Information Clause under Articles 13 and 14 of the GDPR – e-Delivery Service Users

Who processes your data?

The Controller of your personal data is: Autenti Spółka Akcyjna with its registered office in Poznań, at ul. Święty Marcin 29/8, entered into the Register of Entrepreneurs maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań under KRS number: 0001254852 (hereinafter referred to as "Autenti") – the operator of the online service provided under the name "Autenti" – an online platform accessible at www.autenti.com (hereinafter referred to as the "Autenti Platform") and a provider of qualified electronic registered delivery services.

Where did we get your data from?

We received your data from you in connection with your acceptance of:

The Autenti eDelivery Terms and Conditions, if you are a recipient of a qualified electronic registered delivery service;
The Autenti Platform Terms and Conditions, if you are a registered user of the Autenti Platform.

We may obtain your personal data:

directly from you when creating an account on the Autenti Platform (necessary to use the electronic delivery service, including setting up a mailbox), or
from the Super Administrator of an organization's account, under which you have been designated as a person authorized to use the electronic registered delivery service, including access to the inbox,
directly from you or at your request as part of the Identification process required for the provision of the qualified electronic registered delivery service,
from the sender of your e-Delivery, in connection with the provision of the qualified electronic registered delivery service.

Personal data may also be collected from other sources or activities carried out by you within the management of your account on the Autenti Platform or in connection with using the qualified electronic delivery service.

What is the purpose and legal basis of Autenti's processing of your personal data?

Autenti processes your data for the purpose of:

Executing the agreement for the provision of services specified in the Autenti Platform Terms and Conditions and the Autenti eDelivery Terms and Conditions (pursuant to Article 6(1)(b) of the GDPR), e.g., for:
- providing services electronically and ensuring full use of the qualified electronic registered delivery service, including sending or receiving e-Deliveries,
- creating and managing your account(s), as well as providing support for your account, mailbox, and e-Deliveries,
- handling inquiries you direct to us, e.g., via the contact form, including resolving technical issues reported by you;
Complying with legal obligations to which the Controller is subject (pursuant to Article 6(1)(c) and Article 6(3) of the GDPR), e.g., for:
- tax and accounting purposes,
- handling complaints,
- verification of your identity,
- archival and evidentiary purposes in connection with the qualified electronic delivery service provided to you;
Performing a task carried out in the public interest entrusted to Autenti in connection with the provision of qualified electronic delivery services and in connection with participating in the provision of public electronic registered delivery services (pursuant to Article 6(1)(e) and Article 6(3) of the GDPR);
Pursuing legitimate interests of Autenti (pursuant to Article 6(1)(f) of the GDPR), including informing you of changes to the service, terms and conditions, and other documents applicable to you as a User of the service;
Establishing, exercising, or defending legal claims (pursuant to Article 6(1)(f) of the GDPR);
Based on your consent (pursuant to Article 6(1)(a) of the GDPR), e.g., for:
- sending marketing or commercial content by Autenti,
- marketing products or services through Trusted Partners with whom Autenti collaborates. By "Trusted Partners," we mean entities with which Autenti cooperates regarding the provision or promotion of services specified in the Autenti Platform Terms and Conditions.

Do you have to provide us with your personal data?

If we obtain personal data directly from you, we require you to provide the following personal data to conclude and perform the agreement with you, and thus to provide you with the qualified electronic delivery service:

first name, last name, email address, telephone number,
other data allowing us to verify your identity, which may include, among others, a PESEL number, identity document number, or other data, depending on the identification method chosen by you.

If you use an organization account and act on behalf of a legal entity (company, association, etc.), it is also necessary to provide your place of employment, position, or role, which may include demonstrating your authority to represent the entity.

Providing data is voluntary, but necessary. If personal data is not provided to Autenti, we will unfortunately be unable to enter into an agreement with you or provide electronic delivery services for your benefit.

What are your rights against Autenti regarding processed data?

Pursuant to legal provisions and considering the nature, purpose, and scope of personal data processing, you have the following rights:

the right to access your data and the right to rectify it,
the right to erasure of your data, subject to the limitations set forth in Article 17 of the GDPR, meaning that Autenti will have the right to refuse or limit the execution of your request under the rules described in Article 17 of the GDPR,
the right to restriction of processing, under the rules described in Article 18 of the GDPR,
the right to data portability, pursuant to Article 20 of the GDPR,
the right to object to the processing of data based on Autenti's legitimate interest or to processing for direct marketing purposes, pursuant to Article 21 of the GDPR,
the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal — if processing is based on your consent,
the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data violates the provisions of the GDPR.

The exercise of your rights is performed in accordance with the relevant provisions of the GDPR, which means that Autenti reserves the right to refuse or restrict their implementation if the law so requires or permits.

If you have questions, wish to exercise your rights, or have any other concerns, please contact our Data Protection Officer. Contact details can be found below.

To whom do we disclose your personal data?

We may share your personal data with:

senders or recipients of e-Deliveries, in connection with carrying out the e-Delivery delivery process,
other providers of electronic registered delivery services, within the framework of interoperability,
the Ministry of Digital Affairs and the Central Information Technology Centre (Centralny Ośrodek Informatyki) regarding the use of public electronic registered delivery services (applicable for polish entities), primarily for the purpose of disclosing your address in the BAE (Baza Adresów Elektronicznych / Electronic Address Base),
other Users who share an e-Delivery dispatch/inbox with you,
entities supporting Autenti in providing electronic services or electronic delivery services, i.e., entities providing SMS and email dispatch services, a list of which is available under the link (at the bottom of the page, under the question: What does it mean that Autenti e-Doręczenia is a qualified service?),
entities providing services related to your identity verification to Autenti,
payment service providers,
entities providing consulting or auditing services, provided applicable laws permit such disclosure,
entities supporting the maintenance of Autenti Platform users and providing technical services, including hosting (including cloud storage),
entities supporting promotional offers, collaborating on marketing campaigns, or providing other customer request systems, IT systems, or email infrastructure.

We may also transfer your personal data to authorized public authorities combating fraud and abuse for the purposes of criminal proceedings, provided that applicable laws permit such disclosure.

How long do we store your personal data?

Your personal data is processed to perform the agreement for the provision of services defined in the Autenti eDelivery Terms and Conditions, comply with a legal obligation, and perform a task in the public interest; therefore, the storage duration depends on the specific database in which your data resides and the purposes for which it is processed.

To the extent that your data is necessary for the execution of services provided to you, personal data will be stored for the duration of the agreement, and thereafter for the period necessary to:

provide post-sales customer services (e.g., handling complaints);
secure or pursue legal claims;
if necessary — ensure the proper provision of services in accordance with the Autenti eDelivery Terms and Conditions;
comply with legal obligations of the Controller (e.g., resulting from tax or accounting regulations, the eIDAS Regulation, and others).

The retention periods for your personal data, where processing is based on a specific legal provision or the fulfillment of a purpose in the public interest, are specified in the Policy and Practice Statement for the Qualified Electronic Registered Delivery Service or the eDelivery Terms and Conditions.

Personal data processed for the marketing of our own products or services based on a legitimate legal interest or consent will be processed until you object. Data processed on the basis of consent is processed until it is withdrawn. Upon expiration of the processing period, data is irreversibly erased or anonymized.

Your personal data will be processed in an IT environment, which means that it may also be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with performing backups, testing changes in IT systems, detecting anomalies, or protecting against abuse and cyberattacks.

Do we transfer your data outside the European Economic Area?

Your personal data may be transferred outside the European Economic Area (EEA) to entities providing an adequate level of protection through:

cooperating with processors of personal data in countries for which a relevant decision of the European Commission has been issued,
application of Standard Contractual Clauses issued by the European Commission;
application of Binding Corporate Rules approved by the competent supervisory authority;
other safeguards ensuring an adequate level of protection based on appropriate legal safeguards.

Do we process your personal data automatically (including profiling) in a manner affecting your rights?

Your personal data will be processed in an automated manner (including profiling); however, this will not produce any legal effects concerning you or similarly significantly affect your situation, except where Autenti is required to conduct identity verification. Following a negative outcome of an identity or representation rights verification, Autenti may refuse to provide the electronic registered delivery service to you or to the entity you represent.

Profiling of personal data by Autenti consists of processing your data (including by automated means) by using it to evaluate certain personal aspects, in particular to confirm your identity and representation rights if you act on behalf of another individual or entity.

How to contact us for additional information regarding the processing of your personal data?

Please contact the Data Protection Officer designated by Autenti using the contact details provided below:

Data Protection Officer: Agata Kolorz-Lentini
Email address: dpo@autenti.com
Postal address: Data Protection Officer Autenti S.A., ul. Leona Henryka Sternbacha 1 (Building L1), 30-394 Kraków, Poland