PRIVACY POLICY AND COOKIES

1. Privacy Policy – general information
   • Privacy Policy and the use of Cookies on the website of the Barg Group – www.barg.pl [hereinafter called “the Website”]
   • The controller and owner of the website of the Barg Group – www.barg.pl is Barg S.A. based at Kazimierza Kamińskiego 28, 05-850, Ożarów Mazowiecki, entered into the register of entrepreneurs of the National Court Register managed by the district Court for the Capital City of Warsaw, 14th KRS Commercial Division under the number: 0000409608, NIP: 5242749164, REGON 145991691, share capital: PLN 1,260,000,00, paid in full., e-mail address: rodo-bargs.a@www.barg.pl, telephone number.: 22 814-04-23 [hereinafter called: “Barg”]. The list of companies within the Barg Group can be found here www.barg.pl. PKN Barg did not appoint the data protection supervisor. The Controller can be contacted via the contact data above.
   • Personal data specified in the Privacy Policy constitutes information about an identified or identifiable person to whom the data pertains, that is a person that can be directly or indirectly identified, particularly based on features such as: name and surname, ID number, location data, Internet ID or one or more characteristics describing a physical, physiological, genetic, psychological, economical, culture or social identity of an individual.
   • Barg process personal data of persons to whom the data pertains according to valid provisions of the law, particularly of the Polish law and the Regulation of the European Parliament and Council Regulation (UE) 2016/679, dated April 27^th 2016, on the protection of individuals with regard to the processing of personal data and of the free flow of such data and repealing the directive 95/46/WE (General Data Protection Regulation, GDPR).
   • Processing as understood by this Privacy Policy shall mean an action or a set of actions performed on the Personal Data or sets of Personal data, such as collecting, recording, organising, ordering, storing, adaptation or amendment, downloading and browsing, in an automated and non-automated manner. Personal Data is not profiled.

2. Scope and purpose of collecting data
   • The Controller processes the Personal Data within the website for the purposes of allowing for the use of functionalities of the Website, including automatic processing during the use of the Website, that is for the purpose of:
     • realisation of contracts and orders, including fulfilling obligations (art. 6 p. 1b of the GDPR); the processing period: the period of fulfilling the obligations, extended by the expiration period of claims resulting from the provisions of law;
     • initiating relations and managing business relationships, including responding to questions (art. 6 p. 1a of the GDPR); processing period: until an objection based on article 21 of the GDPR is filed, no more than 5 years, unless the data is processed with a different purpose and on different grounds;
     • ordering and sending newsletters (art. 6 p. 1a of the GDPR); processing period: until an objection based on article 21 of the GDPR is filed, no more than 5 years;
     • realisation of the legal obligation to manage and store documentation (art. 6 p. 1c of the GDPR); processing period: as long as the obligation to store VAT invoices, fiscal and accounting documents, including fiscal books, is valid;
     • guaranteeing proper management and functioning of the Website, as well as guaranteeing safety of use, including detecting misuse, generating reports and analyses, including traffic statistics of the webpages of the Website (art. 6 p. 1a of the GDPR); processing period: until an objection based on article 21 of the GDPR is filed, no more than 5 years, unless the data is processed with a different purpose and on different grounds;
   • The Personal Data collected by the Website shall be stored for 5 years counting from the end of the calendar year when the Personal data was used, unless the Personal Data is subject to shorter period of processing or the legal grounds of the processing changes. In such case another proper data processing period shall be applied. At the end of the storage period the Personal Data shall be erased or anonymised.
   • The Personal Data is provided on a voluntary basis, but it is necessary to realise one or more purposes of processing Personal Data defined in p. 2.1 above.

3. Cookies
   • Barg hereby informs that during the use of the Website, the system logs of the Website Store automatically collect Personal Data with Cookies.
   • Barg hereby informs that at the moment when the user connects to the Website, the system logs of the Website collect the information regarding the user’s number (including IP) and the type of the end device used by the user to connect the Website. Barg hereby informs that the data regarding the number (including IP) and the type of the user’s device, as well as the time of connection with the Website and other operating data regarding the user’s activity on the Website, is also processed legally. The data described above is processed for technical purposes to adjust the Website for the user’s needs and to collect other statistical information regarding the operation of the Website.
   • Barg uses Cookies to collect information on the use of the Website by users. Cookies files constitute IT data, particularly small text files, saved and stored on devices used by the users of the Website, which files allow for:
     • adjustment and optimisation of the Website to the user’s needs;
     • personalisation of marketing content;
     • ensuring safety and reliability of the Website.
   • The Website uses session Cookies, which are deleted after the browser window is closed, as well as permanent Cookies, stored for a specified period on the devices used by the user to access the Website.
   • At any moment the Website’s user may change the Cookies settings to define the conditions of their storage and their access to the user’s device. The user can change the settings specified in the previous sentence with the browser settings or service configuration. The settings can particularly be adjusted to deny the automatic Cookies in the browser settings or to always notify on storage of Cookies on the user’s device. Detailed information regarding Cookies is available in the user’s browser settings.
   • At any time, the user may delete the Cookies with use of functions available in the browser.
   • Limiting the use of Cookies may affect some of the functionalities of the Website.

4. Rights and responsibilities of Burg
   • Barg declares entrusting processing of Personal Data, on the grounds of a written contract concluded according to valid provisions, to entities providing hosting, administration, maintaining and managing services of the Website for Bard, as well as services in the scope of optimisation of content, services provided by PR and advertising agencies, legal and tax advisers, subcontractors of services and works.
   • Barg declares entrusting processing of Personal Data to companies within the Barg Group.
   • Personal Data can be processed on the territory of Poland, Member States of the European Union (EU), on the territory of a signatory of the European Economic Area Agreement (EAA).

5. Processing Personal Data by the Processing Entities
   • Processing Entities as understood by this Privacy Policy are entities, specified in p. 4.1 and 4.2, which process Personal Data at the order of or in agreement with Barg.
   • A Processing Entity is authorised and has the right to process Personal Data exclusively for the purposes and in the scope specified in this Privacy Policy.
   • Processing Entity processes the Personal Data according to the valid provisions of law, particularly the Processing Entity:
     • uses technical and organisational means required by the law, particularly in the scope of safety of processing Personal Data;
     • the means guaranteeing: i) possibility of continuous guarantee confidentiality, integrity, availability and resistance of the processing systems and services; ii) Possibility of quick restoration of personal data and access to it in case of a physical or technical incident; iii) regular testing, measuring and assessing the efficiency of the technical and organisational means used to guarantee the safety of processing;
     • implements means of protecting Personal Data at the level that is not inferior to the means used by Barg.
   • The Processing Entity may amend, erase or block the processed Personal Data only at the Controller’s order. If a person to whom the Personal Data pertains directly asks the Processing Entity for amendment or deletion of their Personal Data, the Processing Entity shall without unnecessary delays, no later than within 5 working days, communicate such request to Barg.
   • The Processing Entity shall not process Personal Data for other purposes than realisation of the responsibilities specified in this Privacy Policy. The Processing Entity may not disclose Personal Data to third persons.
   • The Processing Entity is responsible before the person to whom the Personal Data pertains for any damage which this person may experience as a result of an action or omission of the Processing Entity.

6. Rights and responsibilities of a person to whom Personal Data Pertains
   • The users of the Website have the following rights with regards to their Personal Data:
     • the right to access their Personal Data;
     • the right request amendment of their Personal Data;
     • the right to erase the Personal Data in situations specified in the provisions of law;
     • the right to file a complaint to a supervisory organ involved in the protection of personal data,
     • the right to limit the processing of their Personal Data.
   • If the Personal Data is processed based on consent or within a service (the data is necessary to provide a service), the user may additionally exercise the following rights:
     • the right to revoke the consent in the scope of these grounds for processing, Revoking the consent will not affect the legality of the processing completed based on the consent before the consent was revoked;
     • the right to transfer Personal Data, that is to obtain the Personal Data from the Controller in a structured, commonly used, machine-readable format, for the purposes of transferring it to a different controller of Personal Data.
   • In order to execute these rights Barg should be contacted. The contact data is specified above.

7. Final provisions
   • Matters not regulated in this Privacy Policy shall be governed by the provisions of law regarding processing Personal Data, including the GDPR.

Ożarów Mazowiecki, date: 10.11.2020.