XI.I. CONCLUSION OF THE AGREEMENT FOR PARTICIPATION IN A TOURIST EVENT

1. The Administrator processes personal data for the following purposes:
   1. Conclusion of agreement for participation in a tourist event and its performance, including ensuring the correct quality of services (legal basis - Article 6 sec. 1 letter b GDPR) – “performance of the agreement”.
   2. Performance of the Administrator's legal obligations, e.g. financial settlements and accounting reporting, including issuing and storing invoices (legal basis – Art. 6 sec. 1 letter c of the GDPR) – “legal obligation”.
   3. Claiming damages resulting from the agreement (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”. The deadlines for claiming damages resulting from the agreement are specified in detail in the Civil Code and the Act on tourist events and related tourist services.
   4. Improvement of the quality of services provided, including customer satisfaction surveys (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”.
   5. Sending marketing information (e.g. newsletter), where consent is given to the use of data for this purpose (legal basis – Art. 6 sec. 1 letter a of the GDPR) – “consent”.
   6. Direct marketing, including personalization of marketing content (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “lawful interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. The Administrator may process personal data in order to perform the agreement for participation in a tourist event, in particular:
   1. given name(s),
   2. surname,
   3. date of birth,
   4. gender,
   5. e-mail address,
   6. phone number,
   7. residence address,
   8. specimen of the signature,
   9. and data from identity card or passport necessary to perform the agreement (depending on the country of departure or offer) and to verify the identity of the customer, i.e. place of birth, citizenship, facial image, series and number of the document, authority issuing the document, date of issue and date of expiry of the document.
3. Provision of personal data indicated above is voluntary, but necessary for the conclusion of the agreement and its performance. The consequence of a failure to provide personal data will be the impossibility of concluding and performing the agreement.
4. To the extent necessary to conclude and perform the agreement for participation in a tourist event and to ensure the proper quality of services, the Administrator may also process special categories of personal data (including data concerning health, e.g. disabled persons, persons with reduced mobility, persons requiring special medical care) if the data subject has given their explicit consent to the processing of such data for the indicated purpose (legal basis – Art. 9 sec. 2 letter a of the GDPR) – “consent”.
5. The Administrator processes personal data in order to send commercial information (to e-mail address) and for the purposes of direct marketing (using a phone number) on the basis of separate consents, in accordance with the provisions of the Telecommunications Law and the provisions of the Act on the provision of services by electronic means.
6. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 5. above. Depending on the legal basis, this will be accordingly:
   1. the time needed to perform the agreement,
   2. time of performing legal obligations and time period the legal regulations require data to be stored for, e.g. tax regulations,
   3. the time after which the claims resulting from the agreement expire,
   4. the time to object,
   5. the time until the withdrawal of consent.
7. Subject to all data security guarantees, the Administrator may transfer the personal data of the customer – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. agents, technical service providers and entities providing consulting services,
   2. other administrators to the extent necessary for the provision of services and legal requirements, e.g. electronic payment operators, couriers, carriers, insurers, hotel service providers, additional service providers (e.g. parking lots, airport services), local or national tourist chambers, contractors providing services for the Administrator on the basis of concluded agreements.
8. To the extent necessary for the proper performance of the agreement, the Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
9. In connection with the processing of personal data by the Administrator, the customer is entitled to:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator,
   6. the right to withdraw consent if the Administrator processes personal data of the customer based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the customer considers that the processing of personal data violates the provisions of the Regulation.
10. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.II. CUSTOMER ZONE

1. The Administrator processes personal data for the following purposes:
   1. Conclusion of an agreement for the provision of services by electronic means (in accordance with the Act of 18 July 2002 on the provision of services by electronic means, Journal of Laws, No. 144, item 1204, as amended), including the registration and operation of a user account in the Customer Zone at www.itaka.pl and in a mobile application (legal basis – Art. 6 sec. 1 letter b of the GDPR) – “performance of the agreement”.
   2. Claiming damages resulting from the agreement (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”. The deadlines for claiming damages resulting from the agreement are specified in detail in the Civil Code.
   3. Sending marketing information (e.g. newsletter), where consent is given to the use of data for this purpose (legal basis – Art. 6 sec. 1 letter a of GDPR) – “consent”.
   4. Direct marketing, including personalization of marketing content (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “lawful interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. Providing personal data is voluntary, however it is necessary to conclude an agreement, including registration and operation of a user account in the Customer Zone.
3. The Administrator processes personal data in order to send commercial information (to e-mail address) and for the purposes of direct marketing (using a phone number) on the basis of separate consents, in accordance with the provisions of the Telecommunications Law and the provisions of the Act on the provision of services by electronic means.
4. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 15. above. Depending on the legal basis, this will be accordingly:
   1. the time needed to perform the agreement,
   2. time of performing legal obligations and time period the legal regulations require data to be stored for, e.g. tax regulations,
   3. the time after which the claims resulting from the agreement expire,
   4. the time to object,
   5. the time until the withdrawal of consent.
5. Subject to all data security guarantees, the Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators to the extent necessary for the implementation of services, on the basis of concluded agreements.
6. To the extent necessary for the proper performance of the agreement, the Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
7. In connection with the processing of personal data by the Administrator, the user is entitled to:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator,
   6. the right to withdraw consent if the Administrator processes personal data of the user based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
8. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.III. OFFER FORM

1. The Administrator processes personal data for the purpose of:
   1. Processing the inquiry, i.e. presentation of an offer for participation in a tourist event (legal basis – Art. 6 sec. 1 letter b of the GDPR) – “taking action at the request of the data subject prior to the conclusion of the agreement”.
   2. Sending marketing information (e.g. newsletter), where consent is given to the use of data for this purpose (legal basis – Art. 6 sec. 1 letter a of the GDPR) – “consent”.
   3. Personalization of marketing content where consent is given to the use of data to obtain marketing information (legal basis – Art. 6 sec. 1 letter f) of RODO) – “legitimate interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. The provision of data is voluntary, but necessary to process the inquiry, i.e. to present an offer for a tourist event. The consequence of a failure to provide the required personal data is the lack of possibility to send an offer to the user.
3. The Administrator processes personal data in order to send commercial information (to e-mail address) and for the purposes of direct marketing (using a phone number) on the basis of separate consents, in accordance with the provisions of the Telecommunications Law and the provisions of the Act on the provision of services by electronic means.
4. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 23. above. Depending on the legal basis, this will be accordingly:
   1. time necessary to process the inquiry, i.e. preparation and presentation of an offer and obtaining a response from the customer, but not longer than 60 months from the date of sending the offer.
   2. the time to object,
   3. the time until the withdrawal of consent.
5. Subject to all data security guarantees, the Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators, to the extent necessary to provide answer the question asked.
6. The Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
7. In connection with the processing of personal data by the Administrator, the user is entitled to, respectively:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator in cases in which the basis for the processing is the consent given,
   6. the right to withdraw consent if the Administrator processes personal data of the customer based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
8. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.IV. CONTACT FORM

1. The Administrator processes personal data for the purpose of:
   1. Answering questions asked with the use of the contact form (or e-mail and telephone address) available at www.itaka.pl and the mobile application (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”.
   2. Sending marketing information (e.g. newsletter), where consent is given to the use of data for this purpose (legal basis – Art. 6 sec. 1 letter a of the GDPR) – “consent”.
   3. Personalization of marketing content where consent is given to the use of data to obtain marketing information (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. Providing the data indicated in the contact form and in the mobile application is voluntary, but necessary to answer the question. The consequence of a failure to provide the required personal data is the lack of possibility to send a reply to the user.
3. The Administrator processes personal data in order to send commercial information (to e-mail address) and for the purposes of direct marketing (using a phone number) on the basis of separate consents, in accordance with the provisions of the Telecommunications Law and the provisions of the Act on the provision of services by electronic means.
4. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 31. above. Depending on the legal basis, this will be accordingly:
   1. the period necessary for the implementation of the purpose indicated above, i.e. until the moment of answering the inquiry sent by the user,
   2. the time to object,
   3. the time until the withdrawal of consent.
5. Subject to all data security guarantees, the Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators, to the extent necessary to provide answer the question asked.
6. The Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
7. In connection with the processing of personal data by the Administrator, the user is entitled to:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator in cases in which the basis for the processing is the consent given,
   6. the right to withdraw consent if the Administrator processes personal data of the customer based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
8. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.V. ITAKA CHATBOT APPLICATION

1. The Administrator processes personal data for the purpose of:
   1. Answering questions asked with the use of the ITAKA Chatbot software available in Messenger application (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”.
   2. Processing the inquiry, i.e. presentation of an offer for a tourist event (legal basis – Art. 6 sec. 1 letter b of the GDPR) – “taking action at the request of the data subject prior to the conclusion of the agreement”.
   3. Sending marketing information (e.g. newsletter), where consent is given to the use of data for this purpose (legal basis – Art. 6 sec. 1 letter a of the GDPR) – “consent”.
   4. Personalization of marketing content where consent is given to the use of data to obtain marketing information (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. In order to contact the Administrator, i.e. to use the ITAKA Chatbot software, the user of the Messenger application provides personal data, in particular their name and other data (in accordance with the rights specified by the user in the application settings). The provision of data is voluntary, but necessary to make contact and obtain answer to a question asked.
3. The Administrator processes personal data of the user in order to process the inquiry. Provision of data is voluntary, but necessary to process the inquiry, i.e. to present an offer for a tourist event. The consequence of a failure to provide the required personal data is the lack of possibility to send an offer to the user.
4. The Administrator processes personal data in order to send commercial information (to e-mail address) and for the purposes of direct marketing (using a phone number) on the basis of separate consents, in accordance with the provisions of the Telecommunications Law and the provisions of the Act on the provision of services by electronic means.
5. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 39. above. Depending on the legal basis, this will be accordingly:
   1. time necessary to process the inquiry, i.e. prepare and present an offer and obtain a response from the customer, but not longer than 60 months from the date of sending the offer
   2. the time to object,
   3. the time until the withdrawal of consent.
6. Subject to all data security guarantees, the Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators to the extent necessary for the implementation of services, on the basis of concluded agreements.
7. The Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
8. In connection with the processing of personal data by the Administrator, the user is entitled to, respectively:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator in cases in which the basis for the processing is the consent given,
   6. the right to withdraw consent if the Administrator processes personal data of the customer based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
9. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.VI. NEWSLETTER

1. The Administrator processes personal data for the purpose of:
   1. Providing marketing information to persons interested in the Administrator's offer by means of a newsletter (legal basis – Art. 6 sec. 1 letter a of the GDPR) – "consent".
   2. Personalization of marketing content where consent is given to the use of data to obtain marketing information (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”. The Administrator may process personal data in order to prepare and present a customized offer for a tourist event. Such data will also be processed in an automated manner, however decisions taken will not have any legal effect on the customer.
2. The provision of data is voluntary, but necessary to receive marketing information. The consequence of a failure to provide the required personal data is the lack of possibility to send a newsletter to the user.
3. A user using a newsletter may at any time and without giving any reason, resign from receiving it, in particular by clicking on the deactivation link contained in each e-mail sent to the user or by sending correspondence to the following address: info@itaka.pl.
4. The Administrator has the right to process personal data until the withdrawal of consent by the user.
5. The Administrator has the right to process personal data for the period necessary to achieve the purposes specified in point 39. above. Depending on the legal basis, this will be accordingly:
   1. the time until the withdrawal of consent,
   2. the time to object.
6. The Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators to the extent necessary for the implementation of services and legal requirements, on the basis of concluded agreements.
7. The Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
8. In connection with the processing of personal data by the Administrator, the user is entitled to:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator,
   6. the right to withdraw consent if the Administrator processes personal data of the user based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to object to the processing of data if the basis for the processing is the legitimate interest of the Administrator,
   8. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
9. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.VII. BLOG

1. The Administrator processes personal data in order to enable the user to register and exchange information, including adding comments on the Administrator's blog, and to answer questions of the user (legal basis – Art. 6 set. 1 letter a of the GDPR) – “consent”.
2. The provision of data is voluntary, but necessary to use the blog. The consequence of failure to provide the required personal data is the inability to register and exchange information, including adding comments on the Administrator's blog.
3. The user may, at any time and without giving any reason, withdraw their consent to the processing of data, which will mean resignation from using the blog.
4. The Administrator has the right to process personal data until the withdrawal of consent by the user.
5. The Administrator may transfer the personal data of the user – apart from persons authorized by the data Administrator – to other entities, including:
   1. entities processing data on behalf of the Administrator, e.g. technical service providers and entities providing consulting services,
   2. other administrators to the extent necessary for the implementation of services and legal requirements, on the basis of concluded agreements.
6. The Administrator may transfer data to countries outside the European Economic Area (EEA) which do not provide an adequate level of protection. However, the Administrator shall ensure that the transfer is carried out in a secure, controlled manner and is secured by appropriate agreements with the recipients, meeting the conditions set out in Chapter V of the GDPR. The Administrator may also transfer personal data to countries outside the EEA for which the European Commission has established that they offer an adequate level of protection.
7. In connection with the processing of personal data by the Administrator, the user is entitled to:
   1. the right to access personal data,
   2. the right to rectify personal data,
   3. the right to delete personal data (the right to be forgotten),
   4. the right to limit the processing of personal data,
   5. the right to transfer data to another administrator,
   6. the right to withdraw consent if the Administrator processes personal data of the user based on consent at any time and in any way, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal,
   7. the right to lodge a complaint with the Director of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych), if the user considers that the processing of personal data violates the provisions of the Regulation.
8. In order to exercise the rights specified above, please contact the Administrator via e-mail: daneosobowe@itaka.pl.

XI.VIII. SOCIAL MEDIA

1. The Administrator processes personal data of users visiting the Administrator's profiles in social media (e.g. Facebook, YouTube, Twitter, Google+). This data is only processed in connection with the Administrator's profile, including for the purpose of promoting the Administrator's own brand (legal basis – Art. 6 sec. 1 letter f of the GDPR) – “legitimate interest”.
2. The scope of personal data processing, detailed objectives, as well as rights and obligations of the user of a social networking website result directly from the regulations of a given portal.

XI.IX. FINAL PROVISIONS

1. The Administrator shall secure the personal data processed by them in accordance with generally applicable regulations concerning personal data protection and security of information.
2. This Privacy Policy is for informational purposes only and applies only to the Website www.itaka.pl and mobile application. The Website and mobile application may contain links to other websites. The Administrator suggests that each user, after accessing other websites, should read the privacy policy applicable there.
3. The Administrator reserves the right to introduce changes to the applicable Privacy Policy in case of technology development, changes in generally applicable legal regulations, including personal data protection and in case of the development of the Website.