ATMOS WORKS sp. z o.o. (“ATMOS WORKS”, “we”, “us”) is committed to protecting personal data and processes such data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Polish Act on the Protection of Personal Data of 10 May 2018. This Privacy Policy explains how we collect, use, and safeguard personal data in connection with the website atmos-works.com (the “Website”).

1. Controller

The controller of personal data is:

Entity: ATMOS WORKS sp. z o.o.

Registered office: ul. Kołowa 8, 30-134 Kraków

Court of registration: District Court for Kraków – Śródmieście in Kraków, 11th Commercial Division of the National Court Register

KRS: 0001235395

NIP: 6772541124

REGON: 544505032

Share capital: PLN 50,000.00

Email: kb@atmos-works.com

You may contact us regarding any matter relating to the processing of your personal data:

• by sending written correspondence to our headquarters;
• by sending an email to the email address listed above.

2. Scope and categories of data

We process personal data in the following situations:

2.1 Contact and engagement requests. When you submit a request via the “Engagement Request” or “Request Systems Overview” forms, or contact us by email, we process the data you provide (e.g., name, organisation, professional email address, telephone number, role, and the content of your message).

2.2 Server logs. When you visit the Website, our hosting provider automatically records technical data necessary to deliver and secure the Website, including IP address, browser type and version, operating system, referring URL, date and time of access, and pages requested.

2.3 Cookies and analytics. We use cookies and similar technologies to operate, secure, and improve the Website, and to measure its use. See Section 8 for details.

3. Purposes and legal bases

We process personal data on the following legal bases:

• Necessary for the performance of a contract or to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR) — to verify and process inquiries regarding cooperation, analyse commercial inquiries, and maintain ongoing contact with business partners.
• Legitimate interests of ATMOS WORKS (Article 6(1)(f) GDPR), consisting of:
• ensuring security and business continuity – in particular, day-to-day operations, protection against cyberattacks, and the technical development of the Website and ICT systems;
• preventing abuse – in particular, combating fraud and abuse, and detecting and blocking attempts at unauthorized access to the company’s resources and systems;
• handling communication and managing relationships – in particular, conducting day-to-day correspondence, responding to inquiries, and archiving submissions for evidentiary purposes;
• verifying business partners and managing legal risk – in particular, verifying business partners based on European security frameworks, sanctions lists, and export-control regulations;
• establishing, pursuing, and defending claims – in particular, safeguarding the legal and financial interests of ATMOS WORKS and handling any civil or legal claims that may arise in connection with its business activities.
• Consent (Article 6(1)(a) GDPR) – for non-essential cookies and analytics, where required by law. You may withdraw your consent at any time.
• Legal obligations (Article 6(1)(c) GDPR) – to comply with applicable law, including accounting, tax, defence-procurement, and export-control obligations.

Engagement-related processing may also involve verification of counterparty status, including checks against EU and national restrictive-measures lists, and may rely on Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interests).

4. Recipients of data

Personal data may be entrusted to:

• our group company ATMOS Space Cargo GmbH and its affiliated entities, on a need-to-know basis;
• service providers acting as processors on our behalf (hosting, email, analytics, IT security, professional advisers);
• competent public authorities, where required by law or for the purposes of European security frameworks, sovereign procurement, or export controls.

All processors are bound by written data-processing agreements meeting the requirements of Article 28 GDPR.

5. External links

Our Website may contain links (references) to external third-party websites. These entities maintain their own independent privacy policies and terms of service, which the user should review upon visiting those sites. The Controller has no control over the content of these websites, their privacy practices, or their processing of personal data, and therefore assumes no responsibility or liability for the privacy rules applicable to external websites.

6. International transfers

Where we engage data processors (service and technology providers) and personal data is transferred outside the European Economic Area, such transfers take place subject to appropriate safeguards under Chapter V GDPR – typically by means of an adequacy decision or the European Commission’s Standard Contractual Clauses, supplemented by additional measures where required. A copy of the relevant safeguards may be obtained from us upon request.

7. Retention

We retain personal data only for as long as necessary for the purposes set out above. In particular:

• enquiry correspondence: up to 24 months from the last contact, unless a longer period is required for the establishment, exercise, or defence of legal claims, or for legal/regulatory reasons;
• server logs: for the period required for IT-security and analytics purposes, typically up to 12 months;
• accounting records: for the periods required by Polish tax and accounting law;
• cookie data: for the duration set out in our cookie information (see Section 8).

After expiry of the retention period, personal data is deleted or irreversibly anonymised.

8. Cookies and analytics

The Website uses cookies and similar technologies. We use:

• Strictly necessary cookies, required for the basic operation, security, and functionality of the Website. These cookies are set on the basis of our legitimate interest and do not require consent.
• Analytics cookies, used to measure and improve the use of the Website. These cookies are set only with your prior consent.

You can manage your cookie preferences via the cookie banner shown on your first visit and at any time via your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

A detailed list of cookies, their purposes, providers, and lifetimes is available in our Cookie Notice / cookie banner.

9. Your rights

Subject to the conditions set out in the GDPR, you have the right:

• of access (Article 15);
• to rectification (Article 16);
• to erasure (Article 17);
• to restriction of processing (Article 18);
• to data portability (Article 20);
• to object to processing carried out on the basis of legitimate interests (Article 21);
• to withdraw consent at any time (Article 7(3)), without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise your rights, please contact us at kb@atmos-works.com.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you consider that the processing of your personal data infringes the GDPR.

10. Automated decision-making

We do not carry out automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.

11. Security

We implement appropriate technical and organisational measures to protect personal data, consistent with our operation under European security frameworks. Notwithstanding such measures, no transmission of data over the Internet can be guaranteed to be entirely secure.

12. Provision of data

Providing personal data is voluntary, but constitutes a necessary condition to respond to your inquiry (for communication purposes) or to perform the required counterparty screening under European security frameworks and export controls (for business engagement purposes), and failure to provide such data will respectively result in the inability to process your request or establish business cooperation with ATMOS WORKS.

13. Changes

We may update this Privacy Policy from time to time to reflect changes in law, our operations, or the Website. The current version is identified by the “Last updated” date below.