1. General Information
This document, being Appendix No. 2 to the Regulations for Provision of Electronic Services by Online Arbitration S.A., as well as Appendix No. 2 to the Regulations of Holding the Position of Arbitrator of the permanent Online Arbitration Court, constitutes the Declaration on Privacy of the controller of your personal data, i.e. Online Arbitration S.A. with its registered office in Wrocław, ul. Kazimierza Wielkiego 67 (hereinafter: OAC), registered by the District Court for Wrocław-Fabryczna, VI Commercial Division of the National Court Register at KRS No. 0000540734, NIP No. 8971803496, share capital PLN 250,000 paid-up in full.
In this Privacy Declaration we explain which of your personal data we collect and how we process it. The declaration refers to:
- all the data of the current and potential clients of the OAC (the data of potential clients is understood as data of the persons who have filled in a registration form but have not concluded an agreement with the OAC yet in accordance with the Regulations for Electronic Services Provided by Online Arbitration S.A.);
- every person participating in the arbitration procedure before the permanent Online Arbitration Court – whether as an individual or a representative of a legal person – this also applies to the persons not being parties to proceedings (e.g. arbitrators, witnesses, expert witnesses and others);
- the persons who are not clients of the OAC, e.g. the contact persons for corporate clients (not being individuals).
Personal data refers to all types of information which may tell us something about you or which we may associated with you. Detailed information on categories of the data processed by the OAC is included in point 2 hereof. Processing is understood as anything we may do with such data, i.e. collecting, recording, storing, changing, organizing, using, disclosing, transferring or removing it. You will provide us with your personal data when you become our client, register on the OAC Website, fill in an online form, conclude an agreement, use our services or contact us using one of our communication channels. We also make use of the data which, under the law, is available from public sources, in particular from the National Court Register, the Central Business Register and Information Service (CEIDG) or other, similar foreign registers. It also includes the data which – under the law – was provided to us by other entities, in particular participants to arbitration proceedings.
Your personal data will be processed on the basis of the regulation of the European Parliament and Council (EU) 2016/679 of 27 April 2016 (Official Journal of the European Union L.2016.119.1 of 4 May 2016), applicable since 25 May 2018 (hereinafter referred to as the Regulation).
2. Types of your data that we collect
The personal data that we collect includes:
- Identification data, such as full name, address, PESEL number of another domestic identification number of a natural person, email address, phone number, citizenship, data of business entities with which you are associated in different ways (as an employee, partner, body member, attorney, etc.).
- Information on the arbitration proceedings in which you participate as a party, witness, expert witness or an Arbitrator, in particular the data from the submitted pleadings and evidence.
- Financial data regarding settlements between you and the OAC.
- Data in audio-visual form, such as recordings from the hearings conducted in the form of video conferences within arbitration proceedings.
We do not record sensitive data on your health, ethnic origin, religious or political views, unless it is necessary. If we record it, it is limited to specific circumstances, e.g. if medical documentation is included in the case files.
3. What do we do with your personal data?
The processing of your data is performed in accordance with the law, in connection with the following objectives:
If you are a Website User:
- Performance of the agreement, including day-to-day management of relationships with client: while registering your user account, we collect the information necessary for verifying the correctness of opening your account and for the purpose of contacting our users. In this case, the legal grounds for processing your data are art. 6 point 1 letter b of the Regulation: processing is necessary for performing the agreement of the data subject. Performance of the Agreement is also understood as using user data for providing it with important information on the operation of the Website (e.g. information on temporary unavailability of the Website).
- Conduct of arbitration proceedings: for the purposes of conducting arbitration proceedings, we collect the information on your relationship with the given case, in particular the information on your business activities or on the business activities of the entities with which you are associated in any way. In this case, the legal grounds for processing your data are art. 6 point 1 letter d of the Regulation: the processing is necessary for protecting the legitimate interests of the data subject and art. 6 point 1 letter f of the Regulation: the processing is necessary for the purposes resulting from the legitimate interests of the administrator or a third party.
- Marketing: we may send to you emails or text messages offering products or services if you consent to it, e.g. during registration on the OAC Website or during registration for newsletter purposes on our website. You may revoke your consent at any time.
If you are an Arbitrator:
- The stated personal data will be used solely for opening Arbitrator accounts, verifying their identity and in the scope necessary for concluding, performing, amending or terminating the framework agreement and for conducting the arbitration proceedings in which the Arbitrator is member of the Adjudication Panel. Performance of the Agreement is also understood as using Arbitrator data for providing it with important information on the operation of the Website (e.g. information on temporary unavailability of the Website).
4. Whom do we provide with your data and why?
To be able to offer the best services, we provide certain data both internally and externally. This applies to the following circumstances.
a. Arbitrators and other Website users
For the purposes of conducting proceedings before the Court and resolving disputes.
b. State authorities
In some cases, we are legally obliged to provide your data to external entities, including:
- courts on account of conducted proceedings for the purpose of confirming enforceability of awards of the Online Arbitration Court at the Online Arbitration S.A. company with its registered office in Wrocław;
- tax authorities which may require us to provide information on the proceedings in which you were a party;
- judicial/ law enforcement authorities, such as police, public prosecutor’s offices and courts, at their explicit and legal requests.
c. Service providers
When we use the services of other providers, we provide them solely with the personal data required on account of the given service. Service providers support us in the scope of the following activities: electronic payments, designing and maintaining online tools and applications, marketing activities and events, and management of communication with clients.
In all such cases, we ensure that third parties only have access to the personal data necessary for performing the given activities.
Whenever we provide your personal data to third parties (including abroad), we apply the necessary security measures for the purpose of protecting it. In that regard, the OAC uses:
- proper personal data processing agreements,
- standard contractual clauses adopted in the European Union (they refer to provision of data by entities from the European Union outside of the European Economic Area for the purpose of compliance with the EU data protection provisions);
- the “EU-US Privacy Shield” agreement which protects the personal data sent to the United States.
5. Your rights and the methods in which we respect them
We respect your rights to determine how your personal data is processed. These rights include:
- Right of access to data: You are entitled to request that we send a list of your personal data that we process.
- Right to rectify data: If your personal data is incorrect, you are entitled to request that we rectify it. If we provide your data to a third party, and that data is later rectified, we will inform the third party about that fact.
- The right to object to processing: You may raise an objection with the OAC against the processing of your personal data due to the legitimate interests of the OAC or third parties. We will analyze your objection and whether the processing of your data has any adverse influence on you that requires that we cease such processing.
- Right to restriction of data processing: You are entitled to request that we limit the use of our personal data if you believe that it is incorrect, that we process your data in breach of the law, that the OAC no longer needs such data, but you want us to keep it in case of claims, you object to our processing of your data due to legitimate interests of the OAC and that objection was accepted by the OAC.
- Right to data portability: You are entitled to request that we transfer your personal data directly to you or to another organization. This refers to the personal data we process in an automated way and with your consent or under an agreement concluded with you. If technically possible, we will provide you with that personal data.
- Right to erasure: You may request that we erase your personal data, if we no longer need it for the purposes, for which it has been collected, if you revoke your consent for the processing thereof and OAC has no other grounds for processing, if you object to our processing of your data based on our legitimate interests and there are no superior legitimate interests of data processing and that objection is accepted or for the purpose of sending personalized commercial messages (in the last case, we will stop to process data for marketing purposes), if the OAC processes your personal data in breach of the law or if the provisions of the European Union or of an EU member state require the OAC to erase your personal data.
- Right to submit a complaint: If you believe that the processing of data by the OAC takes place in breach of your rights, you may submit a complaint with the supervisory authority, i.e. President of the Personal Data Protection Office. Also, you are entitled to submit a complaint by contacting the data protection authority in your country.
If you want to exercise your rights, please contact us. You may email us at firstname.lastname@example.org or by sending a letter to the address of the registered office of the OAC. We try to answer such questions as soon as possible. If we need more time to answer to your petition, we will inform you on how much more time we need, with reasons for the delay. In some cases we may legally reject your petition. In such a case, we will inform you properly of the reasons for such rejection.
6. How we protect your personal data
In order to protect your data, the OAC applies internal policies and standards. Such policies and standards are updated periodically in order to maintain their continuous compliance with provisions and technological changes. In particular, as well as under the law, we apply proper technical and organizational measures (policies and procedures, IT security measures, etc.) in order to guarantee confidentiality and integrity of your personal data, and of the way in which it is processed. Furthermore, the OAC employees and Arbitrators ruling in arbitration proceedings are subject to confidentiality obligations and may not disclose your personal data in breach of the law.
7. What may you do in order to facilitate our protection of your data?
You may undertake the following activities personally in order to improve protection of your personal data:
- install antivirus software, antispyware software and a firewall and update them,
- always log out of the OAC Website immediately after ending work,
- keep your passwords confidential and apply the so-called strong passwords, i.e. avoid obvious combinations of letters and digits.
8. How long do we store your personal data?
We may store your personal data only as long as necessary for the purposes, for which it was collected in the first place, taking into account the obligations imposed by the law on permanent arbitration courts in the scope of archiving the files of arbitration proceedings.
9. Contacting the OAC
If you want to learn more about how your personal data is processed, you may contact us by writing to: email@example.com or by sending a letter to the address of the registered residence of the OAC.