INFORMATION ABOUT VIDEO SURVEILLANCE AT ISTRAIL SP. Z O.O.

1. Pursuant to Article 222 of the Labour Code Act of 26 June 1974 (Journal of Laws 2019, item 1040, as amended), ISTRAIL Sp. z o.o. applies specific surveillance over the premises of the workplace, including the area surrounding the workplace, using technical means that allow for the recording of images (video surveillance).
2. The legal basis for introducing video surveillance and processing the recorded data is the legitimate interest of the data controller (Article 6(1)(f) of the GDPR), in order to ensure the safety of employees and protection of property.
3. The image of individuals (employees, customers, goods recipients, or third parties) recorded through video surveillance does not constitute biometric data within the meaning of Article 9 of the General Data Protection Regulation (GDPR), as the data controller does not possess tools or technical methods to identify these individuals using their features through automatic image analysis.
4. Contact with the data controller regarding data processing can be made at: rodo@istrail.pl.

PROCESSING OF PERSONAL DATA AT ISTRAIL SP. Z O.O.

We process your personal data and strive to protect your rights and privacy. Therefore, in fulfillment of the informational obligation under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR), ISTRAIL Sp. z o.o., with its registered office at PTTK 56, 87-100 Golub-Dobrzyń, as the data controller, provides the following information concerning the processing of data:

Why do we need your data?
We process your personal data for the purpose of fulfilling at least one of the following objectives:

1. Performance of contracts or actions aimed at entering into contracts (Article 6(1)(b) GDPR), for example, submitting and fulfilling orders and their settlement, responding to inquiries regarding offers, determining the terms of cooperation, customer service, or handling complaints.
2. Compliance with a legal obligation to which the data controller is subject (Article 6(1)(c) GDPR), e.g., for tax office settlements, complying with decisions or rulings issued by authorized bodies, institutions, or courts.
3. Legitimate interests pursued by ISTRAIL as the data controller (Article 6(1)(f) GDPR), e.g., for contact purposes, handling potential claims, conducting statistical analysis.
4. Consent given by you for data processing (Article 6(1)(a) GDPR or, for sensitive data, Article 9(2)(a) GDPR), depending on the consent provided, e.g., for saving data in cookies.

In some of these processes, we act as a data processor, as services or goods were commissioned to us by ISTRAIL branches in Norway and Sweden. If you are a current or former client of ISTRAIL AS, located at Nordre Kullerød 17, 3241 Sandefjord, Norway, or ISTRAIL AB, located at Aleby 14, 686 91 Sunne, Sweden, we obtained your data for the purpose of fulfilling an order placed with us.

Who will receive or may receive your data?

1. Your personal data will or may be shared only with entities authorized under applicable law or within the scope of data processing agreements to which ISTRAIL is a party.
2. ISTRAIL Sp. z o.o., as the data controller or processor, does not intend to transfer your personal data to a third country or international organization.

How do we process your data?
We process your data both in paper form (e.g., documents you submitted, contracts we concluded, and documents forming the basis for contract settlements) and electronically, using information systems supporting the realization of our goals (including email, electronic contact forms). However, your personal data will not be subject to automated decision-making, including profiling.

How long will we process your data?
Your data will be processed for no longer than is necessary to achieve the purpose for which it was collected. Afterward, depending on the legal basis and purpose of collection:

1. If personal data was obtained based on your consent, we will process it until you withdraw that consent.
2. If you were our customer or contractor (party to a contract), we will process your data for as long as necessary for:
   • The settlement of services/contracts and in accordance with tax law requirements for storing accounting evidence.
   • The pursuit of potential claims by ISTRAIL Sp. z o.o., according to the deadlines set out in the Civil Code.

What rights do you have as a data subject?
Under the GDPR, you have the right to:

1. Access your data and obtain a copy of it.
2. Rectify (correct) your data if it is outdated or incomplete.
3. Request the erasure of personal data, when the processing does not serve the purpose of complying with a legal obligation or pursuing potential claims.
4. Restrict the processing of your data in certain situations.
5. Object to the processing of your data in certain situations, e.g., if processing is based on the legitimate interest of the company for direct marketing purposes.
6. Request the transfer of your data in certain situations (if technically feasible) to another data controller without hindrance, if the processing is based on your consent.
7. File a complaint with the President of the Personal Data Protection Office (UODO) regarding the processing of your data by the company (at the address of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland).

You also have the right to withdraw consent for the processing of personal data at any time, if such consent was necessary for processing.

When must you provide us with your data?
In most cases, providing your personal data is voluntary but necessary for the conclusion and performance of contracts.

How and where to obtain more detailed information about your rights and the data we process?
If you would like to obtain detailed information regarding your personal data processed by ISTRAIL Sp. z o.o., you can contact us at: rodo@istrail.pl