GDPR Information Clause –
Processing of Personal Data

InStream sp. z o.o.

1. Personal Data Administrator
   The administrator of your personal data is InStream Sp. z o.o. with its registered office in Poznań (61-626), ul. Szelągowska 49, e-mail address: kontakt@instreamgroup.com.
   
2. Source, Scope, and Categories of Processed Data
   A. Source of Data.
   Your data was obtained from publicly available sources, specifically:
   – Public registers.
   – Company websites.
   – Professional industry portals.
   
   B. Scope of Processed Data.
   We only process personal data of a professional/business nature, i.e.:
   – First and last name.
   – Business email address.
   – Company name (employer) and position or function.
   
   We do not process special categories of personal data (Art. 9 GDPR).
   
3. Purpose and Legal Basis for Processing
   Your data is processed exclusively for B2B business purposes according to the following table:

Purpose of Processing	Legal Basis (GDPR)
Sending an inquiry regarding the possibility of establishing business contact (email contact)	Article 6(1)(f) GDPR – Legitimate interest of the Administrator.
Conducting business correspondence and maintaining commercial relationships (e.g., responding to inquiries)	Article 6(1)(f) GDPR – Legitimate interest of the Administrator
Fulfillment of legal obligations (e.g., maintaining compliance with Art. 21 GDPR – storing data of persons who have objected)	Article 6(1)(c) GDPR (Legal obligation) and Article 17(3)(e) GDPR (Defense against claims).

4. Data Recipients (Processors)
   We use only proven service providers who act on our behalf and ensure the highest security standards:
   a. Google LLC: Gmail, Google Drive, Google Workspace (Google Privacy Policy: https://policies.google.com/privacy).
   b. ClickUp Inc.: Project and task management platform (ClickUp Privacy Policy: https://clickup.com/terms/privacy).
   
   Transfer of Data Outside the EEA: Google and ClickUp are US providers. In July 2023, the European Commission adopted an adequacy decision for the EU-US Data Privacy Framework. The decision states that the United States provides an adequate level of protection –comparable to that of the European Union – for personal data transferred from the EU to US companies under the new framework. On the basis of the new adequacy decision, personal data can safely flow from the EU to US companies participating in the framework, and no additional data protection safeguards are necessary.
   Link to the decision: commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en
   
5. Data Retention Period
   Your data will be processed:
   a. For marketing purposes: For the duration of our business activities or until you file an effective objection.
   b. On a “Blacklist” (following an objection/deletion request): We will store your email address and information about the objection to the minimum extent necessary (Art. 17(3)(e) GDPR) for a period required to defend against claims (maximum 6 years from the end of marketing processing, as well as for the duration of proceedings before the UODO or a court). The email address itself will be processed as part of an exclusion list for as long as the Company provides mailing services and there is a risk of re-acquiring the address.
   
6. Your Rights
   You have full control over your data. Please note that in order to protect your data from unauthorized deletion, we may ask you to verify your identity. You have the following rights:
   a. Access to data (Art. 15 GDPR): Information on what data we process.
   b. Rectification (Art. 16 GDPR): Correcting your data.
   c. Erasure (Art. 17 GDPR): The “right to be forgotten” (subject to retention on a “Blacklist” to avoid future contact).
   d. Restriction of processing (Art. 18 GDPR).
   e. Data portability (Art. 20 GDPR).
   f. Right to object (Art. 21 GDPR): You may object at any time without providing a reason; we will immediately stop processing for that purpose.
   
7. Right to Lodge a Complaint
   If you believe the processing violates GDPR, you have the right to lodge a complaint with the supervisory authority:
   President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): ul. Stanisława Moniuszki 1A, 00-014 Warsaw.
   
8. Information on Profiling
   We do not perform profiling or make automated decisions that would have legal effects or significantly affect you.
   
   Last update: 13.10.2025.