INFORMATION CLAUSE

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119) – hereinafter referred to as GDPR – we would like to inform you that:

Your data co-administrators

The administrators of your personal data are as follows:

1. Weco-Travel Services Sp. z o.o. located in Warsaw at al. Jana Pawła II 19, 00-854 Warsaw.
2. Weco-Travel Sp. z o.o. located in Warsaw at al. Jana Pawła II 19, 00-854 Warsaw. jointly acting as co-administrators. As part of our co- administration agreement, we have agreed on the scope of our responsibilities regarding the fulfilment of obligations arising from the GDPR, in particular, we have agreed that Weco-Travel Services Sp. z o.o. as a co-administrator, is responsible for fulfilling the legal obligation to provide you with information.

How to contact us about data protection

The co-administrators have appointed a Data Protection Officer, who can be contacted by the contact form.

Purpose of data processing

The purpose and the method of processing any personal data by the co-administrators arise from the concluded Co-Administration Agreement. In particular, the Parties have agreed that the common purpose of the processing is:

1. Article 6(1)(f) of the GDPR – the legitimate interest of the co-administrator to enable electronic and telephone contact with the data administrator:

• answering any questions about a reservation or other service provided by the Company;
• responding to any complaints or other request;
• providing you with any information you may request;
• providing you with travel documents issued in your name;
• to present an offer or other commercial information in the event of ordering such information and/or for direct marketing purposes (newsletter);
• for any other purposes related to managing your correspondence.

2. Article 6(1)(b) of the GDPR – the necessity for the performance of the contract concluded with contractors in the scope of correspondence conducted for the purpose of performing the contract;
3. Article 6(1)(f) – the co-administrator's legitimate interest in pursuing claims or defending against claims, in accordance with the general applicable provisions of law, in particular the Act of 23 April 1964 on the Civil Code;
4. Article 6(1)(a) of the GDPR – voluntary consent – if the sent correspondence contains data of special categories. If the sender has not included consent in their correspondence, we will ask you to give it separately, as this is a necessary condition for us to process special category data in accordance with the GDPR. The consent given may be withdrawn at any time, without giving a reason, but without affecting the lawfulness of its processing before the withdrawal.

Data processing time

Your personal data contained in electronic correspondence will be processed for one year, unless the messages contain content relevant to pursuing claims or defending against claims. In such cases, the messages will be stored until the expiry of the limitation period for claims in accordance with the Civil Code.

Data recipients

The recipients of your personal data may be entities authorized by law to receive them. In addition, your data may also be made available or entrusted to other entities on the basis of concluded agreements in connection with the need to provide services, e.g. ICT, postal, courier, legal, advisory or resulting from the need for professional destruction of documentation. Your personal data may also be shared with other entities if their cooperation with the Company is justified by the purposes of the processing (e.g. airlines, hotels, embassies in the case of visa services, insurers, car rental companies, railways)

Data transfer outside the EEA

For the most part, personal data will not be transferred outside the European Economic Area (hereinafter: EEA). However, with regard to the services provided by the co-administrators, and in particular the comprehensive organisation of business trips, the co-administrators may provide contractors and partners operating outside the EEA with such data as: name and surname, professional status, business telephone number and business e-mail address. Individual countries outside the EEA in whose territory personal data will be processed ensure an adequate level of data protection (in accordance with EEA standards) in accordance with the decision of the European Commission.

Rights of the person whose data is processed

In connection with the processing of your personal data, you have the right to:

• Requests the access to your personal data
• Requests to rectify your personal data, delete or restrict processing
• Object to the processing of your personal data
• Requests to transfer your personal data
• Filing a complaint to the President of the Personal Data Protection Office, if you believe that the co-administrator has committed irregularities in the processing of your personal data.

Profiling and automated decision-making

In connection with the processing of data by co-administrators, your personal data will not be subject to profiling or automated decision-making.