Dear Sir or Madam,
The companies belonging to the Mostostal Capital Group take the security of your personal data and privacy very seriously. In accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"), we provide information below on how your data is processed and your rights in this respect.

1. Pursuant to Article 4(7) of the GDPR, the controller of your personal data is Mostostal S.A. with its registered office in Warsaw (01-531), at ul. Wybrzeże Gdyńskie 6B, entered into the register of entrepreneurs maintained by the District Court for the capital city of Warsaw. in Warsaw, under number 0000341646, Tax Identification Number (NIP): 5361788006, National Business Registry Number (REGON): 140410666 (hereinafter referred to as the "Company").
2. The Company has appointed a Data Protection Officer (DPO), who can be contacted regarding matters relating to personal data protection and the exercise of related rights. For this purpose, contact can be made by e-mail at rodo@mostostal-sa.pl or by traditional mail to the Company's registered office address.
3. Your personal data may be processed for the following purposes and legal bases:
a) conducting correspondence, including ongoing communication related to inquiries (e.g., inquiries regarding properties you are interested in), which constitutes the Company's legitimate interest (legal basis for data processing: Art. 6 sec. 1 letter f of the GDPR),
b) conducting direct marketing activities, which constitutes the Company's legitimate interest (legal basis for data processing: Art. 6 sec. 1 letter f of the GDPR),
c) sending commercial information electronically (by email) regarding property sales offers and other related services offered by Mostostal S.A. and other entities from the Mostostal Capital Group operating in Poland – if a specific individual has consented to receiving such information (legal basis for data processing: Article 6, paragraph 1, letter a of the GDPR),
d) for marketing communications using telecommunications terminal equipment and automated calling systems (phone calls, SMS/MMS messages) to present offers for the sale of premises and other related services offered by Mostostal S.A. and other entities from the Mostostal Capital Group operating in Poland – if the individual has given separate consent to such communication at the provided telephone number (legal basis for data processing: Article 6 paragraph 1 letter a) of the GDPR),
e) conducting statistical analyses, which constitutes the Company's legitimate interest (legal basis for data processing: Article 6 paragraph 1 letter f) of the GDPR),
f) storing data for archiving purposes and for the purpose of demonstrating the proper fulfillment of legal obligations incumbent on the Company, which constitutes its legitimate interest (legal basis for data processing: Article 6 paragraph 1 letter f) of the GDPR),
g) internal administration of business and administrative processes carried out within the Mostostal Capital Group, which constitutes the Company's legitimate interest (legal basis for data processing: Article 6 paragraph 1 letter f) of the GDPR). 4. Your personal data may be disclosed to the following entities:
a) entities supporting the Company in the field of technical and IT support (including the provision, implementation, and maintenance of software and IT equipment, hosting services, and the like),
b) marketing agencies providing services to the Company,
c) law firms providing services to the Company,
d) consulting, auditing, and advisory entities – within the scope of services provided by these entities to the Company,
e) conducting statistical analyses, which constitutes the Company's legitimate interest (legal basis for data processing: Article 6, paragraph 1, letter f of the GDPR),
f) storing data for archiving purposes and for demonstrating compliance with the Company's legal obligations, which constitutes its legitimate interest (legal basis for data processing: Article 6, paragraph 1, letter f of the GDPR),
g) internal administration of business and administrative processes carried out within the Mostostal Capital Group, which constitutes the Company's legitimate interest (legal basis for data processing: Article 6, paragraph 1, letter f of the GDPR).
4. Your personal data may be disclosed to the following entities:
a) entities supporting the Company in the scope of technical and IT support (including the delivery, implementation, and maintenance of software and IT hardware, hosting services, and the like),
b) marketing agencies providing services to the Company,
c) law firms providing services to the Company,
d) consulting, auditing, and advisory entities – within the scope of services provided by these entities to the Company,
e) entities providing financial intermediation services, interior finishing and design services,
f) entities from the Mostostal Capital Group – within the scope of administering internal administrative and business processes within the Capital Group.
5. Personal data may be transferred by the Company outside the European Economic Area (EEA). In such a case, the Company will ensure the legally required personal data protection measures, which may include (depending on the case): I) transferring data to an entity located in a third country in respect of which a decision has been issued confirming an adequate level of protection, in accordance with the requirements of Art. 45 GDPR; II) data transfers based on a data transfer agreement concluded with a third party based on Standard Contractual Clauses adopted by the European Commission; III) data transfers based on the adopted binding corporate rules referred to in Article 47 GDPR. The person whose data is transferred in the above-mentioned case has the right to obtain a copy of the information on the security measures applied. More information regarding the security measures applied by the Company regarding data transfers outside the EEA can be obtained by contacting us electronically at rodo@mostostal-sa.pl or by post to the Company's registered office.
6. The Company guarantees the right to exercise the rights provided for under the GDPR, i.e., the right to request access to one's personal data, the right to rectification, erasure, or restriction of processing, the right to data portability, and the right to object to their processing, under the terms and in the cases provided for in the GDPR. 7. Where the Company processes personal data to pursue legitimate interests (as mentioned above), we inform you of your right to object to the processing of your data for reasons relating to your particular situation, and also of your right to object at any time in the case of data processing for direct marketing purposes.
8. Where personal data is processed based on consent, we inform you of your right to withdraw consent at any time without providing a reason. However, this will not affect the lawfulness of data processing that took place before your consent was withdrawn. 9. Personal data will be retained by the Company:
a) for the period necessary for the Company to document its compliance with legal obligations before public administration authorities, including the personal data protection supervisory authority;
b) for archiving purposes, where this concerns the history of correspondence and responses to submitted inquiries – for a period no longer than 3 years from data collection;
c) for direct marketing purposes – until an objection to data processing is filed or the data is determined to be outdated;
d) for the purpose of sending commercial information electronically (by email) or marketing communications using telecommunications terminal equipment and automated calling systems – until consent to these purposes is withdrawn or the data is determined to be outdated.
10. We hereby inform you of the right to lodge a complaint regarding the processing of personal data with the supervisory authority, which is the President of the Personal Data Protection Office. 11. Your data will not be processed in an automated manner that could lead to decisions being made about you that would have legal effects or significantly affect your situation in a similar manner.
12. Providing personal data for the above-mentioned purposes is voluntary, but necessary for the processing of personal data.