§ 1. DEFINITIONS

The Data Controller (also referred to as the "Controller") is Autoklinika Robert Nowaczyk spółka komandytowa with its registered office in Poznań, address: ul. Sianowska 67a, 60-453 Poznań, NIP: 7812029121, REGON: 520676611, entered into the National Court Register under number: 0000938928, processing personal data of users of the website operating at https://autoklinikapoznan.pl/.

Personal Data (also referred to as "Data") - any information relating to an identified or identifiable natural person, whereby an identifiable natural person is one who can be directly or indirectly identified, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or email address.

All capitalized terms, as well as other terms contained and used in this Privacy Policy (hereinafter referred to as the "Privacy Policy"), have primarily the meaning assigned to them in this document, and in the absence of definitions in this document - the meaning assigned to them in the Terms and Conditions, available at https://autoklinikapoznan.pl/kontakt/.

§ 2. DATA PROCESSING PRINCIPLES

The Administrator processes Personal Data in accordance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"), as well as other applicable laws, including national laws on personal data protection. The Administrator applies appropriate security measures for the processing of Data, taking into account the risks and categories of Data, in accordance with the requirements of applicable law.

Methods of Data Collection

User Data is collected:

• a) when the User voluntarily provides it, e.g., by using the Website or Services (e.g., by filling out the Contact Form),
• b) through cookies - functional files necessary for the operation of the Website, which automatically collect Data, and other files - only if the User consents to their use.

Purposes of Data Processing

User Data will be processed for the following purposes:

1. to use the functionality of optional cookies (described in detail in § 8 of the Privacy Policy) when the User consents to their use (Art. 6(1)(a) of the GDPR - consent),
2. to use the Services based on agreements concluded in accordance with the Terms and Conditions, i.e., to perform the contract for the provision of electronic services, including responding to User inquiries, requests, or applications (Art. 6(1)(b) of the GDPR - processing necessary for the performance of a contract),
3. to fulfill legal obligations incumbent on the Administrator, including consumer law regulations (e.g., handling complaints) and the GDPR (responding to requests to exercise rights) (Art. 6(1)(c) of the GDPR - compliance with legal obligations),
4. to pursue the legitimate interests of the Administrator, such as marketing the Administrator's products and services, protecting copyright and other claims, as well as ensuring the proper presentation and optimization of the Website (mandatory cookies) and for statistical and analytical purposes (Art. 6(1)(f) of the GDPR - legitimate interests pursued by the Administrator).

Contact person

The Administrator - due to the lack of a legal obligation - has not appointed a Data Protection Officer. Users can contact the Administrator (contact details provided above) regarding the processing of Data and the exercise of Users' rights related to the processing of Data.

Data Processing Period

The Administrator will process the Data only for a period no longer than necessary to achieve the purposes for which the Data is processed, i.e.,

• a) for the time necessary to respond to inquiries, summons, and requests, and after that time for the limitation period of any claims - with regard to data related to the performance of the Contact Form Service,
• b) for the time required by applicable law or until the performance of legal obligations, but no longer than the time in which the Administrator may incur legal consequences for non-performance of the obligation - with regard to data processed in connection with the performance of legal obligations,
• c) for the period specified in the law for the limitation of specific types of claims - for defense or assertion of claims,
• d) for the period specified in the Privacy Policy with regard to data processed in connection with enabling the use of the Website (mandatory cookies).
• e) until the withdrawal of consent, but no longer than for a period of 1 year - with regard to data processed in connection with the consent given for the use of optional cookies,
• f) for a period of 10 years or until objection is raised - for direct marketing purposes,
• g) for a period of 14 months from obtaining the data - for statistical and analytical purposes,

unless applicable law requires further processing of the Data.

Data Recipients

Personal data may be disclosed by the Administrator to entities authorized to obtain information under applicable law, as well as based on a written data processing agreement or a written authorization to entities that need to access the data in order to achieve the purpose for which the personal data was provided, in particular to entities providing the following services to the Administrator: postal, forwarding, transport, accounting, personnel and payroll, legal, banking, data storage, and IT services.

When using the Website, other entities that are service providers whose plugins are placed on the Website, including: youtube.com, instagram.com, facebook.com, pinterest.com (the Administrator may have profiles on them), may also come into possession of information partially sent automatically by the internet browsers used by Users. Each of the providers determines the rules and purposes of obtaining information on their own websites.

In connection with the use of Google tools (Google Analytics, Google AdWords, YouTube), data may be transferred to the USA. This is done on the basis of an agreement containing standard contractual clauses approved by the European Commission and using other safeguards described in Google's privacy policy (https://policies.google.com/privacy?hl=en#infosecurity). It is possible to obtain a copy of the data transferred to the USA using the Google functions described in the aforementioned privacy policy. Personal data will not be transferred to an international organization.

Voluntary provision of data

In each case, providing Data by the User is voluntary, however, failure to provide data by the User may make it difficult or impossible to use the Website's Services.

User's Rights

Each User has the following rights in connection with the processing of their Personal Data:

1. the right to access the Data and obtain a copy of the Data;
2. the right to request the correction of the Data;
3. the right to request the erasure of the Data, provided that one of the following conditions is met:
   • the Data is no longer necessary for the purposes for which it was collected or otherwise processed;
   • the person to whom the Data relates has withdrawn consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing;
   • the person to whom the Data relates has objected to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the person to whom the Data relates has objected to the processing pursuant to Article 21(2) of the GDPR;
   • the Data has been unlawfully processed;
   • the Data must be erased for compliance with a legal obligation in Union or Member State law to which the Administrator is subject;
   • the Data has been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR;
4. the right to lodge a complaint with a supervisory authority responsible for the protection of personal data;
5. the right to restrict the processing of the Data;
6. the right to withdraw consent to the processing of the Data (in the case and to the extent that the Data is processed based on consent) - withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;
7. the right to data portability (in the case and to the extent that the Data is processed based on consent or is necessary for the performance of a service);
8. the right to object to the processing of the Data based on the legitimate interest of the Administrator, in accordance with Article 21 of the GDPR (i.e., for reasons related to the User's particular situation), and at any time and for any reason - for direct marketing purposes.

For matters related to the exercise of the above-mentioned rights, Users can contact the Administrator.

The Data will not be subject to automated decision-making, but it may be profiled for statistical, analytical, and marketing purposes, i.e., to tailor communication and promotional materials to the User's choices and preferences.

§ 3. COOKIE POLICY

Cookies are small text files that are stored on a user's computer, tablet, or smartphone when they visit different websites on the Internet. A cookie file contains anonymous data about the user's usage of the website.

The website uses cookies solely to ensure the correct and convenient functioning of the website for users and for statistical purposes.

The user can decide whether they want cookies to be stored on their computer. They can deactivate or completely disable cookies in their web browser options by selecting the appropriate option in firewall programs or by installing software that blocks cookies (e.g., https://tools.google.com/dlpage/gaoptout?hl=en). They can also delete previously stored cookies. To not receive cookies, the user should use the internet browser options used to connect to the website and select the option to automatically reject cookies. These settings usually also allow managing cookies to some extent. More information on managing cookies can be found at:

1. Microsoft Explorer: http://support.microsoft.com/kb/278835/en
2. Mozilla Firefox: http://support.mozilla.org/en/kb/delete-cookies
3. Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=en&answer=95647
4. Opera: http://www.opera.com/browser/tutorials/security/privacy/
5. Apple Safari: http://www.apple.com/support/safari/

Disabling the use of cookies may cause difficulties in using certain services and functionalities of the website. If you do not agree to the use of cookies by us, you should change the settings of your web browser accordingly or refrain from using the website.

The following types of cookies are used on the website:

§ 4. USING Google Analytics and YouTube TOOLS

The website uses Google Universal Analytics and YouTube tools. The use of these tools is subject to privacy protection rules, which are available at: https://www.google.com/policies/privacy/. It is possible to block the Google Universal Analytics tool according to the instructions available at: https://tools.google.com/dlpage/gaoptout/.

§ 5. EXCLUSIONS

This Privacy Policy does not apply to websites of entities whose contact information or links may appear on our pages. The Administrator is not responsible for the information provided by these websites or collected through them, or for any other actions of these websites.

§ 6. DATA USED FOR COMMUNICATION VIA E-MAIL

1. This paragraph applies to the processing of Data in connection with email correspondence.

2. The following provisions of the Privacy Policy apply accordingly to the processing of Data for the purposes mentioned above: Definitions, Contact Person, Data Recipients, User Rights.

3. Providing Data is voluntary, and failure to provide Data may prevent correspondence.

4. Data is collected on the following legal bases and for the following purposes:

• a. based on Art. 6(1)(b) of the GDPR, as necessary for the performance of a contract, if you are a party to a contract with the Administrator or are interested in entering into such a contract;
• b. based on Art. 6(1)(c) of the GDPR - for the purpose of fulfilling legal obligations, including responding to complaints, requests under the GDPR,
• c. based on Art. 6(1)(f) of the GDPR - in the legitimate interest of the Administrator, i.e., for the purpose of responding to inquiries, summons, or applications, or reports of infringements of rights or goods, asserting claims or defending against claims, as well as for statistical purposes,
• d. based on separately given consent and Art. 10(2) of the Act on the Provision of Electronic Services of July 18, 2002 (consolidated text: Journal of Laws of 2017, item 1219, as amended) or Art. 172 of the Telecommunications Act of July 16, 2004 (consolidated text: Journal of Laws of 2017, item 1907, as amended) - for the purpose of sending commercial information (sending advertising and promotional offers) electronically or by telephone using terminal equipment.

5. Data will be stored for the following periods:

• a. Data processed for the purposes of concluding and performing a contract - for the duration of the contract or, in the case of failure to conclude a contract, for a period of 6 months from the date of obtaining the data,
• b. Data processed for the purpose of responding to inquiries, applications, complaints, reports - for the time necessary to send a response, after which they may be processed for the limitation period of any claims,
• c. Data collected for statistical purposes - for a period of 1 year from the date of obtaining the data,
• d. Data processed for the defense or assertion of claims - for the period specified in the law for the limitation of specific types of claims,
• e. Data processed for the purpose of fulfilling legal obligations - for the time required by applicable law or until the performance of these obligations, but no longer than the time in which the Administrator may incur legal consequences for non-performance of the obligation,
• f. Data collected for direct marketing purposes - for a period of 5 years from the date of obtaining the data,

unless the provisions of applicable law require the Administrator to store the data for a longer period.

6. The data will not be the basis for automated decision-making, but may be subject to profiling for statistical and marketing purposes.

7. Users have the right to object to the processing of data for direct marketing purposes at any time.

8. If the email address has not been provided directly by the individuals whose data is being processed, the source of obtaining the data may be:

• a. the website of the organization/entity in which the person whose data is being processed works, holds a position, or is listed as a contact person,
• b. publicly available information contained in public registers (e.g., Central Register and Information on Economic Activity, National Court Register, etc.).

§ 7. FINAL PROVISIONS

The provisions of the Privacy Policy shall be governed by the relevant provisions of the applicable law.