The Warsaw Stock Exchange (GPW) pays special attention to ensuring personal data security.

This Privacy Policy describes in detail the processing of personal data obtained through the website, the legal basis of the processing, the methods of personal data collection and use, as well as natural persons whose data are processed.

Definition of personal data

Personal data mean any information relating to an identified or identifiable natural person.

GPW processes personal data for different purposes; different method of collection, legal basis of processing, and storage periods may apply depending on the purpose.

Data controller

The data controller is Giełda Papierów Wartościowych w Warszawie S.A. (Warsaw Stock Exchange) with its registered address at ul. Książęca 4, 00-490 Warsaw.

GPW has appointed a Data Protection Officer, who may be contacted on matters of data protection at .

Data security

GPW has taken many steps to protect your personal data as much as possible against loss, destruction or damage, in particular against unauthorized access, including technological and organisational security measures.

Purposes of processing

GPW (website or service) may collect the following personal data through the website:

  • Data for business contacts at the e-mail address presented on the website;
  • Data of senders of messages addressed to GPW at e-mail addresses presented on the website;
  • Data of candidates for President of the Exchange Management Board and members of the GPW Supervisory Board addressed to GPW at e-mail addresses presented on the website in the announcement of GPW’s General Meeting, and data of GPW shareholders nominating such candidates;
  • Data of candidates for employment, interns, trainees at dedicated e-mail addresses presented in the website sections Career or Internship, to which interested persons send applications;
  • Data provided during recorded telephone calls – calls are recorded at phone numbers dedicated to the processing of requests, in particular concerning trading sessions;
  • Data of participants of training courses, conferences and other events organised by GPW through registration forms available on the website;
  • Data of users of closed services who register in closed services on the website;
  • Data of GPW newsletter recipients;
  • Data of recipients of statistics at dedicated e-mail addresses, to which statistics request forms are sent.

The GPW online service includes a service dedicated to exchange education, through which GPW collects data of participants of educational competitions, participants of the educational platform GPWTrader.

The educational service collects data of participants of the Exchange School, which is organised and administered by the GPW Foundation with its registered address in Warsaw at ul. Książęca 4, 00-498 Warsaw. The GPW Foundation is a part of the GPW Group and pursues an educational mission as a provider of training and educational programmes in support of the development of the capital and commodity market, addressed to a broad audience. Information concerning the processing of personal data by the GPW Foundation is available in the registration forms of events organised by the GPW Foundation and in online services maintained by the GPW Foundation, including School Visits, Go4Poland.

Legal basis of the processing

Where processing is necessary for the performance of a contract to which the data subject is party (for instance, where processing is necessary to provide a service), the processing is based on the contract;

Where processing is necessary for compliance with a legal obligation, e.g., under tax law which requires evidence of provided services, the processing is based on the legal obligation;

Where personal data are processed for other purposes, the processing is based on the purposes if legitimate interests pursued by the data controller or on the consent of the data subject.

Storage period

Personal data processed by GPW are stored for a period of time considered necessary to achieve the purpose of their collection (including requirements of applicable legislation); the period may be longer if storage is necessary for the establishment, exercise or defence of claims related to the provision of services in which data are processed.

Data recipients

The following may have access to your personal data:

  • employees and associates of the Data Controller who are authorised to process your personal data;
  • data processors of the Data Controller, including providers of technical and organisational services (in particular, providers of information and communication services);
  • data recipients may include auditors, audit firms and consulting firms;
  • other entities, persons or authorities, to the extent and on the terms and conditions defined by law.

The above-mentioned entities will have access to your personal data in compliance with the law and in full conformity with the conditions of data security and confidentiality.


We use no profiling.

Rights in connection with the processing of personal data

Every person whose personal data are processed by the Data Controller has the right of access to their personal data, the right to rectification, erasure, restriction of processing, and portability, subject to the applicable legislation including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”).

Every person has the right to lodge a complaint with the President of the Personal Data Protection Office, to object to the processing of their personal data and, where processing is based on consent, to withdraw the consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

In particular, every person has the right to object to the processing of their personal data on the basis of legitimate interests pursued by the Data Controller and the right to object to the processing of their personal data for the purpose of marketing communication.


Cookies are used for the purposes of online service management and improved navigation.

Cookies provide statistical information on user traffic and use of GPW service pages. Every user may deactivate cookies in their browser, which may affect some functionalities available on websites. For details about cookies, read the Cookies Policy.


The online service collects anonymous data of view statistics based on Google Analytics. The tool uses cookies and does not provide any data which could be used to identify users.

The online service processes data provided during electronic communication: IP addresses of computers and other devices in ICT networks, logged by GPW’s IT systems, including in connection with the viewing of websites in the GPW domain; such data are processed in order to ensure the appropriate functionality and ICT security of GPW’s ICT systems.

The website features links redirecting users to social networks. GPW has no liability for any use of personal data and other information entered by users in social networks.

The online service may feature links to third-party websites. GPW is not liable for privacy policies pursued by owners of websites linked at the GPW online service.

Contact details of the Data Controller

Please send questions and requests concerning GPW’s processing of personal data by e-mail to: .