Information Obligation Pursuant to Articles 13 and 14 of the GDPR

Where Do We Get Your Data From?

If you are a recipient of a document via the eSIGN module on the Autenti Platform, we received your data from the User of the Autenti Platform in order to send you the document and enable you to place an electronic signature on it or perform another action (e.g., initialing or commenting) — depending on the sender's instructions.

The controller or entity providing us with your personal data is the relevant Account User on the Autenti Platform (acting on their own behalf or on behalf of the legal entity they represent), and our platform fulfills solely a technical role in handling the signing process and provides appropriate trust services to you, enabling you to declare your intent in the form of an electronic signature.

Upon receiving an invitation to the signing process in the form of an email message, we inform you that Autenti, in providing the service to you, acts as a personal data controller, although we originally received your personal data from another entity or person.

From the moment we begin providing you with the signing handling service and you place or reject a signature via the eSIGN module on the Autenti Platform, the Controller of your personal data will be Autenti spółka akcyjna with its registered office in Poznań at ul. Święty Marcin 29/8, entered into the Register of Entrepreneurs maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań under KRS number: 0001254852 (hereinafter referred to as "Autenti") – the operator of the online service provided under the name "Autenti" – an online platform accessible at www.autenti.com (hereinafter referred to as the "Autenti Platform").

Furthermore, depending on the type of electronic signature chosen by the sender, Autenti may ask you to additionally confirm your identity prior to signing. Such a requirement arises when it is necessary to place an Autenti Advanced e-Signature. The rules for providing the service can be found in the Autenti Trust Services Policy for Autenti Electronic Signatures and Document Signing Handling, available at: https://autenti.com/en/terms-and-conditions.

What Is the Purpose and Legal Basis for Processing Your Personal Data by Autenti?

Until you place or reject a signature or perform another action in connection with the received document, as well as in the event that you take no action, Autenti will process your data for the purpose of pursuing Autenti's legitimate interest (pursuant to Article 6(1)(f) of the GDPR): consisting in striving to provide the services specified in the Autenti Platform Terms and Conditions, including providing access to the document content, metadata of the signing process, and securing, as a service provider, appropriate evidence related to actions performed within the signing process.

Performing an action associated with the signing process (i.e., issuing an instruction to sign, initial, or comment) involves accepting the Autenti Platform Terms and Conditions and the Autenti Trust Services Policy for Autenti Electronic Signatures and Document Signing Handling, thereby concluding a one-off agreement with Autenti S.A. for the provision of trust services to you. Consequently, Autenti will process your data for the purposes of:

1. providing trust services to you (pursuant to Article 6(1)(b) of the GDPR),
2. collecting and securing data and metadata associated with the performed action or trust service, in particular for the purposes of establishing, exercising, or defending legal claims (pursuant to Article 6(1)(c) or (f) of the GDPR),
3. based on your consent — if granted, e.g., for marketing of own products or services, or those of Trusted Partners with whom Autenti collaborates. By Trusted Partners, we mean entities with which Autenti cooperates regarding the provision of services specified in the Autenti Platform Terms and Conditions or services related to the marketing of own services. The full list of Trusted Partners can be reviewed on our website.

What Are Your Rights Against Autenti Regarding Processed Data?

Pursuant to legal provisions and considering the nature, purpose, and scope of personal data processing, you have the following rights:

• the right to access your data and the right to rectify it. After placing an electronic signature or performing another action, rectification of personal data will not be possible,
• the right to erasure of your data, subject to the limitations set forth in Article 17 of the GDPR, meaning that Autenti will have the right to refuse or limit the execution of your request under the rules described in Article 17 of the GDPR,
• the right to restriction of processing of your personal data, under the rules described in Article 18 of the GDPR,
• the right to data portability, pursuant to Article 20 of the GDPR — where applicable,
• the right to object to the processing of data based on Autenti's legitimate interest or to processing for direct marketing purposes, pursuant to and under the rules described in Article 21 of the GDPR,
• the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal — if processing is based on your consent (where applicable),
• the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data violates the provisions of the GDPR.

The exercise of your rights is performed in accordance with the relevant provisions of the GDPR, which means that Autenti reserves the right to refuse or restrict their implementation if the law so requires or permits.

If you have questions, wish to exercise your rights, or have any other concerns, please contact our Data Protection Officer. Contact details can be found below.

To Whom Do We Disclose Your Personal Data?

We share your personal data with parties to the processed documents or transactions you conclude via the Autenti Platform, as well as entities supporting us in providing electronic services, i.e., those providing, where applicable: payment services, consulting or auditing services, supporting the maintenance of Autenti Platform users, providing technical services including hosting (including cloud storage) or telecommunication services, supporting promotional offers, or collaborating on marketing campaigns.

Your personal data may also be transferred to competent public authorities, including the supervisory authority for trust services, the personal data protection office, and authorities combating fraud and abuse, such as the prosecutor's office or police, within the scope of ongoing proceedings.

How Long Do We Store Your Personal Data?

We provide your personal data to the parties to the documents or transactions processed that you conclude on the Autenti Platform and to entities supporting us in the provision of electronic services, i.e. those that provide payment, credit, insurance services, provide consulting or auditing services, support the service of Autenti Platform users, provide technical services incl. hosting (including data storage in the so-called cloud), regarding the development and maintenance of IT systems and websites, support the promotion of offers, cooperate in marketing campaigns. We have the right to transfer your personal data to public entities fighting frauds and abuse.

 

If processing is based on consent, personal data is processed until it is withdrawn.

 

Do We Transfer Your Data Outside the European Economic Area?

Your personal data may be transferred outside the European Economic Area (EEA) to entities providing an adequate level of protection through:

1. cooperation with entities processing personal data in countries for which a relevant adequacy decision has been issued by the European Commission;
2. application of Standard Contractual Clauses issued by the European Commission;
3. application of Binding Corporate Rules approved by the competent supervisory authority;
4. other safeguards ensuring an adequate level of protection based on appropriate legal safeguards.

Transfer to a third country may occur primarily due to Autenti's use of security-enhancing systems or software, publicly available tools used for servicing clients and contractors, and fulfilling personal data processing purposes in connection with the service.

Do We Process Your Personal Data Automatically (Including Profiling) in a Manner Affecting Your Rights?

Your personal data may be processed in an automated manner, however without profiling. Automated data processing may produce legal effects concerning you or similarly significantly affect your situation — e.g., by refusing to provide a trust service to you in the event of a negative outcome of identity verification necessary to place an electronic signature.

How to Contact Us for Additional Information Regarding the Processing of Your Personal Data?

Please contact the Data Protection Officer designated by Autenti using the contact details provided below:

• Data Protection Officer: Agata Kolorz-Lentini
• Email address: iod@autenti.com
• Postal address: Data Protection Officer Autenti S.A., ul. Leona Henryka Sternbacha 1 (Building L1), 30-394 Kraków, Poland