1. General Information

This Privacy Policy describes the rules for processing personal data within the iMKA mobile application, which is used for travel planning and purchasing public transport tickets within the Małopolska Agglomeration Card (MKA) system.

The Małopolska Roads Authority (ZDW) and the MKA system Operator place special emphasis on respecting the privacy of MKA system users. In accordance with the Act of August 29, 1997 on the Protection of Personal Data (Journal of Laws of 1997 No. 133, item 883, as amended) and the Regulation, ZDW and the Operator carefully select and apply appropriate technical and organizational measures to ensure adequate protection of the data being processed. In particular, they secure the data against unauthorized access and processing in violation of applicable laws. ZDW and the Operator continuously monitor the data processing process and limit access to the data as much as possible, granting appropriate authorizations only when necessary for the proper functioning of the MKA system.

The iMKA application downloaded from the store is unauthorized and has limited functionality. No personal data is processed in the unauthorized application.

Data Controller: Małopolska Roads Authority (ZDW) 56 Głowackiego St., 30-085 Kraków, Poland REGON: 000588890 NIP: 677-20-85-382 Main Office: (+48) 12 44-65-700 Secretary's Office: (+48) 12 44-65-701 Email: sekretariat@zdw.krakow.pl EPUAP: /ZDW/SkrytkaESP e-Delivery: AE:PL-33160-78502-WHTTC-19

2. Types of Personal Data Processed

When using the authorized version of the iMKA application, the following personal data may be processed:

• Unique client number in the MKA system
• First and last name
• Photograph
• Information regarding the entitlement to use transport services

These data are processed solely for the purpose of providing the functionality of the application, delivering transport services, and verifying the User's entitlements.

3. Legal Basis for Data Processing

Personal data are processed in accordance with Article 6, paragraph 1, letters a), c), and e) of the General Data Protection Regulation (GDPR), i.e. based on:

• the User's consent,
• the legal obligation of the Administrator,
• the performance of a task carried out in the public interest (public transport organization).

4. Data Sharing

Personal data may be shared exclusively with:

• Entities authorized to receive them under applicable laws,
• Entities supporting the Administrator in providing services, based on appropriate data processing agreements.

Data is not transferred outside the European Economic Area (EEA).
If ZDW receives information about a User’s unauthorized use of the service available via the application, ZDW may process the User's personal data to the extent necessary to establish the User’s liability, provided that ZDW records the fact and content of such information for evidentiary purposes. ZDW may, at its discretion, notify the User about unauthorized actions and request the immediate cessation of such activities, as well as invoke the rights described above.

5. Registration and Login

The creation of an account in the MKA system is done through the dedicated online portal. The iMKA application allows for subsequent login to the system and usage of its features after the application is authorized via an individual code.

6. Data Retention Period

Personal data is retained for as long as necessary to fulfill the processing purposes, i.e., providing services within the MKA system, and after the completion of these services for the period required by law or until the account is deleted by the User. In the case of data processed based on consent, they will be retained until the consent is withdrawn.

7. User Rights

Each User has the right to:

• Access their personal data,
• Correct, supplement, or rectify their data,
• Request the deletion of their data ("right to be forgotten"),
• Limit the processing of their data,
• Object to the processing of their data,
• Transfer their data,
• Withdraw consent at any time (if consent was the basis for processing).

To exercise these rights, Users can contact the Data Controller or use the functions available within their User Account.

8. Contact with the Data Protection Officer

The Administrator has appointed a Data Protection Officer who can be contacted via email at: iod@zdw.krakow.pl.

9. Right to File a Complaint

Users have the right to file a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw) if they believe that the processing of their personal data violates the provisions of the GDPR.

10. Data Security

The Administrator applies appropriate technical and organizational measures to ensure the security of personal data, in particular protecting it from unauthorized access, loss, or destruction.

11. Automatically Collected Data

The iMKA application does not use any analytical, tracking, or advertising mechanisms (such as Google Analytics, Firebase, AdMob). It does not collect data automatically, except for the essential technical information required for the app’s functionality.

12. Children

The application is not intended for children and does not intentionally process the data of individuals under the age of 16.

13. Changes to the Privacy Policy

The Administrator reserves the right to make changes to this Privacy Policy. Any changes will be published in the application and/or on the MKA system website.