ICAN PRIVACY POLICY
(Information about the processing of personal data and cookies )

ICAN Spółka z ograniczoną odpowiedzialnością spółka komandytowa (Sp.k. Limed Liability Partnership) with its registered office in Warsaw ("ICAN"), at the address al. Niepodległości 18, 02 653 Warsaw, registered in the Register of Entrepreneurs of the National Court Register, kept by the District Court for the Capital City of Warsaw, XII Economic Division - National Court Register, under the KRS number: 0000263445, NIP: 5851072522, REGON number: 190477387, tel: 22 11 33 444, 22 250 11 44, email: infolinia@ican.pl.

Who is the controller of your personal data?

1. directly from you, we obtained it through, for example: ICAN websites, social media, paper forms, as well as in the case where we concluded a contract with you, or took steps to conclude it;
2. from an entity that has contracted ICAN to provide services to you;
3. from an ICAN partner/third party who has provided your personal information based on your consent;
4. from publicly available sources, such as the National Court Register, the Central Register and Information on Business Activity, social media, or other similar sources.

Who is the controller of your personal data?

This Privacy Policy applies to ican.pl, mitsmr.pl and other websites operated by ICAN if they link to this Privacy Policy. This Privacy Policy also applies to ICAN's processing of personal data outside the websites, in particular, to ICAN's activities related to organising conferences and conducting training courses.

What personal data is necessary to use ICAN websites?

In order to use ICAN websites, it is necessary for you to provide the following personal data:

1. if the use takes place through registration or logging in, this data includes: name, surname, email address, data contained in cookies and also data from server logs (i.e. in particular: the time of the visit to the website; the type of event related to the visit to the website, the name of the user together with the IP address).
2. In the case of the use of so-called "open materials" posted on the ICAN website, data contained in cookies and data from server logs (in particular: time of the visit to the website; type of event related to the visit to the website; username and IP address).

What data do we process?

ICAN processes the following categories of data depending on the purposes of the processing:

1. in order to use the ICAN website
   • if you use the ICAN website by registering or logging in: first name, surname, email, cookie data and server log data (in particular: time of website visit; type of event related to the website visit; username, including IP address),
   • in the case of the use of so-called “open materials” posted on the ICAN website, data contained in cookies and data from server logs (in particular: time of the visit to the website; type of event related to the visit to the website, username together with IP address);
2. For the purpose of concluding and performing an agreement - data required for identification for the purpose of its conclusion, performance of a service and issuing an invoice (name, surname, address, PESEL, NIP number, position held in the company, contact person's company address, telephone number, health information concerning the possibility of consuming particular products in the case of participation in a training course or conference);
3. in order to conduct our marketing activities and provide newsletter services - identification data necessary to provide services online (data contained in cookies, email, name, surname, telephone, position);
4. data necessary for the selection of an appropriate marketing offer and ICAN services for you (email address, data contained in cookies).

For what and on what basis will we use your personal data?

We will process your personal data for one or more of the following purposes:

1. for the performance of activities carried out at your request before entering into a contract (Article 6(1)(b) of the General Data Protection Regulation - GDPR);
2. for the conclusion and performance of the contract you have entered into with ICAN (Article 6(1)(b) of the DPA);
3. for the purpose of performing a contract concluded with ICAN on your behalf as a third party (Article 393 of the Civil Code), when another entity is a party to the contract (Article 6(1)(f) of the GDPR, where the administrator's legitimate interest consists in performing the contract concluded with the contractor);
4. for the purpose of conducting competitions organised by ICAN in which you participate (Article 6(1)(b) of the GDPR);
5. for the purpose of fulfilling a legal obligation with ICAN, such as issuing an invoice or bill or fulfilling obligations under the GDPR (Article 6(1)(c) of the GDPR);
6. for the purpose of setting up and administering your "myICAN " account integrated with ICAN's IT systems/web services (Article 6(1)(b) of the DPA);
7. for the purposes of marketing ICAN products and services (Article 6(1)(f) of the DPA);
8. for the purposes of conducting market and opinion research (quantitative research) (Article 6(1)(a) or (f) of the GDPR, where the administrator's legitimate interest lies in the methodologically correct conduct of such research by, among other things, selecting an appropriate group of respondents);
9. in order to adapt the menu provided for conference and training participants to your needs (Article 9(2)(a) GDPR);
10. if you so agree, and only to the extent that you agree, we will process your data:
    1. For the purpose of marketing ICAN's products and services using profiling and other advanced measures (so-called remarketing, behavioural advertising, attribution marketing, social media, presentation of the offer by automated telephone) (Article 6(1)(a) GDPR),
    2. for the marketing of third parties (Article 6(1)(a) GDPR),
    3. for the purpose of sharing your personal data with businesses that ICAN works with so that they can use it for marketing purposes (Article 6(1)(a) of the GDPR),
    4. in order to conduct the following types of market and opinion research: quantitative research (surveys and tests) or qualitative research (personal interviews) (Article 6(1)(a) of the GDPR),
    5. in order to provide you with discounts or rebates on our services, if you consent to the processing of your personal data for the specific purposes indicated in the individual forms (Article 6(1)(a) GDPR).

Are you obliged to provide personal data?

Insofar as the processing of your data takes place for the purpose of performing a contract with ICAN, your provision of data is a condition for the conclusion of this contract. Providing data is voluntary, but it is necessary for the conclusion and performance of the contract. If you do not provide your personal data, the contract will not be concluded. Providing data necessary for issuing an invoice is a statutory obligation and results from the Act on Goods and Services Tax (Article 106e of the Act on Goods and Services Tax). In other respects, providing personal data is voluntary, is not a statutory or contractual requirement and is not a condition for concluding a contract, but it can provide you with additional benefits.

How do I withdraw my consent?

You can give all, some, or none of your consent. You may withdraw any consent you have given to ICAN in connection with the processing of your personal data at any time without adverse consequences. Simply send an email, call or write using the postal service, to the contact points indicated above. The wish to withdraw consent can be expressed in any way, the only condition is that it must reach us. Withdrawal of consent does not affect the lawfulness of the processing of your data before it was carried out, i.e., until you withdraw your consent, the processing of your data by ICAN is lawful. You may also withdraw your consent to the processing of your data using a form on our website, regardless of how you consented to the processing of your personal data.

How do I contact ICAN?

For matters relating to the processing of your personal data and the exercise of your rights under data protection legislation, please contact our Data Protection Officer (DPO) via email at: iod@ican.pl.

When, and with whom, may we share your data?

If you agree, we will share your personal data with businesses that ICAN works with ("ICAN Partners") for which you give your consent. Relevant lists of partners are always presented in the signing up form related to the event organized by ICAN or a purchased service. We may also disclose your data to recipients in the form of companies that cooperate with us and perform tasks on our behalf.

Your data may be transferred by us outside the European Economic Area, to the USA, but only to entities ensuring safe processing, which is safeguarded by Standard Contractual Clauses for data transfers between EU and non-EU countries adopted by the European Commision.

What can you do with the personal information you provide to us?

You have the right to request from ICAN:

1. access to your personal data, in any case of processing by ICAN;
2. rectification of your personal data, in each case of processing by ICAN;
3. erasure of your data, in each case of processing, if your data is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent to the processing and there is no other basis for the processing of your personal data, or you have lodged an effective objection to the processing, or your personal data has been processed unlawfully by ICAN, or your data must be erased because of a legal obligation of ICAN;
4. restrict processing if you contest the accuracy of your personal data until ICAN has verified the accuracy of the data, or ICAN's processing is unlawful but you do not request erasure, or we as ICAN, no longer need your data for processing but you need it for the purposes of establishing, pursuing or defending a claim, or you have lodged an objection to processing and we as ICAN, will only process your data by storing it for the duration of its investigation;
5. data portability to another data controller if the processing is based on consent or for the performance of a contract;
6. with respect to the processing of your data for the purpose of marketing ICAN's own products or services, you may object to such processing that is based on ICAN's legitimate interests,
7. with respect to other purposes of processing where the processing is based on a legitimate interest, you may object to such processing.

How long will we keep your data?

We will retain your personal data for as long as is necessary for the performance of the contract between you and ICAN or the contract entered into by another party on your behalf, and thereafter for a period of time corresponding to the period of limitation for claims (generally three to six years, unless otherwise provided by specific law) that ICAN may raise and that may be raised against ICAN. This period is extended if there are circumstances allowing this by law.

If your personal data is processed in order to fulfil a legal obligation incumbent on the controller, the personal data will be stored for the time necessary to fulfil this obligation (e.g., in the case of processing data contained in invoices - five years, calculated until the end of the calendar year, pursuant to Article 74 (2) item. 2 of the Accounting Act).

We will process your data on the basis of consent until you withdraw that consent.

If your personal data is processed on the basis of a legitimate interest of the controller, where the basis of that processing is the performance of a contract entered into with ICAN on your behalf, your data will be processed for the period of ICAN's legitimate interest (e.g. in the case where you are a participant in our training courses and conferences aimed at improving your professional competences with the consent of your employer who has entered into a contract to attend the training course on your behalf. In this situation, our legitimate interest allows us to process your data for the duration of the training and for as long as claims against us, or claims we have, are not time-barred).

If your personal data is processed on the basis of a legitimate interest of the controller, where the basis of this processing is direct marketing of its products and services, your personal data will be processed until you object.

Your data will be deleted when we can no longer process it in accordance with the provisions of generally applicable law, that is, when we lose the legitimate basis for processing such data.

Where can you lodge a complaint about the processing of your personal data by ICAN?

Complaints can be directed to the President of the Office of Personal Data Protection (ul. Stawki 2, 00 193 Warsaw).

What modern technologies do we use to process your personal data?

On ICAN websites we use cookies and other technologies to record information about pages or subsites visited by users and their activities.

What are cookies?

Cookies are small pieces of text that a website sends to your browser and that your browser sends back the next time you visit the website. They are mainly used to maintain a session, e.g., by generating and returning a temporary ID after login. However, they can be used more broadly by storing any data that can be encoded as a string. This prevents the user from having to enter the same information each time they return to that page or move from one page to another.

Because advertisements must be delivered to the browser directly from advertisement’s network servers, these networks can display, edit, or enter their own cookies as if the user were requesting a web page from their site.

What types of cookies do we use?

ICAN uses the following types of cookies:

1. Neutral - necessary for the proper functioning of the site / needed to enable the functionality of the site.
2. Research - used to track users but does not include personally identifiable information.
3. Tracking - used to track users and provide information that identifies a specific user.

ICAN allows other entities (ICAN Partners) to use cookies (so-called third-party cookies). The information contained in these cookies is transmitted to ICAN Partners (providers of services, in particular search, advertising, web research, etc.).

Does ICAN use profiling and for what purpose?

ICAN may make decisions that are based solely on automated processing, including profiling, and that result in legal effects on you or that significantly affect you. For example, the granting of a discount is based on your engagement (whether you visit the website regularly, whether you recommend our content, how long you stay on ICAN's websites, whether you are a customer, whether you have purchased before, the source of your traffic, your history of activities on the website). The consequence of these actions is granting a discount, wider access to the content (e.g., to the content closed for the user without subscription), granting a longer subscription period. After determining whether the criteria are met, the IT system automatically sends information about the granted benefit, e.g., a discount.

ICAN collects information about how you use our websites, which allows us to tailor advertisements and offers to your preferences and habits. Based on this information, it is possible to create, for example, general user profiles (e.g., age, gender, interests, purchase history, browsing history).

Based on this information, ICAN makes decisions about how to tailor and send you an offer or display an advertisement.