IQFM Sp. z o.o. | Version: August 2026
1. Data Controller and Contact Details
The controller of your personal data is:
IQFM Sp. z o.o. ul. Wołodyjowskiego 46, 02-724 Warszawa, Poland | KRS: 0000211059 | NIP: 525-230-40-09
Contact details for personal-data matters:
- e-mail: piotr.witkowski@iqfm.pl
- phone: +48 511 880 319
- correspondence address: ul. Wołodyjowskiego 46, 02-724 Warszawa, Poland
IQFM Sp. z o.o. has not appointed a Data Protection Officer because there is no legal obligation to do so in relation to our activities. For matters concerning the processing of personal data, please contact the Controller directly using the details above.
2. When Does This Information Apply?
This information fulfils the information obligation under Articles 13 and 14 GDPR and covers the processing of personal data by IQFM in connection with:
- using the iqfm.pl website;
- contacting the company by contact form, e-mail or telephone;
- submitting requests for proposals, applications or complaints;
- using IQFM services and establishing business relationships;
- subscribing to a newsletter or providing another form of marketing consent;
- participating in recruitment processes.
For specific processes, such as recruitment or performance of an agreement, we may provide an additional detailed privacy notice appropriate to the particular purpose and relationship. A detailed description of data sources, security measures and processing rules is available in the Privacy Policy on iqfm.pl.
3. Purposes and Legal Bases of Processing
Depending on your relationship with IQFM and the data you provide, we may process personal data for the following purposes and on the following legal bases:
| Purpose of processing | Legal basis |
|---|---|
| Responding to a message or handling a contact enquiry | Article 6(1)(b) or (f) GDPR (steps taken prior to entering into a contract or the legitimate interest of conducting correspondence) |
| Entering into and performing an agreement, providing services and settlements | Article 6(1)(b) GDPR |
| Compliance with tax, accounting and other legal obligations | Article 6(1)(c) GDPR |
| Establishing, pursuing or defending claims | Article 6(1)(f) GDPR (legitimate interest) |
| Newsletter and electronic marketing communications | Article 6(1)(a) GDPR (freely given, specific and informed consent) |
| CCTV monitoring at the registered office | Article 6(1)(f) GDPR (legitimate interest in protecting persons and property) |
| Recruitment | Article 6(1)(b) GDPR and/or Article 6(1)(a) GDPR (consent to process data beyond the scope required by law) |
| Other purposes specified when voluntary consent is given | Article 6(1)(a) GDPR |
4. What Data May We Process?
The scope of the data processed depends on the method of contact and the relationship between us. It may include in particular:
- identification data: name and surname, company and job title;
- contact details: e-mail address, telephone number and correspondence address;
- the content of correspondence and enquiries;
- data necessary to perform an agreement or settle accounts, including billing details;
- basic technical data relating to website use, such as IP address and browser type, to the extent permitted by the Cookie Policy;
- job-candidate data, to the extent required by law or provided voluntarily.
Please do not provide data beyond what is genuinely necessary to deal with a matter. In particular, do not send sensitive data or special categories of personal data referred to in Article 9 GDPR unless this is expressly required in a specific situation.
5. Sources of Personal Data
As a rule, we receive personal data directly from you when you submit an enquiry, enter into an agreement, use the website or send recruitment documents.
In certain cases, data may be obtained indirectly, for example:
- from your employer or business partner when they identify you as a contact person for the performance of an agreement;
- from publicly available registers, such as KRS or CEIDG, to the extent necessary to verify a business partner or establish a business relationship;
- from social media, to the extent of interactions conducted through our profiles.
6. Recipients of Personal Data
Your data may be disclosed to:
- Processors acting on our behalf (Article 28 GDPR), including providers of hosting, e-mail, IT systems, legal and accounting services and subcontractors supporting service delivery, solely under data-processing agreements and our documented instructions.
- Public authorities authorised to obtain data under applicable law, including courts, law-enforcement authorities and tax authorities, solely to the extent required by law and after the statutory conditions have been met.
Your data is not sold or otherwise provided to third parties for payment.
7. Transfers Outside the European Economic Area
Some technology providers whose services we use, in particular Google Ireland Limited, may process data outside the European Economic Area. In each such case, data is transferred only with appropriate safeguards under the GDPR, in particular standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR) or a European Commission adequacy decision (Article 45 GDPR). At your request, we will provide information about the mechanism applicable to a particular provider.
8. Data Retention Periods
We retain data for the period necessary to achieve the purpose for which it was collected, taking into account:
- Correspondence and enquiries: until the matter is closed and for the period necessary to defend against possible claims.
- Agreement-related data: for the duration of the agreement and then for the period required by tax and accounting regulations (as a rule, five years from the end of the tax year) or for the limitation period applicable to claims.
- Data processed on the basis of consent: until consent is withdrawn or the purpose for which it was given ceases to apply, unless another independent legal basis permits further processing.
- CCTV monitoring: recordings are generally retained for no longer than 30 days. Where a recording may constitute evidence in proceedings, it is retained until the matter is finally resolved.
- Recruitment: until the recruitment process is completed. If you have separately consented to participation in future recruitment processes, for the period specified in that consent, but no longer than 12 months.
9. Your Rights
Subject to the rules and scope set out in the GDPR, you have the right to:
- access your data and obtain a copy of it (Article 15 GDPR);
- rectify or complete your data (Article 16 GDPR);
- erase your data - the “right to be forgotten” (Article 17 GDPR);
- restrict processing (Article 18 GDPR);
- data portability where processing is carried out by automated means on the basis of consent or an agreement (Article 20 GDPR);
- object to processing based on a legitimate interest, including profiling based on that interest (Article 21 GDPR);
- withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR).
The scope of each right depends on the legal basis and the circumstances of the particular processing. To exercise your rights, contact IQFM using the details provided in section 1 of this notice. We will respond without undue delay and, as a rule, within one month.
10. Right to Lodge a Complaint with a Supervisory Authority
If you believe that we process your personal data in breach of applicable law, you have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office ul. Stawki 2, 00-193 Warszawa, Poland | e-mail: kancelaria@uodo.gov.pl | phone: 606-950-000 | www.uodo.gov.pl
Before lodging a complaint, we encourage you to contact us first so that we can clarify the matter and respond to your request.
11. Is Providing Data Mandatory?
Providing data is generally voluntary, but it may be necessary to:
- respond to an enquiry or handle a request;
- enter into or perform an agreement;
- comply with an obligation imposed by law.
Failure to provide data may make it impossible to deal with a matter or provide a service. Where the obligation to provide data arises from law or is a condition of entering into an agreement, we will inform you in the relevant process.
12. Automated Decision-Making and Profiling
In connection with the use of iqfm.pl and the contact form, we do not make decisions concerning you based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you (Article 22 GDPR).
13. Changes to This Information
This information may be updated following changes in law, the scope of our activities or the tools and providers we use. We will communicate material changes in a manner appropriate to their nature. The date of the latest update is shown in the document header.