Information about the processing of personal data by the Comarch Group Companies

The table below indicates the Controller of your personal data, depending on the purposes of processing, The purposes of processing are presented in detail in the section: LEGAL BASIS, PURPOSE AND PERIOD OF DATA PROCESSING

The Comarch Group companies may receive contact details directly from the data subject (for instance, via electronic forms or during conferences) or through other persons (e.g. from the employer, another employee or other entity with whom that person cooperates on a permanent basis).

In the case of direct contact, you will have full control over the scope of data made available to the Comarch Group companies.

In the case of data provided by another person, the Comarch Group companies usually collect only the main contact details connected with the data subject’s professional activity, including: the name, surname, email address, telephone number, job title or position, company and potentially other data in accordance with the contract or order under which the contact person’s personal data is being provided.

Personal data are processed by Comarch Group companies for the purposes specified below.
For each purpose, we have provided the relevant legal basis for data processing and criteria for determining the data processing period.

I.
PURPOSE: contract performance or order execution, LEGAL BASIS: Article 6.1.b) of GDPR
PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims
In the case of concluding a contract or order between you and a Comarch Group company, the data provided by you will be processed for the purpose of performing that contract or executing that order and for settlement purposes.
In the case of electronic forms used to download/order a file (e.g. an e-book, demo, report, etc.), the provided data will be processed in order to deliver the ordered file and for related contact and settlement purposes.
In the case of electronic forms used to sign up for a conference, training or other event organised by a Comarch Group company, the provided data will be processed in order to organise the event and for related contact and settlement purposes.

II.
PURPOSE: business contacts, LEGAL BASIS: Article 6.1.f) of GDPR
PROCESSING PERIOD: until your objection submitted under Article 21 of GDPR is granted
Contact data entered into any electronic form, made available under a applicable contract or order, or made accessible otherwise, may be processed for business contact purposes.
Business contacts- include running contacts regarding ongoing negotiations, performance of the contract, sending to you an offer, invitations to a meeting or event organized by a Comarch Group Company or other marketing activities addressed to you by a representative of the Comarch Group Company. As part of this purpose of processing personal data, you may occasionally receive information about products, services or activities of the Comarch Group and other information related to the activities of the Comarch Group.
If you are a representative of a supplier or service provider, representatives of the Comarch Group companies may also contact you to request a business proposal, information or documents.
If this is the case, your data will be processed to pursue the legitimate interests of the controller, namely the marketing and sale of its products and services as well as building and maintaining of business relations.
You have the right to object to such processing of your personal data in accordance with the RIGHTS OF DATA SUBJECT section.

III.
PURPOSE: newsletter, LEGAL BASIS: Article 6.1.a) of GDPR
PROCESSING PERIOD: until you unsubscribe from the newsletter (withdraw consent)
If you give your consent to receiving a newsletter from the Comarch Group companies, your email address will be used to send you our newsletter. The newsletter will be sent to you with the frequency determined by the marketing department, so as to ensure you have access to up-to-date information on the offering and activities of the Comarch Group companies, and other information regarding the Comarch Group’s business.

IV.
PURPOSE: reply to your inquiry, LEGAL BASIS: Article 6.1.a) of GDPR
PROCESSING PERIOD: until you cancel your inquiry (withdraw consent)
If you fill out a contact form or submit an inquiry otherwise (for instance, by email, telephone or social networking site), then you consent to being contacted with regard to your request or inquiry. To withdraw consent, please use the contact details given in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section. Your consent may be withdrawn at any time; its withdrawal will not, however, affect the lawfulness of data processing prior to the consent being withdrawn, but such withdrawal will result in a lack of reply to your inquiry.

V.
PURPOSE: organisation and promotion of events, LEGAL BASIS: in the case of direct notification Article 6.1.b) of GDPR performance of contracts, or taking steps prior to the conclusion of the contract, (ii) in the event of notification by the employer or other entity - Article 6.1.f of GDPR- realization of the legitimate interest of the Controller which is the performance of concluded contracts, realization of obligations and promotion through the organization of events.
PROCESSING PERIOD: the period of performance of the organizer's obligations
In the case of signing up for a conference, training, webinar or any other event organised by a Comarch Group company, the data of participants and speakers will be processed in order to organize the event and for contacts related to this event (before, during and after the event, including sending post-conference / training materials) and possible settlements
After the implementation of this processing purpose the data will be further processed for the purpose (i) fulfillment of the legal obligation to prepare and retain documents (ii) confirmation the fulfillment of obligations, and exercise or defence of legal claims.
You have the right to object to such processing of your personal data in accordance with the RIGHTS OF DATA SUBJECT section.

VI.
PURPOSE: performance of contracts or execution of orders between a Comarch Group company and a third party, LEGAL BASIS: Article 6.1.f) of GDPR
PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims, or until your objection submitted under Article 21 of GDPR is granted
If you are indicated by your employer or other entity as a contact person, your data may be processed for the purpose of performing and settling a contract (or order) between a Comarch Group company and your employer or such other entity. In this case, data processing will involve ongoing contacts related to the contract performance, preparation and retention of contract performance documents, as well as exercise and defence of any legal claims.
Your data will be processed to pursue the controller’s legitimate interests, namely the executing of rights, performance of contracts and receiving due remuneration.
You have the right to object to such processing of your personal data in accordance with the RIGHTS OF DATA SUBJECT section.

VII.
PURPOSE: cooperation with a partner of the Comarch Group, LEGAL BASIS: Article 6.1.f) of GDPR
PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims, or until your objection submitted under Article 21 of GDPR is granted
If you are interested in a product or service distributed through a network of the Comarch Group’s partners, your personal data will be made available to a dedicated partner. This applies if you are a potential or existing client of a Comarch Group company, and if your employer or business partner is/will be a party to a contract or order with a Comarch Group company.
If this is the case, your data will be processed to pursue the controller’s legitimate interests, namely the performance of contracts, business growth and development of a network of partners.
You have the right to object to such processing of your personal data in accordance with the RIGHTS OF DATA SUBJECT section.

VIII.
PURPOSE: contacts with the media and media promotion of the activities, products and services of the Comarch Group, LEGAL BASIS: Article 6.1.a) of GDPR
PROCESSING PERIOD: until you express a wish to discontinue contacts (withdraw consent)
In the case of journalists, editors, reporters and other persons involved in journalism, personal data will be processed for the purpose of maintaining contacts between representatives of the Comarch Group companies and the media, and to promote the activities, services and products of Comarch Group companies in the media. In particular, this may include informing the media of important events, activities, products and services, as well as achievements of the Comarch Group companies.
Contact with a representative of Comarch Group company will be treated as consent to such contacts. If you consent to such contacts, your consent is voluntary and may be withdrawn at any time. To that end, please use the contact details given in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section. Withdrawal of your consent will not affect the lawfulness of data processing before its withdrawal.

IX.
PURPOSE: fulfilment of the legal obligation to prepare and retain documents,
LEGAL BASIS: Article 6.1.c) of GDPR
PROCESSING PERIOD: the retention period for invoices, accounting records and documents confirming the conclusion and performance of contracts, arising from the controller’s national laws.
If a contract is performed, order is executed or other service is provided to you, we will also process your personal data included in invoices, accounting records or other documents confirming the contract’s conclusion and performance in order to draw up and retain the necessary documents as required by applicable laws. This applies in a situation where you are a party to the contract or order, where your employer or business partner is a party to the contract or order, or where any service (for instance hotel booking) has been provided to you.

X.
PURPOSE: confirming the fulfilment of obligations, and exercise or defence of legal claims,
LEGAL BASIS: Art. 6.1.f) of GDPR
PROCESSING PERIOD: the period of performing the relevant obligations and the statutory period of limitation of claims
Data entered into any electronic form, made available under a contract or order, or made accessible otherwise to Comarch Group company may be processed for purposes related to retention of information or documents confirming the fulfilment of obligations by a Comarch Group company and for the purpose of exercising or defending any legal claims by a Comarch Group company. This applies in a situation where you are a party to the contract or order, where your employer or business partner is a party to the contract or order, or where a Comarch Group company was required, on whatever basis, to perform a service for you or to exercise your rights.
If this is the case, your data will be processed to pursue the controller’s legitimate interests, namely the executing of rights, confirming the fulfilment of obligations and receiving due remuneration.
You have the right to object to such processing of your personal data in accordance with the RIGHTS OF DATA SUBJECT section.

XI.
PURPOSE: Post-conference contact, LEGAL BASIS: Art. 6.1.f) of GDPR
PROCESSING PERIOD: until your objection submitted under Article 21 of GDPR is granted.
Personal data of event participants obtained from them directly during the event (e.g. by leaving a business card) or made available to a Comarch Group company by the event organizer will be used for the purpose of a one-off dispatch of promotional materials related to the subject of the event and inquiries for consent for further contacts
If this is the case, your data will be processed to pursue the controller’s legitimate interests, namely the business development, customer acquisition, marketing and sales of products and services, as well as building and strengthening business relationships.

XII.
PURPOSE: Information on the acquired program or service, LEGAL BASIS: Art. 6.1.f) of GDPR
PROCESSING PERIOD: until your objection submitted under Article 21 of GDPR is granted.
Personal data of customers and persons indicated by them for contacts will be used for the purpose of sending information regarding the program or service purchased by the client.
If this is the case, your data will be processed to pursue the controller’s legitimate interests, namely the business development, customer acquisition, marketing and sales of products and services, as well as building and strengthening business relationships.

XIII.
PURPOSE: producer`s warranty, LEGAL BASIS: personal data of client - Art. 6.1.b) of GDPR, data of persons indicated by the client for contact purposes art. 6.1.f) of GDPR
PROCESSING PERIOD: warranty period.
In the case of purchasing software produced by Comarch S.A. from a company from the Comarch Group or through a partner of the Comarch Group and receiving a manufacturer's warranty document, the customer's data and the contact persons indicated by him will be processed for the purpose of fulfilling the producer's obligations resulting from the granted warranty.
After the implementation of this processing purpose the data will be further processed for the purpose (i) fulfillment of the legal obligation to prepare and retain documents (ii) confirmation the fulfillment of obligations, and exercise or defence of legal claims.
Personal data of persons indicated by the customer will be processed to pursue the controller’s legitimate interests, namely protect the right, performance of contracts and receiving due remuneration
After the implementation of this processing purpose the data will be further processed for the purpose (i) fulfillment of the legal obligation to prepare and retain documents (ii) confirmation the fulfillment of obligations, and exercise or defence of legal claims.

XIV.
PURPOSE: Customer verification, LEGAL BASIS: (i) customer data Art. 6.1.b) of GDPR, (ii) Personal data of persons indicated by the customer for contact purposes Art. 6.1.f) of GDPR
PROCESSING PERIOD: Customer verification period.
Before concluding and during the performance of the contract or order, the data of the customer, subcontractor, supplier, service provider or partner with whom the Comarch Group company undertakes cooperation, and the data of persons indicated by these entities for contact purposes, will be processed for the purpose of verification of the customer, which may be carried out by sending a survey regarding the customer for completion or by verifying the data and financial situation of the customer in publicly, available public registers or by entities specializing in the customer verification.
Personal data of persons indicated by the customer will be processed to pursue the controller’s legitimate interests, namely performance of contracts and protection of controller rights.
After the implementation of this processing purpose the data will be further processed for the purpose (i) fulfillment of the legal obligation to prepare and retain documents (ii) confirmation the fulfillment of obligations, and exercise or defence of legal claims.

XV.
PURPOSE: customer satisfaction survey, LEGAL BASIS: Art. 6.1.f) of GDPR
PROCESSING PERIOD: customer satisfaction survey period.
If you are customer of Comarch Group Company or, you were indicated as a contact person or a person participating in the performance of the contract by your employer or other entity in connection with a concluded contract or order between a Comarch Group company and your employer or that entity, your data may be processed customer satisfaction surveys regarding the quality of services or software provided.
If this is the case, your data will be processed to pursue the controller’s legitimate interests, namely which is the performance of concluded contracts and business development.
After the implementation of this processing purpose the data will be further processed for the purpose (i) fulfillment of the legal obligation to prepare and retain documents (ii) confirmation the fulfillment of obligations, and exercise or defence of legal claims.

In the case of electronic forms, the provision of data is voluntary. However, if you fail to provide data marked as obligatory (required) you will not be able to submit the form and, consequently, download a file, participate in an event or subscribe to the newsletter, as the case may be.
In the case of data collected by representatives of the Comarch Group companies in connection with purchases, sales or marketing activities, the provision of data is fully voluntary, but if you fail to provide data we may not be able to contact you in the future.

In the case of persons who are party to a contract or order with a Comarch Group company, the provision of data necessary to perform the contract and fulfil the relevant legal obligations is a prerequisite to its conclusion and performance.

If you consent to receiving the newsletter, your consent is voluntary and may be withdrawn at any time. To that end, please follow the instructions given in the newsletter or use the contact details contained in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section. Withdrawal of your consent will not affect the lawfulness of data processing before its withdrawal.

If you opt out of receiving the newsletter but do not object to business contacts, we may still have grounds to contact you for that purpose (see par. II in the LEGAL BASIS, PURPOSE AND PERIOD OF DATA PROCESSING section). In order to object to such contacts, please use the contact details given in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section.

Under the provisions of GDPR, you have the following rights as the data subject:

1/ right of access to data;
2/ right to rectification of data;
3/ right to erasure of data (‘right to be forgotten’);
4/ right to restriction of data processing;
5/ right to data portability;
6/ right to object (where the controller’s legitimate interest is the basis for data processing);
7/ right to withdraw consent (where consent is the basis for data processing).

The exercise of these rights is subject to the conditions set out in GDPR. If your request is rejected, you will receive a reply with relevant reason for such decision.

In order to exercise your rights, please contact us as directed in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section.

Please note that:

• the right to erasure of data and the right to restriction of data processing will only apply in cases specifically mentioned in GDPR;
• the right to data portability will only apply if the legal basis for processing is your consent or the performance of a contract;
• the controller may refuse to erase your data despite receiving such a request if one of the exceptions listed in GDPR applies, for instance if the processing is required for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
• in some cases, the controller may refuse to grant your objection to the processing of data based on the controller’s legitimate interest, where there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where there are grounds for the establishment, exercise or defence of legal claims; however, this right is not available to the controller when data is processed for direct marketing purposes (e.g. commercial communications).

As of May 25th 2018, you will have the right to lodge a complaint with the competent supervisory authority. A list of supervisory authorities in EU Member States is available at https://ec.europa.eu/newsroom/article29/items/612080

Personal data are stored on Comarch S.A.’s servers, but they are remotely accessible to representatives of all Comarch Group companies. Therefore, please be advised that your personal data may be transferred to a non-EU country in which a Comarch Group company operates.

Your data may be made available to suppliers, service providers and partners with whom Comarch Group companies cooperate, to the extent required to provide services to clients, maintain business contacts, pursue marketing activities, and manage the operations of Comarch Group companies.

If you sign up for a conference, training or other event, your data may be shared with other participants, speakers, co-organisers, hotels and other entities involved in the organisation of that event.

If personal data is transferred to a third country in respect of which no adequacy decision regarding the level of data protection has been issued by the European Commission, the Comarch Group companies will provide appropriate safeguards via standard data protection clauses adopted by the European Commission or the supervisory authority (in accordance with Article 46.2 c) and d) of GDPR).

Should you have any questions on the processing of your data and how to obtain a copy of standard data protection clauses, please contact us as directed in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section.

The data provided by you may be processed for the purpose of profiling to send you commercial and/or marketing information that is tailored to your interests and commercial or professional activity.

However, the data provided by you will not be processed for automated decision-making.

This Information about the processing of personal data by the Comarch Group companies is of a purely informational nature and is disclosed to meet the obligations arising under the General Data Protection Regulation (GDPR). This Information is copyright protected work and as such is legally protected. This document may only be used for its intended purpose and must not be reproduced or used in whole or in part for any other purposes.