PLAST-FARB data protection and privacy policy

We care about your privacy.

PLAST-FARB and PLAST-FARB Group entities pay special attention to the protection of personal data
and respect for privacy. We feel responsible for the security of personal data processed by us in
connection with our business. Our goal is to provide high quality services and to duly inform the people
whose data we process about the legal basis, how their personal data is collected and used, and their
rights.

Who is the administrator of your personal data?

The administrator of your personal data is PLAST-FARB Sp. z o. o. Sp. k. address: 87A Skłodowskiej-
Curie Street, 87-100 Toruń.

PLAST-FARB GROUP

PLAST-FARB Sp. z o. o. Sp. k. is part of a group of companies – PLAST-FARB Group, which
includes:

1. PLAST-FARB Sp. z o. o. Sp. k.with headquarters in Toruń
   Skłodowskiej-Curie Street 87A, 87-100 Toruń
2. PLAST-FARB Sp. z o. o. with its seat in Toruń
   Skłodowskiej-Curie 87A, 87-100 Toruń
3. TORPAK Sp. z o. o. with its registered seat in Czaple
   Czaple 30, 87-214 Płużnica
4. PLAST-FARB Józef Głowiński with its registered seat in Czaple
   Czaple 30, 87-214 Płużnica

We may have a legitimate interest in sharing some personal data with PLAST-FARB Group entities for
internal administrative purposes.

Cookies

To a limited extent, we may collect your personal information automatically via cookies. These are
small text files stored on your computer or other mobile device when you use websites. These files are
used, among other things, for the use of various functions provided on a given website or to confirm
that a given user has seen certain content from a given website. Among cookies, we can distinguish
those that are necessary for the operation of websites and those that, although not necessary for the
operation of websites, facilitate their use. The data that are stored relate to:

• the public IP address of the user’s computer;
• maintaining the user’s session;
• saving the state of the user’s session;
• remembering the user’s choice to stop displaying a selected message or to display it a certain number of times;
• restoring the user’s session;
• setting the user’s preferred language, font size and other such properties to facilitate the use of the application.

These data are not associated with specific people browsing our pages. The Cookies mechanism is not used to obtain
any information about users or to track their navigation. Cookies do not store any personal data or other information collected from users.

You can manage Cookies by changing the settings of your Internet browser. At the same time, we warn that if you reject cookies, some functions offered by our services may not work properly. If you do not change your settings, you accept the use of Cookies.

Access logs

We collect information regarding your use of our websites and public IP addresses based on analysis of
access logs. We use this information to diagnose server problems, analyze possible security breaches,
and manage the website. We use this data for statistical purposes, which usually include information
about the viewership of our sites. However, these compilations do not contain, as we emphasize, any
data that allows you to be identified – to determine your identity.

Links to other sites

Our websites may contain links to other websites. We cannot be held responsible for the privacy policies of these sites.
We suggest that when you go to other sites, you review the privacy policies and regulations established there.

What is personal data and what does it mean to process it?

Personal data means information about an identified or identifiable natural person through one or more
specific factors that determine physical, physiological, genetic, mental, economic, cultural or social
identity, including image, voice recording, contact data, location data, information contained in
correspondence, information collected through recording equipment or other similar technology.
Personal data processing is basically any action performed on personal data, whether or not it is carried
out by automated means, such as collecting, storing, recording, organizing, modifying, viewing, using,
sharing, restricting, deleting or destroying.

Pillars of data protection that guide us.

Legality – we take care to protect privacy and process personal data in accordance with the law.

Compatibility with purpose and appropriateness of data – we process personal data as part of processes
related to our business, only for the specific purposes for which they were collected. We follow the
principle of minimization of personal data. We limit ourselves to collecting only those personal data
that are needed to fulfill the specified purpose, which we inform you about at the time of data
collection. We make sure that by default only those data are collected that are necessary for the specific
purpose of processing.

Correctness of data – we take special care to ensure the substantive correctness of the data. We take
measures to ensure that incorrect personal data are promptly corrected or deleted.
Retention limitation – we keep personal data for no longer than it is needed to fulfill the purpose for
which it was collected. Data whose usefulness is reduced with the passage of time is deleted. However,
we may keep personal data for a longer period for archival purposes in the public interest, for scientific
or historical research, or for statistical purposes, which is considered to be in compliance with data
protection laws.

Security – We provide an adequate level of security for personal data. We have implemented personal
data security measures adequate to the risks. We conduct risk analysis on an ongoing basis to ensure
that your personal data is processed in a secure manner. Only authorized persons have access to your
personal data and only to the extent that it is necessary due to the tasks they perform. We take all
necessary measures to ensure that our subcontractors and other cooperating entities provide sufficient
guarantees of data security.
Data subjects’ rights – we enable data subjects to exercise their rights and we exercise those rights.

Accountability – we document how we comply with our obligations under data protection law so that
we can demonstrate compliance with the law at any time.

Personal data we collect – information you provide to us yourself.

We collect or ask you to provide personal information, in particular when:

• you contact us by email, phone, mail or other means;
• you request a quote, assistance, downloads or other information;
• you purchase a product, service or other solution;
• you sell us a product, service or other solution;
• you are our subcontractor or other collaborator;
• you join a recruitment process because you want to become our employee;
• you are our employee or collaborator.

The types of personal information we may ask for will usually be obvious to you at the time you
provide it, and may include: name; contact information (e.g., home address, email address, phone
number).

How do we use your personal data?

We process personal data for various purposes, and depending on the purpose, different methods of
collection, legal bases for processing, including sharing, and retention periods may apply.

We would like to point out that whenever we process your personal data on the basis of our legitimate
interest, we try to analyze and balance our interest and the potential impact on you (positive as well as
negative) and your rights under data protection laws. We do not process personal data based on our
legitimate interest in cases where we conclude that the impact on your person would outweigh our
interests (in which case we may process personal data if, for example, we obtain your consent or are
required or permitted to do so by law).

We only use the personal information we have received from you for the purposes described in this

Policy or for similar purposes specified at the time of collection of the personal information, in
particular, these purposes are related to:

• responding to inquiries made over the phone, to correspondence sent to us by email, postal
  mail;
• entering into contracts and their performance;
• carrying out direct marketing, in particular making
  offers about our products and services;
• conducting accounting and financial reporting;
• recruiting employees and hiring staff;
• investigating or defending against claims in the event of a legal need to prove facts;
• operating and managing our websites;
• security of property and persons on our premises.

What is our legal basis for processing your personal information?

Our legal basis for collecting and using the personal information described above will depend on the
type of personal information and the specific purpose for which we have collected or requested it.
Nevertheless, we generally collect personal data only when:

• the data is necessary for the provision of a service or the performance of a contract or agreement with
  you;
• we have your consent to do so;
• we are legally obliged to collect your personal data;
• the processing is in our legitimate interests and does not conflict with your data protection interests or fundamental
  rights and freedoms.

How long do we process personal data?

The length of time we may process your personal data depends on the legal basis for us to process your
personal data:

• when we process your personal data on the basis of consent, the period of processing lasts until you withdraw that consent;
• when we process your personal data in connection with the performance of a contract, the period of processing lasts until the performance of the contract or its termination;
• when we process your personal data on the basis of our legitimate interest, the period of processing lasts until the aforementioned interest ceases (e.g. the statute of limitations for civil law claims) or until you object to such processing – in situations where you are entitled to such an objection under the law;
• when we process your personal data because it is necessary due to applicable laws, the periods of processing for this purpose are determined by these laws (this is, for example, the obligation to store documents
  related to employment).

Email and traditional correspondence

If you send us correspondence via e-mail or postal mail unrelated to the contract concluded with you or
the services provided to you, the data contained in this correspondence will be processed by us for the
purpose of communication and resolution of the matter to which it relates. We only process personal
data relevant to the matter to which the correspondence relates in a manner that ensures its security.

The legal basis for the processing is our legitimate interest in conducting correspondence addressed to
us in connection with our business (Article 6(1)(f) of the RODO) and your consent expressed in the
form of an explicit action of sending correspondence to us (Article 6(1)(a) of the RODO).

We may also process your data for the purpose of possible investigation or defense against claims,
being the realization of our legitimate interest of securing information in case of legal need to prove
facts (Article 6(1)(f) RODO).

Video surveillance and access control

In order to ensure the security of persons and property, we apply access control to our facilities using a
video surveillance system and an entry and exit book. The basis for processing personal data is our
legitimate interest in ensuring the security of persons and property (Article 6(1)(f) of the DPA).
We may also process the data collected in this way for the purpose of possible investigation or defense
against claims, being the realization of our legitimate interest of securing information in case of legal
need to prove facts (Article 6(1)(f) RODO).

Recruitment of employees

As part of our recruitment processes, we expect you to provide personal data (e.g., in your resume or
CV) only to the extent specified in labor laws. If you also provide us with other data not required by us,
we will consider you to have given your consent to their processing. You may also withdraw such
consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
The data will not be considered by us in the recruitment process.

The purposes for which we process data in the recruitment process are:

• to carry out the job recruitment process – the legal basis for the processing of personal data is the
  necessity to take actions prior to the conclusion of a contract of employment (Art. 6(1)(b) RODO) and
  the fulfillment of obligations under the law, related to the employment process, including primarily the
  Labor Code (Art. 6(1)(c) RODO);
• with regard to data not required by law, the legal basis for processing
  is your consent (Art. 6(1)(a) RODO);
• implementation of future recruitment processes, based on your
  consent (art. 6(1)(a) RODO);
• possible investigation or defense against claims, being the realization of
  our legitimate interest of securing information in case of legal need to prove facts (art. 6(1)(f) RODO).

If we process your data based on your consent, you may withdraw it at any time, without affecting the
lawfulness of the processing carried out before its withdrawal. For the purposes of future recruitment
processes, we will delete your personal data no later than after one year, unless you withdraw your
consent earlier.

Provision of services or performance of contracts

If we collect personal data for purposes related to our provision of services or performance of a
contract, we will provide you with details of the processing of your personal data at the time of entering
into the contract.

Implementation of direct marketing

We may process your personal data for purposes related to the fulfillment of direct marketing. The
basis for the processing is our legitimate interest related to the contract concluded with you or to seek
to conclude a contract by providing information about our products and services (Article 6(1)(f)
RODO). Our sending of commercial information electronically in the form of e-mails, including
newsletters to the e-mail address indicated by you and in the form of text messages to the telephone
number indicated by you and the use of telecommunication terminal equipment – e-mail and telephone
for this purpose is based on your consent.

We may process data processed for direct marketing purposes until you object to its processing for this
purpose or withdraw your consent to carry out marketing using telecommunication terminal equipment,
including electronic communication means.

Collection of data in other cases

In connection with our business, we also collect personal data in other cases, such as during business
meetings or through the exchange of business cards. We process the personal data collected in this way
for purposes related to seeking to conclude a contract – the legal basis for processing data for us is the
necessity to take action before concluding a contract (Article 6(1)(b) of the RODO) and for purposes
related to initiating and maintaining business contacts – the legal basis for processing in this case is our
legitimate interest (Article 6(1)(f) of the RODO), consisting of networking in connection with our
business.

We may also process the data collected in this way for the purpose of possible investigation or defense
against claims, being the realization of our legitimate interest in securing information in case of legal
need to prove facts (Article 6(1)(f) RODO).

When and how do we share personal data with third parties?

We share your personal data with other parties only when we are permitted to do so by law.
Accordingly, we may share your personal data with the following categories of recipients:

• third-party service providers, i.e. entities providing hosting services for us, IT companies,
  subcontractors providing software delivery services, software or hardware maintenance services,
  companies providing accounting and human resources services, couriers, law firms, debt collection
  companies, auditors and auditors, tax advisors;
• law enforcement, regulatory and other public administration authorities, if we deem it necessary to share
  your personal data (A) in connection with and in a manner consistent with the requirements of applicable laws,
  (B) to exercise, establish or defend our rights (C) to protect your vital interests or those of third parties;
• cooperating entities, PLAST-FARB Sp. z o. o. Sp. k. is part of a group of companies – PLAST-FARB Group, we may share
  your personal data within the Group, based on our legitimate interest to fulfill internal administrative
  purposes.

Do we transfer data to third countries?

Your personal data may be transferred to and processed in countries other than the country where you
live, including countries outside the European Economic Area (EEA). These countries may have
different data protection laws than those in EU countries, however, in the process of selecting providers
of such solutions, we are guided by the provider’s compliance with stringent data security standards
equivalent to European standards (POPI, U.S. Privacy Shield, Swiss Privacy Shield, FISC), compliance
with ISO 27001, ISO 27017, ISO 27018 or equivalent U.S. standards SOC2 and SOC3.
Your rights and the ability to exercise them
You have certain rights regarding your personal data, we, as the data controller, are responsible for
exercising these rights in accordance with applicable laws. If you have any questions or concerns about
the scope and exercise of your rights, please contact us. We will respond to you via snail mail, unless
your request has been made by email or you have requested that we forward your response
electronically. In order to protect your privacy and ensure your security, we reserve the right to exercise
the following rights upon positive verification of your identity.

Access to your personal data

You have the right to access your personal data that we maintain as data controller and to receive a
copy of it.

Changing your personal data

You have the right to update your personal data and make changes if your personal data that we hold is
incorrect or incomplete.

Withdrawal of consent

Where we process your personal data on the basis of consent, you may withdraw that consent at any
time. The withdrawal of consent will not affect the lawfulness of the processing of your personal data
carried out prior to this withdrawal. We will inform you of this right at any time we collect consent and
allow you to withdraw your consent as easily as you gave it.

Right to restrict processing

You have the right to request the restriction of the processing of your personal data. This is granted
when:

• you question the accuracy of your personal data – for a period of time that allows us to check its
  accuracy;
• you object to our deletion of your data;
• you need us to keep your personal data because you need it to establish, assert or defend your claims.

If you make such a request, we will only be limited to storing your personal data until the reasons for
restricting processing cease.

Right to object

You may object to the processing of your personal data when:

• we process your personal data on the basis of a legitimate interest or for statistical purposes, and your
  objection is justified by your particular situation,
• we process your personal data for direct marketing
  purposes, including profiling them for that purpose.

Right to request erasure and right to data portability

You can exercise your right to erasure, e.g. when your personal data is no longer necessary for the
purposes for which it was collected by us, or when you withdraw your consent for us to process your
personal data, and when you object to the processing of your personal data or when your personal data
is processed unlawfully. Your data will also be deleted by us in order to comply with a legal obligation.

On the other hand, you have the right to data portability when we process your personal data on the
basis of your consent or a contract concluded with you, and when this processing is carried out by
automated means.

Right to lodge a complaint

You also have the right to file a complaint with the supervisory authority, which is the President of the
Office for Personal Data Protection

How can you contact us?

We provide detailed information about the processing of your personal data at the time of collection. If
you have questions about your personal data and the exercise of your rights, please contact us at:

e-mail address: rodo@plast-farb.com

postal address: PLAST-FARB Sp. z o. o. Sp. k., 87A Skłodowskiej-Curie Street, 87-100 Toruń

Whether and when changes to this Policy are possible?

We undertake to review this Data Protection and Privacy Policy on a regular basis and to amend it if it
becomes necessary or desirable due to new laws, new guidelines from authorities responsible for
overseeing data protection processes, best practices applied in the area of personal data protection
(Codes of Good Practice, if we are bound by such Codes, of which we will then inform you). We also
reserve the right to amend this Data Protection Policy in the event of changes in the technology by
which we process personal data (to the extent that such change affects the wording of this document),
as well as in the event of a change in the means, purposes or legal basis for our processing of personal
data.