GDPR information notice

This English text is a translation provided for convenience. The legally binding version is the Polish GDPR notice. Version dated 15 August 2026.

In connection with the processing of the personal data of clients, car park users, subscribers, contact persons and other people using the services of TIS Partners sp. z o.o., in accordance with Art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, hereinafter "GDPR", we provide the following information.

1. Data controller

The controller of your personal data is TIS Partners sp. z o.o., with its registered office in Łódź, ul. Prezydenta Gabriela Narutowicza 26/28, 90-135 Łódź, entered in the register of entrepreneurs of the National Court Register under KRS 0000336300, NIP 7272750581, REGON 100743293, hereinafter the "Controller".

On matters relating to personal data protection and the exercise of your rights, please contact us:

• by e-mail: [email protected],
• in writing: TIS Partners sp. z o.o., ul. Prezydenta Gabriela Narutowicza 26/28, 90-135 Łódź.

2. Categories of data processed

Depending on the type of relationship with the Controller, the following may be processed in particular:

1. first name and surname,
2. company name and business identification data,
3. address of residence, registered office, correspondence, or an address indicated for issuing settlement documents,
4. NIP, where required to issue an invoice or identify the entrepreneur,
5. e-mail address and phone number,
6. vehicle registration number,
7. information on the contract, subscription, period of use of the car park and services provided,
8. data on payments, invoices and settlements, including bank account number where necessary, e.g. for a refund,
9. data on complaints, reports, correspondence and claims,
10. images of persons and vehicles and registration numbers recorded by video monitoring,
11. other data necessary to perform a specific service or fulfil a legal obligation.

The Controller does not collect the PESEL number or ID document number as a standard element of using the car park, unless in a specific, exceptional case there is a separate and justified legal basis for processing them.

3. Source of data

Data are obtained primarily directly from the person to whom they relate.

If a person acts as an employee, representative or contact person of a client that is an entrepreneur or other organisation, their data may be provided to the Controller by that entity.

Data in the form of images, vehicle images and registration numbers may be obtained via the video monitoring system in the car park.

4. Purposes and bases of processing

Conclusion and performance of a contract

Data are processed to:

• take steps before concluding a contract at the person’s request,
• conclude a contract,
• enable use of the car park,
• handle a subscription,
• contact regarding the performance of the service,
• settle amounts due under the contract.

The basis is Art. 6(1)(b) GDPR.

Fulfilment of legal obligations

Data may be processed to fulfil tax, accounting, documentary and other obligations imposed on the Controller by law. The basis is Art. 6(1)(c) GDPR.

Complaints, reports and claims

Data are processed to:

• handle complaints,
• clarify events,
• establish, pursue or defend claims,
• secure evidence relating to performance of the contract or an event in the car park.

The basis is Art. 6(1)(f) GDPR, the Controller’s legitimate interest in protecting its rights, clarifying disputes and ensuring the ability to pursue and defend claims.

Video monitoring and security

The car park may be covered by video monitoring. Monitoring serves to:

• ensure the safety of persons,
• protect property,
• prevent theft, damage and other incidents,
• clarify incidents,
• secure evidential material in the event of incidents.

Monitoring may record images of persons, vehicles, registration numbers and information about the place and time of an event. The basis is Art. 6(1)(f) GDPR, the Controller’s legitimate interest in ensuring the safety of persons and property and protection against claims and abuse. Monitoring is not used to control people’s behaviour for purposes other than those indicated above.

Contact and correspondence

If a person contacts the Controller on a matter not yet related to an existing contract, data may be processed to conduct correspondence and provide a reply. The basis is Art. 6(1)(f) GDPR, the Controller’s legitimate interest in communication. If the contact aims at concluding a contract, the basis may be Art. 6(1)(b) GDPR.

5. Retention period

Data are stored no longer than necessary for the purpose for which they were collected. In particular:

1. data necessary to perform the contract are processed for its duration;
2. after the contract ends, data may be kept for the period required by tax, accounting or other law;
3. data needed to establish, pursue or defend claims may be kept until the relevant limitation period expires, and if proceedings are commenced - until they are finally concluded and the decision enforced, where necessary;
4. complaint documentation is kept for the period needed to handle the complaint and then for the period needed to protect against possible claims;
5. data on enquiries that did not lead to a contract may be kept for up to 12 months from the end of the correspondence, unless earlier deletion is possible and justified or further storage is necessary to establish, pursue or defend claims;
6. video monitoring recordings are, as a rule, kept for 14 days from the recording date and are then deleted or overwritten.

If a recording constitutes or may constitute evidence in connection with an event, claim or proceedings conducted on the basis of law, the relevant fragment may be secured for the time needed to clarify the matter or to finally conclude the relevant proceedings.

6. Recipients of data

Data may be transferred to entities that support the Controller in running its business, to the extent necessary to perform the tasks entrusted to them, in particular:

• providers and maintainers of IT systems,
• providers of hosting, IT infrastructure, network and security services,
• entities supporting car park operations,
• payment operators and financial institutions, where necessary for payment or refund,
• accounting offices,
• tax advisers, lawyers and auditors,
• debt-recovery firms and entities pursuing amounts due,
• insurers, where necessary to handle a claim,
• postal and courier providers,
• administrative authorities, courts, prosecutors, the Police and other entities entitled to obtain data under the law.

Entities processing data on the Controller’s behalf may process them only under an appropriate agreement and within the entrusted activities, unless the law provides otherwise. The Controller does not sell personal data.

7. Transfers of data outside the European Economic Area

For the basic operation of the car park, the Controller primarily uses solutions intended to run the processes related to the parking service. When using the website, e-mail or other global IT services, some providers may process data outside the European Economic Area, in particular in the United States.

In such a case the Controller ensures that the transfer takes place in accordance with Chapter V of the GDPR, in particular:

• on the basis of a European Commission adequacy decision, including the EU-US Data Privacy Framework, where the recipient is covered by an appropriate decision, or
• on the basis of standard contractual clauses approved by the European Commission and, where necessary, additional safeguards.

Detailed information on the services used on parking.lodz.pl is provided in the privacy policy and cookies.

8. Rights of the data subject

Depending on the basis and circumstances of processing, the data subject has:

1. the right of access to data and to obtain a copy - Art. 15 GDPR;
2. the right to rectification - Art. 16 GDPR;
3. the right to erasure in the cases set out in Art. 17 GDPR;
4. the right to restriction of processing in the cases set out in Art. 18 GDPR;
5. the right to data portability - Art. 20 GDPR, where data are processed on the basis of consent or a contract and by automated means;
6. the right to object to processing based on Art. 6(1)(f) GDPR - Art. 21 GDPR;
7. the right to withdraw consent at any time, where processing is based on consent - Art. 7(3) GDPR.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. The individual rights are not absolute and apply in the cases and to the extent arising from the GDPR.

9. Right to object

Where data are processed on the basis of the Controller’s legitimate interest, i.e. Art. 6(1)(f) GDPR, a person may object at any time on grounds relating to their particular situation. The Controller will stop processing the data covered by the objection unless it demonstrates the existence of compelling legitimate grounds for further processing, overriding the interests, rights and freedoms of the person, or grounds for establishing, pursuing or defending claims.

If data were processed for direct marketing, a person may object at any time to such processing. After an objection, the data will no longer be processed for direct marketing.

10. Right to lodge a complaint

A person who considers that their personal data are processed in breach of the law has the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa.

11. Voluntariness and obligation to provide data

Providing data is, in principle, voluntary. However, providing data may be necessary to:

• prepare an offer,
• conclude and perform a contract,
• use a subscription,
• issue an invoice,
• make a refund,
• handle a complaint or a specific report.

Failure to provide data necessary to perform a given activity may make it impossible to carry out. Where the obligation to provide certain data arises directly from the law, the Controller will inform of this in the relevant case.

12. Automated decision-making

The Controller does not make decisions about clients or car park users based solely on automated processing, including profiling, that would produce legal effects concerning the person or similarly significantly affect them. Video monitoring is not used for such automated decision-making. When using parking.lodz.pl, analytics tools may be used on the terms described in the privacy policy and cookies.

13. Data of contact persons provided by a company

If a person’s data were provided to the Controller by their employer, principal, contractor or another entity, the Controller may process in particular the first name and surname, position or function, business contact details and information about the entity represented. The basis is Art. 6(1)(f) GDPR, the legitimate interest of the Controller and the entity represented by that person in enabling contact, carrying out cooperation and performing a contract. In such a case the data come from the entity that indicated the person as a representative or contact person.