INFORMATION CLAUSE FOR CLIENTS/CONTRACTORS

Version release date: 15.05.2026

Dear Sir or Madam,

On 25 May 2018, the Act of 10 May 2018 on Personal Data Protection entered into force (Journal of Laws of 2018, item 1000). The Act regulates the principles of protection of your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

Who is the controller of your personal data?

The controller of your personal data is Eduworld Sp. z o.o., with its registered office at: Aleja Grunwaldzka 472, 80-309 Gdańsk, Tax Identification Number (NIP): 5842832809 (hereinafter referred to as the Company or the Controller).

How can you contact us to obtain information about your personal data and/or the personal data of your dependent?

The Controller may be contacted in writing by traditional mail at the address indicated above or by e-mail at: kontakt@eduworld.pl

How do we ensure the security of your personal data and/or the personal data of your dependent?

We implement all physical, technical and organisational measures necessary to protect personal data against accidental or intentional destruction, accidental loss, alteration, unauthorised disclosure, use or access, in accordance with all applicable legal provisions.

What rights do you have in relation to the data concerning you that we process?

You have the right to request from the Controller:

• access to your personal data and to obtain a copy thereof;
• rectification (correction) of your personal data;
• erasure of your personal data where processing is not carried out for the purpose of complying with a legal obligation;
• restriction of the processing of your personal data;
• objecting to the processing of your personal data;
• data portability;
• lodging a complaint with the President of the Personal Data Protection Office (contact details available at www.uodo.gov.pl) if you believe that the processing of your personal data violates the provisions of the GDPR.

What is the purpose and legal basis for processing your personal data?

We process personal data for the following purposes:

• the conclusion and performance of a contract (including contact purposes, settlements and payments necessary for its performance) or taking steps at your request prior to entering into a contract (Article 6(1)(b) or Article 6(1)(f) GDPR if the person contacting us is an employee of a contractual partner). Providing data is a contractual requirement and/or a condition for entering into a contract; providing data is voluntary but necessary for the conclusion and performance of the contract;
• archiving data after contract performance (pursuant to Article 6(1)(c) GDPR in connection with legal obligations and pursuant to Article 6(1)(f) GDPR for data stored in archives and backup copies – the legitimate interest is the establishment, exercise or defence of legal claims and ensuring data integrity);
• fulfilment of legal obligations arising, among others, from tax, civil or transport law, for example in the field of accounting and taxation, transport, foreign trade and customs matters (Article 6(1)(c) GDPR);
• where processing is based on consent – for the purposes specified each time in the content of that consent (Article 6(1)(a) GDPR);
• responding to messages, offers or telephone enquiries sent by you, carrying out actions requested by you or providing information where you have given your consent, where this is necessary prior to entering into a contract or where we are required to do so by law (Article 6(1)(a), (b) or (c) GDPR).

Your personal data is or may also be processed on the basis of Article 6(1)(f) GDPR where such processing is necessary for the following purposes arising from the legitimate interests pursued by the Controller:

• after-sales service, in particular handling and processing complaints or other claims, as well as conducting debt recovery procedures (the legitimate interest is the establishment, exercise and defence of legal claims);
• offering products and services, including direct marketing (the legitimate interest is expanding the customer base and improving customer relations);
• evaluating and/or measuring customer satisfaction (the legitimate interest is the development of products and services);
• internal administration and work organisation, including internal supervision and reporting (the legitimate interest is ensuring the optimal functioning of the enterprise);
• ensuring the security of IT networks and processes (the legitimate interest is the protection of persons and property).

Who may be the recipient of your personal data?

We disclose or may disclose your personal data primarily to: providers of accounting and office software, other companies providing maintenance or IT services, and Meta Platforms Ireland Limited.

The data are processed on the basis of an agreement concluded with us and solely on our instructions. We do not disclose your data to any third parties for their own purposes – they may only process the data for the performance of the tasks specified above. All partners processing your personal data ensure an appropriate level of security and fulfil all obligations relating to personal data protection.

What are the rules regarding the transfer of your personal data outside the EEA?

Your personal data are transferred to recipients located in third countries, i.e. outside the European Economic Area (EEA), or to international organisations. We may transfer personal data to a third country (outside the EEA) only where such country guarantees a level of data protection at least equivalent to that applicable within the European Union.

How long do we retain your personal data?

We retain your personal data only for the period necessary to achieve the purposes for which the data were collected or for the period required by law. The data will be processed for a period of 5 years. In the case of data processed on the basis of consent – until such consent is withdrawn. In the case of processing for the purpose of responding to an enquiry – for 1 year from the end of the correspondence. In other cases, the retention period will correspond to the limitation period for claims or other periods provided for by applicable law.

How may we make decisions based on your personal data?

Based on your personal data, we may make automated decisions, including profiling, as referred to in Article 22(1) and (4) GDPR. You have the right to challenge such a decision by communicating your position to us through the communication channels indicated above.