LAMARK-AUTO Sp. z o.o. General Privacy and Data Protection Policy

1. INTRODUCTION

This Privacy Policy sets out the rules for collecting and processing personal data of current and potential Customers of LAMARK-AUTO Sp. z o. o., including visitors to LAMARK-AUTO websites (hereinafter collectively "Users"). LAMARK-AUTO respects your privacy. Whether you are dealing with LAMARK-AUTO as a customer, consumer, interested in our services and products, etc., you have the right to protect your Personal Data. This data may refer to name, telephone number, e-mail address, but also other data such as vehicle identification number (VIN), geolocation data, etc.

In this General Privacy and Personal Data Protection Policy (hereinafter referred to as the "Policy"), we describe how we collect your Personal Data and why we collect it, what we do with your Personal Data, with whom we share it, how we protect it, and what choices you can make regarding your Personal Data.

This Policy applies to the processing of Personal Data as part of various services, tools, applications, websites, portals, (online) sales promotions, marketing campaigns, sponsored social media platforms, etc., which are provided or operated by us or on our behalf. This Policy contains general rules and explanations. It is supplemented by separate information obligation clauses regarding the above-mentioned specific services, tools, applications, websites, portals, (online) sales promotions, marketing activities, sponsored social media platforms, etc. These disclosure requirements will be provided to you when your Personal Data is processed as part of the above-mentioned activities (e.g. via websites, portals, individual communication services, newsletters, etc).

This Policy applies to all Personal Data collected and used by (or on behalf of) LAMARK-AUTO Sp. z o. o., collectively referred to in this Policy as "LAMARK-AUTO", "we", "us" and "our".

If you accept the provisions of this Policy, you also consent to the processing of your Personal Data in the manner specified in this Policy.

At the end of this Policy, you will find definitions of key terms used in it in capital letters (e.g. Personal Data, Processing, Data Administrator).

2. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA?

The entities responsible for the Processing of your Personal Data (Data Administrators) are:

LAMARK-AUTO Sp. z o. o.
ul. Czeremchowa 5c, 03-159 Warsaw, Poland

REGON: 523338783, NIP: 7831865692

Email for data protection communications: lamarkauto.spzoo@gmail.com

3. KEY PRINCIPLES

We care about the Personal Data entrusted to us and undertake to process them in a fair, transparent and secure manner. To this end, LAMARK-AUTO applies the following principles:

• Lawfulness: we will only collect and process your Personal Data in a lawful, fair and transparent manner.
• Data minimization: we will limit the collection of your Personal Data to what is adequate and necessary to achieve the purposes for which it was collected.
• Purpose limitation: we only collect your Personal Data for specific, explicit and legitimate purposes and will not process your Personal Data in a way that is incompatible with those purposes.
• Accuracy: we ensure that the Personal Data we store is accurate and up-to-date.
• Security and data protection: in order to ensure the security and protection of data at the appropriate level, we implement technical and organizational measures, taking into account, among others, the nature of the Personal Data subject to protection.
• Access and rectification of data: we will process your Personal Data in a manner that ensures confirmation as to whether they are being processed, and access to such Data and obtaining the requested information along with a request to rectify your Personal Data in accordance with your rights.
• Limited data retention period: we will retain your Personal Data in a manner consistent with applicable data protection laws and regulations and for no longer than is necessary to fulfill the purposes for which it was collected or as required by law.
• Protection in case of international transfer: we will ensure that your Personal Data is adequately protected when transferred, in particular to countries outside the EEA.
• Third party safeguards: we will ensure that access to Personal Data by third parties (and transfer of Personal Data to them) is in accordance with applicable law and appropriate contractual safeguards.
• Compliance with the law of direct marketing and the use of cookies: we ensure that sending promotional materials and placing cookies on your computer is carried out in accordance with applicable law.

4. PROCESSING OF YOUR PERSONAL DATA: WHAT PERSONAL DATA WE COLLECT AND ON WHAT LEGAL BASIS

Each time you are asked to provide your Personal Data, you will be clearly informed about which of your Personal Data is being collected. This information will be provided to you in the form of an appropriate information obligation clause included in specific services (including communication services), Internet portals, electronic newsletter, reminders, surveys, offers, invitations to events, etc. Please note that in accordance with the provisions on the protection of your data Personal Data may be processed if:

• you have consented to the Processing (as described in the disclosure clause applicable to that specific Processing). When in doubt, you always have the right to withdraw your consent at any time; or
• it is necessary for the performance of a contract to which you are a party; or
• in the case of certain Processing, we act on the basis of our legitimate interest, provided that it is not overridden by your interests or fundamental rights and freedoms. The existence of such a legitimate interest will be duly communicated to you in the form of a disclosure clause relating to that particular Processing;
• it is required by law.

5. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

We will only process your Personal Data for specified, explicit and lawful purposes and will not further process it in a way that is incompatible with those purposes.

Such purposes may be to fulfill an order you have placed, to perform a contract, to improve the quality of our services based on your opinion about visiting one of our websites or portals, to improve the quality of our products or services in general, to offer services or applications, to communicate and with marketing, profiling as part of marketing, etc. The purpose of each Processing of your Personal Data is set out in a specific information obligation clause relating to that particular Processing. Information on specific information obligation clauses is made available, for example, by websites or portals, in applications, electronic newsletters, etc.

6. PROCESSING OF PERSONAL DATA IN A WAY ENSURING THEIR CORRECTNESS AND TIMELINESS

Keeping the Data in a way that ensures its correctness and validity is very important to us. We ask that you inform us of any changes or errors in your Personal Data as soon as possible by contacting us through the e-mail listed in section 2. We will take reasonable steps to ensure that any inaccurate or outdated Personal Data is removed or adjusted accordingly.

7. ACCESS TO YOUR PERSONAL DATA

You have the right to access your Personal Data that we process and, if your Personal Data is inaccurate or incomplete, to request that it be corrected or deleted. If you need further information regarding your privacy rights or would like to exercise these rights, please contact us through the e-mail listed in section 2.

8. HOW LONG WE STORE YOUR PERSONAL DATA

We will retain your Personal Data in a manner consistent with Data Protection Laws and only as long as necessary for the purposes for which we process it, or to comply with the law, or as required by law to retain your Data for a period of time. For information on how long certain Personal Data will be retained before being deleted from our systems and databases, please contact us through the e-mail listed in section 2.

Relevant information will also be provided in specific clauses of the information obligation that will be provided to you when your Personal Data is processed.

9. PROTECTION OF YOUR PERSONAL DATA

In order to guarantee the protection of your Personal Data against accidental or unlawful destruction, loss, modification, unauthorized disclosure or unauthorized access, we have applied an appropriate set of technical and organizational measures. They are specifically designed taking into account our IT infrastructure, the potential impact on your privacy and related costs, and in accordance with current industry standards and practice.

Your Personal Data may be processed by a third party Data Processor only if that Data Processor undertakes to apply these technical and organizational data security measures.

Keeping Personal Data safe means protecting its confidentiality, integrity and availability:

• Confidentiality: we will protect your Personal Data from unsolicited disclosure to third parties.
• Integrity: we will protect your Personal Data from modification by unauthorized third parties.
• Availability: we will ensure that authorized parties are able to access Personal Data when needed.

Our Data security procedures include: access security, backup systems, monitoring, review and maintenance of systems, management of security incidents, ensuring business continuity, etc.

10. USE OF COOKIES OR SIMILAR TOOLS

We use cookies on our websites. Thanks to this, we are able to provide you with a greater comfort when browsing the website and it allows us to make improvements on the website.

For additional information on the use of cookies and how to avoid them, please refer to our Cookie Policy available on each LAMARK-AUTO website (www.lamark-auto.eu).

11. DISCLOSURE OF PERSONAL INFORMATION

Depending on the purposes for which we collect your Personal Data, we may disclose it to the following categories of recipients, who will then process it only as part of the indicated purposes:

1.  Within our LAMARK-AUTO organization:

• Our authorized employees;

2.  External business partners:

• Advertising, marketing and promotion agencies acting on our behalf: to help us deliver and analyze the effectiveness of our advertising and promotional campaigns;
• Commercial partners: for example, trusted companies that may use your Personal Data to provide the services and/or products you have requested and/or that may provide you with marketing materials (provided you have consented to receive them). We ask such companies to always comply with applicable laws and this Policy and to pay particular attention to the confidentiality of personal information;
• LAMARK-AUTO service providers: companies that provide services to or on behalf of LAMARK-AUTO to provide such services (for example, LAMARK-AUTO may disclose your Personal Data to third party IT related service providers);

3.  Other third parties:

• when required by law or legally necessary to protect LAMARK-AUTO:

        ◦  to comply with the law, requests of state authorities, court orders, legal procedures, obligations related to reporting and providing information to authorities, etc.;

        ◦  to verify or enforce compliance with LAMARK-AUTO policies and agreements;

        ◦  to protect the rights, property or safety of LAMARK-AUTO and/or our customers;

• in connection with corporate transactions: in the context of a transfer or divestiture of all or part of its business or otherwise in connection with a merger, consolidation, change of control, reorganization or liquidation of all or part of the LAMARK-AUTO business.

Please note that the third party recipients listed in points above – especially service providers who may offer products and services through LAMARK-AUTO services or apps or through their own channels - may collect Personal Data from you separately. In such case, these entities are solely responsible for the processing and control over such Personal Data, and your dealings with them will be subject to their terms and conditions.

12. USE OF SOCIAL MEDIA

If you use a specific social media login (e.g. Facebook account) when using a LAMARK-AUTO tool (website, portal...), LAMARK-AUTO will record your Personal Data available on these social media and your use of such social media means that you have expressly consented to the transfer of Personal Data recorded by LAMARK-AUTO through the tools of this social media.

LAMARK-AUTO sometimes facilitates the publication of Personal Data via social media such as Twitter and Facebook. Social media have their own privacy policies that you must take into account when using them. We remind you that posting content on social media may have certain consequences, including for your privacy or the privacy of the people whose Personal Data you provide, e.g. the inability to withdraw published content in a short time. You are fully responsible for what you post. LAMARK-AUTO assumes no liability in this respect.

13. TRANSFER TO COUNTRIES OUTSIDE THE EEA

Your Personal Data may be transferred to recipients located outside the EEA and may be Processed by us and recipients outside the EEA. In connection with any transfer of your Personal Data to countries outside the EEA, LAMARK-AUTO will put in place appropriate measures to ensure an adequate level of protection for your Personal Data. These measures may, for example, consist of agreeing binding contractual clauses with customers that guarantee an adequate level of protection.

We will always clearly inform you when your Personal Data is transferred outside the EEA. This information will be provided to you via a separate disclosure clause, which will be included, for example, in certain services (including communication services), electronic newsletters, reminders, surveys, offers, invitations to events, etc.

14. YOUR CHOICES AND YOUR RIGHTS

We want our activities to be as transparent to you as possible so that you can make rational choices about how we use your Personal Data.

• Your Personal Data

You can always contact us through the the e-mail listed in section 2 to find out what personal data we have about you and what is their purpose origin. Under certain circumstances, you have the right to receive a copy of the Personal Data you have provided to us in a commonly used, structured and machine-readable format or to request that your Personal Data be transferred to any third party of your choice.

• Your corrections

If you find an error in your Personal Data, or if you believe that it is incomplete, outdated or incorrect, you may request us to correct or supplement it.

• Your restriction reques

You have the right to request restriction of the Processing of your Personal Data (e.g. where the accuracy of your Personal Data is contested when it is not needed for the processing purposes).

• Your reservations

You can object to the use of your Personal Data on the basis of the Administrator's legitimate interest (we will stop processing data for this purpose, unless there are legally justified grounds for processing specified in the regulations or when processing is necessary to establish, pursue or defend claims) .

You can also object to your Personal Data being used for direct marketing purposes or being shared with third parties for the same purpose.

• Your right to withdraw your consent

You may withdraw your consent to further Processing of Personal Data that you have given us at any time. Withdrawal of consent is possible by contacting the the e-mail listed in section 2.

• Your right to be forgotten

In addition, you may request us to delete your Personal Data (except in certain cases, for example to prove a transaction, pursue or defend claims, or where required by law).

• Your right to complain

Please also remember that you also have the right to lodge a complaint against LAMARK-AUTO Sp. z o. o. as the Data Administrator to the appropriate data protection office ("President of the Data Protection Office").

15. LEGAL NOTICE

The requirements of this Policy are in addition to and do not replace any other requirements under data protection law. In the event of a conflict between the content of this Policy and the requirements of data protection law, the data protection law shall prevail.

LAMARK-AUTO may change this Policy at any time, e.g. in order to adapt it to current data protection laws, due to decisions or other acts of state authorities or in connection with the need to improve the provision of our services. We will keep you informed of any changes by publishing the current version of this Policy on the website of each LAMARK-AUTO on each LAMARK-AUTO website (www.lamark-auto.eu).

16. DEFINITIONS

In this Policy, the following terms have the following meanings:

1. EEA means the European Economic Area (i.e. Member States of the European Union + Iceland, Norway and Liechtenstein).
2. Personal Data is any information about an identified or identifiable natural person or enabling you to be identified indirectly, such as, for example, name and surname, telephone number, e-mail address, vehicle identification number (VIN), geolocation, etc.
3. Processing means an operation or set of operations performed on your Personal Data or sets of such Data, whether or not by automated means, such as collecting, recording, organizing, structuring, storing, adapting or modifying, retrieving, accessing and all forms of use of Personal Data.