GDPR and your data protection rights

1. Who is responsible for your data

The controller is Artur Januszczyk, conducting business under the name ARTUR JANUSZCZYK USŁUGI INFORMATYCZNE IN4SYSTEM, ul. Grodzieńska 9/65, 19-300 Ełk, Poland, Tax ID (NIP): 8481600751, REGON: 281090809, operating under the in4system brand. Contact: info@in4system.com.

The controller handles GDPR matters directly through the contact above. This notice supplements the Privacy and Cookie Policy, which contains the full table of processing purposes, legal bases, recipients, transfers and retention criteria.

2. Your GDPR rights

The availability of a right depends on the legal basis and circumstances of the processing. Exercising a right does not always require all data to be deleted; for example, tax law or the need to defend a claim may require limited continued retention.

3. How to exercise a right

Email info@in4system.com and describe the right you want to exercise and the context in which you dealt with us, such as an inquiry, newsletter subscription, invoice or client account. You do not need to quote an article number.

For security, we may ask for information necessary to verify identity. Do not send a password, full identity document scan or unrelated sensitive data unless we specifically explain why a narrowly limited document is necessary and provide a safe method.

• We respond without undue delay, normally within one month of receiving the request.
• For a complex request or several simultaneous requests, the period may be extended by up to two further months; we will explain the extension within the first month.
• Requests are generally free of charge. A reasonable fee or refusal is possible only where a request is manifestly unfounded or excessive, particularly because it is repetitive.
• If we cannot fulfil the request, we will explain the legal reason and inform you about the right to complain.

4. Objection and withdrawal are different

Use withdrawal when processing is based on consent, such as the newsletter. Use an objection when processing is based on our legitimate interest, such as certain B2B communication, service security or claims. For non-marketing objections we balance your particular situation against compelling legitimate grounds.

The fastest way to stop newsletter messages is the unique unsubscribe link in every campaign. You may also email us. We keep a limited suppression record where necessary to ensure the address is not accidentally reactivated.

5. Complaint to the supervisory authority

If you believe that processing infringes the GDPR, you may complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). The authority recommends first asking the controller to address the issue; this does not remove your right to complain.

Use the current complaint instructions and delivery addresses published by the authority, as office details and electronic delivery channels can change.

6. When data comes from another source

Business contact data may be supplied by your employer, client, authorized representative or project partner, or obtained from a public business register. In that situation we process identity, professional role, business contact details and communication connected with the project or relationship.

The basis is normally Article 6(1)(f) GDPR: our legitimate interest in identifying the correct representative, communicating about a project, verifying a business entity and documenting cooperation. We provide the Article 14 GDPR information within the required time unless a lawful exception applies, for example because you already have the information.

7. Voluntary and required information

8. Controller and processor roles in client projects

For our own website, business relationship, accounts, invoices and newsletter, in4system normally acts as controller. For customer databases and operational data handled only to build, host, maintain or support a client’s system, in4system may act as processor and the client determines the purposes and means.

Processor work is governed by a data processing agreement under Article 28 GDPR, including subject matter, duration, instructions, confidentiality, security, subprocessors, assistance with rights and deletion or return of data. Requests about data controlled by a client should normally be sent to that client; we will assist the client as required by the agreement.

9. Official legal sources

This notice is based on the GDPR, the Polish Personal Data Protection Act and, for electronic marketing and device storage, the Polish Electronic Communications Law. The official consolidated or current texts take precedence over this plain-language summary.