Information on the processing of personal data in selected companies of the PCC Group

I. Who is the Personal Data Controller of your personal data?

This information applies to selected companies of the PCC Group. The list of companies is indicated at the end of this document in point XI ("PCC Group").

The PCC Group companies are separate Personal Data Controllers ("Personal Data"), i.e. they decide about the purposes and methods of its processing ("Personal Data Controller") - depending on which company you enter into the contract or conduct business relationships with, as a rule the given company will be your Personal Data Controller. However, it may happen that a specific company from the PCC Group performs activities for another company within the PCC Group, e.g. runs an accounting service - in this case, the company that performs the work does not become the Personal Data Controller of your Personal Data but processes it on the basis of the entrustment agreement concluded with the Personal Data Controller.

In most of the processes taking place within the PCC Group, the Personal Data Controller is PCC Rokita SA with its registered office in Brzeg Dolny (Sienkiewicza 4, 56-120 Brzeg Dolny), KRS0000105885 District Court for Wrocław-Fabryczna in Wrocław, IX Commercial Department of National Court Register, NIP 917-000-00-15, REGON 930613932, share capital 19 853 300 PLN, paid-in capital 19 853 300 PLN.

However, the information in this document applies to each of the PCC Group companies to the extent to which these companies are the Personal Data Controllers of the data processed by them.

If you have any questions about Personal Data, please contact us at the email address indicated in point XI.

II. How do we process Personal Data?

Personal Data means any information about an identified or identifiable individual. An identifiable natural person is a person who can be directly or indirectly identified, in particular on the basis of an identifier such as: name, identification number, location data, internet identifier or one or more specific factors determining physical, physiological, genetic, psychological, economic, cultural or social identity of a natural person.

The data is processed in accordance with the current regulations, including the General Regulation on the Protection of Personal Data (GDPR).

The Personal Data Controller declares that he is taking particular care to protect the interests of the data subjects and, in particular, ensures that:

1. he processes Personal Data in accordance with the law, fairly and transparently;
2. he collects Personal Data for specific, explicit and legitimate purposes and does not further process it in a manner inconsistent with these purposes;
3. Personal Data is adequate, relevant and limited to what is necessary for the purposes for which it is processed;
4. Personal Data is correct and updated as necessary;
5. Personal Data is stored in a form that permits identification of the data subject for no longer than is necessary for the purpose for which the Data is processed;
6. he processes Personal Data in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organizational measures.

III. When do we process Personal Data?

We process Personal Data as a Personal Data Controller in many situations. These may be situations in which you have provided your Personal Data to us personally through various communication channels (e.g. submitting your application, submitting an inquiry / offer via email, telephone or via forms on our websites) or within the scope of our cooperation when signing or implementing a contract (including a contract concluded remotely, as part of the provision of electronic services). We also process your Personal Data obtained from other sources (e.g. from a company you cooperate with and which is our contractor / client, including other companies in the PCC Group).

IV. Data Processing in relation to commercial and business relationships or a contact.

a. What Personal Data do we process?

As a Personal Data Controller, we process the Personal Data of our clients and business partners and their employees / co-workers, Personal Data of other people provided to us as part of the contracts or making contact with us via telephone, e-mail or forms on our websites.

In relation to these relationships, we may process the following Personal Data: identification data, contact details, job position data and professional qualifications, and other Personal Data provided to us in connection with cooperation or contact.

We collect the above Personal Data directly from you as well as from other people, e.g. from your employers / clients.

b. What is the purpose and legal basis of Personal Data processing?

In relation to the above relationships, we process Personal Data for the following purposes:

• establishing cooperation;
• conclusion and performance of the contract;
• settlement of contracts;
• answering any questions or requests addressed to us and conduct further correspondence / contact in this regard;
• marketing and contact regarding other information and services of the Personal Data Controller;
• defence against potential claims, as well as for the purpose of claim management;
• fulfilling the Personal Data Controller's legal obligations (e.g. regarding public, tax and accounting companies, regarding the processing of complaints).

The basis for the processing of your Personal Data is:

• indispensability to perform the contract or take action before its conclusion at the request of the data subject;
• implementation of legal obligations imposed on the Personal Data Controller;
• the legitimate interest of the Personal Data Controller in the form of marketing of products and services of the Personal Data Controller or a third party; contact, including correspondence and defence against potential claims.

Providing Personal Data is voluntary, but it may be necessary to conclude or perform a contract or to respond to an inquiry or to conduct correspondence.

c. How long will Personal Data be processed?

Personal Data collected for the purposes of the conclusion and performance of the contract will be processed for the duration of the contract or until you object to the processing based on our legitimate interest, unless the law (for example, archiving, tax, accounting regulations) will oblige us to prolong the processing of this Personal Data, or we will keep it longer in case of potential claims, for a period of limitation specified by law - depending on which of these periods is longer.

Your Personal Data provided as part of contact with us will be processed for the period necessary to answer and possibly conduct correspondence, and then for the limitation period for the possible claims.

V. Processing of Personal Data in connection with entering the premises

a. What Personal Data do we process?

PCC Rokita SA with its registered office in Brzeg Dolny, Sienkiewicza 4 Street (56-120) is the Personal Data Controller of the data collected due to entry and stay on the premises of PCC Rokita SA, including data from monitoring, identification data and the image of persons.

Part of your Data used for identification, the Personal Data Controller might receive from the entity who reports your visit via the notification system. As a rule, it is an entity you are employed with (we collect data for security reasons).

b. What is the purpose and legal basis of Personal Data processing?

Your Personal Data will be processed:

• in order to ensure an appropriate level of security within the premises, which are also used by other companies from the PCC Group,
• in order to ensure security of persons and property, in particular for the purposes of restricting access to selected zones / areas to authorized persons only,
• for purposes related to the possibility of disputes between you and the Personal Data Controller.

The basis for the processing of your Personal Data is:

• the legitimate interest of the Personal Data Controller or a third party, including companies from the PCC Group, consisting in ensuring an adequate level of security within the premises, protection of property and defence against potential claims and their management,
• its indispensability to protect the vital interests of the data subject or another natural person.

Submission of Data by you is voluntary, but necessary to enter and stay on the premises of the Personal Data Controller (failure to provide Data will result in the lack of access / entry and stay at PCC Rokita SA).

c. How long will Personal Data be processed?

Your Data is stored by the Personal Data Controller for the period of limitation of potential claims which is determined by law (in particular the Civil Code), unless the law will oblige us to process the Data for a longer period of time, or until you make an objection. In the case of recordings from monitoring, we will store them for a period of three months, unless the recordings are evidence in legal proceedings or the Personal Data Controller received information that they may be evidence in the proceedings - in this case, the period of limitation is extended until the final conclusion of the proceedings.

VI. Processing of Personal Data in connection with recruitment.

Due to the fact that the recruitment processes within the PCC Group are run and managed by the Centrum Wspierania Biznesu "Partner" Sp. z o.o. with headquarters in Brzeg Dolny, Sienkiewicza 4 Street (56-120), most often this company is the Personal Data Controller of the data included in your application and other data collected during the recruitment process.

a. What Personal Data do we process?

As a Personal Data Controller, we process Personal Data of people applying for employment, transferred by any available recruitment channels, in particular we process all Personal Data provided in the application and collected as part of the recruitment process.

In connection with recruitment, we may process the following Personal Data (processing of some Personal Data may depend on your consent): Identification data, contact details, education, skills and past employment data, rights data and other Personal Data provided to us in during the recruitment process.

b. What is the purpose and legal basis of Personal Data processing?

In connection with recruitment, we process Personal Data for the following purposes:

• consideration of the applications and implementation of the recruitment process, and if consent was granted, also for the purposes of future recruitment or recruitment within the PCC Group;
• defence against potential claims, as well as for the purpose of claim management.

The legal ground for the processing of your Data is: taking action at the request of the data subject, before concluding the contract, the provisions of applicable law, in particular the Labour Code and executive acts, and in the broader scope than specified in these provisions or for the future recruitment processes - your consent.

The legal basis for the processing of Personal Data related to the defence against potential claims is the legitimate interest of the Personal Data Controller.

Providing Personal Data is voluntary, but necessary to carry out the recruitment process and to establish possible further cooperation.

We may create a summary of information about you based on the received Data - your professional profile (in this case, the legal basis for data processing is also our legitimate interest in finding and adjusting job positions that may suit your preferences).

c. Recruitment in the PCC Group

The Personal Data Controller manages, supervises and often identifies recruitment needs within the PCC Group, so in order for your application to be used in the most effective manner, we ask you to grant access to your Data, including the summary created by the Personal Data Controller, to selected companies from PCC Group, which will increase your chances of employment (we do not allow all companies from the PCC Group to have access to your Data, but only those whose recruitment processes correspond to your profile). Due to the high flexibility and dynamic changes within the PCC Group personnel policy, including policy of those entities that ultimately would be your employer, the lack of such consent in practice makes it impossible to participate in the recruitment processes within the PCC Group.

d. How long will Personal Data be processed?

The Data is stored by the Personal Data Controller for the duration of the recruitment process or, depending on your additional voluntary consent, for future recruitment processes or until the consent is withdrawn, and it will be deleted in each case two years after its receipt, unless the law obliges us to process this Data for a longer period, or we will keep it longer in case of potential claims, during the limitation period prescribed by law, in particular the labour code or civil code (in each case a longer processing period applies).

VII. Processing of Personal Data in connection with investor relations.

a. What Personal Data do we process?

As a Personal Data Controller, we process the Personal Data of our investors collected in connection with the purchase of our securities.

In connection with investor relations, we may process the following Personal Data: identification data, contact details, emission details and other Personal Data provided to us for further cooperation or contact.

Your Personal Data may have been made available to the Personal Data Controller by a relevant entity accepting subscriptions under the issuance of securities, whose services you have used for this purpose.

b. What is the purpose and legal basis of Personal Data processing?

We process Personal Data for the following purposes:

• implementation of the contract for the purchase of securities;
• the exercise of rights arising from the securities held;
• purchase of securities or their redemption;
• tax and accounting;
• marketing of own products and services;
• marketing of products and services of entities within the PCC Group, including information about the financial situation and issues of securities maintained by entities from the PCC Capital Group;
• dealing with potential disputes.

The basis for the processing of Personal Data by the Personal Data Controller is:

• indispensability to perform the contract or take action before its conclusion at the request of the data subject;
• implementation of legal obligations imposed on the Personal Data Controller;
• the legitimate interest of the Personal Data Controller in the form of marketing of products and services of the Personal Data Controller or a third party; contact, including correspondence and defence against potential claims.

Providing Personal Data is voluntary, but it may be necessary to conclude or perform a contract or to respond to an inquiry or to conduct correspondence.

c. How long will Personal Data be processed?

Personal Data collected for the purposes of the conclusion and performance of the contract will be processed for the duration of the contract or until you submit an objection to the processing based on our legitimate interest, unless the law (e.g. law regarding archiving, tax, accounting, issue of securities) will oblige us to process this data for a longer period or we will keep it longer in case of potential claims, for a period of limitation specified by law - depending on which period is longer.

VIII. Who is the recipient of Personal Data?

Personal information we process may be transferred to entities that support us in fulfilment of agreements, sending e-mails and in the event of some advertising activities - also in marketing campaigns, ensure support and operation of ICT tools and systems (e.g. data storage), and also to entities who send packages, ensure ongoing legal support, conduct audits, provide services of scanning, printing, handling correspondence, archiving and destroying documents, etc., online payments operators or banks – in the event of performing financial settlements, to entities cooperating with the Controller as part of the sales services, in the event of monitoring - also to security companies, including, as part of the above activities, to companies from the PCC Group.

In the case of recruitment, your Personal Data may also be transferred to entities that technically or organizationally help us recruit employees, (including communication with candidates), and, with your consent, to selected companies from the PCC Group for recruitment purposes, which will increase your employability (we do not allow all companies from the PCC Group to have access to your Personal Data, but only those whose recruitment processes match your profile).

In the case of investor relations, your Personal Data may be transferred also to the National Depository for Securities [KDPW S.A.], Stock Exchange [Gielda Papierow Wartosciowych S.A.], Polish Financial Supervision Authority [Komisja Nadzoru Finansowego], entities authorized to keep records in the case of bonds that do not have the form of a document, in accordance with Art. 8 sec. 2 of the Act of 15 January 2015 on bonds (Journal of Laws [Dz.U.] of 2015, item 238).

Personal Data processed by us in connection with access to confidential information may also be provided to competent authorities, at their request, in particular the Polish Financial Supervision Authority.

Your personal information may be transferred also to the economic information office, credit bureau, entities purchasing debts, patent office and other institutions specified by the legal regulations.

IX. Personal Data outside the European Economic Area (EEA)

If, in the future, Personal Data should be transferred to a place outside the EEA, the Personal Data Controller shall take appropriate steps to ensure the protection of Personal Data, in particular by:

• the use of specific contractual clauses called "standard contractual clauses" that have been approved by the European Commission; or
• transfer to countries for which the European Commission has issued a decision stating the appropriate level of protection.

In this case, you have the right to obtain information about security, by contacting us in the matter of protection of Personal Data by e-mail to the address indicated in point. XI.

X. What rights do you have?

In any case, you have the right to:

1. access to Personal Data (including, for example, receiving information which Personal Data is processed),
2. request for correction and limitation of processing of Personal Data (e.g. if it is incorrect);
3. deletion of Personal Data (e.g. in the event that it was processed unlawfully);
4. transfer of Personal Data that has been provided to the Personal Data Controller, and which is processed in an automated manner, and the processing takes place on the basis of consent or under a contract, e.g. to another Personal Data Controller;
5. object to the processing of Personal Data processed on the basis of indispensability for purposes arising from legitimate interests pursued by the Personal Data Controller or by a third party, in particular in the case of processing for marketing purposes;
6. lodging a complaint to the President of the Office for Personal Data Protection.

If the processing of Personal Data takes place on the basis of consent, you have the right to withdraw it at any time without affecting the legality of the processing which had been made on the basis of consent before its withdrawal.

XI. List of PCC Group companies covered by this Policy.