GDPR

1. Data Controller

Arche S.A., based in Warsaw, 02-801 Warsaw, ul. Puławska 361 (hereinafter Arche S.A.). Arche is responsible for processing personal data for the purposes and on the legal bases set out in this notice, including contract performance and customer/supplier relationship management, group-level marketing
and sales activities
; purchasing, finance and other administrative and business matters; and product and service analysis and development.

2. Purpose and legal basis for processing personal data

Personal data is processed on the following legal bases:

1. Performance of the contract between Arche and its customer, supplier or business partner (hereinafter Business Customers), and fulfilling data subjects’ pre-contract requests, e.g. requests for information or an offer, newsletter subscriptions or purchase orders (Article 6(1)(b) GDPR);
2. Managing relationships with Business Customers or similar entities, based on the Controller’s legitimate interest (Article 6(1)(f) GDPR);
3. The Controller’s legitimate interest in marketing products and services to contact persons designated by Business Customers (Article 6(1)(f) GDPR);
4. Compliance with the Controller’s legal obligations under the laws applicable in the country of operation (Article 6(1)(c) GDPR).

Personal data is processed for the following purposes:

1. Providing products and services;
2. Creating, managing and developing Arche–Business Customer relationships;
3. Developing products and services;
4. Communicating with Business Customers, including collecting their feedback, e.g. through satisfaction surveys;
5. Detecting, preventing and investigating fraud and other crimes;
6. Analysis, segmentation and statistics for the purposes described above.

3. Data subjects and personal data categories

Arche processes personal data of sole traders and contact persons designated by its prospective, current and former Business Customers. For the purposes described above, the following personal data categories are processed:

• Basic data subject information, e.g.: name, title
  and occupation, position in the Company, Company details, employment contact details;
• Marketing data, e.g.: positions and activities in business and public service; professional preferences and interests; other interests and information provided by the data subject; marketing activities undertaken; event
  attendance; marketing permissions and consents (acceptance), restrictions
  and prohibitions (rejection);
• Contact and communication data, e.g.: contact requests and feedback, emails, digital forms, chat conversations;
• Analytical data, e.g.: marketing segments and profiles developed from the data described above and obtained from ordinary sources through analysis
  and pattern use, such as calculating possible Company/data subject interests or assigning the Company/data subject to a specific group of companies/data subjects.

For direct marketing to contact persons of prospective or former Business Customers, only the basic
and marketing data described above are processed.

4. Sources of information

Personal data is collected directly from the data subject when they request contact or information, complete a form, make a purchase or place an order, enter into a contract, attend events, or otherwise contact Arche in person, by phone or digitally. Personal data of contact persons designated by prospective, current or former Business Customers is obtained directly from the Business Customers. Personal data may also be collected and updated
using Business Customers’ websites, public and private registers, and public institutions. Data obtained from such sources is collected in compliance with applicable data protection laws.

5. Disclosure and transfer of data

Data will not be disclosed to other external entities unless necessary to comply with Arche’s legal obligations. Arche may commission ICT, marketing, communication and other activities to external suppliers or subcontractors. In such cases, Arche may provide subcontractors with the personal data necessary to perform the services assigned to them. They will process personal data on Arche’s behalf and must follow its instructions. Arche will use appropriate contractual measures to ensure that personal data is processed lawfully. Personal data will not be transferred outside the European Union or European Economic Area. If such a transfer is necessary, Arche will verify whether the destination country has been deemed by the European Commission to provide adequate privacy protection or will conclude with the recipient an agreement based on the Standard Contractual Clauses issued by the European Commission.

6. Data protection and retention

Personal data will be accessible only to authorised persons who need to process it for their work or other duties. Digital data is protected by firewalls, passwords and other technical and organisational measures. All data is stored in secure premises protected by physical access controls. Personal data will be retained for as long as needed for the specified purposes. After the relationship between Arche and the Business Customer ends, or Arche learns that the data subject is no longer the Business Customer’s contact person, personal data will be deleted, subject to the following exceptions:

• Anonymised data may be retained indefinitely;
• Marketing data may be retained until consent is withdrawn or an objection to processing is made;
• Where applicable law permits longer retention, e.g. purchase orders.

7. Access, rectification and other data subject rights

Data subjects have the right to:

• access their personal data and receive a copy of the data being processed;
• request erasure (the right to be forgotten) where the circumstances in Article 17 GDPR apply;
• request restriction of processing in the cases specified in Article 18 GDPR;
• object to processing in the cases specified in Article 21 GDPR;
• data portability for data provided and processed by automated means.

If a data subject believes that their personal data is processed unlawfully, they may lodge a complaint with the supervisory authority (UODO, ul. Stawki 2, Warsaw). For further information on data protection or to exercise your rights, contact us: Data Protection Officer: rodo@arche.pl Arche S.A., based in Warsaw, 02-801 Warsaw, ul. Puławska 361 Privacy notice for guests of Arche S.A. hotels

1. Data Controller

Arche S.A., based in Warsaw, 02-801 Warsaw, ul. Puławska 361 (hereinafter Arche S.A.).

2. Purpose and legal basis for processing personal data

Personal data is processed for the following purposes:

1. Entering into and performing a contract for hotel or catering services (Article 6(1)(b) GDPR);
2. Pursuing potential claims by Arche S.A. for damage suffered by the hotel and caused by a hotel guest, or defending against the guest’s claims
   against the Hotel (Article 6(1)(f) GDPR);
3. Documenting service performance for tax purposes (Article 86 of the Tax Ordinance) (Article 6(1)(c) GDPR);
4. Ensuring the safety of hotel guests and others on Hotel premises through hotel monitoring (Article 6(1)(f) GDPR);
5. Fulfilling statistical obligations (Article 30 of the Public Statistics Act) (Article 6(1)(c) GDPR);
6. Personal data will also be processed for the Controller’s marketing purposes (Article 6(1)(f) GDPR), and, where consent is given when providing personal data, for marketing purposes of other entities in the Arche Group (i.e. Arche S.A.) (Article 6(1)(a) GDPR);.

Arche S.A.’s legitimate interest is ensuring guest safety, pursuing potential claims and marketing its own products or services. Providing data is voluntary but necessary for the above purposes. Arche S.A. will transfer personal data to entities entrusted with processing it on behalf of Arche S.A., including:

• IT service and software providers;
• consulting firms and law firms providing legal advice and litigation services.

In addition, Arche S.A. will disclose personal data to other recipients where required by law. Data will not be transferred to third countries
or international organisations.

3. How long will Arche S.A. process data?

Personal data will be processed while you use our services and thereafter, for the period required by law, including the Civil Code and Accounting Act.

4. Data access, correction and other data subject rights

Data subjects have the right to:

• access their personal data and receive a copy of the personal data being processed;
• request erasure (the right to be forgotten) where the circumstances in Article 17 GDPR apply;
• request restriction of processing in the cases specified in Article 18 GDPR;
• object to processing in the cases specified in Article 21 GDPR;
• data portability for data provided and processed by automated means.

If a data subject believes their personal data is processed unlawfully, they may lodge a complaint with the supervisory authority (UODO, ul. Stawki 2, Warsaw). For further information about personal data protection or to exercise your rights, contact us: Data Protection Officer: rodo@arche.pl Arche S.A., Warsaw, 02-801 Warsaw, ul. Puławska 361