Information Obligation Pursuant to Articles 13 and 14 of the GDPR

Who Processes Your Data?

The Controller of your personal data is: Autenti Spółka Akcyjna with its registered office in Poznań, at ul. Święty Marcin 29/8, entered into the Register of Entrepreneurs maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań under KRS number: 0001254852 (hereinafter referred to as "Autenti") – the operator of the online service provided under the name "Autenti" – an online platform accessible at www.autenti.com (hereinafter referred to as the "Autenti Platform") and the Autenti eID service (formerly Broker ID).

Where Do We Get Your Data From?

We received your email address and/or telephone number from the person or entity requesting the verification of your personal data (hereinafter referred to as the "User"), in order to send you an invitation containing information about the identification process and links allowing you to enter the verification process within the Autenti eID service.

We received your data from you in connection with your consent to carry out the verification of your personal data on the basis of the Broker ID Terms and Conditions:

during the verification process initiated on a mobile device via a link sent to your telephone number, or
during the verification process initiated via a link received from the person requesting verification, or
during the verification process initiated via a link contained in an email message received by you.

What Is the Purpose and Legal Basis for Processing Your Personal Data by Autenti within Autenti eID?

Your data within the Autenti eID service is processed for the purpose of:

Executing the agreement concluded on the basis of the Broker ID Terms and Conditions or a separate agreement (Article 6(1)(b) of the GDPR). In the case of applying a specific identification method that requires it, we may also process your biometric data (Article 9(2)(a) of the GDPR — solely based on your consent granted prior to commencing the identification process);
Complying with legal obligations to which the Controller is subject under tax law, accounting law, and the Act on Trust Services and Electronic Identification (Article 6(1)(c) and Article 6(3) of the GDPR);
Pursuing the legitimate interests of the Controller, i.e., establishing, exercising, or defending potential claims or other demands of third parties, including public authorities (Article 6(1)(f) of the GDPR).

Do You Have to Provide Us with Your Personal Data?

We require you to provide the following personal data to conclude and perform the agreement entered into with you, and thus to provide you with the service, as well as to perform the agreement entered into with the User involving the transfer of your personal data verification result to the User:

first name and last name, email address, telephone number, date of birth, PESEL number, identity document number, and/or other data required to carry out verification using the chosen ID Method, including biometric data.
Selected ID Methods may also include images or video recordings of identity documents or the face of the Identified Person.

Providing your personal data is voluntary; however, failure to consent to identification or failure to provide the requested personal data within Autenti eID will result in the inability to carry out the identification requested by the User, including the collection of personal data and/or confirmation of your identity.

What Are Your Rights Against Autenti Regarding Processed Data?

Pursuant to legal provisions and considering the nature, purpose, and scope of personal data processing, you have the following rights:

the right to access your data and the right to rectify it,
the right to erasure of your data, subject to the limitations set forth in Article 17 of the GDPR, meaning that Autenti will have the right to refuse or limit the execution of your request under the rules described in Article 17 of the GDPR,
the right to restriction of processing, under the rules described in Article 18 of the GDPR,
the right to data portability, pursuant to Article 20 of the GDPR,
the right to object to the processing of data based on Autenti's legitimate interest or to processing for direct marketing purposes, pursuant to Article 21 of the GDPR,
the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal — if processing is based on your consent,
the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data violates the provisions of the GDPR.

The exercise of your rights is performed in accordance with the relevant provisions of the GDPR, which means that Autenti reserves the right to refuse or restrict their implementation if the law so requires or permits.

If you have questions, wish to exercise your rights, or have any other concerns, please contact our Data Protection Officer. Contact details can be found below.

To Whom Do We Disclose Your Personal Data?

We disclose your personal data to:

The User, by transferring the identification results. This person will receive only such data as is necessary for the execution of the agreement between the Controller and the User, based on the User's instruction and applicable legal provisions. The Controller is not responsible for unlawful processing of personal data by the User;
Providers participating in the delivery of the Autenti eID service, including entities providing technical services or delivering ID Methods, e.g., hosting services. They may process personal data or anonymized information to enable the Controller to achieve the purposes resulting from the Terms and Conditions;
Other third parties, if the Controller has reason to believe that it is necessary: to comply with applicable law, court orders, subpoenas, or other legal processes; to investigate, prevent, or take action regarding illegal activities; suspected fraud; violations of the Terms and Conditions; or situations involving threats to the property or assets of the Controller or the safety of any person or third party; as well as to establish, protect, or exercise the Controller's rights or defend the Controller against legal claims.

How Long Do We Store Your Personal Data?

Your personal data processed for the purpose of executing the agreement for the provision of services defined in the Broker ID Terms and Conditions for your benefit will be stored for the duration of the agreement, and thereafter for a period no longer than required by Autenti's legitimate interest, i.e., establishing, exercising, or defending potential claims or other demands of third parties, including public authorities (Article 6(1)(f) of the GDPR), i.e., for no longer than a period of 6 years.

Personal data processed for the fulfillment of legal obligations will be processed for the period specified by applicable legal provisions.

Personal data processed on the basis of your consent will be processed until your objection or withdrawal of previously granted consent, without affecting the lawfulness of processing carried out prior to such withdrawal.

Your personal data will be processed in an IT environment, which means that it may also be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with performing backups, testing changes in IT systems, detecting anomalies, or protecting against abuse and cyberattacks.

Do We Transfer Your Data Outside the European Economic Area?

Your personal data will not be transferred outside the European Economic Area (EEA).

Do We Process Your Personal Data Automatically (Including Profiling) in a Manner Affecting Your Rights?

Your personal data, including biometric data, will be processed in an automated manner such that Autenti, based on the data and documents provided by you, verifies their correctness and evaluates their compliance against the declared identity.

Carrying out the verification of your personal data and identity may produce legal effects concerning you or similarly significantly affect your situation, depending on the process or purpose for which the identification is conducted on behalf of the User.

How to Contact Us for Additional Information Regarding the Processing of Your Personal Data?

Please contact the Data Protection Officer designated by Autenti using the contact details provided below:

Data Protection Officer: Agata Kolorz-Lentini
Email address: dpo@autenti.com
Postal address: Data Protection Officer Autenti S.A., ul. Leona Henryka Sternbacha 1 (Building L1), 30-394 Kraków, Poland