§ 1 Basic Information

1. Respecting your rights as a data subject and complying with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and other relevant data protection regulations, we undertake to maintain the security and confidentiality of the personal data obtained from you.

2. This Privacy Policy of the FALA System (hereinafter: Policy) covers all data obtained by the Controller. Below we describe what information we collect, for what purpose, and in what manner and scope it is used.

3. The Policy also contains information on data security and rights regarding access and supervision over the provided information.

4. All capitalized terms have the meanings assigned to them in the Terms and Conditions of the FALA System, unless otherwise stated in this document.

5. InnoBaltica employees have been appropriately trained in the processing of personal data, and InnoBaltica, as the Data Controller, has implemented appropriate technical and organizational measures to ensure the highest degree of protection. In case of necessity, InnoBaltica cooperates with the supervisory authority in Poland, i.e., the President of the Personal Data Protection Office (PUODO).

6. Every recorded case of a security breach is documented and, if necessary, reported to PUODO and the data subjects.

§ 2 Data Controller

The Controller of personal data in the FALA mobile application and on the FALA portal (https://systemfala.pl) is InnoBaltica Sp. z o.o., entered into the Register of Entrepreneurs under KRS: 0000311943, NIP: 9571003404, REGON: 220639884, mailing address: ul. Lastadia 2, 80-880 Gdańsk. Email: innobaltica@innobaltica.pl.

§ 3 Data Protection Officer

1. The Controller has appointed a Data Protection Officer (DPO) and a Deputy DPO. Any inquiries or complaints regarding the processing of personal data (hereinafter: Requests) should be sent to: iod@innobaltica.pl.

2. The Request should clearly indicate: a) the data of the person(s) concerned, b) the event causing the Request, c) the specific demands, d) the expected method of resolving the matter.

§ 4 Purposes and Legal Bases for Processing

The primary goal is the organization of public transport in the public interest. Specific purposes include:

1. Service provision: Creating a User profile and providing FALA System services (Art. 6(1)(b) GDPR – performance of a contract).

2. Marketing and sales: Promoting services and enabling contact (Art. 6(1)(f) GDPR – legitimate interest).

3. Legal obligations: Handling complaints, archiving, and financial settlements (Art. 6(1)(c) GDPR in conjunction with Transport Law and tax regulations).

4. Discount entitlements: Processing data regarding encoded travel discounts (Art. 6(1)(a) and Art. 9(2)(a) GDPR – Passenger's consent).

§ 5 Personal Data Subject to Processing

1. Following the data minimization principle, we only process data necessary for the purposes in § 4.

2. Data is collected directly via forms in the Application or at Customer Service Points (POK).

3. Data collected for Card Users includes:

   • Name and surname, Image (optional), Location (validation), PESEL/Foreigner ID, Date of birth, Address, Bank account for refunds, Phone number (optional), E-mail (optional), FALA Card PIN.

4. For encoded discounts: type/number of entitlement document, issuing authority, and validity dates.

5. Technical data: IP address, Google Analytics data, and data from linked social media accounts (Facebook, Google, Apple).

§ 6 Change of Personal Data

A request to change data must be submitted in person at a POK or via the Customer Portal. If the change concerns data printed on the FALA Card, a new card must be issued for a fee according to the Terms and Conditions.

§ 7 Data Retention Period

Data is processed for the duration of the agreement. After termination, data is stored for 5 years from the end of the calendar year of termination to fulfill legal obligations and settle potential claims.

§ 8 Data Recipients

Data may be shared with:

1. Entities authorized by law (e.g., tax authorities, law enforcement).

2. Ticket issuers (e.g., ZTM Gdańsk, ZKM Gdynia, POLREGIO, SKM).

3. IT service providers, postal/courier operators, and card manufacturers.

§ 9 Rights of Individuals

You have the right to: access/copy data, rectification, erasure (right to be forgotten), restriction of processing, data portability, objection to marketing, and lodging a complaint with PUODO. You may also withdraw consent for discount data processing at any time.

§ 10 Obligation to Provide Data

Providing certain data is necessary for service provision. Failure to provide required information may result in the inability to use the FALA System.

§ 11 Automated Processing and Profiling

The system processes data automatically. This may include profiling to improve service quality and match offers to User expectations, but it does not produce legal or significantly similar effects.

§ 12 Trusted Partners and Service Providers

The Controller uses technology from: Asseco Data Systems, PIRIOS, Google LLC, Apple Inc., Facebook (Meta) Ireland Ltd., and Operator Płatności PeP.

§ 13 Transfer of Data Outside the EU

Data may be transferred to third countries (e.g., USA) by service providers. These entities declare the use of Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.

§ 14 In-App Payments

The Application collects payment card details only if provided by the User to link a card as a payment method or identifier. These are processed solely to handle transactions.

§ 15 Updates and Final Provisions

1. This Policy is effective as of October 13, 2025.

2. Any updates will be published on https://systemfala.pl. For significant changes, we may notify you via email.