Policy for processing of personal data at BTC Ltd.

1. DEFINITIONS

1.1 Administrator

BTC Sp. z o.o. with its headquarters in Szczecin, building C, 2nd floor, 38 1 Maja St., phone +48 91 433 18 80.

1.2 Personal data

All information about a natural person identified or identifiable by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including image, voice recording, contact data, location data, information contained in correspondence, information collected through recording equipment or other similar technology.

1.3 Policy

This Personal Data Processing Policy.

1.4 RODO

Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

1.5 Data subject

Any natural person whose personal data is processed by the Administrator, such as a person visiting the Administrator’s headquarters or directing a written or electronic inquiry to the Administrator.

2. DATA PROCESSING BY THE CONTROLLER

2.1 Data processing

The Administrator collects and processes personal data in accordance with applicable laws, including in particular the RODO, and the data processing rules provided therein.

2.2 Administrator:

• Ensures transparency in data processing;
• informs about the processing of data at the time of collection;
• ensures that data are collected only to the extent necessary for the stated purpose and processed only for the period of time necessary;
• ensures the security and confidentiality of personal data.

3. CONTACT THE ADMINISTRATOR

3.1 Contact information

• E-mail: mkaczynski@btc.com.pl
• Correspondence address: Inspector for Personal Data Protection, BTC Sp. z o.o., building C, 2nd floor, 38 1 Maja St., 71-627 Szczecin

3.2 Data Protection Officer

The Data Protection Inspector is Maciej Kaczynski. He can be contacted via e-mail: iod@btc.com.pl.

4. SECURITY OF PERSONAL DATA

4.1 Safety measures

The administrator has implemented appropriate procedures to ensure the protection of personal data. Only authorized persons have access to the data.

4.2 Security measures

• Introduction of organizational and technical solutions to guarantee the security of processed data.
• Cooperate only with entities that guarantee the use of appropriate security measures.
• Conduct ongoing risk analysis and monitor the adequacy of safeguards in place.

5. PURPOSES AND LEGAL BASIS FOR PROCESSING

5.1 Email/Traditional Correspondence

Personal data contained in correspondence are processed for the purpose of communication and resolution of the matter to which the correspondence relates. The legal basis for the processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO).

5.2 Telephone contact

Personal data provided in the course of a telephone call are processed solely for the purpose of handling the matter to which the contact relates.

5.3 Entry control

To ensure security, the Administrator uses an entry and exit registration system.

5.4 Recruitment

The data is processed in accordance with labor laws and on the basis of the candidate’s consent.

5.5 Service provision and contracts

The data is processed for the performance of the contract in accordance with the information provided at the time of contracting.

5.6 Other cases

Data may be collected for business purposes, such as during meetings or business card exchanges.

6. DATA RECIPIENTS

Personal data may be disclosed to IT, accounting, courier, marketing and recruitment service providers.

7. TRANSFERRING DATA OUTSIDE THE EOG

The Administrator does not transfer personal data outside the European Economic Area (EEA).

8. PERIOD OF PROCESSING OF PERSONAL DATA

The data retention period depends on the purpose of processing and applicable regulations. After the expiration of the retention period, the data is deleted or anonymized.

9. RIGHTS OF DATA SUBJECTS

Data subjects have the right to:

• information on data processing;
• obtain a copy of the data;
• data rectification;
• deletion of data;
• processing restrictions;
• data portability;
• Object to processing;
• withdrawal of consent;
• To file a complaint with the President of the DPA.

9.1 Making requests

Requests for the exercise of rights can be submitted:

• In writing to: BTC Sp. z o.o., Building C, 2nd floor, 38 1 Maja St., 71-627 Szczecin.
• By e-mail: iod@btc.com.pl.

10. CHANGES IN PERSONAL DATA PROCESSING POLICY

The policy is regularly reviewed and updated. The current version was adopted on May 24, 2018 and is effective as of May 25, 2018.