Information Clause on the Processing of Personal Data for Contractors and Their Representatives

 In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, 4.05.2016, p. 1 and OJ EU L 127, 23.05.2018, p. 2), hereinafter referred to as "GDPR," we inform you that:

I. Data Controller

The controller of your personal data is ADREPUBLIC S.C., operating at the address: ul. Skośna 9, 05-119 Michałów-Reginów; NIP: 5361862949, REGON: 145872621.

II. Contact Information

The controller has not appointed a Data Protection Officer. For all matters related to personal data protection, you can contact the controller in the following ways:

1) By email: biuro@adrepublic.pl

2) By phone: 607 608 102

3) In writing to: ADREPUBLIC S.C., ul. Skośna 9, 05-119 Michałów-Reginów, with the note “Personal Data Protection.”

III. Legal Basis and Purposes for Processing Personal Data

1. Your personal data is processed for purposes related to the conclusion, performance, and management of the contract.

2. The legal basis for processing your personal data is as follows:

2.1. If you are a party to the contract:

- Article 6(1)(b) GDPR: The processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.

- Article 6(1)(c) GDPR: The processing is necessary for compliance with a legal obligation to which the Controller is subject, related to maintaining accounting records and tax documentation in accordance with applicable laws (e.g., the Accounting Act of September 29, 1994, or the Tax Ordinance Act of August 29, 1997).

- Article 6(1)(f) GDPR: The processing is necessary for the purposes of legitimate interests pursued by the Controller, such as ensuring continuous and uninterrupted business operations, internal administrative purposes (including service management), necessary settlements related to the contract, as well as establishing, asserting, or defending against claims.

2.2. If you are a representative of a legal entity or organization that is a party to the contract, or an employee or associate involved in the conclusion or performance of the contract: - Article 6(1)(f) GDPR: The processing is necessary for the purposes of the legitimate interests pursued by the Controller, such as determining the terms of the contract with the contractor, facilitating communication related to its performance, and identifying persons responsible for its execution or authorized for contact.

IV. Recipients of Personal Data

As a rule, personal data will not be transferred to other entities, except for:

1. Entities authorized to process data under legal provisions, particularly public authorities.

2. Entities supporting us in fulfilling our rights and obligations and in providing services, including those offering accounting, HR, legal, archiving, and document destruction services, as well as postal, courier, payment, marketing, and security services. Additionally, data may be shared with providers of sales platforms and IT systems, including those offering technical support and assistance for systems where your data is processed.

V. Transfer of Personal Data to a Third Country or International Organization

As a rule, the Controller does not transfer your personal data to a third country or an international organization. However, due to the transnational nature of data flows within social media services, your data may be transferred to a third country when using services such as Facebook. The Controller has no control over the data collected by the providers of online services or plugins. Facebook may transfer your data outside the European Economic Area (i.e., the EU countries, Iceland, Norway, and Liechtenstein). The rules for processing your personal data by Facebook Ireland are available at: https://www.facebook.com/privacy/explanation.

YouTube stores your data as user profiles and uses it for advertising, market research, and/or customizing its website. This analysis is conducted (even for users who are not logged in) to provide tailored advertising and inform other social network users about your activities. For more information on the purpose and scope of data collection and processing by YouTube, please review their privacy policy. Additional details about your rights and settings to protect your privacy can be found at: https://www.google.pl/intl/pl/policies/privacy.

VI. Retention Period for Personal Data

1. Your personal data will be stored only for the period necessary to fulfill the purpose for which it was collected or as specified by legal regulations.

2. After the purpose for collecting your personal data has been fulfilled, it may only be retained for archival purposes for a period determined in accordance with legal regulations.

VII. Rights of Data Subjects, Including Access to Personal Data

Under the provisions of GDPR, you have the right to request the Controller:

1) Access to the content of your personal data,

2) Rectification (correction) of your personal data,

3) Deletion of your personal data (e.g., when processing is not based on a legal obligation of the Controller or for establishing, asserting, or defending claims),

4) Restriction of the processing of your personal data,

5) Portability of your personal data (if processing is based on consent or a contract).

In addition, you have the right to object to the processing of your data in connection with a specific situation (this right applies, among others, when the Controller processes data to achieve its legitimate interests).

Please note that we may not always be able to fulfill your requests. The scope of your rights depends on the legal basis for processing your data and, in some cases, the methods of data collection.

VIII. Right to Withdraw Consent

1. For personal data that is optional and has been provided by you, you have the right to withdraw your consent at any time.

2. Withdrawal of consent does not affect the processing of your data carried out prior to its withdrawal.

IX. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates data protection laws, you have the right to file a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, located at ul. Stawki 2, 00-193 Warsaw.

X. Obligation/Voluntariness of Providing Data and Consequences of Non-Provision

Providing your personal data is a necessary condition for concluding and performing a contract and fulfilling the legal obligations of the Controller.

XI. Automated Decision-Making, Profiling

Your personal data may be processed automatically; however, this will not involve automated decision-making, including profiling.

B. If Personal Data Was Not Obtained Directly from You - in accordance with Article 14(1)(d) and Article 14(2)(f) of GDPR, we further inform you that:

I. Categories of Data

Depending on the circumstances, we may process the following categories of your personal data: basic identification data (e.g., name and surname), contact data (e.g., phone number, email address), address data (e.g., workplace address), and other employment-related data (e.g., job position). These categories of data are collected in adherence to the principle of adequacy, considering the purpose of the matter, and are primarily derived from applicable legal regulations.

II. Source of Personal Data

Your personal data may come from a contractor who provided the personal contact data of their representatives in the contract or from publicly available sources (e.g., a company website).