Data Controller

The controller of your personal data is Aithernal PSA, with its registered office at ul. Mikołaja Kopernika 5/6, 00-367 Warsaw, Poland under KRS number: 0001142578, NIP: 8971946356, REGON: 54036389400000).

For all matters related to the processing of personal data, you may contact the Controller at: lm@aithernal.com.

Categories of Personal Data Collected

Depending on your interaction with our services, we may process the following personal data:

• email address (e.g. when subscribing to a newsletter),
• other personal data voluntarily provided via the website,
• data collected through cookies and similar technologies.

Purposes and Legal Bases for Processing

For website users:

• Newsletter subscription – for the purpose of providing the newsletter upon request (Article 6(1)(b) GDPR),
• Website analytics and optimisation – to analyse and improve the functionality of the website (Article 6(1)(f) GDPR – legitimate interest),
• Security and stability – to ensure the proper and secure operation of the website (Article 6(1)(f) GDPR – legitimate interest),
• Establishment, exercise or defence of legal claims – (Article 6(1)(f) GDPR – legitimate interest).

For social media users (e.g. Facebook, LinkedIn, Instagram):

• Brand promotion – to promote legal services and professional activity (Article 6(1)(f) GDPR – legitimate interest),
• Communication – to respond to messages, comments and inquiries (Article 6(1)(f) GDPR – legitimate interest).

Data Collection Methods

Personal data are collected directly from you when you:

• visit the website,
• follow or interact with social media profiles,
• subscribe to the newsletter,
• contact the Controller via available communication channels.

Data Retention Periods

Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected:

• processing based on consent – until consent is withdrawn,
• processing based on legitimate interest – until such interest ceases or an effective objection is raised,
• cookies – until their expiry or deletion from the user’s device.

Retention periods are subject to regular review to ensure compliance with the storage limitation principle under the GDPR.

Data Recipients

Personal data may be disclosed to:

• entities providing services supporting the Controller’s operations (e.g. accounting offices, legal advisors),
• IT and cloud service providers (e.g. Microsoft),
• hosting providers,
• marketing and analytics tool providers.

Personal data may also be disclosed to public authorities where required by applicable law.

Rights of Data Subjects

You have the following rights:

• the right of access to personal data,
• the right to rectification,
• the right to erasure (“right to be forgotten”),
• the right to restriction of processing,
• the right to data portability,
• the right to object to processing, including for direct marketing purposes,
• the right to withdraw consent at any time (without affecting the lawfulness of processing carried out prior to withdrawal),
• the right not to be subject to decisions based solely on automated processing, including profiling.

To exercise your rights, please contact: lm@aithernal.com.
The Controller may require identity verification before fulfilling the request.