SECURITY POLICY OF PERSONAL DATA PROCESSING

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, hereinafter referred to as the "Regulation", we inform you that:

1. Data Controller

The administrator of your personal data is FlyingAtom Sp. z o.o., address: Złota 59, 14th floor ( SkyLight office building ) 00-120 Warsaw, NIP 5272744800, REGON 362509039, KRS 0000575732 hereinafter referred to as the "Company".

2. Contact

Should you wish to contact us regarding your personal data, please contact the Data Controller at the following email address - rodo@flyingatom.com.

3. Categories of Personal Data

We process the following categories of your personal data: identification data, address data and contact data, including bank account and wallet numbers used to complete the process related to the operations conducted through us.

4. Purpose of data processing and legal basis

Personal data may be processed by the Company for the following purposes:
- to conclude a contract on the basis of Art. 6 (1) b of the Regulation,
- Performing the concluded contract, or in order to provide services by the Company, pursuant to Article 6.1.b-c 0 of the Regulation,
- processing of claims, requests, and complaints, pursuant to Art. 6.1.b-c and 6.1.f of the Regulation,
- performance of activities by the Company arising from generally applicable legal regulations, pursuant to art. 6 sec. 1 letter c of the Regulation,
- marketing, including promotion of products or services offered by the Company, pursuant to art. 6.1.f of the Regulation,
- to determine and assert claims by the Company in connection with its business activities, pursuant to art. 6.1.f of the Regulation,
- detection and limitation of fraud related to the Company's activity, as well as to ensure the security of safekeeping of funds of the Bank's clients and investigation proceedings, on the basis of Article 6 section 1 letter f of the Regulation.

5. Sharing of personal information

Your data may be disclosed by the Company:
- entities and authorities to which the Company is obliged or authorized to disclose personal data under generally applicable laws, including entities and authorities entitled to receive personal data from the Company or entitled to request access to personal data under generally applicable laws,
- entities to which the Company has entrusted the performance of agency activities for the Company,

6. Transfer of personal data to a third country

Your data may be to countries outside the EEA in connection with international money transfers.

7. Period of retention of personal data

Your personal data will be stored for the period:
- duration of the contract concluded with the Company, and after its termination, in connection with the Company's legal obligations under generally applicable laws,
- necessary for the Company to pursue claims in connection with its operations or defend against claims made against the Company, based on generally applicable laws, taking into account the periods of limitation of claims set forth in generally applicable laws,

8. Your rights

In relation to the Company's processing of your personal data, you have:
- The right to access your personal data,
- The right to rectify your personal data,
- The right to erasure of personal data (right to be forgotten),
- The right to restrict processing of your personal data,
- the right to data portability to another controller,
- The right to object to the processing of your data, including profiling, and for the purposes of direct marketing, including profiling,
- The right to withdraw consent where the Company processes your personal data on the basis of consent, at any time and in any way, without
- affect the legality of the processing that was performed on the basis of consent before its withdrawal,
- The right to lodge a complaint to the President of the Office for Personal Data Protection, if you consider that the processing of your personal data violates the provisions of the Regulation.

9. Source of data - the information concerns personal data obtained otherwise than from the data subject

Your personal data may come from a legal representative, a principal in the case of granted power of attorney, an entrepreneur in relation to whom you remain a real beneficiary, an employer, a party to a contract concluded with the Company and from publicly available sources, in particular, from databases and registers: National Court Register (KRS), Central Register and Information on Business Activity (CEIDG), REGON.

10. Data requirement

Providing your personal data is necessary for the purpose specified in point 4 above, for:
- the conclusion and performance of the contract concluded with the Company, and the consequence of not providing your personal data will be the inability to conclude and perform the contract concluded with the Company,
- Provision of services by the Company, and the consequence of failure to provide your personal data will be lack of service,
- to handle complaints, requests, or appeals, and the consequence of your failure to provide personal data will be the inability to handle complaints, requests, or appeals,
- receive offers or marketing of products offered or services provided by the Company, and the consequence of not providing your personal data is that you will not be able to receive these offers or marketing of products or services.

11. Automated decision-making, including profiling

The Company will not make automated decisions based on your personal data, including decisions resulting from profiling. - Profiling means any form of automated processing of personal data that involves the use of personal data to evaluate certain personal factors of an individual, in particular to analyse or predict aspects relating to that individual's work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.