Privacy Notice

This Privacy Notice provides information regarding the processing by ARPI & PARTNERS Sp. z o.o. (KRS 0000255170) and ARPI TAX CONSULTING Sp. z o.o. (KRS 0000424776) (jointly and individually hereinafter referred to as “ARPI”, “we” or “us”) of personal data relating to individuals associated with our former, current or prospective clients, suppliers and other business partners, investors, whistleblowers or other interested parties.

I. Introduction

This Privacy Notice sets out what personal data ARPI may process, the legal basis and purposes for such processing, and the persons or entities to whom such data may be disclosed.

This Privacy Notice may be amended from time to time. The current version of this document is available at all times on the ARPI website and may be downloaded from there.

This Privacy Notice does not apply to links available on the ARPI website which lead to other websites. Such websites are not covered by this Privacy Notice. If you have any questions regarding the way in which information is used by a particular website, please refer to the privacy notice applicable to that website.

II. Who is responsible for your personal data

ARPI is the controller and/or processor of the personal data covered by this Privacy Notice.

When processing personal data, ARPI undertakes to ensure compliance with all applicable laws and regulations concerning the protection of personal data.

III. On what legal bases and for what purposes may ARPI process your personal data

III.1. Legal bases

ARPI undertakes to ensure that personal data are processed only for lawful purposes, in particular:

• for the purpose of entering into or performing a contract;
• for the purpose of complying with a legal obligation;
• for the purpose of pursuing the legitimate interests of ARPI or a third party;
• for the purpose of protecting the vital interests of a natural person; or
• on the basis of the consent of the data subject.

If you have consented to the processing of your personal data, you have the right to withdraw such consent at any time.

Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal.

III.2. Purposes of processing

ARPI may process personal data covered by this Privacy Notice in connection with its legitimate business purposes, including, in particular, for the purpose of:

• negotiating, entering into and performing agreements with clients, suppliers and other business partners;
• communicating with and managing relationships with current and prospective clients, suppliers, investors and other third parties;
• organising and managing the business operations of the enterprise, including financial and asset management, implementation of control mechanisms, management reporting, analyses, internal audits and investigations;
• ensuring compliance with applicable laws and regulations, including in connection with reports made under whistleblower protection legislation or matters falling within the scope of anti-money laundering and counter-terrorist financing regulations (AML/CFT);
• establishing, pursuing or defending claims and conducting judicial and out-of-court proceedings;
• conducting compliance checks and integrity and reliability checks.

III.3. Personal data scope

In pursuing its legitimate business purposes, ARPI may process personal data relating to individuals associated with our former, current or prospective clients, suppliers and other business partners, investors, whistleblowers or other interested parties.

Depending on the lawful purpose of processing, personal data may include private information and business contact details, such as:

• first and last name;
• email address;
• telephone number;
• IP address;
• company name;
• position/function;
• date of birth;
• photographs;
• contact preferences;
• other personal data, in particular information contained in correspondence with us.

In addition, we may process other personal data obtained as part of the verification of prospective and existing business partners for the purpose of ensuring compliance with legal and regulatory requirements, in particular relating to:

• anti-bribery and anti-corruption legislation;
• anti-money laundering legislation;
• trade control regulations;
• economic sanctions regulations;
• whistleblower protection legislation.

IV. Cookies

ARPI may collect personal data through cookies and similar technologies.

Cookies are small information files that store and retrieve information relating to your visit to the ARPI website, including, for example, how you accessed the website, how you navigate it and information in which you have expressed an interest.

You may manage and configure your cookie preferences through the settings of your web browser.

V. Who has access to your personal data

V.1. Access to personal data

Personal data may be accessed only for the legitimate purposes for which such data are processed.

ARPI employees and associates are authorised to access personal data only to the extent necessary for the performance of their assigned duties.

V.2. Access to personal data by third parties

ARPI may disclose personal data to:

• external service providers – in connection with the provision of services to ARPI; we may transfer personal data to entities providing us with IT, hosting, software development, document translation, advisory, notarial and other services necessary for the proper provision of our services and the fulfilment of our legal obligations;
• public authorities and/or courts – where required under applicable laws or regulations.

ARPI strictly complies with all mandatory laws and regulations when transferring personal data to third parties and undertakes to ensure an appropriate level of protection of personal data and that such data are processed solely for permitted purposes.

VI. Do we transfer your data to countries outside the EU/EEA

Where personal data are transferred to authorised external service providers established within or outside the European Union/European Economic Area, we implement appropriate organisational, contractual and legal safeguards to ensure that personal data are processed solely for the purposes specified above and that an appropriate level of protection of personal data is maintained.

We use Microsoft Office 365. Data contained in email correspondence may be transferred outside the EU/EEA on the basis of standard contractual clauses for the protection of personal data approved by the European Commission.

VII. How is your personal data protected

ARPI is committed to protecting your personal data and has implemented appropriate measures to ensure their confidentiality and security.

ARPI has implemented appropriate technical, physical and organisational security measures designed to protect personal data against unauthorised or unlawful disclosure, access, loss, damage or alteration.

In the event of a personal data breach, where the personal data are exposed to a risk, ARPI shall notify the competent authorities and the relevant data subjects, subject to and in accordance with applicable laws and regulations concerning the protection of personal data.

VIII. How long does ARPI retain your personal data

Unless applicable laws or regulatory requirements provide otherwise or impose an obligation to act differently, ARPI endeavours to retain personal data only for as long as it considers necessary to fulfil the legitimate purposes for which the personal data were collected, including, where applicable, to comply with legal requirements or obligations.

Instead of destroying or deleting your personal data, we may anonymise such data so that they can no longer be associated with you or used to identify you.

IX. What rights do you have in relation to the processing of your personal data

ARPI enables you to exercise all rights available to you under applicable laws, including the right of access, rectification and erasure of your data, the right to restriction of processing, the right to data portability, the right not to be subject to automated decision-making, and the right to object to the processing of your personal data. You also have the right to lodge a complaint with the President of the Personal Data Protection Office.

X. Questions and contact details

If you have any questions or comments concerning this Privacy Notice or the processing of your personal data, please contact us at: privacy@arpiaccounting.com.