In connection with the applicability of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the so‑called GDPR), and the provisions of the Act of 10 May 2018 on the protection of personal data, this Privacy Policy sets out the rules for the processing of personal data and the use of cookies obtained via the website operated by Agencja Rozwoju Przemysłu S.A. with its registered office in Warsaw. We make every effort to protect the privacy of persons visiting our website and to ensure transparency regarding the manner, purpose and legal basis for the processing of personal data. Below we present the most important information concerning the rules for data processing and the use of cookies.

I. Data controller and contact

The data controller is:

Industrial Development Agency Joint-Stock Company

Nowy Świat Street 6/12, 00-400 Warsaw

Tax Identification Number (NIP): 526-030-02-07

REGON: 000001699

National Court Register (KRS): 0000037957

Contact details of the Data Protection Officer at the Industrial Development Agency S.A.

DPO's name: Krzysztof Radtke

Email address: iod@arp.pl

II. Scope and purposes of personal data processing

We process the following data:

• data provided via the contact form (email address, phone number, first and last name),
• basic technical and statistical data (e.g., IP address, browser and operating system information).

Personal data are processed only to the extent necessary to achieve purposes such as:

1. Communicating via the contact forms available on this website.
2. ensuring the security and proper functioning of the website,
3. sending the newsletter and marketing information, including promotion of our activities, based on your consent
4. conducting statistical analyses based on the Administrator's legitimate interest.

III. Legal bases for processing

Processing is carried out on the basis of:

1. consent of the data subject (Art. 6(1)(a) GDPR) with regard to marketing communications and newsletter subscription,
2. the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), e.g. contact by responding to submitted inquiries and handling contact forms, as well as to ensure site security and conduct analyses
3. legal provisions – in situations where the law requires us to process personal data for archival, tax, reporting, or accounting purposes (Article 6(1)(c) GDPR).

IV. Cookies

The site uses only essential cookies that ensure the proper functioning of the service and do not require the user's consent. We do not currently use analytics or tracking tools (e.g. Google Analytics). We reserve the right to implement such tools in the future — after first providing appropriate user consent mechanisms in accordance with applicable law (GDPR, the ePrivacy Directive). Any changes will be communicated in the updated privacy policy and in the cookie management panel available on the site. The user has the right to change cookie settings at any time via their browser settings or the cookie management panel available on the site. More information about the cookies used on the site can be found in the cookie management window.

V. Data recipients

Data may be transferred to partners and entities cooperating in the delivery of courses, as well as to IT and technical support service providers, on the basis of data processing agreements. Recipients of personal data that ARP S.A. processes as the data controller may include:

• entities providing hosting services;
• subcontractors of ARP S.A. providing software delivery services, software or hardware maintenance services for equipment we use, as well as service providers whose services we use;
• entities providing survey research services;
• debt collection companies;
• auditors and statutory auditors, legal advisers, tax advisers;
• authorities supervising compliance with the law, regulatory authorities, and other public administration bodies.

Data will not be transferred outside the European Economic Area without appropriate safeguards.

VI. Data retention period

The period for which we may process your personal data depends on the legal basis constituting the lawful ground for ARP S.A.'s processing of personal data. Accordingly, we inform you that if ARP S.A. processes personal data on the basis of:

1. consent, the processing period lasts until the withdrawal of that consent by the data subject or the completion of the processing purpose;
2. where processing is based on the legitimate interest of the data controller, the processing period lasts until that interest ceases (e.g. the limitation period for civil claims) or until the data subject objects to further such processing — in situations where such an objection is permitted by law;
3. Under the applicable legal provisions, the periods for processing data for that purpose are specified by those provisions.

VII. Rights of data subjects

Individuals whose data are processed have the right to:

1. access to their data,
2. correction of data,
3. deletion of data ("the right to be forgotten"),
4. restrictions on processing,
5. data transfer,
6. objection to the processing of data,
7. withdrawal of consent at any time,
8. filing a complaint with the supervisory authority – the President of the Personal Data Protection Office.

VIII. Changes to the Privacy Policy

The Administrator reserves the right to make changes to this Privacy Policy, in particular in the event of changes to legal provisions, supervisory authority guidelines, or the manner of processing personal data. The updated version of the Policy will be published on the website each time and will take effect from the moment it is made available.