Information on data protection

The Interzero Group companies, viz: Interzero Organizacja Odzysku Opakowań S.A., Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A. take the protection and security of your data very seriously and take this into account in all their business activities. In this data protection notice, we would like to provide an overview of the aspects of our online services that are relevant to data protection legislation.

In the following paragraphs we will explain:

• What data we collect when you use our online services.
• For what purposes the companies: Interzero Organizacja Odzysku Opakowań S.A., Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A. process the data.
• What rights and possibilities you have in relation to the processing of your data.
• How you can contact us about data protection.

What does this data protection notice cover?

This data protection notice applies to the online services provided by Interzero Organizacja Odzysku Opakowań S.A., Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o. as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A..

on the interzero.co.uk domain and on the social media accounts operated by Interzero on the portals Facebook, Twitter, LinkedIn i Xing (hereinafter referred to as "social media accounts"). The online services of Interzero companies other than those mentioned above are subject to individual data protection notices, which can be viewed on the websites in question.

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (OJ EU. L. 2016, No. 119, p. 1) (RODO), the joint data controllers are:

• Interzero Organizacja Odzysku Opakowań S.A. with its registered office in Warsaw, 165 Wiertnicza St., 02-952 Warsaw, entered in the register of entrepreneurs by the District Court for the capital city of Warsaw in Warsaw, 13th Economic Division of the National Court Register, under the KRS number 0000266658, share capital: PLN 2,500,000.00, paid in full, NIP 5213409980, REGON 140718909, BDO 000000172;
• Interzero Advisory Spółka z o.o. with its registered office in Warsaw, 165 Wiertnicza St., 02-952 Warsaw, entered in the register of entrepreneurs by the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under the KRS number 0000676980, share capital: PLN 100,000.00, paid in full, NIP 1132335293, REGON 017443900, BDO 000518378;
• Interzero Polska Sp. z o.o. with registered office in Warsaw, 165 Wiertnicza St., 02-952 Warsaw, entered in the register of entrepreneurs by the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under the KRS number 0000459881, share capital: 105,000.00 PLN, paid in full, NIP 9512367010, REGON 146653200, BDO 000009153;
• Interzero Organizacja Odzysku Opakowań i Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A. with registered office in Kraków, ul. Mogilska 65, 31-545 Kraków, entered into the register of entrepreneurs by the District Court for the capital city of Warsaw in Warsaw, 13th Economic Division of the National Court Register, under the KRS number 0000925732, share capital: PLN 5,000,000.00, paid in full, NIP 9512530326, REGON 520530764, BDO 000552505.

Where the words "we", "us" or "Interzero" are used herein, this shall mean exclusively Interzero Organizacja Odzysku Opakowań S.A. and Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o. as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A..

We would like to inform you that the Joint Administrators have appointed a Data Protection Officer - Ms Agnieszka Radtke.

For all data protection issues, you can contact the DPO by writing toiod@interzero.plor by traditional post to ul. Wiertnicza 165, 02-952 Warsaw.

Interzero Organizacja Odzysku Opakowań S.A., Interzero Polska Sp. z o. o., Interzero Advisory Spółka z o.o. as well as Interzero Organizacja Odzysku Opakowań and Interzero Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A. have concluded an appropriate agreement on the co-management of your personal data. We have agreed that we will co-operate in the case of your exercise of the rights referred to below, but that Interzero Organizacja Odzysku Opakowań S.A. will be responsible for taking the necessary measures, e.g. will be responsible for correcting your personal data in the event of a request for rectification. The above arrangements do not affect the fact that you can exercise your rights vis-à-vis each of the joint controllers separately.

Interzero is represented on the following networks of its own social media accounts:

• Facebook
• Twitter
• LinkedIn
• Xing

On these pages we keep you up to date with the latest news from Interzero and all that we do, and we are happy to use the facilities provided by social networks to communicate directly with their members.

However, please note that we do not have full control over the processing of your data by social networks. Therefore, please check carefully what personal data and what messages you send to us via social networks and, if in doubt, use the other means of contacting us that we provide. We are not responsible for the conduct of the operators of these social networks and their other members, we are only responsible for our own acts or omissions.

When you communicate with us via our social media accounts, we process the information provided to us for this purpose by the respective social network (e.g. your name, your profile page and the content of the messages you have sent to us) in accordance with the purpose for which you sent it (e.g. service requests, suggestions and criticism). We will delete the data collected in this way when storing it is no longer necessary, or we will restrict its processing if there are statutory retention obligations. In the case of public posts on our social media accounts, we decide on a case-by-case basis, weighing your interests and ours, whether and when we can delete said posts.

The legal basis for the above data processing depends on the purpose of sending the message. If the purpose is to make use of our customer service or to request a service from Interzero, the legal basis will be Article 6(1)(b) RODO. Otherwise, the legal basis will be Article 6(1)(f) RODO (necessary for the purposes of the legitimate interests pursued by the controller). To the extent that the User has consented to the processing of the above data, the legal basis will be Article 6(1)(a) RODO.

5.1 Principles

We only disclose your data if:

• You have given your express consent to do so in accordance with Article 6(1)(a) of the RODO
• The disclosure is necessary on the basis of Article 6(1)(f) of the DPA in order to bring, exercise or defend the Interzero Companies' legal claims and there is no reason to believe that you have a compelling interest in your data not being disclosed that overrides our legitimate interest,
• We have a statutory duty to disclose pursuant to Article 6(1)(c) of the DPA,
• Disclosure is permitted by law and is necessary under Article 6(1)(b) of the RODO in order to perform a contract to which you are a party or to take action at your request before entering into a contract

5.2 Disclosure of information to external service providers Interzero Organizacja Odzysku Opakowań S.A. and Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego S.A.

Some of the data processing specified in this Data Protection Notice may be carried out on our behalf by external service providers. Together with the service providers mentioned in this data protection notice, these may include, in particular, data centres that store our websites and databases, IT service providers that maintain our systems and corporate consultants.

Where we disclose data to our service providers, these service providers may only use the data to perform their tasks. Such service providers are carefully selected and act on our instructions. They are contractually obliged to comply with our instructions, have appropriate technical and organisational measures in place to protect the rights of data subjects and are regularly monitored by us.

Should we, in addition to the above data protection notice, transfer your data to a service provider located in a country outside the European Economic Area (EEA), we will inform you separately of this fact when necessary and provide you with the specific guarantees on which this transfer is based. Should you wish to receive copies of the warranties attesting to an adequate level of data protection, please kindly contact us (see section 1).

Unless otherwise stipulated in this data protection notice, we store data and use them only for as long as necessary to fulfil our contractual or statutory obligations or for the purpose for which the data was collected. After the expiry of the statutory limitation period, we will restrict their processing, i.e. from that point onwards, the data will only be used to fulfil statutory obligations.

We will delete your data immediately, unless we still need it until the end of the statutory limitation period for evidential purposes, in civil claims or to comply with statutory retention periods. Even later, we may need to retain your data for accounting purposes. We are obliged to do so in order to comply with statutory record retention rules that may arise from the Accounting Act, the Tax Ordinance, the Packaging and Packaging Waste Management Act, the Anti-Money Laundering and Countering the Financing of Terrorism Act and others. The retention periods set out in these laws are up to a maximum of six years counting from the end of the relevant calendar year.

The legal basis for such data protection for the purposes of compliance with statutory documentation and storage obligations is Article 6(1)(c) of the DPA.

(1) Every person whose data is processed has the right:

a. to access - to obtain confirmation from the controller as to whether or not his or her personal data are being processed. If data about a person is being processed, he or she is entitled to have access to it and to be provided with the following information: the purposes of the processing, the categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, the period for which the data have been or will be stored or the criteria for determining them, the data subject's right to request rectification, erasure or restriction of the processing of personal data and to object to such processing (Article 15 RODO);

b. to receive a copy of the data - obtain a copy of the data undergoing processing, with the first copy being free of charge and for subsequent copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) RODO);

c. to be corrected - request the rectification of personal data concerning him/her which is inaccurate or the completion of incomplete data (Article 16 RODO);

d. to delete data - request the erasure of her personal data where the controller no longer has a legal basis for the processing or the data are no longer necessary for the purposes of the processing (Article 17 RODO);

e. to restrict processing - request the restriction of the processing of personal data (Article 18 RODO) when:

• • • the data subject questions the accuracy of the personal data, for a period allowing the controller to verify the accuracy of the data;
    • the processing is unlawful and the data subject objects to the erasure by requesting a restriction of use;
    • the controller no longer needs the data, but they are needed by the data subject to establish, assert or defend a claim;
    • the data subject has objected to the processing - until it is established whether the legitimate grounds on the part of the controller override the grounds of the data subject's objection.

f. to data portability - to receive in a structured, commonly used machine-readable format the personal data concerning him or her which he or she has provided to the controller, and to request that these data be sent to another controller if the data are processed on the basis of the data subject's consent or a contract with him or her and if the data are processed by automated means (Article 20 RODO);

g. to the objection - object to the processing of his or her personal data for the legitimate purposes of the controller on grounds relating to his or her particular situation, including profiling. The controller shall then assess the existence of valid legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of claims. If, according to the assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to cease processing for these purposes (Article 21 RODO).

(2) In order to exercise the aforementioned rights, the data subject should contact, using the contact details provided, the controller and inform him/her of which right and to what extent he/she wishes to exercise it.

(3) The data subject has the right to lodge a complaint if he or she believes that his or her personal data is being processed incorrectly.

(4) The supervisory authority to which a complaint may be lodged is the President of the Office for the Protection of Personal Data (OPAP).

We maintain technical measures suitable for guaranteeing data security in our online services, in particular to protect your data from the dangers of data transmission and from unauthorised access by third parties. These measures are constantly adjusted to reflect the latest state of technology. In order to protect the personal data you provide on our website, we use TLS (Transport Layer Security), which encrypts the information you enter.

We will update this Data Protection Notice from time to time, for example if we modify our website or if statutory or official regulations change.