II. Processing of Personal Data

1. Principles of Processing of Personal Data

Unless you have received another information clause regarding the processing of Personal Data from the Data Controller Group Company. Personal Data, the Administrator of your Personal Data is Auto Spot sp. z o.o. with its registered office in Pruszków, Henryka Sienkiewicza 19, 05-800 Pruszków, and the principles of Personal Data processing by the Personal Data Administrator are described in this Privacy Policy.

The processing of Personal Data will be carried out in accordance with the applicable provisions of the RODO.

The Personal Data Administrator shall apply technical and organisational measures ensuring the protection of Personal Data processing and securing the Personal Data Personal Data against their disclosure to unauthorised persons, acquisition by unauthorised persons, processing in violation of the relevant legal provisions relating to the protection of personal data, and alteration, loss or destruction.

Personal Data collected within the Service in the form of cookies may be profiled by the Personal Data Administrator in the cases indicated in point 3(f) below.

2. Processing of Personal Data outside the European Economic Area

In accordance with the requirements of the law, we inform you that, due to the need to ensure the highest possible level of IT services, including the security of Personal Data, access to Personal Data may be accessed by IT service providers outside of the European Economic Area Economic Area ("EEA"). The level of protection for Personal Data outside the EEA differs from that provided by European law. For this reason, the Data Controller Personal Data shall ensure that the above IT service providers have access to Personal Data only to the extent necessary for them to perform their services (including maintenance) and with an adequate level of protection, primarily by:

• a) cooperation with entities in countries for which a relevant decision of the European Commission concerning the finding of an adequate level of protection for personal data;
• b) the application of the standard contractual clauses issued by the European Commission

European Commission.

In the aforementioned case, the User has the right to obtain a copy of the information on the applicable safeguards by contacting the Data Protection Officer.

3. Purposes and legal basis for processing Personal Data and the period of time of processing of Personal Data

The Personal Data Administrator may process Personal Data for the following purposes.

purposes:

• a) in order to communicate, identify and respond to the User's inquiry through the Service.

The User has the opportunity to contact the Personal Data Administrator using electronic contact forms available on the Service. Use of the form requires the User to provide Personal Data necessary to contact the User and respond to the inquiry. User in the content of the inquiry may also provide other data to facilitate contact or handling of the inquiry.

The legal basis for processing Personal Data for the above purpose is the consent of the User i.e. Article 6(1)(a) of the RODO. The User's personal data will be processed for the period of time necessary to answer the inquiry or until the withdrawal of the granted consent to process personal data.

In the case of using other dedicated forms available on the Website such as the Contact Form or the Complaint Form, the legal basis for of processing are each time indicated in the information on the processing of Personal Data included under that form.

• b) in order to communicate, identify and respond to an inquiry via through other forms of contact

In the case of contact via general email addresses or telephone numbers telephone numbers of the secretariats of the Personal Data Controller and/or Group Companies Personal Data Administrator, as well as email addresses or telephone numbers of other departments available on the Site, the Personal Data Administrator processes Personal Data in order to enable contact and respond to the inquiry.

The legal basis for processing Personal Data for the above purposes is the legally legitimate interest of the Personal Data Administrator, i.e. Article 6(1)(f) of the RODO. Data Personal Data will be processed for the period necessary to answer the inquiry or until you object to the processing of your Personal Data in the legally legitimate interest pursued by the Personal Data Administrator.

• c) in order to handle complaints

In case of filing a complaint regarding Products from the Administrator's offer Personal Data via:

(a) electronic contact forms or through functionalities available on the Site;
(b) general email addresses and telephone numbers of the secretariats of the of the Personal Data Controller and/or Group Companies of the Personal Data Controller.
(c) stores.

The Personal Data Administrator processes Personal Data in order to process complaints.

The legal basis for the processing of Personal Data is the fulfillment of a legal obligation legal obligation, i.e. Article 6(1)(c) of the RODO, and the legitimate interest of the Personal Data Administrator

Personal Data i.e. Article 6(1)(f) RODO consisting in the investigation by the Administrator of Personal Data and/or Group Companies of the Administrator of Personal Data.

Personal Data Administrator's Group companies to assert potential claims and also to defend against such claims. Data Personal data will be processed for the period necessary to investigate the claim, the period of statute of limitations for claims from the complaint and the period necessary to defend against claims of the of the person making the complaint.

• d) for direct marketing purposes

The Personal Data Administrator may process Personal Data for the purposes of marketing the of the Personal Data Administrator and/or the Group Company of the Personal Data Administrator

Personal Data Administrator, as well as marketing of products from the commercial offer of the

Personal Data Administrator (hereinafter referred to as Products). The current list of Products can be found on the autospot.com.pl website.

Processing of Personal Data for direct marketing purposes may be carried out also through public profiles within social networks such as Facebook, Twitter, LinkedIn, TikTok, Instagram, Snapchat, Pinterest, among others, which are administered by the Personal Data Administrator are administered by the Personal Data Administrator and/or Group Companies of the Personal Data Administrator.

The personal data processed in these profiles is primarily data of visitors to the profiles, to which the Personal Data Administrator has access through, among other things, comments, likes, online identifiers or as part of any interaction between a profile visitor and the Personal Data Administrator, a Group Company of the Personal Data Administrator, or an entity to which the Personal Data Administrator and/or a Group Company of the Personal Data Administrator of the Personal Data Controller's Group has contracted to handle the aforementioned profiles.

The purposes of the processing of Personal Data are to enable visitors to be activity on the profiles, to effectively operate the profiles by presenting visitors with visitors with information about initiatives, activities, events, services or products as well as statistical and analytical activities using the  apabilities provided by the providers of the aforementioned social networks.

Personal data within your LinkedIn profile may also be processed in order to carry out effective recruitment policies by the Personal Data Administrator Personal data through the use of direct messaging options to users who have public profiles on the aforementioned service in order to present them with current job offers and for the purposes of contacting them in connection with the sent offers.

The legal basis for processing Personal Data for the above purposes is the legally justified interest of the Personal Data Administrator consisting in the promotion of the Administrator of Personal Data and/or Group Companies of the Administrator of Personal Data. Administrator's Group and products from its offer as well as improving the quality of the services provided services or conducting an effective recruitment policy - i.e. Article 6(1)(f) of the RODO. Data Personal data will be processed until the realization of the legitimate interest realized by the Personal Data Administrator or until the moment of filing an objection to the processing of Personal Data for these purposes.

In the event that Personal Data is processed through programs chatbot computer programs used to communicate and promote products from the offer of the Personal Data Administrator, the User's Personal Data is processed on the basis of the User's consent - i.e. Article 6(1)(a) of the RODO. Personal data in chatbot computer programs will be processed for the period of availability of this program for Users or until the User withdraws consent.

In the case of processing of Personal Data in the framework of contests and other promotional actionspromotional activities organized on the profiles of the aforementioned social networks, the rules of processing Personal Data are each time described in the regulations of a given contest or promotional action.

The above information constitutes only the principles of Personal Data processing by the Administrator of Personal Data within the framework of conducted profiles in social networks social networks. The rules of processing of Personal Data by providers of the above.

social networks are available on the websites of these providers.

• e) in order to take steps to enter into an agreement/cooperation and/or to perform an agreement/cooperation

The Personal Data Administrator may receive Personal Data of Contractors directly from the Contractors or from a Group Company of the Personal Data Administrator Personal Data with which the Contractor cooperates and/or has entered into a contract, and in the case of Personal Data of Contact Persons directly from such persons, from the Contracting Party or from a Group Company of the Personal Data Administrator with which the Contracting Party cooperates and/or has entered into a contract.

The Personal Data Administrator processes the following Personal Data.

Contractors/Contact Persons, the scope of which is determined in each case by cooperation or concluded agreement: first and last name, function, address of registered office/place of conducting business, other indicated address, e-mail address, telephone no, ID card number, driver's license number, vehicle registration number, individual identification number identification number, e.g. NIP, PESEL, or other data necessary for the conclusion and/or execution of the cooperation/contract.

The personal data indicated above will be processed only to the extent necessary to cooperation/performance of the contract and in accordance with the principle of adequacy.

Provision of Personal Data of Contractors is a condition for the conclusion and performance of the agreement and/or undertaking cooperation, and in the case of Contact Persons it is of a voluntary.

The Personal Data Administrator processes Personal Data of Contractors and/or Contact Persons.

Contact Persons for the purpose of and for the period of:

1. Personal Data of Contractors: for the purpose of concluding and executing the contract/conducting thecooperation, i.e. on the basis of Article 6(1)(f) of the RODO; Personal Data will be processed for the duration of the cooperation and/or the duration of the contract;
2. Personal Data of Contact Persons: in order to conclude or execute cooperation and/or contract with the Contractor, in particular for contact purposes, i.e. in the legitimate interest of the Personal Data Administrator and/or Group companies of the Personal Data Administrator - Article 6(1)(f) of the RODO; Personal Data. Personal Data will be processed for the period of cooperation with the Contractor and/or the duration of the duration of the contract with the Contractor;
3. Personal Data of Contractors and/or Contact Persons: in order to fulfill the purposes of thebusiness and administrative purposes related to the conduct of business activitiesbusiness, i.e. in the legitimate interests pursued by the Personal Data Administrator and/or companies in the group of the Personal Data Administrator - Article 6(1)(f) RODO; Personal Data will be processed for the period of time necessary for the Personal Data Administrator to fulfill the above purposes or until you object to the processing of your personal data;
4. Personal Data of Contractors and/or Contact Persons: for the purpose of investigationby the Personal Data Administrator and/or a Group Company of the Personal Data Administrator.Personal Data Administrator's Group for possible claims related to non-performance orImproper performance of the contract/cooperation and/or torts as well as defense against such claims, i.e. in the legitimate interest of the of the Personal Data Controller and/or the Group Company of the Personal Data Controller Personal Data Administrator i.e. Article 6(1)(f) RODO; Personal Data will be processed for a period equal to the statute of limitations for potential claims fornon-performance or improper performance of the contract/cooperation and/or torts;
5. Personal Data of Contractors and/or Contact Persons: for the purpose of maintainingaccounting books and other accounting documentation, i.e. in the legitimate interest of theinterest of the Personal Data Administrator and/or Group Company of the Personal Data Administrator.
   Personal Data, i.e. Article 6(1)(f) of the RODO; Personal Data will be processed for the period required by laws and regulations that impose certain obligations, the performance of which requires the processing of personal data;
6. Personal Data of Contractors and/or Contact Persons: for marketing purposes.i.e. presentation of offers and commercial information regarding products from the offer of theAdministrator of Personal Data, i.e. in the legally legitimate interest pursued by the Personal Data Administrator i.e. Article 6(1)(f) RODO; Personal data will be processed until you object to theprocessing of personal data for marketing purposes.

• f) in order to adapt the content of the Website to the User's preferences, communication with the User, optimization of use of the Website, for the purposes of creating statistics, presenting personalized content on the Site tailored to the preferences and interests of the User, personalizingand presentation of advertisements displayed on other pages, applications, sites, execution of surveys, and detection of bots and abuse in the services of activity analysis marketing tools and to ensure the security of the use of the Website.

Processing of User's Personal Data for the above purposes is necessary for purposes resulting from the legitimate interests of the Administrator of the Personal Data Administrator, i.e. to ensure proper functioning of the Service and to conduct promotional and marketing activities, including taking into account the characteristics of the recipients in the conducted activities, as well as to protect the Service against attempts of unlawful interference in the Service, e.g.: attempts to break into the Service by unauthorized persons.

unauthorized persons - i.e. Article 6 (1) (f) RODO. Personal data will be processed until raising an objection by the data subject - for reasons related to his/her particular situation - against the processing of personal data concerning him/her, also for marketing purposes.

The Personal Data Administrator implements the above purpose using, among other things, cookiesdescribed in detail in Chapter III - Cookie Policy.

4. Recipients of Personal Data

Personal Data may be transferred:

• a) to the extent indicated in item 3 letters a and b: authorized employees and co-workers of the Personal Data Administrator, a Group Company of the Personal Data Administrator Personal Data Administrator Group company, which, due to the scope of its activities, remains competent to answer the question sent, entities providing services, including maintenance and technical support services for applications, computer programs, IT systems and the Service, in which Personal Data is processed, entities authorized to receive Personal Data under the provisions of universally applicable laws;
• b) to the extent indicated in point.3 c: authorized employees of the Administrator
  Personal Data Administrator and persons authorized by the Personal Data Administrator
  Personal Data Administrator, the Personal Data Administrator's associates, Group companiesof the Personal Data Administrator who are manufacturers and/or distributors of the of the advertised products and their authorized employees; Group Companies of the Personal Data Administrator to whom the complaint has been reported and their authorized employees; toauthorized employees; insurers, insurance brokers, financial service providers, marketing service providers who cooperate with the Personal Data Administrator and/or entities designated by the Personal Data Administrator. Personal Data Administrator within the framework of complaint handling, state authorities when such an obligation results from legal regulations;
• c) to the extent specified in point 3 d: authorized employees and associates of the Personal Data Administrator.and associates of the Personal Data Controller, Group companies Personal Data Administrator and their authorized employees; agenciesmarketing, advertising, media houses cooperating with the Personal Data Administrator Personal Data Administrator or a Group Company of the Personal Data Administrator, entities,who provide services to the Personal Data Administrator (Group Companies of the Personal Data AdministratorPersonal DataAdministrator), in particular, entities providing IT services,entities that provide transportation, freight, postal, courier services, consulting servicesconsulting services, and those supporting thePersonal Data Administrator (Group Companies of the Personal Data AdministratorPersonal Data Administrator) in asserting claims, in particular:law firms, tax firms, debt collection serviceproviders, auditors,insurers, insurance brokers, and authorized employees orassociates of the aforementioned entities;
• d) to the extent indicated in point.3(e): authorized employees ofand associates of the Personal Data Administrator; Group companiesAdministrator of Personal Data and their authorized employees; entities,who provide services to the Personal Data Controller and/or GroupcompaniesAdministrator of Personal Data, including entities which the Administrator of Personal DataPersonal Data Administrator and/or a company in the Personal Data Administrator's Group uses in performing the contractperformance of the contract, in particular, entities providing IT services, entitiesproviding transportation, shipping, postal, courier services, consulting services, andsupporting the Personal Data Controller and/or a Group Company of the Personal Data ControllerPersonal Data Administrator in asserting claims, in particular: law firms,tax, debtcollection companies, auditors, insurers, insurance brokersand authorized employees of theaforementioned entities; entities authorized toreceive personal data on the basis of generallyapplicable lawsapplicable;
• e) to the extent indicated in point 3(f): companies of the Group of the Personal Data Administrator
  Personal Data Administrator Group companies and their authorized employees; entities providing services, includingmaintenance and technical support services for applications, computer programs,IT systems and the Service, in which Personal Data is processed,Partners of thePersonal Data Administrator and/or Group Companies of the Personal Data Administrator.Personal Data.

5. Rights with respect to Personal Data

The person whose Data is processed has the right to:

(a) access to the content of his Personal Data;
(b) rectification of his Personal Data;
(c) erasure of his Personal Data;
(d) limit the processing of his Personal Data;
(e) request a transfer of their Personal Data.

A data subject has the right to lodge a complaint regarding the processing of Personal Data to the supervisory authority, which in Poland is the President of the Office for Personal Data Protection.

In cases where the processing of Personal Data by the Personal Data Administrator Personal Data is carried out for the purpose of realizing the legitimate interest of the Personal Data Administrator

Personal Data or a third party, the person whose data is processed may at any time object - on grounds related to his or her particular situation - against the processing of Personal Dataconcerning him/her.

If the purpose of the processing of Personal Data is marketing, including marketing ofproductsfrom the offer of the Personal Data Controller, the person whose data isprocessed may at anytime object to the processing of Personal Data for the purposes of such marketing.

In cases where the processing of Personal Data is based on consent, the data subject has the rightto revoke at any time the granted consent to the processing of Personal Data. The withdrawal ofconsent shall not affect the lawfulness of the processing that was carried out on the basis ofconsent before itswithdrawal.

The aforementioned rights may only be exercised in accordance with the correspondingprovisions of the RODO.

In the event of a request for the exercise of rights related to the processing of Personal Data, the Personal Data will be processed in order to recognize the request and to document the manner in which the request was handled. The legal basis for the processing is The legitimate interests of the Personal Data Controller or Group Companies Administrator of Personal Data consisting of the need to recognize the request and to ensure accountability related to its recognition - i.e. Article 6(1)(f) of the RODO. The Personal Data will be processed for the period of time that enables the fulfillment of this interest or until you raise an effective objection to the processing of Personal Data for the aforementioned purpose.

The contact person of the Personal Data Controller in all matters related to the processing of personal data, as well as for the purpose of exercising the above rights, is the Data Protection Officer:

Contact details of the Data Protection Supervisor:

Correspondence address:
Auto Spot sp. z o.o.
Henryka Sienkiewicza 19
05-800 Pruszków
iod@autospot.com.pl