Pursuant to Article 13(1) and (2) and Article 14(1) and (2) of the Regulation of the European Parliament and of the Council of Europe (EU) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation) of 27 April 2016, hereinafter referred to as GDPR, we inform you about the manner and purpose forwhich we process your personal data (hereinafter referred to as “data protection-related data”) and your rights.

One of the priorities of the Privacy Policy in force at Concession Europe Ltd. is to respect the privacy of visitors to the Company’s website.

1. Who is responsible for data processing and who can be

The administrator of your personal data is Concession Europe Sp. z o.o., with its registered office (15-688) Bialystok, 4 Gen. George Smith Patton St., hereinafter referred to as “Administrator” or “Concession”, which can be contacted:

• in writing by directing correspondence to (15-688) Białystok, 4 George Smith Patton Street,
• by telephone on + 48 222903727
• e-mail: info@concession.pl

2. Why, what for and on what legal basis we process your personal Concession Europe processes your personal data in connection with:

• recruitment process,
• conclusion of the employment contract,
• signing of civil law contracts,
• signing a contract with other
• your subscription to the

1. The processing of the personal data of job applicants is carried out on the basis of Article 221 1 of theLabour Code and Article 6(1)(a) of the RODO and on the basis of the consent you have given for the processing of data
2. The processing of employees’ personal data, is carried out on the basis of:

• Article 221 1 of the Labour Code and Article 6(1)(b) of the GDPR – processing is necessary for the performance of a contract to which the data subject is a party,
• Article 6(1)(f) GDPR, the processing is necessary for the purposes of the legitimate interests pursued by the Administrator (protection of claims),
• Article 221§ 4 of the Civil Code and Article 6(1)(c) of the GDPR, the processing is necessary for theperformance of a legal obligation incumbent on the Administrator (this is related to the Administrator’s obligations, in terms of tax law and social security).
• Article 221 5 of the Labour Code and Article 6(1)(a) of the GDPR – consent given by the employee

1. The processing of personal data of persons who are party to a civil law contract is carried out on the basis of:

• Article 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is a party,
• Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Administrator (protection of claims),
• Article 6(1)(c) – processing is necessary for the performance of a legal obligation incumbent on the Administrator (this is related to the Administrator’s tax and social security law obligations).

In connection with the signing of a contract with other businesses, the Administrator will process personal data of individuals:

negotiating contracts on behalf of the contractor (based on Article 6(1)(f) of the DPA); signing contracts on behalf of the contractor (on the basis of Article 6(1)(f) GDPR); carrying out certain activities in connection with the signing of a business contract by Concession Europe (on the basis of Article 6(1)(f) GDPR);

representatives of contractors (on the basis of Article 6(1)(f) GDPR);

The processing of the personal data mentioned above on the basis of Article 6(1)(f) of the GDPR, is carried outfor the purpose of possible redress or defence against claims and is related to the protection of the Administrator’s rights.

The processing of your data in connection with subscribing to the Newsletter takes place on the basis of your consent (Art. 6(1)(a) GDPR) and on the basis (Art. 6(1)(f) GDPR) of the controller’s legitimate interest in carrying out marketing activities.

Your data will be processed:

to the extent provided by the entity for which you provide services or work. The extent of the data provided is: name, surname, position held, e-mail address, telephone number or other contact details, necessary for electronic communication, in order to fulfil the contract signed with Concession.

for the purpose of making settlements with the competent authorities and archiving documents, to the extentrequired by law, in particular by the provisions of the Tax Code and the Accounting Act, as well as the Anti-Money Laundering Act. The legal basis for the processing of your data arises from the obligations imposed on the Administrator under Article 6(1)(c) of the DPA.

To whom we may share your personal data.

The data of job applicants will be made available to the Board of Directors of Concession Europe Ltd. and to the Company’s employees handling the recruitment process.

The data of the Company’s employees will be available to authorised employees, dealing with human resources and tax matters.

The data of the persons representing the contractors will be made available to the employees of ConcessionEurope Sp. z o.o. directly negotiating and/or signing the contract with you and/or implementing the signed contract, as well as to the employees providing accounting services.

Your data may be shared with other recipients in order to perform a contract with you and/or to comply with a legal obligation incumbent on Concession Europe, based on your consent or for purposes arising from the legitimate interests of the Administrator or Concession Europe’s contractor. Recipients of your data may be, in particular, the relevant government authorities (including tax authorities and the Social Security Administration).

Whether your data will be transferred to a third country (outside the European Union). Your data will not be transferred to a third country.

If you intend to transfer your data to a third country, Concession Europe will ask you to give the appropriate consent, based on Article 49(1)(a) and (b) GDPR.

How long will your data be processed (stored).

Your data will be processed for the period of time necessary for the purposes of the processing as indicated in point 2 of this Privacy Policy, i.e.:

in the recruitment process, until it is completed. If the job applicant is not recruited, the data sent by him/her will beimmediately destroyed and the documents sent will be returned to the sender.

during the period of employment, the employee’s data will be processed for the entire period of employment and, after its termination, for the period required by the relevant regulations related to tax and social security law. In the event of legal proceedings related to the employee’s employment, his/her data will be stored until the legal conclusion of the aforementioned proceedings.

in respect of the performance of the contract concluded with Concession Europe, until its completion, andthereafter for the period required by law or for the settlement of any claims. in respect of the fulfilment of legal obligations incumbent on Concession Europe, in connection with its activities and the performance of contracts entered into, until such time as Concession Europe has fulfilled these obligations.

as far as processing based on consent is concerned, until such time as you request that the data be deleted.

until the fulfilment of Concession Europe’s legitimate interests forming the basis for such processing or untilyou object to such processing, unless there are legitimate grounds for further processing.

Your personal data, processed during the negotiation of a contract with the entity you represent or which is youremployer, will be stored until you are informed that the contract has not been signed.

Your personal data processed in connection with the signing and/or execution of a business contract will be stored for the period during which claims relating to the business can be made (i.e. for 3 years from the date of signing the contract) and, if claims are made, your data will be stored until the conclusion of legal proceedings.

Your personal data stored in connection with the performance of the legal obligations imposed on ConcessionEurope Sp. z o.o. by the provisions of the Anti-Money Laundering Act will be kept for a period of 5 years, calculated from the end of the year in which the business activity was terminated, unless the General Inspector of Financial Information, pursuant to these provisions, requests that these records be kept for a longer period.

Your data will be retained for a period of 5 years, in terms of tax and accounting settlements, calculated after the end of the year in which the financial event took place.

Your personal data will be stored for the duration of the concluded contract and also after its termination for the following purposes: the assertion of claims in connection with the performance of the contract, the fulfilment oflegal obligations, including in particular tax and accounting obligations, as well as statistical and archiving obligations, for the period established in the relevant legislation.

What rights you have to ensure that your data is adequately protected.

You have the right to obtain confirmation from the Controller as to whether your personal data are being processed and, in the event of confirmation, to request information on the purpose of the processing, thecategories of data processed, the recipients of the data, the duration of the processing, the right to request rectification, erasure or restriction of the processing, the right to data portability and to object to the processing.

You have the right to withdraw at any time any consent you have previously given for the processing of data to the extent to which that consent relates, with the proviso that the withdrawal of consent will not affect the lawfulness ofprocessing carried out on the basis of consent before its withdrawal;

You have the right to be informed about the source of access to your data.

You have the right to lodge a complaint with the President of Data Protection if you consider that the processing of your data violates the provisions of the GDPR.

In addition, you have the right to object to the processing at any time:

for reasons related to your particular situation, unless the Administrator demonstrates the existence ofcompelling legitimate grounds for the processing, overriding your rights, which relate to the assertion or defence of claims (Article 21(1) GDPR),

for direct marketing purposes, including against profiling for marketing purposes, to the extent that the processing is related to direct marketing (Article 21(2) GDPR).

Do you have an obligation to provide data?

The provision of your personal data is voluntary; however, it is necessary in order to initiate the recruitment process, to conclude an employment contract, to conduct negotiations related to the conclusion of a contract witha business contractor, to perform a contract with an entity you represent or which is your principal.

If you do not provide your personal data, it will be impossible, and in some cases very difficult, to conclude and perform the contract.

If you do not provide your personal data for the purposes of your obligations under the Anti- Money Laundering and Countering the Financing of Terrorism Act, Concession Europe will not be able to conclude a contract with you or the entity you represent.

Where do we obtain your data from and what are the categories of data.

Most of the data processed by Concession Europe comes directly from you, in particular data obtained from you during the recruitment and employment process.

We obtain personal data from entrepreneurs either directly or from other public sources, i.e. the National Court Register or the Central Register of Business Activity.

In the case of data from persons representing or otherwise acting on behalf of entrepreneurs, we also obtaindata from the aforementioned sources as well as from the entrepreneurs themselves.

Information on automated decision-making about the processing of personal data, including profiling.

Your personal data will not be used by Concession Europe for automated processing decisions or profiling.

Contact possibilities

Concession Europe uses the e-mail address provided at the outset, as well as the business addresses, e-mail addresses of its employees, in order to send responses to requests for proposals, during contract negotiations, during the period of contract execution and in the process of employee recruitment. In order to protect itself fromunauthorised access by third parties to e-mail correspondence, Concession Europe uses appropriate security measures, however encrypted correspondence is preferred.

In addition, interested parties may contact Concession Europe Sp. z o.o. by submitting the form found at concession.en/en/contact. In the form, Concession Europe asks for:

name (this is not obligatory),

e-mail address (necessary to establish and continue contact),

the content of the message (necessary to make the request specific).

Filling in the mandatory data by the sender is a prerequisite for contacting the person concerned and clarifying all queries.

The personal data thus provided is processed:

in order to take the necessary steps prior to signing a contract or to perform a contract with the person specified as the sender of the email. (Article 6(1)(b) GDPR;

for statistical purposes relating to the scope of the requests made (Article 6(1)(f) GDPR). Data security

Only authorised persons have access to personal data at the Administrator. The data shall be used only to the extent necessary for the performance of contracts. The Administrator ensures that employees with access to personal data participate in training courses on personal data protection. Appropriate procedures and technical safeguards are in place at Concession Europe Sp. z o.o. to minimise the risks of personal data breach or leakage.

Cookies

Cookies (commonly referred to as cookies), are computer data, usually text files, which are stored on a website user’s terminal equipment. Cookies found on the Concession Europe website.

Concession Europe uses cookies to collect statistics and for the correct functioning of the website. Any personaccessing the Concession Europe website can disable the operation of cookies without being subject to logging out of the website.

Changes to the Privacy Policy

In the event of any changes concerning the Administrator’s data or other information mentioned in the PrivacyPolicy, the Administrator will promptly update this document. This text of the Privacy Policy applies to ConcessionEurope Ltd. as of 1 August 2022.