What is GDPR?

On May 25, 2018, the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, commonly known as the General Data Protection Regulation (“GDPR”), came into force.

The purpose of the GDPR is to ensure the security of personal data processing in accordance with existing threats and methods of processing.

HUTA ŁABĘDY S.A. processes your personal data to fulfill contracts, orders, and legal obligations. We strive to ensure that the amount of personal data collected from you is adequate for the processing purpose and that the process itself is carried out lawfully, fairly, and transparently while maintaining the integrity and confidentiality of your data.

Information on the processing of personal data

• Information for Contact Persons on the Contractor’s Side or Those Authorized to Represent Them Before Huta
• Data Controller and Data Protection Officer
• Purposes and Legal Bases for Processing
• Data Recipients
• Data Retention Period
• Rights Regarding Data Processing
• Automated Processing of Personal Data
• Information on the Requirement to Provide Data
• GDPR Clause for Shareholders
• GDPR Clause of Trigon Dom Maklerski S.A.
• Information Clause – Organization of the Steelworker’s Day 2023 and the 175th Anniversary of HUTA ŁABĘDY S.A. (Steelworker’s Day)

Information for Contact Persons on the Contractor’s Side or Those Authorized to Represent Them Before Huta

HUTA ŁABĘDY S.A. makes every effort to fulfill its information obligation towards individuals whose data it processes as a data controller. When collecting personal data directly from the data subject, HUTA provides the necessary information as required under Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR), at the time of data collection.

HUTA also makes every effort to ensure that in cases where personal data is not collected directly from the data subject but from another entity, the necessary information is also provided to the individuals whose data is being processed, in accordance with Article 14 of the GDPR. These details are communicated as soon as possible after obtaining the data or during the first contact with the data subject, whenever feasible.

In fulfilling the above obligations, we inform you that:

1. The Data Controller is HUTA ŁABĘDY S.A., headquartered in Gliwice at Anny Jagiellonki 45, hereinafter referred to as HUTA. You can contact the Data Controller in the following ways:
   1. By mail at: HUTA ŁABĘDY S.A., ul. Anny Jagiellonki 45, 44-109 Gliwice;
   2. By email at: office@hutalab.com.pl
2. The Data Controller has appointed a Data Protection Officer (DPO), who can be contacted via:
   1. Email: iod@hutalab.com.pl
   2. In writing: HUTA ŁABĘDY S.A., ul. Anny Jagiellonki 45, 44-109 Gliwice

   The Data Protection Officer can be contacted for any matters related to the processing of personal data.

3. The data of contact persons, representatives, or other individuals acting on behalf of a contractor will be processed for the following purposes:
   1. Conclusion, execution, and monitoring of the Agreement, in particular for the purpose of identifying individuals authorized to carry out tasks specified in the Agreement, including designated contact persons, representatives, individuals with access to confidential information of HUTA, or other persons acting on behalf of an entity that has entered into an Agreement with HUTA – in order to fulfill the legitimate interests of the Data Controller related to establishing the terms of the Agreement, facilitating communication regarding its execution, determining responsible persons authorized for contacts, and ensuring the security of facilities and confidential information (trade secrets), based on Article 6(1)(f) of the GDPR;
   2. Archiving, to the extent necessary to comply with legal obligations, particularly tax regulations and accounting laws – in order to fulfill a legal obligation imposed by law (Article 6(1)(c) of the GDPR);
   3. Pursuing claims or defending against claims – to fulfill the legitimate interests of the Data Controller in protecting its financial or non-financial rights or defending against claims, in accordance with general regulations, in particular the Civil Code (Article 6(1)(f) of the GDPR);
   4. Analytical and statistical purposes – to fulfill the legitimate interests of the Data Controller related to analyzing business performance, developing strategies and forecasts, and assessing contractor satisfaction (Article 6(1)(f) of the GDPR).
4. The processing of personal data includes the following categories of data: identification data (such as name, place of work, job position, and, in the case of representatives, also PESEL or an identity document number to confirm the identity of the representative), contact data (such as email address, phone number), as well as other data provided by the entity on whose behalf the individual acts (e.g., information contained in a power of attorney document).
5. Personal data may be shared with other data recipients, including entities processing personal data on behalf of HUTA (e.g., providing IT support services). Such entities process data based on an agreement with the Data Controller and strictly according to the Data Controller’s instructions.
6. Your personal data will not be transferred to third countries (outside the EU/EEA).
7. Personal data will be stored until the legitimate interests of HUTA, which form the basis for processing, are fulfilled, particularly those related to the expiration of potential claims arising from the contract between HUTA and the entity that provided the data.
8. You have the right to access your data and request its rectification, deletion, or restriction of processing. Upon request, the Data Controller will provide a copy of the processed data. To the extent that the legal basis for data processing is the legitimate interest of the Data Controller, you have the right to object to the processing of your personal data. To exercise these rights, you must contact the Data Controller or the Data Protection Officer using the contact details provided above. You also have the right to file a complaint with the data protection supervisory authority, namely the President of the Personal Data Protection Office (UODO).
9. The personal data of contact persons, representatives, attorneys, or other individuals designated as authorized to perform certain actions are provided to HUTA by the entities that designate them as contact persons or authorized representatives.

Data Controller and Data Protection Officer
The Data Controller of your personal data is HUTA ŁABĘDY S.A., headquartered in Gliwice (44-109) at Anny Jagiellonki 45 (hereinafter also referred to as the “Controller”).

You can contact us in the following ways:

1. By mail at: ul. Anny Jagiellonki 45, 44-109 Gliwice;
2. By email at: office@hutalab.com.pl
3. In person during office hours at the Management Support Department.

HUTA ŁABĘDY S.A. has appointed a Data Protection Officer (DPO). You can contact the DPO via email at: iod@hutalab.com.pl.

Purposes and Legal Basis for Processing
Your personal data will be processed for the following purposes:

1. To conclude and perform a contract – the legal basis for processing is Article 6(1)(b) of the GDPR;
2. To handle complaints and claims – the legal basis for processing is Article 6(1)(c) of the GDPR;
3. To fulfill legal obligations, including tax regulations, accounting laws, and the Commercial Companies Code – the legal basis for processing is Article 6(1)(c) of the GDPR;
4. For analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), where the legitimate interest of HUTA ŁABĘDY S.A. is to analyze business performance, develop strategies and forecasts, and assess contractor satisfaction;
5. To ensure communication between the Parties – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR);
6. To conduct marketing activities for the Controller’s own products and services without using electronic communication means, based on Article 6(1)(f) of the GDPR, where the legitimate interest of the Controller is to promote the business activities of HUTA ŁABĘDY S.A.;
7. With your consent, to conduct marketing activities for the Controller’s own products and services using electronic communication means, based on Article 6(1)(a) of the GDPR and other applicable laws requiring consent for such activities;
8. To fulfill the legitimate interest of HUTA ŁABĘDY S.A., consisting of potential establishment, exercise, or defense of legal claims – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR).

Data Recipients
Your personal data may be shared with:

1. Data processors in connection with the execution of contracts we have entered into, under which they have been entrusted with processing personal data, including, for example, providers of IT systems and IT services;
2. Entities to whom we provide personal data necessary for the provision of services on our behalf;
3. Entities based on contractual agreements, such as banks, for the purpose of processing payments;
4. Entities providing postal or courier services;
5. State authorities or other entities authorized to receive your data under applicable laws.

Data Retention Period
Personal data will be stored in a form that allows the identification of the data subject for no longer than necessary for the following purposes:

• For the performance of the contract(s) – until they are terminated or expire;
• For the establishment, exercise, or defense of legal claims – until the statute of limitations expires;
• For compliance with legal obligations – until the expiration of obligations arising from legal regulations.

For data processed based on your consent, it will be stored until you withdraw your consent or object to the processing, whichever occurs first.

Rights Regarding Processed Data

You have the right to:

1. Access your personal data;
2. Rectify (correct) your personal data;
3. Request the deletion of your personal data;
4. Request data portability, which includes the right to receive your data and transfer it to another controller or, where technically feasible, request that the data be transferred directly to another controller (applicable to data processed automatically for contract execution or based on consent);
5. Object to the processing of your personal data;
6. Withdraw your consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal (if processing is based on consent).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your personal data is not in compliance with the law.

Automated Processing of Personal Data

Your personal data will not be processed in an automated manner (including profiling) in such a way that any decisions would be made based on automated processing or that such processing would have legal effects or otherwise significantly impact you.

Information on the Requirement to Provide Data

Regarding the processing of personal data where it is necessary to fulfill a legal obligation imposed on the Controller, providing data is a statutory requirement.

For the processing of data for the conclusion and execution of a contract and for purposes arising from the legitimate interests pursued by the Controller, providing data is a contractual requirement. While providing personal data for the above-mentioned purposes is voluntary, it is necessary for the conclusion and execution of the contract with the Controller.

GDPR Clause for Shareholders

INFORMATION FOR SHAREHOLDERS, SHAREHOLDER REPRESENTATIVES, AND PROXIES OF “HUTA ŁABĘDY” S.A. REGARDING THE PROCESSING OF PERSONAL DATA
In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons regarding the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR), we inform you that:

1. The Data Controller of your personal data is “HUTA ŁABĘDY” S.A., headquartered at ul. Anny Jagiellonki 45, 44-109 Gliwice.
2. Your personal data will be processed:
   1. To fulfill the legal relationship between the company and the shareholder – for the period before the establishment of the legal relationship and during its duration, based on generally applicable legal regulations (Commercial Companies Code) – the legal basis for processing is Article 6(1)(c) of the GDPR;
   2. For maintaining the Share Ledger of HUTA ŁABĘDY S.A. – for the duration of maintaining the Share Ledger and after its closure, within the statutory period, based on a legal obligation imposed by legal regulations (Commercial Companies Code) – the legal basis for processing is Article 6(1)(c) of the GDPR;
   3. For creating and maintaining the Shareholder Register of HUTA ŁABĘDY S.A. – for the duration of maintaining the Register and after its closure, within the statutory period, based on a legal obligation imposed by legal regulations (Commercial Companies Code) – the legal basis for processing is Article 6(1)(c) of the GDPR;
   4. For archiving, to the extent necessary to fulfill legal obligations, particularly tax regulations, accounting regulations, regulations on the classification and qualification of documentation, and transferring archival materials to state archives – for the period specified by these regulations – the legal basis for processing is Article 6(1)(c) of the GDPR;
   5. For the potential establishment, exercise, or defense of legal claims – for the duration of legal proceedings and the period of limitation for potential claims – the legal basis for processing is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), where the legitimate interest of the Controller is to pursue claims or defend against claims.
3. Regarding the processing of your personal data, you have the following rights:
   1. The right to object to processing;
   2. The right to access your data;
   3. The right to rectify (correct) your data;
   4. The right to request the deletion of your data (the right to be forgotten);
   5. The right to restrict data processing;
   6. The right to data portability.
4. If you wish to exercise any of the rights listed above, you must submit a written request to the Data Controller at: HUTA ŁABĘDY S.A., ul. Anny Jagiellonki 45, 44-109 Gliwice or via email at: iod@hutalab.com.pl.
5. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe that the processing of your personal data violates GDPR regulations.
6. Providing your personal data is voluntary but necessary for acquiring and exercising shareholder rights.
7. Your personal data may be shared with:
   1. Other shareholders, in accordance with the provisions of the Commercial Companies Code;
   2. Data processors, in connection with the execution of contracts we have entered into, under which they have been entrusted with processing personal data, including the entity maintaining the Shareholder Register, IT system providers, and IT service providers;
   3. Entities with whom we share personal data necessary for providing services on our behalf, based on contractual agreements, such as banks for processing payments;
   4. Public authorities or other entities authorized to receive your data under applicable laws.