2.1. Personal data (referred to in this document as "personal data") belonging to the individual (hereinafter "data subject") who contacts the Operator, either on their own behalf or on behalf of a professional entity (referred to in this policy as "the Professional"), and provided by the data subject (e.g., first and last name, email), will be processed for any purpose related to communication regarding the matters indicated or requested by the data subject. This includes, but is not limited to, actions necessary to establish a legal relationship between the Operator and the data subject or Professional, as well as for any compatible, related, or associated purposes.

2.2. Personal data may also be processed when necessary for the legitimate interests of the Operator or a third party, provided these interests are not overridden by the data subject's rights and fundamental freedoms, which require the protection of personal data.

2.3. The Operator will only process personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is being processed.

2.4. Personal data will be collected, recorded, organized, structured, stored, consulted, and used in accordance with these purposes.

The legal bases for processing may include, as applicable, Article 6(1)(a), (b), (c), and (f) of Regulation (EU) 2016/679 ("the Regulation"), specifically:

(a) The data subject has given consent for the processing of personal data for one or more specific purposes;

(b) The processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract;

(c) The processing is necessary to comply with a legal obligation to which the operator is subject;

(f) The processing is necessary for the legitimate interests pursued by the operator or a third party, unless those interests are outweighed by the data subject's fundamental rights and freedoms, which require the protection of personal data.

The recipients to whom the personal data of the Data Subject may be disclosed or transmitted are those necessary for fulfilling the purposes outlined above. These recipients may include, as applicable, the Operator’s employees, representatives, subcontractors, and other collaborators.

No personal data is transferred to a third country.

However, a potential transfer or series of transfers of personal data to a third country or an international organization may occur under one of the following conditions:

(a) The data subject has explicitly consented to the proposed transfer after being informed of the potential risks due to the absence of an adequacy decision or sufficient safeguards;

(b) The transfer is necessary for the performance of a contract (e.g., a license agreement for the use of the application by the client) between the data subject and the operator, or for pre-contractual measures requested by the data subject;

(c) The transfer is required for the conclusion or performance of a contract in the interest of the data subject between the operator and another individual or legal entity;

(d) There is an adequacy decision regarding the level of protection as per the Regulation, or appropriate safeguards are in place in accordance with the Regulation;

(e) Any other situation permitted by the applicable legal regulations in force.

The personal data will be retained by the Operator from the date of your initial contact and for up to one year following the last communication between you and the Operator, or for no less than the period required by applicable legal regulations.

If the data was collected for additional purposes or based on other grounds, it will be stored for the duration specified for those purposes or grounds, if this period exceeds the aforementioned timeframe.

The provision of personal data did not and does not constitute a contractual or legal obligation, unless the data was collected based on other specific grounds.

The data subject was and is not required to provide personal data, except when such data was collected on other grounds, and the data subject was or is obligated to provide it under those grounds.

Refusal to provide personal (contact) data, or failure to fulfill the obligation to provide or update such data, may result in the inability to communicate with you using the provided contact information or to take necessary steps to establish a legal relationship. However, refusal to provide or update other personal (contact) data will not have any consequences.

If your personal (contact) data has changed since it was last provided, or if you wish to update it, please send a request for an update through any communication channel, including the email provided in point 1 of this notice.

The data subject has the right to request and obtain the rectification of inaccurate personal data from the operator without undue delay. Considering the purposes for which the data is processed, the data subject also has the right to have incomplete personal data completed, including by providing an additional statement if necessary.

10.1. The data subject has the right to request and obtain the deletion of personal data from the operator without undue delay. The operator is obligated to delete the personal data without undue delay if one of the following reasons applies:

(a) The personal data are no longer necessary for the purposes for which they were collected or processed;

(b) The data subject withdraws their consent for processing, if the processing was based on consent for specific purposes, and there is no other legal basis for the processing;

(c) The data subject objects to the processing for reasons related to their particular situation, and there are no overriding legitimate grounds for processing, or the data subject objects to the processing of personal data for direct marketing purposes, and there is no other legal basis for the processing;

(d) The personal data were processed unlawfully;

(e) The personal data must be deleted to comply with a legal obligation imposed on the operator by Union or national law;

(f) The personal data were collected in relation to the provision of information society services to a child, as outlined in the Regulation.

10.2. If the operator has made the personal data public and is required under point 10.1 to delete it, the operator must take reasonable steps, considering available technology and the cost of implementation, to inform other operators processing the data that the data subject has requested the deletion of any links to, copies, or reproductions of the personal data.

10.3. The provisions in paragraphs 10.1 and 10.2 do not apply if the processing is necessary for:

(a) Exercising the right to freedom of expression and information;

(b) Compliance with a legal obligation under Union or national law applicable to the operator, or for performing a task carried out in the public interest or in the exercise of official authority vested in the operator;

(c) Reasons of public interest in the area of public health, as per the Regulation;

(d) Archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes, in line with the Regulation, to the extent that the right to deletion would make it impossible or seriously impair the achievement of such processing objectives;

or

(e) The establishment, exercise, or defense of legal claims.

ata subject also has the right to have incomplete personal data completed, including by providing an additional statement if necessary.

11.1. The data subject has the right to request the restriction of processing from the operator if any of the following circumstances apply:

(a) The data subject contests the accuracy of the data, for a period that allows the operator to verify its accuracy;

(b) The processing is unlawful, and the data subject opposes the deletion of the personal data, instead requesting a restriction on its use;

(c) The operator no longer requires the personal data for processing purposes, but the data subject needs it to establish, exercise, or defend a legal claim;

(d) The data subject has objected to the processing for reasons related to their specific situation, in accordance with the Regulation, during the time it takes to determine whether the operator's legitimate interests override those of the data subject.

11.2. If processing has been restricted in accordance with paragraph 11.1, the personal data may only be processed, apart from storage, with the consent of the data subject, or for the establishment, exercise, or defense of a legal claim, for the protection of the rights of another individual or legal entity, or for reasons of significant public interest in the Union or a member state.

11.3. A data subject who has obtained a restriction on processing in accordance with paragraph 11.1 will be informed by the operator before the restriction is lifted.

The operator will inform each recipient to whom personal data has been disclosed about any rectification, deletion, or restriction of processing performed in accordance with points 9, 10.1, and 11, unless doing so is impossible or requires disproportionate effort. If requested by the data subject, the operator shall provide information about the respective recipients.

13.1. The data subject has the right to receive the personal data they provided to the operator in a structured, commonly used, and machine-readable format. They also have the right to transmit this data to another operator without obstruction from the operator to whom the personal data was provided, provided that:

(a) The processing is based on consent or a contract; and

(b) The processing is conducted by automated means.

13.2. In exercising the right to data portability outlined in point 13.1, the data subject has the right to request that their personal data be transmitted directly from one operator to another where technically feasible.

13.3. Exercising the right mentioned in point 13.1 does not affect the provisions of Article 17. This right does not apply to processing necessary for fulfilling a task carried out in the public interest or in the exercise of official authority vested in the operator.

13.4. The right outlined in point 13.1 does not interfere with the rights and freedoms of others.

14.1. The data subject has the right to object at any time to the processing of their personal data for the legitimate interests pursued by the operator or a third party, for reasons related to their particular situation. This includes objections to profiling based on such processing. The operator must cease processing the personal data unless they can demonstrate legitimate and compelling reasons for the processing that outweigh the interests, rights, and freedoms of the data subject, or if the processing is necessary for the establishment, exercise, or defense of a legal claim.

14.2. If the processing of personal data is intended for direct marketing purposes, the data subject has the right to object at any time to such processing, including profiling, insofar as it relates to marketing.

14.3. If the data subject objects to the processing for direct marketing, their personal data will no longer be processed for this purpose. Should the data subject choose to allow the processing of their personal data for direct marketing separately, and without any connection to other actions—such as by actively consenting through a specific button—the last personal data they provided will be processed for direct marketing.

14.4. The rights outlined in points 14.1 and 14.2 will be explicitly communicated to the data subject at the latest during the first interaction, and presented clearly and separately from any other information.

14.5. In the context of using information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object through automated means that utilize technical specifications.

14.6. If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with the Regulation, the data subject has the right to object to such processing for reasons related to their particular situation, unless the processing is necessary for performing a task in the public interest.

15.1. The data subject has the right not to be subjected to a decision that is based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar manner.

15.2. The right outlined in 15.1 does not apply if the decision:

(a) is necessary for entering into or executing a contract between the data subject and the data controller;

(b) is authorized by applicable Union or domestic law that governs the operator and includes appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject; or

(c) is based on the explicit consent of the data subject.

15.3. In the cases mentioned in point 15.2 (a) and (c), the data controller shall implement appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject. This includes ensuring the data subject has the right to obtain human intervention from the controller, to express their viewpoint, and to contest the decision.

16.1. Without affecting any other administrative or judicial remedies available, any data subject has the right to file a complaint with a supervisory authority, particularly in the Member State where they have their habitual residence, place of work, or where the alleged violation took place, if they believe that the processing of their personal data is in violation of the Regulation.

16.2. The supervisory authority that receives the complaint will keep the complainant informed about the progress and outcome of the complaint, including the possibility of pursuing a judicial remedy under Article 17.

17.1. Without affecting any other administrative or non-judicial remedies, every natural or legal person has the right to an effective judicial remedy against any legally binding decision made by a supervisory authority that pertains to them.

17.2. Without impacting any other administrative or non-judicial remedies, each data subject has the right to an effective judicial remedy if the supervisory authority competent under the Regulation fails to address a complaint or does not inform the data subject of the progress or resolution of the complaint within three months, as specified in Article 16.

17.3. Legal actions against a supervisory authority must be initiated in the courts of the Member State where the supervisory authority is located.

17.4. If actions are taken against a decision made by a supervisory authority that followed an opinion or decision from the committee under the consistency mechanism, the supervisory authority must submit that opinion or decision to the court.

19.1. The data subject has the right to authorize a non-profit body, organization, or association that is properly established under domestic law and whose statutory objectives serve the public interest—particularly in the area of protecting the rights and freedoms of data subjects concerning their personal data—to file a complaint on their behalf. This includes exercising the rights outlined in Articles 16, 17, and 18, as well as pursuing the right to seek compensation on behalf of the data subject, if such provisions exist in domestic law.

19.2. Member States may allow any body, organization, or association mentioned in point 19.1 of this article, regardless of a data subject’s mandate, to independently file a complaint with the supervisory authority competent under Article 16 in that Member State and to exercise the rights outlined in Articles 17 and 18 if they believe that a data subject’s rights under the Regulation have been violated due to the processing of personal data.

20.1. Any individual who experiences material or moral harm due to a violation of the Regulation has the right to seek compensation from the operator or the individual authorized by the operator for the damages incurred.

20.2. Any operator participating in the processing operations is liable for damages resulting from processing activities that violate the Regulation. An individual authorized by the operator is only liable for damages if they fail to comply with the obligations specified in the Regulation that apply to them or if they act outside of or contrary to the legal instructions provided by the operator.

20.3. The operator or the authorized individual is exempt from liability as described in point 20.2 if they can demonstrate that they are not responsible for the event that caused the damage.

20.4. If multiple operators or authorized individuals are involved in the same processing operation and share responsibility for any damages caused under points 20.2 and 20.3, each operator or authorized individual is liable for the full amount of damages to ensure the effective compensation of the affected party.

20.5. If an operator or authorized individual has fully compensated for the damages as per point 20.4, they have the right to seek recovery from the other operators or authorized individuals involved in the same processing operation for their proportional share of liability, as outlined in point 18.2.

20.6. Actions taken to exercise the right to recover paid compensations shall be submitted to the competent courts as specified under the law of the Member State referred to in point 18.2.

When the processing is based on: i) the consent of the data subject for the processing of their personal data for one or more specific purposes; or ii) the consent of the data subject for processing certain special categories of personal data for one or more specific purposes—unless Union law or domestic law stipulates that the prohibition on processing special categories of personal data cannot be lifted by consent—the data subject has the right to withdraw their consent at any time. This withdrawal will not affect the legality of any processing conducted based on that consent prior to its withdrawal.

To clarify, withdrawing consent does not impact the processing of personal data carried out on other legal grounds.

22.1. The data subject possesses all rights outlined in this information notice, as well as any additional rights granted by applicable legal regulations concerning the processing of personal data.

22.2. The rights referenced in this notice may be exercised in accordance with this agreement, the Regulation, and any other relevant legal provisions.

22.3. Any requests submitted by the data subject to the operator for the exercise of these rights can be made in writing via registered letter sent to the operator's headquarters, by email to the address specified in point 1 of this information notice, or through any other method permitted by applicable legal regulations.

22.4. The data subject may request, as previously mentioned, and obtain at no cost, access to their personal data, along with the right to request rectification or deletion, restriction of processing, data portability, and the right to object. This includes the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal effects concerning the data subject or significantly affect them, as well as rights related to breaches of personal data security.

22.5. Terms used in this information notice will have the meanings defined in the Regulation unless the context explicitly indicates otherwise.