GDPR / RODO POLICY

1. Personal Data Administrator
   The Personal Data Administrator is The Burman Robinson Sp. z o.o., headquartered at Aleje Jerozolimskie 85/21, 02-001 Warsaw.
   
2. Personal Data Protection Officer (DPO)
   The role of the Data Protection Officer is performed by Oleksandr Olkhovyk.
   
3. Purposes and Legal Basis for Personal Data Processing
   Personal data is processed in accordance with Article 6(1) of the GDPR for the following purposes:
   

• Contract performance (lit. b GDPR): preparation and execution of contracts, including case analysis and provision of services under the concluded agreements.
• Compliance with legal obligations (lit. c GDPR): fulfillment of obligations under legal regulations, such as document archiving.
• Based on consent (lit. a GDPR): carrying out marketing or informational activities.
• Protection of vital interests (lit. d GDPR): in situations requiring the protection of life or health.

Providing personal data is voluntary but necessary for the above purposes.

4. Data Retention Period
   Personal data will be retained:

• for the duration of the contract and the period required by law,
• until consent is withdrawn—for data processed on this basis,
• for the time necessary to defend against or pursue claims.

5. Recipients of Personal Data
   Recipients of personal data may include:

• employees and collaborators of The Burman Robinson Sp. z o.o.,
• relevant public administrative bodies and state institutions within the scope specified by law.

Personal data will not be transferred to third countries or international organizations unless expressly consented to by the data subject.

6. Automated Decision-Making and Profiling
   Personal data may be processed automatically, including profiling, to tailor services to client needs. Automatically made decisions will not have legal effects or significantly impact individuals.
   
7. Rights of Data Subjects
   Every data subject has the right to:
   

• access their personal data,
• rectify their data,
• erase their data (“right to be forgotten”),
• restrict processing,
• data portability,
• object to processing,
• withdraw consent for personal data processing at any time,
• file a complaint with a supervisory authority – the President of the Personal Data Protection Office.

8. Data Protection Measures
   The Administrator makes every effort to ensure the security of personal data. Appropriate technical and organizational measures have been implemented to protect data from unauthorized access, alteration, loss, or destruction.
   
9. Contact
   For any questions regarding personal data processing, please contact:
   

• via email: ido@burman-robinson.com,
• by mail: at the company’s headquarters.