Information about the processing of personal data

To comply with the obligations arising from the Regulation (EU) 2016/679 of the EuropeanParliament and the Council of 27th April 2016 on protection of natural persons in relation to theprocessing of personal data and on free flow of such data and repealing Directive 95/46/EC(General Data Protection Regulation) hereinafter referred to as GDPR, INTERNATIONALVISA SERVICE Limited Liability Company Limited Partnership with the registered office inKatowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP: 9542766476, REGON:364718356, entered by the Katowice-Wschód District Court in Katowice, 8th Commercial
Division, under KRS number 0000623079 (hereinafter referred to as IVS), informs about theprocessing of the client’s personal data and the rights the client is entitled to. The following
rules are applicable as of May 25th, 2018.

1.

The controller of the personal data

INTERNATIONAL VISA SERVICE Limited Liability Company Limited Partnership with theregistered office in Katowice, ul. Graniczna 29 (29 Graniczna St.), 40-017 Katowice, NIP:9542766476, REGON: 364718356, entered by the Katowice-Wschód District Court in
Katowice, 8th Commercial Division, under KRS number 0000623079 is the controller of thepersonal data
Telephone number: +44 2031 293 603
E-mail address: support@evisa.express
2. Data protection officer

Aleksander Posmyk is the data protection officer at IVS, telephone +44 2031 293 603.

3. Purpose and legal basis of data processing

IVS processes personal data for the purpose of executing a contract to which the person whose
data are processed is a party, or to take actions at the request of the data subject before
concluding the contract (Article 6 par. 1 letter b of the GDPR).

In certain situations, IVS may process personal data due to the need to comply with legal
obligations to which IVS is subject (Article 6 par. 1 letter c of the GDPR), or the processing isnecessary to protect the vital interests of the data subject or another natural person (Article 6par. 1 letter d of the GDPR), or processing is necessary for the purposes of the legitimate
interests pursued by IVS (Article 6 par. 1 letter f of the GDPR), in particular, for the purpose
related to:1) marketing of IVS products and services,2) monitoring and improvement of the quality of services provided by IVS, including
monitoring of telephone conversations and meetings, carrying out customer satisfaction
surveys of services provided,3) if applicable, the conduct of disputable proceedings, as well as proceedings before
public authorities and other proceedings, including carrying on enquiry and defence
against claims.

In all other situations, personal data are processed solely on the basis of the consent granted forthe purpose specified in its content (Article 6 par. 1 letter a of the GDPR).

In all situations, sensitive personal data are processed solely on the basis of the consent granted
for the purpose specified in its content (Article 9 par. 2 letter a of the GDPR).

4. Recipients of data

IVS discloses or may disclose personal data to the following recipients or categories ofrecipients, in particular to:a) public authorities and relevant state offices, competent to process visa applications andto issue visas;b) entities that participate in the processes necessary to perform contracts concluded withclients, including banks, credit card operators, electronic and online payment agents,

c) entities which support IVS in business processes, including in particular entities

processing personal data for IVS (so-called data processors), inter alia:- hosting companies,- legal services and accounting services,- companies and external entities carrying out processes which are a part of the activities
necessary to conclude the contract with a client.
5. Time of data processing

The client’s personal data, including sensitive data provided on the basis of consent, areprocessed by IVS for the time necessary to achieve the objectives indicated in point 3, that is,until the contract is concluded. After that period, IVS may process the client’s data for a periodof time and to the extent specified by law or for the pursuit of the legitimate interest of thecontroller as in point. 3, however, no longer than 10 years. Insensitive data processed on thebasis of separate consent shall be kept until the consent is withdrawn.
6. The rights of data subjects

IVS guarantees all clients exercise of the data subject rights granted by the GDPR, including inparticular:
1. the right to access the personal data;
2. the right to request correction of the personal data which are incorrect and the right to request
supplementing of the incomplete personal data,
3. the right to request erasure of the personal data ("the right to be forgotten"), when:a) the personal data are no longer necessary for the purposes for which they have been collectedor otherwise processed;b) the data subject has withdrawn the consent on which the processing is based and there is noother legal ground for processing;c) the data subject objects to the processing;d) the personal data have been unlawfully processed;e) the personal data have to be erased for compliance with a legal obligation provided by lawf) the personal data have been collected in relation to the offer of information society services.
4. the right to request restriction of processing of the personal data when:a) the data subject challenges correctness of the personal data;b) the processing is unlawful and the data subject opposes to erasure of the personal data,
requesting to limit their use instead;c) the controller no longer needs the personal data for processing but it is necessary for the data
subject to establish an enquiry or defend their claims;d) the data subject has objected to the processing – pending determination of whether thelegitimate grounds on the part of the controller take precedence over the grounds of objection.
5. the right to transfer personal data if:a) the processing takes place on the basis of consent or on the basis of a contractb) the processing is automated
6. the right to object to the processing of personal data, if there are reasons related to the client’s
special situation and the processing results from indispensability for the purposes resulting fromlegally justified interests pursued by the controller.

7. Withdrawal of consent to data processing

To the extent of the client’s consent to processing of their personal data, the client is entitled towithdraw the consent at any time. The withdrawal takes place without affecting the legality ofthe processing which was carried out on the basis of the consent prior to its withdrawal.
8. The right to lodge a complaint with the supervisory authority

In any situation, when the client considers that IVS processes personal data contrary to theprovisions of the GDPR, the client has the right to lodge a complaint with the appropriatesupervisory authority.

9. Transfer of personal data to countries outside the European Economic Area

IVS transfers personal data to countries outside the European Economic Area:
Canada – the transfer of data is necessary for carrying out the contract of the visa agency. Inaddition, the Commission decision of 20th December 2001 stated that the regulations in force
in Canada ensure an adequate level of protection of personal data.
IVS may transfer personal data to third countries, in particular, to the US and internationalorganizations. The transfer of data takes place on the basis of standard contractual clausesagreed with the recipient, the content of which has been adopted by the European Commission
and ensures the highest standards of personal data protection applied on the market.
The client has the right to obtain a copy of the data transferred by IVS.

10. Obligation to provide personal data

Providing personal data is entirely voluntary. Providing data is a condition for concluding avisa contract with IVS or it is necessary to achieve the objectives arising from the legitimate
interests of IVS. Failure to provide all the data will prevent conclusion and execution of theindicated contract.