Dear Sirs and Madams,

Companies belonging to the Mostostal Group (including Mostostal S.A. and companies affiliated with Mostostal S.A. and its shareholders) treat the issue of security and privacy of your personal data very seriously. Acting pursuant to requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”), below we would like to provide you with information about the way of processing your data and rights you have because of that.

1. Pursuant to Article 4(7) of the GDPR, your personal data controller is Mostostal S.A., with its registered office in Warsaw, at ul. Wybrzeże Gdyńskie 6B, 01-531 Warsaw, entered in the register of commercial undertakings of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, under file no. KRS 0000341646, NIP: 5361788006, REGON: 140410666, with the share capital of PLN 1,600,000.00, paid up in full (hereinafter referred to as the “Company”).
2. The Company has appointed a Data Protection Officer (DPO), who can be contacted about matters related to personal data protection and exercising the related rights. For this purpose, you can contact us by e-mail at: rodo@mostostal-sa.pl or by traditional mail at the address of the Company’s registered office.
3. Your personal data may be processed for the following purposes and on the following legal bases:
   
   1. for having correspondence, including ongoing communication regarding addressed inquiries (e.g. inquiries about residential units you are interested in), which constitutes the pursuit of the Company’s legitimate interest (the legal basis for data processing: Article 6(1)(f) of the GDPR),
   2. for conducting direct marketing activities, which constitutes the pursuit of the Company’s legitimate interest (legal basis for data processing: Article 6(1)(f) of the GDPR),
   3. for sending commercial information by electronic means (e-mail) concerning offers for the sale of residential units and other related services offered by Mostostal S.A. and other companies from the Mostostal Group operating in Poland – if a specific person has consented to receiving such information (legal basis for data processing: Article 6(1)(a) of the GDPR),
   4. for marketing communications using telecommunications terminal equipment and automatic calling systems (phone calls, text/MMS messages) to present offers for the sale of residential units and other related services offered by Mostostal S.A. and other companies from the Mostostal Group operating in Poland – if a specific person has given separate consent to such communications to the indicated telephone number (legal basis for data processing: Article 6(1)(a) of the GDPR),
   5. for performing statistical analyses, which constitutes the pursuit of the Company’s legitimate interest (legal basis for data processing: Article 6(1)(f) of the GDPR),
   6. for storing data for archiving purposes and in order to demonstrate compliance with legal obligations resting on the Company, which constitutes the pursuit of its legitimate interest (legal basis for the processing: Article 6(1)(f) of the GDPR),
   7. for internal administration of business and administrative processes carried out within the Mostostal Group, which constitutes the pursuit of the Company’s legitimate interest (legal basis for the processing: Article 6(1)(f) of the GDPR).
4. Your personal data may be disclosed to the following entities:
   
   1. entities supporting the Company by providing technical and IT services (including the delivery, implementation, and maintenance of software and IT equipment, hosting services, and similar services),
   2. marketing agencies providing services to the Company,
   3. law firms providing services to the Company,
   4. consulting, auditing, and advisory entities – with regard to the services provided by these entities to the Company,entities providing financial intermediation services, interior finishing and design services,
   5. companies from the Mostostal Group – with regard to management of internal administrative and business processes within the Mostostal Group.
5. Personal data may be transferred by the Company outside the European Economic Area (EEA). In such a case, the Company shall guarantee the legally required measures for the protection of personal data, which may be (as applicable): I) transfer of data to an entity located in a third country for which a decision has been issued confirming that the country ensures an adequate level of data protection, in accordance with the requirements of Article 45 of the GDPR, II) transfer of data on the basis of a data transfer agreement concluded with a third party based on Standard Contractual Clauses adopted by the European Commission’s decision, III) transfer of data within the framework of binding corporate rules as referred to in Article 47 of the GDPR. The person whose data are being transferred in the above case has the right to obtain a copy of the information on the security measures applied. For more information about the security measures used by the Company in relation to data transfers outside the EEA, please contact the Company by email at rodo@mostostal-sa.pl or by traditional mail to the address of the Company’s registered office.
6. The Company guarantees the right to exercise the rights provided for in the GDPR, i.e. the right to request access to your personal data, the right to rectify, erase or request restriction of processing, the right to transfer data, as well as the right to object to their processing, in accordance with the rules and in the cases provided for in the GDPR.
7. In the case of personal data processing by the Company for the purposes of pursuing legitimate interests (as referred to above), we would like to inform you that you have the right to object to the processing of your data for reasons related to your particular situation, and that you have the right to object at any time to the processing of your data for direct marketing purposes.
8. In cases where personal data are processed on the basis of consent, we would like to inform you of your right to withdraw your consent at any time without giving any reason, which will not, however, affect the lawfulness of the data processing that took place before the withdrawal of consent.
9. Personal data will be stored by the Company:
   
   1. for the period necessary for the Company to demonstrate compliance with its legal obligations before public administration authorities, including the personal data protection supervisory authority,
   2. for archiving purposes when it concerns the history of correspondence and responses to inquiries – no longer than for 3 years from the moment of acquiring the data,
   3. for direct marketing purposes – until an objection is made to the data processing or until the data are found to be outdated,
   4. for sending commercial information by electronic means (e-mail) or for marketing communications using telecommunications terminal equipment and automatic calling systems – until you withdraw your consent to pursue these purposes, or until the data are found to be outdated,
10. We would like to inform you about your right to lodge a complaint regarding the processing of personal data with the supervisory authority, which is the President of the Personal Data Protection Office.
11. Your data will not be processed in an automated manner that could simultaneously lead to decisions being made about you that have legal effects or similarly affect your situation significantly.
12. The provision of personal data for the above purposes is voluntary but necessary to accomplish the purposes.