AC W03

Dear Customer,
As of 25 May 2018, the Regulation (EU) of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, referred to as the GDPR, will come into force.

Therefore, we want to inform you about the rules governing processing of your personal data by AC S.A. and your related rights. We want you to have complete knowledge and thus full comfort of using the AC S.A. services and systems. Therefore, before you start using our websites and platforms, please read the following information.

At the same time, we want to ensure you that we care about your privacy and do not expand our authorisation in any way. Your personal data is safe with us, and you can withdraw your consent to collect and process it at any time, in accordance with the following provisions.

Collection and processing of personal data

When you visit our website, we save, among other things, information about your web browser, operating system, address of the website from which you come to us, the address of web pages on our site that you visit, the date of visit on our site, and the IP address assigned to you by your internet service provider.

AC SA uses the so-called plug-ins of social networks, such as Facebook and LinkedIn. Such plug-ins are normally disabled on our website, meaning that they do not send any data to social networks without your participation. The use of plug-ins is possible only after activating them with a click of the mouse. The plug-in remains active until it is turned off or you delete your cookies. AC S.A. also uses solutions such as Facebook Pixel, Google remarketing code, HotJar tracking code to provide marketing information and improve the site.

Information on the protection of personal data

Based in Białystok, ul. 42 Pułku Piechoty 50, 15-181 Białystok, as the personal data controller, AC S.A. collects your personal data obtained during the conclusion of the contract with you and during its term, in particular:

• First name(s) and surname, e-mail address, contact address, business name of the represented entity, telephone number, position,

• In the case of companies, we also process: tax identification number (NIP), statistical number (REGON), registered address, bank account number,

• In the case of companies applying for a credit limit with AC S.A. we also process data contained in financial documents.

We collect your personal data for the following purposes:

• Conclusion and implementation of a contract between AC S.A. and you, and provision of the services offered to you, including, in particular, shipment of ordered goods and payment processing, handling of complaints,

• Performance of the obligations of AC S.A. provided for by law, including in particular issuing and storing invoices and accounting documents, as well as for archiving purposes,

• Protection of the rights of AC S.A. in accordance with the law, including in particular the recovery of overdue payments as part of debt collection processes and lawsuits,

• Verification of your payment credibility and creditworthiness when granting you a credit limit, as well as to secure due payments (surety agreements and other collateral),

• Legitimate interests of AC S.A. within the meaning of the provisions on the protection of personal data, including marketing of products and services of AC S.A. (direct marketing),

• Conducting marketing activities and sending commercial information in the case of your separate consents.

AC S.A. may transfer personal data to the following third parties for the purposes indicated in this document:

1. Entities with whom AC S.A. has a cooperation agreement in order to implement the contract between AC S.A. and you, to fulfil the obligations of AC S.A. required by the law, to protect the rights of AC S.A. in accordance with the law and for the pursuit of the legitimate interest of AC S.A. within the meaning of the provisions on the protection of personal data; in particular, AC S.A. may transfer your personal data to entities such as: banks, debt collection companies, entities providing accounting services, companies providing postal and courier services, companies with whom we cooperate in order to provide marketing services. Such entities will be obliged under the agreements concluded with AC S.A. to apply appropriate security, technical, and organisational measures to protect personal data and process it only in accordance with the instructions provided by AC S.A.,

2. Supervisory bodies, the authorities and other third parties; if it is necessary to achieve the goals set out above and fulfil the obligations imposed by law, personal data may be transferred to supervisory bodies, courts, and other authorities (e.g. tax authorities and law enforcement authorities), independent external advisers (e.g. auditors) or entities providing services.

AC S.A. undertakes to apply appropriate security measures, both technical and organisational, to protect your personal data. Personal data will be stored by AC S.A. only for the time necessary to achieve the purposes for which these data is collected, the performance of obligations under the law, for the maximum period of securing the materials necessary for legal proceedings (including tax proceedings) and until your and AC S.A.'s potential claims are expired.

In addition, you have the right to:

• Object to the processing of data
  In the event that we process data due to our legitimate interest that you disagree with. If the objection turns out to be legitimate, the data will be deleted.

• Rectification (correction) of data
  In the case that the data being processed is incorrect or incomplete.

• Deleting data (being forgotten)
  You can request your personal data to be deleted in the following situations:
  - When the consent on the basis of which personal data has been processed has been revoked;
  - When the data is not necessary for the purposes for which it has been collected;
  - Objection to data processing has been lodged;
  - When personal data is processed unlawfully.

• Processing restrictions
  You can request that we do not process certain personal data (in addition to its storage), but without completely deleting them.

• Access to data
  The law allows you to obtain information as to whether AC S.A. processes personal data, which data is processed, for what purpose and at what time, and to obtain a copy of your personal data.

• Transfer of data
  You can request to prepare the data that is in the possession of AC S.A. in a structured form, in a format that is commonly readable by machine and/or ask for its transfer to another Data Controller.

• Lodging a complaint
  You have the right to lodge a complaint to a supervisory authority dealing with the protection of personal data, when you think that the processing of your personal data violates the provisions of Regulation 2016/679;

In the event of any questions regarding personal data or the exercise of rights in the field of the data subject, please contact us at rodo@ac.com.pl

We would like to inform you about the possibility of periodical updating of this notice in accordance with the applicable law (e.g. if we implement new systems or processes that involve the use of personal data), in which case we shall inform you accordingly about the changes.