Information Obligation Pursuant to Articles 13 and 14 of the GDPR for Representatives of Autenti's Contractors and Clients

The Controller of personal data is: Autenti Spółka Akcyjna with its registered office in Poznań, at ul. Święty Marcin 29/8, entered into the Register of Entrepreneurs maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań under KRS number: 0001254852 (hereinafter referred to as "Autenti") – the operator of the online service provided under the name "Autenti" – an online platform accessible at www.autenti.com (hereinafter referred to as the "Autenti Platform").

Where Do We Get Your Data From?

Personal data processed by Autenti may come directly from Autenti's Client or contractor, or may be provided by other persons representing the Client or contractor. Furthermore, personal data may be obtained by Autenti from another entity contacting or using Autenti's services, or from publicly available sources – in particular from the National Court Register (Krajowy Rejestr Sądowy) and the Court and Commercial Monitor (Monitor Sądowy i Gospodarczy).

The categories of personal data of persons associated with commercial companies or other entities (e.g., members of governing bodies of such entities), including ultimate beneficial owners, are identical to the categories originating from publicly available sources (e.g., the National Court Register) or categories provided by Autenti's client or contractor, or by another entity contacting Autenti.

What Is the Purpose and Legal Basis for Processing Personal Data by Autenti?

Autenti processes personal data for the purpose of:

Concluding or executing an agreement between Autenti and the entity with which a given natural person is associated or on whose behalf they act, as well as for the purpose of verifying such entity (e.g., Client, Contractor of Autenti, or another entity contacting Autenti) and maintaining ongoing contact with that entity in connection with the performance of the agreement or prior to its conclusion – (Article 6(1)(b) and (f) of the GDPR);
Carrying out activities resulting from generally applicable legal provisions in connection with conducting business activities, in particular in connection with complying with obligations under tax law and accounting regulations, as well as provisions governing proceedings conducted by authorized public authorities – (Article 6(1)(c) of the GDPR);
Establishing, exercising, or defending legal claims – (Article 6(1)(f) of the GDPR);
Archival (evidentiary) purposes consisting of securing information in the event of a need to prove facts or demonstrate compliance with an obligation incumbent upon Autenti – (Article 6(1)(f) of the GDPR).

Is Providing Personal Data Required and What Types of Personal Data Does Autenti Process?

If we obtain personal data directly from you, for the purpose of executing the agreement we may require you to provide the following personal data to enter into and perform the agreement concluded with the entity you represent:

first name, last name, email address, telephone number.

The scope of personal data categories may vary depending on the content of the agreement and the scope of cooperation. In addition to the above, Autenti may process information such as: place of employment, identity card number (if specified, for instance, in a power of attorney), or PESEL number (e.g., within extracts from the National Court Register).

If we obtain personal data from other persons, providing it may be necessary to, among other things, designate you as an authorized representative of the entity, verify representation rights under a provided power of attorney or in public registers, verify ultimate beneficial owners, and comply with other actions required by law.

Providing data is voluntary, but required. If personal data is not provided to Autenti, we will unfortunately be unable to enter into an agreement with the entity you represent, or properly perform it.

Your Rights Against Autenti Regarding Processed Data

Pursuant to legal provisions and considering the nature, purpose, and scope of personal data processing, you have the following rights:

the right to access your data and the right to rectify it,
the right to erasure of your data, subject to the limitations set forth in Article 17 of the GDPR, meaning that Autenti will have the right to refuse or limit the execution of your request under the rules described in Article 17 of the GDPR,
the right to restriction of processing of your personal data, under the rules described in Article 18 of the GDPR,
the right to data portability, pursuant to Article 20 of the GDPR,
the right to object to the processing of data based on Autenti's legitimate interest or to processing for direct marketing purposes, pursuant to Article 21 of the GDPR,
the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal — if processing is based on your consent,
the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data violates the provisions of the GDPR.

The exercise of your rights is performed in accordance with the relevant provisions of the GDPR, which means that Autenti reserves the right to refuse or restrict their implementation if the law so requires or permits.

If you have questions, wish to exercise your rights, or have any other concerns, please contact our Data Protection Officer. Contact details can be found below.

To Whom Do We Disclose Personal Data?

Personal data may be disclosed to the following entities:

Public authorities, institutions, or third parties authorized to request access to or receive personal data based on applicable legal provisions;
Entities to which Autenti has entrusted the processing of personal data or shared such data based on concluded agreements, e.g., IT service providers or technical service providers (including hosting), debt collection companies, consulting and auditing firms, law firms, postal or courier service providers, and accounting firms.

How Long Do We Store Personal Data?

Personal data will be stored for the period necessary to establish cooperation and subsequently for the duration of the agreement, and thereafter depending on the purpose for which the data is processed. The period for which personal data will be stored is calculated based on the following criteria:

accounting purposes: for a period of 5 years from the beginning of the year following the financial year in which operations, transactions, or proceedings related to the concluded agreement were finally completed, paid off, settled, or time-barred;
tax purposes: for a period of 5 years, starting from the end of the calendar year in which the tax obligation arising from the settlement of the concluded agreement arose;
fulfillment of activities by Autenti resulting from generally applicable legal provisions: for the period resulting from these provisions;
fulfillment of Autenti's legitimate interests constituting the basis for such processing: for the period necessary to fulfill this purpose or until an objection to such processing is raised, provided there are no compelling legitimate grounds for further data processing by Autenti;
establishing, exercising, or defending own legal claims: until the expiration of the limitation period for potential claims arising from the agreement or on other grounds.

Your personal data will be processed in an IT environment, which means that it may also be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with performing backups, testing changes in IT systems, detecting anomalies, or protecting against abuse and cyberattacks.

Do We Transfer Data Outside the European Economic Area?

Your personal data may be transferred outside the European Economic Area (EEA) to entities providing an adequate level of protection through:

cooperation with entities processing personal data in countries for which a relevant adequacy decision has been issued by the European Commission;
application of Standard Contractual Clauses issued by the European Commission;
application of Binding Corporate Rules approved by the competent supervisory authority;
other safeguards ensuring an adequate level of protection based on appropriate legal safeguards.

Transfer to a third country may occur primarily due to the Controller's use of publicly available tools used for servicing clients and contractors and fulfilling the purposes of personal data processing.

Do We Process Personal Data Automatically (Including Profiling) in a Manner Affecting the Rights of the Data Subject?

Autenti does not process personal data in an automated manner.

How to Contact Us for Additional Information Regarding the Processing of Your Personal Data?

In case of any questions, please contact the Data Protection Officer designated by Autenti using the contact details provided below:

Data Protection Officer: Agata Kolorz-Lentini
Email address: iod@autenti.com
Postal address: Data Protection Officer Autenti S.A., ul. Leona Henryka Sternbacha 1 (Building L1), 30-394 Kraków, Poland