1. The Controller of Customers’ personal details provided in order to purchase the Ticket on the Website on the form for the purchase of the Ticket including: first name, patronymic (if applicable), last name, date of birth, sex, e-mail address, telephone number, nationality, passport number and series, is the Carrier with whom the specific Contract of Carriage is concluded.
   
   The scope of data required in order to purchase specific Tickets on the Website may differ depending on many factors, such as, in particular: requirements of a specific Carrier with whom the Contract of Carriage is concluded or the direction of the travel (it may also depend on the legislation of the transit countries through which the route goes and the country of destination).
   
   Carrier's data, including contact data, which can be used to contact the Carrier, are provided every time in the information on the specific route (which appears after entering in the search engine an inquiry concerning a specific route, before the purchase of the Ticket) and on the Ticket. The Operator makes every effort to ensure that the Carrier's data are specified in full in the aforementioned locations, and in case of any deficiencies in this respect, the Operator will provide the Customers with the missing data of the Carrier via e-mail: dpofficer@busfor.com.
   
   The aforementioned data are processed by the Operator for the purposes of conclusion and execution of the Contract of Carriage under an agreement for data processing concluded by the Operator with the specific Carrier.
2. The Controller of personal data of Customers provided on the Website and including: first name, patronymic (if applicable), last name, date of birth, sex, e-mail address, telephone number, nationality, passport number and series, country of residence (only for the application), IP address, for the purposes of Service provision and in case of granting such express consent by the Customer - for the purposes of receiving commercial information from the Operator - shall be the Operator (full data of the Operator are specified in sec. II(1) hereof).
   Customers may contact the Operator in matters concerning personal data:
   1. electronically to the Operator’s e-mail address: dpofficer@busfor.com;
   2. in writing to the address of the Operator’s registered office: www.busfor.pl Sp. z o.o., ul. Staromiejska 6/10d, 40-013 Katowice.

Personal data of Customers are processed for the following purposes and based on the legal bases mentioned hereinbelow:

1. in case when the Carrier is a controller - personal data are processed for the purposes related to the conclusion and execution of the Contract of Carriage, and in such case the legal basis for processing is the necessity of processing for the contract execution or to take actions at the request of the data subject before the conclusion of the contract (Art. 6(1)(b) of GDPR);
2. in case when the Operator is a controller - personal data are processed for the purposes of the provision of services electronically within the scope of provision of Contents to the Customers and the provision of Services, and in such case the legal basis for processing is the legitimate interest of the Operator (Art. 6(1)(f) of GDPR) consisting in the provision of Contents for the purposes of the operated business activity, or necessity of processing for the contract execution or to take actions at the request of the data subject before the conclusion of the contract (Art. 6(1)(b) of GDPR);
3. in case when the Operator and the Carrier are controllers - in case of contacting the Operator or the Carrier via their e-mail addresses (in case of the Operator - provided on the Website) or contacting the Operator or the Carrier to the telephone numbers provided by them (in case of the Operator - to the telephone number provided on the Website), in matters not related to Services and Contracts of Carriage - personal data are processed for the purpose of communication and settlement of the case that such contact concerns, and in such situation the legal basis for processing is the legitimate interest of the Operator or the Carrier (Art. (6)(1)(f) of GDPR), consisting in conducting correspondence and settling the case in connection with the operated business activity;
4. in case when the Operator and the Carrier are controllers - in case of contacting the Operator or the Carrier via their e-mail addresses (in case of the Operator - provided on the Website) or contacting the Operator or the Carrier to the telephone numbers provided by them (in case of the Operator - to the telephone number provided on the Website), in matters related to Services or Contracts of Carriage - personal data are processed for the purposes related to the performance of Services or the Contract of Carriage, and in such situation the legal basis for processing is the necessity of processing for the contract execution or to take actions at the request of the data subject before the conclusion of the contract (Art. 6(1)(b) of GDPR);
5. in case of the Operator as a controller - in case when the Customer subscribes to a newsletter - personal data are processed in order to send commercial information electronically by the Operator, and in this case the legal basis for processing is the consent of the data subject (Art. 6(1)(a) of GDPR);
6. in case of the Operator as a controller - personal data are processed for analytical and statistical purposes, and in this case the legal basis for processing is the legitimate interest of the Operator (Art. 6(1)(f) of GDPR) consisting in conducting analyses of activity of Customers, as well as their preferences, in order to improve the used functionalities and to improve the use of the Website, as well as to create an offer for Customers that fits them best;
7. in case of the Carrier as a controller - personal data are processed for analytical and statistical purposes, and in this case the legal basis for processing is the legitimate interest of the Carrier (Art. 6(1)(f) of GDPR) consisting in conducting analyses of activity of Customers, as well as their preferences, in order to improve the provided services and to create an offer for Customers that fits them best;
8. in case of the Operator and the Carrier as controllers - personal data are processed in order to possibly establish and enforce claims or to defend against them on the part of the Carrier or the Operator, and in this case the basis for processing is the legitimate interest of the Carrier or the Operator (Art. 6(1)(f) of GDPR) consisting on the protection of the rights of the Carrier or the Operator;
9. in case of the Operator and the Carrier as controllers - personal data are processed for the purposes of direct marketing related to own products and services of the Carrier or the Operator, in this case the Operator - selecting them in terms of the preferences or location of the Customer with the assistance of profiling, and in this case the basis for processing is the legitimate interest of the Carrier or the Operator (Art. 6(1)(f) of GDPR) consisting in the marketing of own services and products of the Carrier or the Operator, or the consent of the data subject (Art. 6(1)(a) of GDPR), in this case specified in sec. 5) hereinabove;
10. in case of the Operator and the Carrier as controllers - compliance with their legal obligations (Art. 6(1)(c) of GDPR), including providing answers to inquiries in situations resulting from applicable laws and performance of the activities provided for in laws.

1. in the process of concluding the Contract of Carriage - prevents the conclusion of the Contract of Carriage with the Carrier;
2. during the execution of the Contract of Carriage - prevents the fulfilment of the Customer's requests in the course of the execution of the Contract of Carriage;
3. in case of will to read the Contents on the Website - prevents or limits the possibility of viewing such Contents;
4. in case of contacting via e-mail address or to telephone numbers of the Carrier or the Operator - may prevent providing an answer to an inquiry or the performance of the activities expected by the Customer in response to the contact, and thus, it is a requirement for the purposes of full execution of the response and the contact;
5. in case of the Customer's will to use the Services provided on the Website - prevents the performance of a given Service according to the request of the Customer, and thus, provision of such data constitutes a requirement for the purposes of the performance of a specific Service for the Customer;
6. in case of the Customer's will to receive commercial information electronically - prevents the receipt of such information by the Customer, and thus, constitutes a requirement for the purposes of receiving such information.

In connection with personal data processing by the Carrier and the Operator as controllers, the Customer shall have the right, under the principles described in detail in GDPR, to:

1. request access to personal data

   (i.e. to obtain information on the personal data processing, including in particular on the purposes and legal bases of processing, the scope of the possessed data, entities to which personal data are disclosed and the planned date of their deletion and to receive a copy of such data);

2. have personal data rectified

   (i.e. to correct the incorrect personal data, including when the data are outdated, erroneous or incomplete);

3. delete personal data (“right to be forgotten”)

   (i.e. to request the deletion of data in cases specified in GDPR, i.e. in particular: when the data are no longer necessary for the purposes for which they were collected or processed otherwise, to withdraw the Customer's consent for data processing (providing that the Carrier or the Operator does not have the right to process data under any other legal basis); when the data are processed against the law; the necessity of deleting the data results from the legal obligation of the Carrier or the Operator);

4. limit personal data processing

   (i.e. to request the limitation to data processing in cases stipulated in GDPR; in case of making such a request to the Carrier or the Operator - the Carrier or the Operator, respectively, shall be obliged to limit operations on personal data within the scope and under the principles set forth in GDPR, generally to their storage);

5. object to personal data processing

   (i.e. to object personal data processing based on the legitimate interest of the Carrier or the Operator, in the manner binding for the Carrier or the Operator, providing that there are no other prevailing legally legitimate bases for data processing by the Carrier or the Operator.
   In particular, the Customer shall have the right to object to data processing for the purposes of direct marketing);

6. transfer personal data

   (i.e. to obtain from the Carrier or the Operator of the Customer's personal data provided to the Carrier or the Operator or to identify a different controller to which the Carrier or the Operator should transfer such data, providing that it is technically feasible);

7. withdraw the consent for data processing at any time, however without impact on the legality of processing performed based on the consent before its withdrawal;
8. lodge a complaint with a supervisory authority

   (i.e. with the President of the Personal Data Protection Office in case when the Customer decides that personal data processing violates applicable regulations concerning personal data protection).

The period of data retention by the Carrier and the Operator depends on the type of the service provided and the processing purpose. As a rule, personal data shall be retained for the period of the Service provision by the Operator or the execution of the Contract of Carriage and for the period resulting from the limitation of claims, consumer rights, accounting practices or other rights or obligations under applicable laws.

Personal data processed for the purposes of direct marketing are generally processed until an objection is raised with respect to their processing for such purpose, or until the consent is withdrawn (if the processing of such data is performed under the consent granted).

The recipients of personal data may be external entities, including in particular providers of IT services, entities serving payments (PayU S.A. with its registered office at the following address: ul. Grunwaldzka 18, 60-166 Poznań), entities providing accounting and legal services, entities providing marketing services, as well as entities to which the Carrier or the Operator is obliged to provide the personal data under mandatory rules of the law.

For the purposes of the performance of Services or the Contract of Carriage, personal data may be transferred, under Art. 46(2)(c) of GDPR or Art. 49(1)(b) of GDPR, to third countries within the meaning of GDPR (other than members of the EEA).

The aforementioned transfer to a third country within the meaning of GDPR may result in particular from the fact of cooperation of the Operator with related entities and service providers based outside the EEA, and it may also result from the fact that Carriers executing specific Contracts of Carriage on the territory (in full or in part) of such countries are based in third countries within the meaning of GDPR.

Personal data may be transferred to third countries within the meaning of GDPR, which the European Commission considered as not providing an adequate level of protection (under the principles described in GDPR), such as Belarus, Russia, Ukraine, the USA, Moldavia, Armenia, Serbia, Georgia, Montenegro, Kazakhstan. The list of third countries within the meaning of GDPR specified in the previous sentence may be ultimately extended together with the extension of the scope of cooperation of the Operator with the aforementioned entities, as well as with the extension of the list of Carriers, and in such case the Operator will update the privacy policy.

A trip to a specific third country within the meaning of GDPR is generally linked to the processing of personal data of the Customer in such third country within the meaning of GDPR.

In principle, the transfer to the aforementioned countries will take place if it is necessary for the execution of the contract between the Customer and the Carrier or the Operator or if it is necessary for the implementation of pre-contractual measures taken at the Customer's request (Art. 49(1)(b) of GDPR).

In addition, in order to ensure an adequate level of protection of the personal data transferred to the countries which the European Commission considered as not providing an adequate level of protection, standard contractual clauses will be applied concerning data protection adopted by the European Commission, as referred to in Art. 46(2)(c) of GDPR. The clauses are available at the website of the European Commission (ec.europa.eu) or at the Operator's (in the manner described in sec. III(1.2)). The aforementioned provision applies in particular to the entity operating under business name: Google LLC based in the United States of America.

In order to execute some marketing operations of the Operator, including the behavioural advertisement, the Operator may use the so-called profiling, and thus, through automatic data processing, perform the assessment of selected factors concerning Customers in order to analyse their behaviour or create a forecast for the future. Behavioural advertising consists in displaying advertisement contents for the Customer, which correspond to his/her interests or location, i.e. it consists in displaying a personalised advertisement that suits the preferences or the location of the Customer. 

In case of a behavioural advertisement, data processing (in particular data collected through Cookies/Local storage) may also include profiling of Customers, and the prerequisite for such processing is the consent for using Cookies/Local storage, which may be withdrawn at any time (more information on Cookies/local storage and the mentioned consent is provided in sec. IV hereof). Withdrawal of the consent concerning Cookies/Local storage will result in the cessation of the aforementioned profiling.

Processing data in an automated manner (including in the form of profiling) will not have any legal effect for Customers and will not have any significant impact on the situation of Customers.

In case when the Customer provides personal data of another Customer in order to purchase a Ticket for such another Customer, within the functionalities available on the Website and in accordance with the regulations of the Website, personal data of such another Customer are processed in accordance with the principles set forth in the Privacy Policy with respect to: first name, patronymic (if applicable), last name, date of birth, sex, e-mail address, telephone number, nationality, passport number and series.

The scope of data required in order to purchase specific Tickets on the Website may differ depending on many factors, such as in particular: requirements of a specific Carrier with whom the Contract of Carriage is concluded or the direction of the travel (it may also depend on the legislation of the transit countries through which the route goes and the country of destination).