Privacy policy
Respecting the right to privacy of individuals who have entrusted Aforti Exchange S.A. with their personal data, we hereby declare that the data obtained is processed in accordance with national and European legal provisions and under conditions ensuring its security.
In order to ensure transparency in the processing activities we carry out, we present the personal data protection principles applicable at Aforti Exchange S.A., established pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”).
Data Controller
The Controller, i.e. the entity deciding on the purposes and means of personal data processing is Aforti Exchange S.A. with its registered office at Okopowa 58/72, 01-042 Warsaw. In matters related to the processing of your personal data, you may also contact us by e-mail at: iod@aforti.biz.
Data acquisition and purpose of processing
In the performance of our business functions we process personal data for the following purposes:
Purpose of processing |
Legal basis and retention period |
Legitimate purpose, if applicable |
Conclusion and performance of contracts with clients. |
For the duration of the agreement – processing is necessary for the performance of a contract in which the data subject participates as a contracting party, or in order to take steps at the request of the data subject prior to entering into a contract; upon termination of the agreement – the processing of data is necessary for compliance with a legal obligation to which the controller is subject. Pursuant to Article 49(1) of the Act on Counteracting Money Laundering and Financing of Terrorism, obliged institutions shall retain data for a period of 5 years, calculated from the first day of the year following the year in which the business relationship with the customer was terminated or in which an occasional transaction was carried out. |
Aforti Exchange S.A., in connection with actions undertaken for the purpose of entering into or performing a contract, contacts employees and/or associates of clients and contractors for legitimate purposes. |
Handling of complaints and claims. |
Article 6(1)(b) and (f) of the GDPR For a period of 1 year following the settlement of the complaint. |
The Controller, in connection with the handling of complaints, contacts employees and/or associates of clients for legitimate purposes. |
Pursuit of claims or defence against legal claims |
Article 6(1)(f) of the GDPR For the duration of proceedings relating to the pursuit of claims, i.e., until their final and binding conclusion, and in the case of enforcement proceedings, until the claims have been satisfied in full. |
The Controller, in connection with the pursuit of claims or the defence against legal claims, may, for legitimate purposes, process the personal data of employees and/or associates of clients or contractors. |
Archiving of documents, including contracts and accounting records |
Article 6(1)(c) of the GDPR For the periods specified by applicable law, and where no such periods are prescribed for certain documents, for as long as their retention falls within the scope of the Controller’s legitimate purpose, as determined by the statutory limitation period for the possible pursuit of claims. |
---- |
Conducting marketing activities without the use of electronic means of communication |
Article 6(1)(f) of the GDPR Until an objection is raised, i.e., until you indicate to us in any manner that you do not wish to remain in contact with us or to receive information regarding our activities. |
Conducting marketing activities promoting the business operations. |
Conducting marketing activities using electronic means of communication |
Article 6(1)(a) of the GDPR These activities, due to other applicable provisions, in particular the Telecommunications Law and the Act on the Provision of Electronic Services, are carried out on the basis of the consents obtained. They shall continue until such consent is withdrawn, i.e., until you indicate to us in any manner that you do not wish to remain in contact with us or to receive information regarding our activities, and, following such withdrawal, for the purposes of demonstrating compliance with the legal obligations incumbent upon Aforti Exchange S.A. and in connection with any related claims (for up to 6 years from the withdrawal of consent). |
Conducting marketing activities promoting the business operations through the use of email addresses and telephone numbers. |
Conducting recruitment processes |
Article 6(1)(a), (c) and (f) of the GDPR For a period of up to 6 months from the conclusion of the recruitment process, and, in the case of consent to participation in future recruitment processes, for no longer than 1 year. |
The Controller may, without the additional consent of the data subject, retain the personal data of job applicants who have not been hired for up to 6 months following the conclusion of the recruitment process, as a legitimate purpose of the Controller, in view of the possibility that an employed employee or associate may prove unsuitable for the position or may resign. |
Human resources management – employees and associates |
Article 6(1)(a), (b), (c) and (f) of the GDPR Article 9(2)(b) of the GDPR In accordance with applicable legal provisions requiring the archiving of employment law documentation – i.e., personnel files for 50 years, and in certain cases for a period of 10 years – the 10-year retention period for documentation relating to the employment relationship and personnel files shall apply to all employees employed after 1 January 2019. For employees employed after 31 December 1998 but before 1 January 2019, documentation relating to the employment relationship and personnel files shall be retained for a period of 50 years from the date of termination or expiry of the employment relationship, unless the employer submits a declaration of its intention to file information reports for all employees and contractors employed during that period, and such reports are in fact submitted. If a shorter retention period applies to certain documents, the Controller shall comply with such shorter period. In the case of civil law contracts, such contracts shall be retained until the expiry of the limitation periods for claims arising therefrom. |
The Controller shall use an employee’s or associate’s likeness solely on the basis of that individual’s consent. |
If the limitation periods applicable to the pursuit of potential claims are shorter than the retention periods for accounting documents for tax purposes, such documents shall be retained for the period necessary for tax and accounting purposes, namely for 5 years from the end of the year in which the tax obligation arose. Furthermore, pursuant to the applicable Act on Counteracting Money Laundering and Financing of Terrorism, the retention period for documentation confirming the application of financial security measures shall be 5 years, calculated from the first day of the year following the year in which the business relationship with the client was terminated, or
Data recipients
In connection with its business activities, Aforti Exchange S.A. will disclose your personal data to the following entities:
- public authorities or other entities authorised under applicable law,,
- entities supporting us in our business operations on our instruction, in particular: providers of external IT systems supporting our operations, entities auditing our activities,
- an entity providing accounting services or entities cooperating with Aforti Exchange S.A. in the framework of marketing campaigns, provided that such entities process data on the basis of a contract with Aforti Exchange S.A. and solely in accordance with its instructions,
- banks, where necessary for the purposes of conducting settlements.
Rights in relation to the processing of personal data and the voluntary provision of data
Each individual whose personal data is processed by Aforti Exchange S.A. has the right to:
- access their personal data,
- rectify their personal data,
- erase their personal data,
- restrict the processing of their personal data,
- object to the processing of their personal data,
- data portability
In addition, any individual whose personal data is processed by Aforti Exchange S.A. has the right to lodge a complaint with the supervisory authority, i.e., the President of the Personal Data Protection Office. Further information is available at: .
More information on the rights of data subjects can be found in Articles 12–23 of the GDPR, the text of which is available at:
Are you required to provide your personal data to Aforti Exchange S.A.?
The provision of personal data is necessary for the conclusion of contracts, the settlement of business operations, and for Aforti Exchange S.A. to comply with legal requirements. This means that if you wish to use the services offered by Aforti Exchange S.A. or to become its employee or associate, you must provide your personal data.
In all other cases (in particular, for the processing of personal data by Aforti Exchange S.A. for marketing purposes), the provision of data is voluntary.
Transfer of data to third countries
Personal data will not be transferred to third countries.
Automated processing of personal data
Personal data will not be processed in an automated manner (including profiling) in such a way that, as a result of such automated processing, any decisions could be made, other legal effects could be produced, or in any other way materially affect our clients, contractors, and their employees or associates.
Aforti Exchange S.A.
ul. Okopowa 58/72, 01-042 Warsaw,
tel. (+48) 22 647 50 30, e-mail: biuro@aforti.biz,
NIP: 951 236 08 41, KRS: 0000719620.
Cookies – information regarding the end-user device
- 1. The Service Provider stores HTTPS requests directed to the server.
- 2. In order to improve functionality, the Service Provider declares that it uses cookies. Proprietary cookies will be used for the following purposes:
- configuring the service, i.e., adapting the content of the website to the user’s previous actions;
- authenticating the user and maintaining the user’s session on the website (keeping the session active after login);
- carrying out processes necessary for the full functionality of the website;
- conducting analyses and monitoring viewership;
- ensuring security and continuous operation.
- Third-party cookies will be used for the following purposes:
- presenting advertisements tailored to the user’s preferences (remarketing, contextual advertising);
- collecting statistical data via analytical tools for analytical purposes and for the purposes of the marketing automation system.
- Based on the information collected, the Service Provider may compile statistics. Such statistics are generated in a manner that does not permit the identification of individual Service Recipients.
- Any Service Recipient who does not consent to the use of cookies is required to modify the settings of their web browser. Configuring the system to allow the use of cookies constitutes consent to the storage by the Service Provider of the information referred to in paragraph 2, in accordance with Article 173(2) of the Telecommunications Law of 16 July 2004 (Journal of Laws of 2017, item 1907, as amended).
