Privacy Policy of Ex-PRO Sp. z o.o.

I. Who We Are

The purpose of the company operating under the name Ex-PRO Sp. z o.o. (hereinafter referred to as the “Controller”), with its registered office in Klucze at: ul. Osada 4, 32-310 Klucze, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number: 0000804518, NIP: 637-220-84-38, REGON: 384404435, includes, among others, supervision of matters related to personal data protection.
We make every effort to ensure that your personal data processed by us is accurate and up to date. Please inform us if your personal data changes during the period in which we store it.

II. General Information

1. This Privacy Policy describes what we do with your personal data and constitutes fulfillment of the information obligation specified in the GDPR. The Policy applies to the processing of your data both when you are our client, when you visit our website, and when you are our contractor or an employee of our contractor.
2. In this Policy, we describe how we collect, use, or otherwise process your personal data and how we comply with our obligations towards you.
3. If you are our client, we will also try to inform you by email about any significant changes to our data protection principles.
4. The Controller attaches particular importance to protecting the privacy of all individuals whose data we process. A priority aspect is the protection of the rights and freedoms of natural persons in connection with the processing of their personal data. We ensure that the processing of your data complies with Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”), the Personal Data Protection Act, and other specific legal provisions (including labor law, tax law, and accounting regulations).
5. The Company is the Controller within the meaning of Article 4(7) of the GDPR. We also use the services of processors referred to in Article 4(8) of the GDPR – they process personal data on behalf of the Controller.
6. We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of infringement of the rights or freedoms of natural persons of varying likelihood and severity. We ensure that any person acting under our authority and having access to your personal data processes it only on our instructions.
   If you believe that the processing of your data in accordance with this Privacy Policy may violate your rights or is inconsistent with applicable regulations, please inform us at: ul. Osada 4, 32-310 Klucze or via email at: biuro@ex-pro.pl.

III. What Personal Data We Collect, for What Purpose, on What Legal Basis, and for How Long

1. Categories of Data
   When you are our client, contractor, or an employee of a contractor and enter into a relationship with us, we may collect and process the following categories of personal data:
   1.1. Your full name, the company you are associated with, and your position;
   1.2. Your contact details, such as company address, telephone numbers, and email addresses;
   1.3. Our communication with you;
   1.4. Your interest in our products or services, and information related to concluding a contract with us or granting us a power of attorney.
2. Purposes of Processing
   We process your data primarily for the purposes of:
   2.1. Establishing and managing contacts with the company you are associated with;
   2.2. Managing our relationship with you, including performance of concluded contracts and provision of services;
   2.3. Communication.
3. Legal Bases for Processing
   We process your data based on:
   3.1. Your consent (which may be withdrawn at any time) – Article 6(1)(a) GDPR.
   3.1.1. If we have asked for your consent to process personal data for direct marketing purposes or to send commercial information electronically, you may withdraw your consent at any time using the dedicated link included in each message or by contacting us by phone.
   3.2. The performance of a contract to which you are a party or to take steps at your request prior to entering into a contract – Article 6(1)(b) GDPR;
   3.3. Compliance with a legal obligation incumbent upon us as the Controller (e.g., obligations arising from labor law, accounting regulations, or anti-money laundering and counter-terrorism financing laws) – Article 6(1)(c) GDPR;
   3.4. Our legitimate interests, such as processing data for the purpose of establishing, pursuing, or defending against claims – Article 6(1)(f) GDPR.
   If you are our business client, contractor, or act on behalf of a company or institution you represent, we may send information about our products and services to your organization at the indicated correspondence or email address regardless of consent, based on our legitimate interests. Respecting our mutual relationship, we provide the option to opt out of receiving such information in the same manner as individual clients or consumers.

4. Data Retention Period
   • We store personal data in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data is processed. After this period, the data is anonymized (deprived of identifying features) or deleted. Deletion is complete and permanent.
   • The retention period is determined primarily based on legal provisions (e.g., retention of employee documentation, accounting records) and the legitimate interests of the Controller (e.g., marketing activities). These principles apply to both paper and electronic data.

5. Website Users’ Data
   We collect a limited amount of data from users of our website www.ex-pro.pl to improve your experience while using the website and to facilitate management of the services we provide, regardless of whether you choose to use our services. This includes information such as your IP address, date and time and frequency of visits, and how you browse the website.
   We collect so-called server logs – information about certain user activities is logged at the server level. This data is used solely for website administration and to ensure the most efficient hosting services. Viewed resources are identified by URLs. Additionally, the following may be recorded:
   5.1. Time of request;
   5.2. Information about the IP address;
   5.3. Information about errors occurring during HTTP transactions.
   We will also collect data from you when you contact us via the website, for example, using the contact form.

6. Legal Grounds for Processing
   We process your personal data on the following legal grounds:
   6.1. Based on your consent (Article 6(1)(a) GDPR) – you may withdraw consent at any time by following the instructions related to the processing you consented to or by contacting us at biuro@ex-pro.pl;
   6.2. Based on our legitimate interests or those of third parties (Article 6(1)(f) GDPR). When processing data on this basis, we take appropriate steps to protect you from potential harm. Our legitimate interests may include marketing purposes (promotion of our products and services);
   6.3. Based on a concluded contract (Article 6(1)(b) GDPR), to the extent necessary for its performance or for taking steps prior to its conclusion.

7. Your Rights
   We take appropriate measures to provide all relevant information and to communicate with you regarding the processing of personal data in connection with the exercise of your rights, including the right to:
   • Information at the time of data collection;
   • Access to data (including receiving a copy of the data – the first copy free of charge);
   • Rectification of inaccurate or incomplete data;
   • Erasure (“right to be forgotten”) under specified circumstances;
   • Restriction of processing in certain cases;
   • Data portability (for data processed automatically based on consent or contract);
   • Objection to processing (including an absolute right to object to direct marketing);
   • Not to be subject to a decision based solely on automated processing, including profiling. Currently, we do not make such decisions;
   • Information about a personal data breach if it may result in a high risk to your rights and freedoms;
   • Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of the above rights, you may contact us at: biuro@ex-pro.pl or in writing at our registered office address.
If you believe that we are violating data protection laws in processing your personal data, you have the right to lodge a complaint with the President of the Personal Data Protection Office.

8. How We Will Communicate with You
   We provide information in writing or electronically if you consent or request it. If you submit your request electronically to the addresses indicated in Section I, we will, where possible, respond electronically unless you indicate another preferred form of communication.
9. Response Time
   We make every effort to provide information without undue delay – generally within one month of receiving the request. If necessary, this period may be extended by an additional month due to the complexity or number of requests. In any case, within one month of receiving the request, we will inform you of the actions taken and, if applicable, of any extension and the reasons for the delay.
10. Data Recipients
    • We cooperate only with processors that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure GDPR compliance and protection of data subjects’ rights.
    • We carefully verify entities entrusted with data processing and conclude appropriate agreements with them, conducting periodic compliance checks.
    • We may share your data with external service providers acting on our behalf (e.g., business partners and professional advisors such as lawyers and accountants).
    • Your data may also be disclosed upon request to entities authorized under applicable law.
11. Transfers Outside the European Union
    Currently, Ex-PRO Sp. z o.o. does not transfer your data outside the European Union and does not use subcontractors that transfer data outside the EU.
12. Changes to the Privacy Policy
    • To ensure that this Privacy Policy complies with current legal requirements, we reserve the right to amend it at any time.
    • You will be informed of any changes in a clear and understandable manner and by email to the address provided by the User.