Privacy Policy

1. The administrator of Users' personal data processed within the kantorkurs.pl portal is KANTOR KURS sp. z o.o.
2. The legal basis for the processing of personal data is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.
3. The provision of personal data by the User, such as: surname, first name, citizenship, PESEL, type of identity document, document number, document validity period, e-mail, telephone numbers, residential address, postal address, tax resident status, public figure status, bank accounts, company name, type of entity, tax identification number (NIP), company address, company postal address — during the registration process is voluntary and allows for the conclusion of foreign currency purchase/sale transactions.
4. The Administrator processes the User's personal data on the basis of Article 6(1)(b) and (c) of the GDPR Regulation exclusively to the extent necessary to provide services to the User of the portal, and in particular for the following purposes:
5. • purchasing or selling currency,
   • fulfilling the Administrator's obligations under applicable law, in particular the Law on the Prevention of Money Laundering and Terrorist Financing,
   • issuing and providing the User with confirmation of the purchase or sale of currency.
5. Except in cases where the obligation to further provide personal data arises from the provisions of applicable law or is necessary for the provision of services, the Administrator does not transfer the User's personal data to any other persons.
6. The User has the right to control the processing of their personal data, in particular the right to receive information about the purpose, scope, and manner of its processing, to request the supplementation, updating, correction, temporary or permanent cessation of processing, or deletion of personal data if such data is incomplete, outdated, inaccurate, or was collected in violation of the provisions of the GDPR or the Personal Data Protection Act.
7. The Administrator processes and stores the personal data specified in paragraph 3 for the period necessary to provide and settle services to which the User is a party, unless otherwise provided by applicable law — in particular, the Accounting Act, which requires data to be stored for 6 years from the date of the last transaction.
8. Deletion of personal data by the User from the personal data database of the portal managed by the Administrator results in the blocking of the User's account. Deleting data from the portal does not mean deleting personal data from the Administrator's databases, given the requirements of the Accounting Act, until the end of the period specified in clause 7 of the Privacy Policy.
9. The portal automatically collects the following data: The data is used to ensure security and improve the quality of services provided. Automatically collected data is periodically deleted by the Administrator within a period not exceeding 12 months
10. • IP address,
    • date and time of access to the portal,
    • session ID,
    • type of web browser used.