Pursuant to Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), we hereby inform you that:

1. The administrator of your personal data is INCITE HUB SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, NIP: 5253020314, KRS: 0001132368, with its registered oƯice in Warsaw at UL. CHMIELNA 2 / 31, 00-020 WARSAW, conducting business under the name The Unit, hereinafter referred to as the Administrator;

2. To ensure the proper protection of personal data, the Administrator has appointed a Data Protection OƯicer, who can be contacted by mail at the Administrator’s address or via email at biuro@the-unit.pl;

3. Your personal data, including: i. Identification data – e.g., name and surname; ii. Contact data – e.g., phone number and email; iii. Other data provided for the purpose of the Administrator’s service provision or contract execution;

b. Are or will be processed for the purpose of: i. Providing services by the Administrator, including but not limited to brokerage, professional training, and access to information tools; ii. Providing services electronically, e.g., via email or phone;

c. The legal basis for processing is, among others, the Act of 18 July 2002 on the provision of electronic services, as well as Article 6(1)(b) GDPR, Article 6(1)(c) GDPR, and Article 6(1)(d) GDPR;

d. Marketing and commercial activities; i. Handling submitted inquiries; ii. The legal basis for processing is your consent under Article 6(1)(a) GDPR;

4. If, during service provision, you voluntarily provide sensitive data as defined in Article 9(1) GDPR, the basis for processing will be your explicit consent under Article 6(1)(a) GDPR;

5. The Administrator records telephone conversations to enhance security and improve service quality. Both incoming and outgoing calls are subject to monitoring. The legal basis for processing personal data in this regard is the consent of the individual through the continuation of the phone call with the Administrator (Article 6(1)(a) GDPR) and the legitimate interests pursued by the Administrator (Article 6(1)(f) GDPR);

6. Your personal data may be shared with authorized institutions as required by law and with processors providing services to the Administrator, such as consulting, training, and IT services, with data sharing always limited to the necessary scope;

7. Personal data may be transferred to a third country based on agreements concluded with external companies, ensuring compliance with GDPR principles and legal regulations;

8. Your personal data will be stored for the following periods: i. If cooperation is established, for six years from the end of the calendar year in which the service provision was completed; ii. Until consent is withdrawn, where required, without aƯecting the lawfulness of processing based on consent before its withdrawal; iii. Call recordings – 90 days;

9. You have the right to access, rectify, delete, or restrict the processing of your personal data, as well as the right to data portability and the right to object to data processing, including for direct marketing purposes;

10.You have the right to withdraw your consent at any time, which does not aƯect the lawfulness of processing based on consent before its withdrawal;

11.You have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data violates legal provisions;

12.Providing personal data is voluntary but necessary for the provision of services by the Administrator, including consulting, training, access to information tools, newsletters, commercial and marketing communications, or responding to submitted inquiries;

13.Data provided for expert selection may be processed automatically but will not be subject to profiling.