Information about the processing of personal data by the Comarch Group Companies

The table below indicates the Controller of your personal data, depending on the purposes of processing, The purposes of processing are presented in detail in the section: LEGAL BASIS, PURPOSE AND PERIOD OF DATA PROCESSING

For an up-to-date list of the Comarch Group companies and theirs contact details, go to https://www.comarch.com/company/capital-group/
and https://www.comarch.com/contact/worldwide-offices/.

Pursuant to Article 27 of GDPR, the Comarch Group companies established outside the EU have designated Comarch S.A., with its registered office at Al. Jana Pawła II 39, 31-864 Kraków, as their representative.

The Comarch Group companies may receive contact details directly from the data subject (for instance, via electronic forms or during conferences) or through other persons (e.g. from the employer, another employee or other entity with whom that person cooperates on a permanent basis).

In the case of direct contact, you will have full control over the scope of data made available to the Comarch Group companies.

In the case of data provided by another person, the Comarch Group companies usually collect only the main contact details connected with the data subject’s professional activity, including: the name, surname, email address, telephone number, job title or position, company and potentially other data in accordance with the contract or order under which the contact person’s personal data is being provided.

Under the provisions of GDPR, you have the following rights as the data subject:
1/ right of access to data;
2/ right to rectification of data;
3/ right to erasure of data (‘right to be forgotten’);
4/ right to restriction of data processing;
5/ right to data portability;
6/ right to object (where the controller’s legitimate interest is the basis for data processing);
7/ right to withdraw consent (where consent is the basis for data processing).

The exercise of these rights is subject to the conditions set out in GDPR. If your request is rejected, you will receive a reply with relevant reason for such decision.

In order to exercise your rights, please contact us as directed in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section.

Please note that:

• the right to erasure of data and the right to restriction of data processing will only apply in cases specifically mentioned in GDPR;
• the right to data portability will only apply if the legal basis for processing is your consent or the performance of a contract;
• the controller may refuse to erase your data despite receiving such a request if one of the exceptions listed in GDPR applies, for instance if the processing is required for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
• in some cases, the controller may refuse to grant your objection to the processing of data based on the controller’s legitimate interest, where there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where there are grounds for the establishment, exercise or defence of legal claims; however, this right is not available to the controller when data is processed for direct marketing purposes (e.g. commercial communications).

As of May 25th 2018, you will have the right to lodge a complaint with the competent supervisory authority. A list of supervisory authorities in EU Member States is available at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Your data may be made available to suppliers, service providers and partners with whom Comarch Group companies cooperate, to the extent required to provide services to clients, maintain business contacts, pursue marketing activities, and manage the operations of Comarch Group companies.

If you sign up for a conference, training or other event, your data may be shared with other participants, speakers, co-organisers, hotels and other entities involved in the organisation of that event.

If personal data is transferred to a third country in respect of which no adequacy decision regarding the level of data protection has been issued by the European Commission, the Comarch Group companies will provide appropriate safeguards via standard data protection clauses adopted by the European Commission or the supervisory authority (in accordance with Article 46.2 c) and d) of GDPR).

Should you have any questions on the processing of your data and how to obtain a copy of standard data protection clauses, please contact us as directed in the CONTACT DETAILS FOR MATTERS RELATED TO PERSONAL DATA section.