Information on data protection

The companies of the Interzero group, i.e.: Interzero Organizacja Odzysku Opakowań SA, Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego SA take the protection and security of your data very seriously and take this into account in all their business activities. In this data protection information, we would like to provide an overview of the aspects of our online services that are relevant from the point of view of data protection law.

We will explain in the following points:

• What data we collect when you use our online services.
• For what purposes do the companies: Interzero Organizacja Odzysku Opakowań SA, Interzero Polska Sp. z o. o., Interzero Advisory Spółka z o. o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektryczny i Elektronicznego SA process this data?
• What rights and possibilities do you have in connection with the processing of your data.
• How can you contact us regarding data protection.

What is this data protection notice about?

This data protection information applies to online services provided by Interzero Organizacja Odzysku Opakowań SA, Interzero Polska Sp. z o. o., Interzero Advisory Spółka z o. o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrocznego i Elektronicznego SA

in the interzero.pl domain and social media accounts operated by Interzero on Facebook , Twitter , LinkedIn and Xing (hereinafter referred to as “social media accounts”). Internet services of Interzero companies other than those mentioned above are subject to individual data protection notices, which can be viewed on the websites in question.

In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Journal of Laws EU. L. of 2016 No. 119, p. 1) (GDPR) co-controllers of data are:

• Interzero Organizacja Odzysku Opakowań SA with its registered office in Warsaw, ul. Wiertnicza 165, 02-952 Warsaw, entered into the Register of Entrepreneurs by the District Court for the city of st. Warszawa in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000266658, share capital: PLN 2,500,000.00, paid up in full, NIP 5213409980, REGON 140718909, BDO 000000172;
• Interzero Advisory Spółka z o. o. with its registered office in Warsaw, ul. Wiertnicza 165, 02-952 Warsaw, entered into the Register of Entrepreneurs by the District Court for the city of st. Warszawa in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000676980, share capital: PLN 100,000.00, paid up in full, NIP 1132335293, REGON 017443900, BDO 000518378;
• Interzero Polska Sp. z o. o. with its registered office in Warsaw, ul. Wiertnicza 165, 02-952 Warsaw, entered into the Register of Entrepreneurs by the District Court for the city of st. Warszawa in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000459881, share capital: PLN 105,000.00, paid up in full, NIP 9512367010, REGON 146653200, BDO 000009153;
• Interzero Packaging Recovery Organization and Electrical and Electronic Equipment Recovery Organization SA with its registered office in Kraków, ul. Mogilska 65, 31-545 Kraków, entered into the register of entrepreneurs by the District Court for the city. st. Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000925732, share capital: PLN 5,000,000.00, fully paid up, NIP 9512530326, REGON 520530764, BDO 000552505.

Where the words “we”, “us” or “Interzero” are used in this information, this shall mean only Interzero Organizacja Odzysku Opakowań SA and Interzero Polska Sp. z o. o., Interzero Advisory Spółka z o. o. as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrocznego i Elektronicznego SA

Please be advised that the Joint Controllers have appointed the Data Protection Officer – Ms. Agnieszka Radtke.

In all matters related to the protection of personal data, you can contact the DPO by writing to the address iod@interzero.pl or via traditional mail to the address ul. Wiertnicza 165, 02-952 Warsaw.

Interzero Organizacja Odzysku Opakowań SA, Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektrycznego i Elektronicznego SA have entered into an appropriate agreement on the joint control of personal data. We have established that in the event of your exercising the rights referred to in the further part of the information, we will cooperate, however, Interzero Organizacja Odzysku Opakowań SA will be responsible for taking the necessary actions, e.g. it will be responsible for correcting your personal data in the event of a request for their rectification. The above arrangements do not affect the fact that you can exercise your rights towards each of the joint controllers separately.

Interzero is represented on the following networks of own social media accounts:

• Facebook
• Twitter
• LinkedIn
• Xing

On these pages we inform you about the latest news from Interzero and everything we do, and we are happy to use the facilities provided by social networks to communicate directly with their members.

However, please note that we do not have full influence over the processing of data by social networks. Therefore, please check carefully what personal data and messages you send to us through social networks and, in case of doubt, use the other means of contacting us that we provide. We are not responsible for the conduct of the operators of these social networks and their other members, we are solely responsible for our own acts or omissions.

Where you communicate with us via our social media accounts, we process the information provided to us by the relevant social network for this purpose (e.g. your name, your profile page and the content of the messages you send us) in accordance with the purpose for the needs of which you sent them (e.g. service requests, suggestions and criticism). We will delete the data collected in this way when their storage is no longer necessary, or we will restrict their processing if there are statutory data retention obligations. In the case of public posts on our social media accounts, we decide on a case-by-case basis, weighing your interests and ours, whether and when we can remove said posts.

The legal basis for the above data processing depends on the purpose of sending the message. If the purpose is to use our customer service or to apply for a benefit from Interzero, the legal basis will be Art. 6 sec. 1 lit. b) GDPR. Otherwise, the legal basis will be Art. 6 sec. 1 lit. f) GDPR (necessary for the purposes of the legitimate interests pursued by the administrator). To the extent that the User has agreed to the processing of the above data, the legal basis is art. 6 sec. 1 lit. a) GDPR.

5.1 Rules

We only disclose your data if:

• You have given your express consent to this in accordance with Article 6 para. (1) lit. a) GDPR
• Disclosure is necessary pursuant to Art. 6 sec. 1 lit. f) GDPR in order to bring, exercise or defend legal claims of Interzero companies and there are no grounds to assume that you have a significant interest in not disclosing your data that overrides our legitimate interest,
• We have a statutory disclosure obligation pursuant to Art. 6 sec. 1 lit. c) GDPR,
• Disclosure is permitted by law and is necessary under Art. 6 sec. 1 lit. b) GDPR for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract

5.2. Disclosure of information to external service providers Interzero Organizacja Odzysku Opakowań SA and Interzero Polska Sp. z o.o., Interzero Advisory Spółka z o.o., as well as Interzero Organizacja Odzysku Opakowań and Organizacja Odzysku Sprzętu Elektryczny i Elektronicznego SA

Some of the data processing set out in this data protection notice may be performed on our behalf by third party service providers. Along with the service providers listed in this data protection notice, these may include, but are not limited to, data centers that host our websites and databases, IT service providers that maintain our systems, and corporate consultants.

Where we disclose data to our service providers, those service providers may only use the data to perform their tasks. These service providers are carefully selected and act on our behalf. They are contractually bound to follow our instructions, have appropriate technical and organizational measures in place to protect the rights of data subjects, and are regularly monitored by us.

Should we, in addition to the above data protection notice, transfer your data to a service provider located in a country outside the European Economic Area (EEA), we will inform you separately of this fact when it proves necessary and provide certain guarantees on which this data transfer is based. In case you would like to receive copies of guarantees certifying an adequate level of data protection, please feel free to contact us (see section 1).

Unless otherwise stated in this data protection notice, we only store and use data for as long as necessary to perform our contractual or statutory obligations or for the purpose for which the data was collected. After the expiry of the statutory limitation period, we will limit their processing, i.e. from that moment, the data will be used only to fulfill statutory obligations.

We will delete your data immediately, unless we still need it until the end of the statutory limitation period for evidentiary purposes, in civil claims or to comply with statutory retention periods. Even later, it may be necessary to store the data for accounting purposes. We are obliged to do this in order to meet the statutory rules for storing documentation, which may result from the Accounting Act, the Tax Ordinance, the Act on the Management of Packaging and Packaging Waste, the Act on Counteracting Money Laundering and Terrorist Financing, and others. The storage periods specified in these acts last up to a maximum of 6 years from the end of the relevant calendar year.

The legal basis for such data protection for compliance with statutory documentation and storage obligations is Art. 6 sec. 1 lit. c) GDPR.

1. Every person whose data is processed has the right to:

a. to access – to obtain confirmation from the controller as to whether his or her personal data are being processed. If data about a person are being processed, he or she is entitled to access them and to obtain the following information: about the purposes of processing, categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, the period of data storage or the criteria for determining them, the right to request the rectification, deletion or restriction of the processing of personal data of the data subject and to object to such processing (Article 15 of the GDPR);

b. to receive a copy of the data – to obtain a copy of the data being processed, where the first copy is free of charge and for subsequent copies the controller may impose a reasonable fee resulting from administrative costs (Article 15 paragraph 3 of the GDPR);

c. to rectify – to request the rectification of personal data concerning him/her that are incorrect or the completion of incomplete data (Article 16 of the GDPR);

d. to delete data – to request the deletion of his or her personal data if the controller no longer has a legal basis for their processing or the data are no longer necessary for the purposes of processing (Article 17 of the GDPR);

e. to restrict processing – request the restriction of the processing of personal data (Article 18 of the GDPR), when:

• • • the data subject questions the accuracy of the personal data – for a period enabling the controller to verify the accuracy of such data;
    • the processing is unlawful and the data subject opposes their deletion, requesting the restriction of their use;
    • the controller no longer needs the data, but the data subject requires it to establish, pursue or defend legal claims;
    • the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of the controller override the grounds for objection of the data subject.

f. to transfer data – to receive, in a structured, commonly used and machine-readable format, the personal data concerning him/her that he/she has provided to the controller, and to request that this data be sent to another controller, if the data are processed on the basis of the consent of the data subject or a contract concluded with him/her and if the data are processed by automated means (Article 20 of the GDPR);

g. to object – to object to the processing of their personal data for the legitimate purposes of the controller, for reasons related to their particular situation, including profiling. In such a case, the controller assesses the existence of important legitimate grounds for processing that override the interests, rights and freedoms of the data subjects, or grounds for establishing, pursuing or defending claims. If, according to the assessment, the interests of the data subject are more important than the interests of the controller, the controller will be obliged to cease processing the data for these purposes (Article 21 of the GDPR).

2. In order to exercise the above-mentioned rights, the data subject should contact the controller using the contact details provided and inform him/her which right he/she wishes to exercise and to what extent.

3. The data subject has the right to lodge a complaint if he or she believes that his or her personal data is being processed incorrectly.

4. The supervisory authority to which a complaint may be lodged is the President of the Personal Data Protection Office (UODO).

We maintain technical measures appropriate to guarantee data security on our online services, in particular to protect your data against the dangers of data transmission and against unauthorized access by third parties. These measures are constantly revised to reflect the latest state of technology. To secure the personal information you provide on our site, we use TLS (Transport Layer Security), which encrypts the information you enter.

We will update this Data Protection Notice from time to time, for example when we make modifications to our website or if statutory or official regulations change.