Information clause

I. Who is the controller of your personal data?

Pursuant to Articles 13(1) and (2) and 14(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR"), we hereby inform you that the Controller of your personal data is the company with which you have concluded or intend to conclude the Agreement (hereinafter referred to as the "Controller" or the "Company"). The Controller's identification details and contact information are provided in the Agreement.

The Controller of your personal data processed through the mobile application of the service provider selected by you (e.g., Glovo, Uber, Bolt, Wolt, etc.) is the respective service provider. Information regarding the processing of your personal data by that provider will be made available to you directly by the provider.

II. Have the companies within the Eternis Group appointed a data protection officer?

The companies within the Eternis Group have appointed a Data Protection Officer ("DPO"), who may be contacted as follows:

a) by post, at the Company's registered address;

b) by e-mail: rodo@eternis.pl;

c) by telephone: +48 604 782 535.

III. For what purposes and on what legal basis do we process your personal data?

Your personal data are processed for the following purposes and on the following legal bases:

a) the performance of the Agreement concluded with the Company and the settlement of all matters related thereto – the legal basis for the processing is the necessity to perform the Agreement or to take steps prior to entering into the Agreement (Article 6(1)(b) of the GDPR);

b) verification of your identity prior to the conclusion of the Agreement – the legal basis for the processing is the Company's legitimate interest (Article 6(1)(f) of the GDPR);

c) compliance with the Company's accounting and tax obligations arising under applicable laws – the legal basis for the processing is compliance with a legal obligation to which the Company is subject (Article 6(1)(c) of the GDPR), in conjunction with the applicable tax legislation and accounting regulations;

d) maintaining contact with you in connection with the performance of the Agreement – the legal basis for the processing is the Company's legitimate interest (Article 6(1)(f) of the GDPR);

e) GPS monitoring of the leased vehicle – the legal basis for the processing is the Company's legitimate interest consisting in ensuring the security of its property (the leased vehicle) and improving the efficiency of fleet management (Article 6(1)(f) of the GDPR);

f) compliance with legal obligations arising under the Act of 6 September 2001 on Road Transport, with particular reference to Article 6 thereof – the legal basis for the processing is compliance with a legal obligation to which the Company is subject (Article 6(1)(c) of the GDPR);

g) verification of the validity of documents relating to the notification of a driver or vehicle submitted to the competent municipal or city authority for the purposes of internal audits (Article 6(1)(f) of the GDPR) or external inspections (Article 6(1)(c) of the GDPR);

h) enhancing security and improving the quality of customer service by recording telephone conversations through the customer service helpline, based on your voluntary consent to the recording of such conversations (Article 6(1)(a) of the GDPR);

i) establishing, pursuing or defending claims arising from the non-performance or improper performance of the Agreement – the legal basis for the processing is the Controller's legitimate interest consisting in establishing, pursuing or defending claims relating to the Agreement concluded between the parties (Article 6(1)(f) of the GDPR);

j) sending commercial information for marketing purposes relating to the products or services offered by companies within the Eternis Group – the legal basis for the processing is the Controller's legitimate interest (Article 6(1)(f) of the GDPR), subject to your separate consent to the use of a specific communication channel (telephone number or e-mail address);

k) marketing the services provided by companies within the Eternis Group through the publication of photographs or video materials containing your image – the legal basis for the processing is your consent (Article 6(1)(a) of the GDPR);

l) disclosure of your personal data to the FLEETCHECK register maintained by PZPA Solutions Sp. z o.o., with its registered office at ul. Saska 9A, 03-968 Warsaw, Poland (National Court Register (KRS) No. 0001173208), concerning breaches related to the performance of your obligations under agreements concluded with companies within the Eternis Group, including, in particular, the reporting of breaches relating to your financial obligations towards companies within the Eternis Group – the legal basis for the processing is your consent (Article 6(1)(a) of the GDPR).

If you represent a legal entity or have been designated as a contact person for the performance of the Agreement:

1. For natural persons representing a legal entity (a party to the Agreement), including attorneys-in-fact and commercial proxies, the Company will process personal data for the following purposes:

a) entering into the Agreement and handling settlements related thereto – the legal basis for processing is processing necessary for the performance of the Agreement (Article 6(1)(b) of the GDPR);

b) identifying persons authorized to represent the entity (a party to the Agreement), verifying their identity, and determining the scope of their authority – the legal basis for processing is the Company’s legitimate interest in properly identifying authorized representatives (Article 6(1)(f) of the GDPR);

c) fulfilling the Company’s accounting and tax obligations arising from applicable legal provisions, pursuant to Article 6(1)(c) of the GDPR in conjunction with tax regulations and the Accounting Act;

d) establishing and pursuing potential claims related to non-performance or improper performance of the Agreement – the legal basis for processing is the Company’s legitimate interest in establishing, pursuing, or defending against claims arising from the Agreement concluded between the parties (Article 6(1)(f) of the GDPR).

2. For natural persons indicated by the entity on whose behalf you act as a contact person in connection with the conclusion or performance of the Agreement with the Company, the Company will process personal data for the following purposes:

a) contacting you in ongoing matters, including matters relating to the performance of the Agreement between the Company and your employer/the entity you represent, maintaining correspondence in connection with the concluded Agreement, and providing other information regarding the parties’ cooperation and business arrangements – the legal basis for processing is the performance of the Agreement (Article 6(1)(b) and (f) of the GDPR);

b) fulfilling the Company’s accounting and tax obligations arising from applicable legal provisions, pursuant to Article 6(1)(c) of the GDPR in conjunction with tax regulations and the Accounting Act;

c) establishing and pursuing claims related to non-performance or improper performance of the Agreement – the legal basis for processing is the Company’s legitimate interest in establishing, pursuing, or defending against claims related to the Agreement concluded by the Company with the entity you represent (Article 6(1)(f) of the GDPR).

IV. For how long will we process your personal data?

Your personal data will be processed until the legal basis for their processing ceases to exist, the purpose of the processing has been achieved, or the purpose otherwise ceases to exist. In particular:

a) where the legal basis for the processing is the Controller's legitimate interest, your personal data will be processed until such legitimate interest has been fulfilled or until you object to the processing of your personal data;

b) where your personal data are processed on the basis of the Agreement, they will be processed for the duration of the contractual relationship between you and the Controller and thereafter for the period required under applicable law (including tax and accounting legislation), which, as a general rule, is five tax years;

c) where your personal data are processed on the basis of your consent, they will be processed until you withdraw your consent. Withdrawal of consent shall not affect the lawfulness of any processing carried out on the basis of your consent prior to its withdrawal. In the case of recordings of telephone conversations conducted through the customer service helpline, the personal data contained in such recordings will be processed for no longer than three (3) years from the date the conversation was recorded.

The above retention periods may be extended where the processing of your personal data is necessary for the establishment, pursuit or defence of legal claims. After that period, your personal data will be retained only where and to the extent required by applicable law.

V. With whom do we share your personal data?

Your personal data may be disclosed to competent public authorities, companies within the Eternis Group (to the extent that such companies provide services to the Controller), business partners on whose behalf you perform transport or delivery services, and entities providing services to the Controller under relevant agreements, including, in particular, providers of external IT systems, accounting service providers, debt collection agencies, consulting firms and auditors. Such entities act solely as service providers and process personal data on the basis of data processing agreements and exclusively in accordance with our documented instructions.

VI. Is the provision of personal data voluntary?

The provision of your personal data for purposes related to the Agreement is voluntary; however, it is necessary for the conclusion and performance of the Agreement.

VII. Where do we obtain your personal data from?

We obtain your personal data directly from you. In the case of individuals representing an entity that is a party to the Agreement or individuals designated as contact persons for the Controller, the personal data have been provided by the entity that identified you as a member of its personnel, its attorney-in-fact, or its business associate.

Furthermore, where, prior to establishing cooperation with the Company, you provided your personal data through the contact form available on the Eternis website, the personal data provided in that form were made available to the company with which you subsequently concluded the Agreement for the purpose of contacting you and taking steps towards the conclusion of the Agreement. The legal basis for such transfer is an intra-group data sharing agreement governing the exchange of personal data within the Eternis Group.

VIII. What rights do you have in relation to the processing of your personal data?

The Controller enables you to exercise the following rights:

Right of access – You have the right to obtain confirmation as to whether your personal data are being processed and, where that is the case, to access your personal data and obtain a copy thereof. You are also entitled to receive information regarding, in particular, the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom your personal data have been or will be disclosed, the envisaged retention period, and the rights available to you.

Right to rectification – If the personal data we process are inaccurate or incomplete, you have the right to request that they be corrected without undue delay or completed, as appropriate.

Right to erasure – You have the right to request the erasure, in whole or in part, of your personal data where such data are no longer necessary for the purposes for which they were collected, where you object to the processing and there are no overriding legitimate grounds for the processing, or where you consider that your personal data are being processed unlawfully. This right shall not apply where the processing is necessary for the establishment, exercise or defence of legal claims or for compliance with a legal obligation requiring the processing or retention of your personal data.

Right to restriction of processing – You have the right to request the restriction of the processing of your personal data where you consider that the personal data we hold are inaccurate, the processing is unlawful, you require the data for the establishment, exercise or defence of legal claims instead of their erasure, or during the period preceding the resolution of your objection to the processing. In such circumstances, we will restrict the processing of your personal data to storage or to such other processing activities as may be agreed with you. Notwithstanding the exercise of this right, we may continue to process your personal data where necessary for the establishment, exercise or defence of legal claims.

Right to object – On grounds relating to your particular situation, you have the right to object at any time to the processing of your personal data where such processing is based on our legitimate interests. Upon receipt of your objection, we will no longer process your personal data on that basis unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

Right to data portability – You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format. You also have the right to request that we transmit those personal data directly to another controller, where technically feasible.

Right to lodge a complaint with a supervisory authority – If you believe that your personal data are being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority, namely the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), with its registered office in Warsaw.

If you wish to exercise any of the rights described above, please submit your request by e-mail to rodo@eternis.pl or send it by post to the Company's registered office.

Please note that the rights described above are not absolute and may not apply in every instance of the processing of your personal data.