Polfer Podzespoły Indukcyjne S.A.

PRIVACY POLICY

1. Who is responsible for your personal data? (Administrator)

Administrator of your personal data is POLFER S.A. Woźniki 25, 08-200 Łosice, entered into enterpreneurs register of National Court Register conducted by the District Court, 14th Commercial Division,

00-454 Warszawa, ul. Czerniakowska 100 NIP: 4960214541 REGON: 140698696

2. How to contact the Administrator?

On matters concerning the processing of your personal data by the Administrator, please contact us:

• by regular mail to the following address POLFER S.A. Woźniki 25,

08-200 Łosice or

• via e-mail: rodo@polfer.com.pl

3. On what basis and for what purpose do we process your personal data?

• Execution of the contract(s) concluded with POLFER S.A. (legal basis: Article 6(1)(b) GDPR);

• Fulfilment of legal obligations imposed on POLFER S.A. in connection with the conduct of its business activities and performance of contracts concluded (legal basis: Article 6(1)(c) GDPR);

• Internal administrative purposes of POLFER S.A., including statistics and internal reporting of POLFER S.A. (Legal basis: Article 6(1)(b), (c) RODO).

4. What rights do you have in relation to your personal data?

Under the provisions of the GDPR, you have a number of rights in relation to your own personal data. The following is a general description of your rights:

a) Access to personal data. You may exercise your right of access to your data at any time.

b) Correction and completion of data. You have the right to request from the Administrator the immediate rectification of your personal data which is inaccurate, as well as to request the completion of incomplete personal data.

c) Right to deletion of data. You have the right to request the Administrator to delete your personal data immediately in any of the following cases:

• when the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;

• when the person concerned has withdrawn the consent on which the processing is based and there is no other legal basis for the processing;

• when you object to the processing referred to in point e) below and there are no overriding legitimate grounds for the processing of those data;

• when personal data are processed unlawfully;

• when personal data must be removed in order to comply with a legal obligation under European Union or Polish law;

• when personal data has been collected in connection with the offering of information society services.

However, the controller will not be able to delete your personal data to the extent that the processing is necessary: (i) to exercise the right to freedom of expression and information, (ii) to comply with a legal obligation requiring processing under European Union or Polish law, (iii) to establish, assert or defend claims.

d) Right to limit the processing of data. You have the right to request the Administrator to restrict processing in cases where:

• you contest the accuracy of your personal data, for a period enabling the Administrator to verify the accuracy of that data;

• the processing is unlawful and you object to the erasure of your personal data, requesting instead that their use would be restricted;

• the Administrator no longer needs your personal data for the purposes of the processing, but you need them in order to establish, assert or defend your claims;

• you have objected to the processing referred to in point (e) below - until such time as it is ascertained whether the legitimate grounds on the part of the Administrator override your grounds for objection.

e) Right to object. You have the right to object to the processing of your personal data where the Administrator processes the data for legitimate interests, i.e. processing for direct marketing purposes. The Administrator may reject the objection if they prove the existence of compelling legitimate grounds for the processing which override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of claims.

f) Right to withdraw consent. To the extent that the processing of your personal data is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

g) Right to data portability. To the extent that your data is processed for the purpose of entering into and performing a contract or processed on the basis of consent and the processing of data is carried out in an automated manner - you have the right to receive from the Administrator your personal data which you have provided/provided prior to or in the course of your cooperation with the Company, in a structured, commonly used machine-readable format. You also have the right to send this personal data to another administrator.

(h) Right to complain. You have the right to file a complaint against the processing of your personal data by the Administrator to the supervisory authority, which in Poland is the President of the Office for Personal Data Protection.

The rights referred to in (a) to (g) above can be exercised by contacting us:

• by regular mail to the following address POLFER S.A. Woźniki 25, 08-200 Łosice or

• via e-mail address: rodo@polfer.pl

The right to lodge a complaint referred to in point h) above can be exercised by contacting the supervisory authority directly.

5. Processing of sensitive personal data

If you have a business relationship with the Administrator, your personal data are processed by the Company or third parties on the basis of a legitimate interest (Article 6(1)(f) GDPR).

Legitimate interest should be understood as direct marketing of services provided by the Administrator or third parties.

In the absence of a business relationship between you and the Administrator, your personal data are processed by the Company on the basis of your voluntary consent (Article 6(1)(a) GDPR).

If you give your consent, the Administrator is entitled to process your personal data for marketing purposes even after the contract between you and the Administrator has ended. The Administrator will not process your personal data if you withdraw your previously given consent. Processing carried out prior to revocation of consent shall continue to be lawful.

6. Submission of personal data The submission of personal data by you directly is voluntary. However, a refusal to provide data may - depending on the context in which the data are processed - prevent you from being contacted.

7. With whom do we share your personal data?

Your personal data is or may be processed by:

a) Employees employed and cooperators working under civil law contracts with POLFERS.A. who need to have access to the data;

b) Entities processing personal data on behalf of POLFER S.A. and participating in the performance of its activities, i.e.:

• Postal or courier service providers;

• Entities operating the company's ICT systems or providing the company with ICT tools, including hosting providers;

• Legal service providers;

c) Public administrative authorities, if this is provided for by law, administrative decision or court ruling.

8. Transfer of personal data to third countries

In the case of forwarding of your personal data to third countries, i.e. recipients located outside the European Economic Area or Switzerland in countries which, according to the European Commission, do not provide sufficient data protection (third countries not providing an adequate level of protection), the Administrator shall transfer them using mechanisms in accordance with the obligatory legislation, which include, among others, the following (1.) "Standard Contractual Clauses“ UE, (2.) obtaining a certification of compliance with the Privacy Shield by a third party (if based in the United States), (3) when the transfer of data takes place to a third country for which the European Commission has made a determination on the basis of a decision that the third country meets an adequate level of protection. More information on existing security measures implemented by the Administrator to ensure that personal data are processed in accordance with the relevant legislation as well as about the possibilities of obtaining a copy of the data or about the place where the data can be made available can be obtained by contacting us as indicated in point 2 above.

9. For how long are your personal data stored?

The Administrator shall make every effort to ensure that your personal data are processed adequately and for as long as necessary for the purposes for which they were collected. With this in mind, the Administrator shall keep your personal data for no longer than is necessary to fulfil the purposes for which the data was collected or, if necessary, in order to comply with applicable law, in particular the period for the performance of the contract and the period relating to limitation of claims.

10. Automated decision-making

The Administrator does not carry out automated decision-making, including profiling, based on the personal data provided.

11. Zmiany Polityki Prywatności

This Privacy Policy is subject to change, in particular if the need or obligation to make such changes arises from a change in relevant legislation, including changes to data recipients.

Persons whose data is processed in accordance with this Privacy Policy will be notified of changes to it in advance.

Administrator
POLFER S.A.

INFORMATION CLAUSE - VIDEO SURVEILLANCE

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (OJ EU L 119 of 4 May 2016), hereinafter referred to as "GDPR", please be informed:

1. The Administrator of your personal data collected by video surveillance is POLFER S.A., Woźniki 25, 08-200 Łosice, hereinafter referred to as the Company.

2. For matters concerning the protection of your personal data, you can contact us via the following e-mail address: rodo@polfer.com.pl, or in writing POLFER S.A., Woźniki 25, 08-200 Łosice.

3. Video surveillance is used solely to ensure the safety of persons on the Company's premises and to secure property in the area covered by the surveillance.

4.The area covered by monitoring is understood to be: the area around the Company's buildings, halls, warehouses, shop, pavement, entrance and exit gates, car parks.

5. Monitoring data is processed on the basis of Article 6(1)(f) GDPR, the legitimate interest of the Administrator.

6. All data recorded by the video surveillance cameras is saved on the data recorder and is stored for a period of 40 days after recording. After this date, the data is automatically overwritten.

7. The company secures incidents recorded by video surveillance that threaten the safety, life and health of persons, destruction and theft of property for evidential purposes:

• at the request of third parties,

• at the request of the investigating authorities,

• at the request of the Manager

Any safeguarding of events recorded by video surveillance shall take place upon written request to the Administrator.

Secured data from video surveillance is only made available to the authorities investigating the recorded event, e.g. the police, prosecutor's office, courts, which operate on the basis of separate regulations.

8. Monitoring data may be disclosed:

• to the competent authorities authorised in accordance with the applicable law, e.g. the police or the public prosecution service,

• to the entities processing personal data on behalf of the Company (e.g. providers of physical security and IT support services, system maintenance providers) whereby such entities process data on the basis of a contract with the Controller and only in accordance with the Controller's instructions

• authorised employees and co-operators of the Company.

Disclosure may only be made to the extent necessary and only on a valid legal basis for such disclosure consistent with the above-mentioned purposes of the processing.

9. Persons recorded by the monitoring system have the right to:

• access, correct, delete or restrict processing of their personal data,

• object to the processing, as well as to the transfer of data,

• to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

10. The data collected will not be used for the purposes of automated decision-making, including profiling.

11. Monitoring data will not be transferred to a third country or international organisation

12. You have the right to file a complaint with the supervisory authority, which is the President of the Office for the Protection of Personal Data. The provision of your personal data is voluntary but necessary in order to be present in the monitored area

Administrator
POLFER S.A.