addresses (street, house number, city including postal code), financial transaction data (including

account numbers, credit or payment card numbers, other unique identifiers), location data, Internet identifiers (IP addresses), types of Internet browsers, devices and systems used by the data subject, pages visited by the data subject and actions taken on them, the content of cookies and other personal data voluntarily provided by the data subject through the service, including interactive forms, surveys or when contacting the Data Controller.

[Voluntariness of data transfer].

(10) Except where absolutely and universally required by law, the provision of data by the data subject is voluntary. However, refusal to provide data is equivalent to the inability to register, log in, place orders, enter into contracts or paid agreements, provide information through the service or communicate with data subjects.

[Data recipients]

11 The Data Controller reserves the right to disclose data to relevant authorities, including courts, government and local government authorities, pre-trial authorities, enforcement authorities, other legal protection authorities, business information bureaus, debt buyers, entities participating in acquisitions, mergers, divisions, transformations of business entities, on the basis of appropriate legal grounds, in accordance with generally applicable law.

12. The Data Controller reserves the right to entrust the processing of data to third parties providing services to the Data Controller, in particular, hosting services, website management, including in the process of servicing data subjects, transportation (including postal operators, postal or courier operators, which are not postal operators), payment intermediation (including banks and payment institutions), IT, equipment repair, marketing, collection of product reviews, consulting, accounting, taxation, finance, debt collection, law, archiving, destruction, record keeping, as well as loss adjustment (including loss adjustment service providers).

13 The Data Controller reserves the right to entrust the processing of data to third parties providing the necessary services for the use of the site, including registration, logging in, placing orders, entering into contracts or paid agreements, providing information through the site, or communicating with the persons whose data are processed, including the processing of complaints.

14 Data may be processed in Poland, a member state of the European Union (EU), a signatory state of the European Economic Area (EEA). Data may also be processed outside of the EEA, including by international organizations, through transfer by the Data Controller, but only if it is necessary to achieve the purposes set forth in paragraph 8 above, and the transfer and processing of data outside of the EEA is carried out using appropriate protection measures recognized by the European Commission's decision as complying with the principles set forth in the RODO. The Data Controller shall inform of its intention to transfer data outside the EEA at the stage of data collection.

[Data retention periods].

15 Data will be kept by the Data Controller for as long as there is a legal basis for its processing, unless a longer retention period is required by law. Data will therefore be kept by the Data Controller for the following periods:
- Until the data subject withdraws his or her consent - in case the processing is based on consent,
- Until an objection is raised - in case the processing is necessary to pursue the Data Controller's legitimate interests, subject to the provisions in paragraph 19,
- Until the expiration of obligations under the Agreement or Paid Contract and claims relating to their performance - in case, when the processing is necessary for the performance of an Agreement or a Paid Contract or to take action at the request of the data subject prior to the conclusion of an Agreement or a Paid Contract,
- Until the expiration of the obligations of the Data Controller under generally applicable laws,
- Until the expiration, including the statute of limitations, of the rights, claims or obligations of the Data Controller and the data subject - when the processing is necessary to pursue the legitimate interests of the Data Controller.

(16) At the end of the retention period, the data will be deleted or anonymized.

[Data Profiling].

17 Data shall also be processed by automated means, including profiling, using information about the data subject's activities on the Website, including information relating to Contracts or Paid Contracts and socio-demographic data, in order to tailor marketing information to the data subject's individual preferences.

[Rights and obligations of data subjects].

18. Data subjects have the right to request from the Data Controller:
- access to personal data and to provide a copy of the full set of data, as well as information regarding its processing,
- rectification of data, pointing out incorrect or outdated data,
- deletion of data, although the Data Controller has the right to refuse deletion in cases specified by law,
- data portability by preparing and transmitting to another data controller or data subject the indicated data in a structured, commonly used machine-readable format,
- restriction of data processing.

(19) The data subject shall also have the right to object at any time to processing based on the legitimate interests of the Data Controller, including profiling based on such interests, for reasons related to his or her particular situation, which shall be binding on the Data Controller, unless the Data Controller demonstrates the existence of compelling legitimate grounds for further processing that outweigh the interests, rights and freedoms of the data subject, or grounds for the establishment, assertion or defense of claims.

(20) If data are processed for direct marketing purposes by the Data Controller, the data subject shall have the right to object at any time to the processing of such data for such purposes, including profiling to the extent that the processing is related to such direct marketing.

(21) If data are processed by the Data Controller on the basis of the consent of the data subject, such consent may be withdrawn at any time, but this shall not affect the lawfulness of processing that took place on the basis of consent before its withdrawal (future effect).

(22) The data subject shall exercise the rights referred to in paragraphs 18-21 above, in particular by sending an appropriate request to the e-mail address contact@myfundingaccount.com, stating his/her name.

(23) If the data subject also provides data of other persons on the site, he or she may do so only if this does not violate generally applicable laws or the personal rights of such persons.

24 The data subject shall have the right to use the data and content provided by other persons on the site during and in connection with the use of the site, and with their consent, in accordance with generally applicable laws, unless he/she obtains the consent of such persons to the processing of their data and content for a broader scope and purpose than provided for in the Privacy Policy and the use of the site.

(25) The data subject also has the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of alleged infringement, if he or she believes that the processing of data violates the provisions of the RODO. The supervisory authority in Poland is the President of the Office for Personal Data Protection.

[Data Security].

26 The Data Controller shall apply technical and organizational measures to protect the Data from accidental or intentional manipulation, loss, destruction or access by unauthorized persons. During the collection and processing of Data, information is transmitted in encrypted form to prevent its misuse by third parties. The security measures used by the Data Controller are constantly improved and adapted to the development of technology.

27 To ensure a high level of data security for data subjects, the Data Controller shall apply measures to ensure:

- The ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services;
- the ability to quickly restore Data availability and access in the event of a physical or technical incident;
- regularly test, measure and evaluate the effectiveness of technical and organizational measures to ensure processing security.

[Use of cookies].

28 Cookies are small text files that are locally stored in the browser cache on the computer of the data subject from which the website was visited.

29 Cookies identify the web browser in order to optimize the content offered by the website and simplify the use of the website. These data are not used to personally identify the person who visited the website.

30 The use of cookies is based on the Cookie Policy, which is an appendix to the Privacy Policy.

[Final Provisions]

31 In matters not regulated by the Privacy Policy, the provisions of the law on data processing, including the RODO, shall apply.

32 The Data Controller reserves the right to amend or supplement the Privacy Policy at any time for valid reasons, in particular:

- issuance of a court ruling or a decision of a state authority that results in the necessity to change the Privacy Policy,
- changes in generally applicable laws,
- significant changes in the market concerning the activities carried out by the Data Controller,
- improvement by the Data Controller of the level of security, functionality or protection of the processed data,
- expansion or improvement of the functionality of the website or cancellation of certain functionalities within the website,
- changes in the scope of the activities carried out by the Data Controller (its expansion or limitation).

These changes may not deprive the data subject of his/her acquired rights, and they apply to the future, i.e. from the date of their implementation. A person who does not agree with the changes to the Privacy Policy may stop using the site at any time.