PRIVACY POLICY

I. Data Controller

Please be informed that the data controller of your personal data is Multico Sp. z o.o. with its registered office in Warsaw, ul. Ciasna 6, 00-237 Warsaw, entered into the National Court Register under KRS number 0000048039, share capital: PLN 1,050,000.00, NIP: 527-02-04-181, hereinafter referred to as the "Company". Contact with the Company regarding personal data protection is possible in person, via post, or at the email address: rodo.niechorze@multico.pl.

II. Purposes and Legal Basis for Personal Data Processing

To ensure that our services are provided in accordance with our scope of operations, the Company processes your personal data for various purposes, but always in compliance with the law. Below are the specific purposes of personal data processing along with their legal bases.

Based on actions taken by you prior to entering into an agreement (i.e., a development agreement and a property sale agreement), at your request and/or for the purpose of concluding it, and subsequently to execute the provisions of the concluded agreement, we process personal data such as:

• first name
• last name
• company name
• PESEL (National Identification Number)
• NIP (Tax Identification Number)
• residential address
• mobile phone number
• bank account number

The legal basis for such data processing is Article 6(1)(b) of the GDPR, which permits the processing of personal data if it is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract.

In order to fulfill our legal obligation, i.e., keeping accounting records and tax documentation, we process personal data such as:

• first name
• last name
• company name
• PESEL
• NIP
• residential address

The legal basis for such data processing is Article 6(1)(c) of the GDPR, which allows personal data processing when it is necessary for compliance with a legal obligation to which the controller is subject.

For the purpose of our legitimate interest, i.e., pursuing claims arising from our business activities, we process personal data such as:

• first name
• last name
• company name
• PESEL
• NIP
• residential address

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which permits the processing of personal data when it is necessary for the purposes of the legitimate interests pursued by the controller.

For the purpose of using cookies on the website, we process text information (cookies are described separately in section III).

The legal basis for such processing is Article 6(1)(a) of the GDPR, which allows the processing of personal data based on freely given consent (upon first entering the website, a request for consent to use cookies is displayed).

In order to create logs and registers related to the GDPR, including, for example, a register of clients who have objected in accordance with the GDPR, we process personal data such as:

• first name
• email address

The legal basis for such data processing is, first, Article 6(1)(c) of the GDPR, which allows processing when it is necessary to comply with a legal obligation; second, Article 6(1)(f) of the GDPR, which allows processing when the controller pursues its legitimate interest (in this case, the Company's interest is to maintain knowledge of individuals exercising their rights under the GDPR).

III. Cookies

1. Like other entities, the Company uses cookies on its website—short text files saved on a user's computer, phone, tablet, or other device. They can be read by our system, as well as by systems belonging to other entities whose services we use.
2. Cookies perform many useful functions on a website, which we describe below:
   • Ensuring security — cookies are used to authenticate users and prevent unauthorized use of the client panel. They protect the user's personal data from unauthorized access;
   • Impact on website processes and efficiency — cookies are used to ensure the smooth operation of the website and the availability of its features. This is achieved, among other things, by remembering settings between visits, allowing efficient navigation through the website and its subpages;
   • Session state — cookies often store information about how visitors use the website, e.g., which subpages they view most frequently. They also help identify errors displayed on certain pages. Session state cookies help improve services and enhance the browsing experience;
   • Maintaining session state — if a client logs into their panel, cookies keep the session active. This means that when moving to another subpage, the client does not need to re-enter their login and password each time, increasing user comfort;
   • Creating statistics — cookies are used to analyze how users interact with the website (how many visitors open the page, how long they stay, what content generates the most interest, etc.). This allows continuous improvement of the website and adaptation to user preferences. To track activity and create statistics, we use Google tools such as Google Analytics. In addition to reporting usage statistics, Google Analytics may also be used alongside cookies to show more relevant content across Google services (e.g., Google Search) and the web.
3. Importantly, many cookies are anonymous to us — without additional information, we are unable to identify your identity based on them.
4. Your web browser allows the use of cookies on your device by default, which is why we ask for your consent upon your first visit. If you do not wish to use cookies while browsing the website, you can change your browser settings to completely block cookies or receive notifications every time a cookie is placed on your device. Settings can be changed at any time.
5. While respecting the autonomy of all visitors, we must inform you that disabling or restricting cookies may result in serious difficulties using the website, such as having to log in on every subpage, longer loading times, or functional limitations.

IV. Right to Withdraw Consent

1. If personal data processing is based on consent, you may withdraw this consent at any time at your own discretion.
2. If you wish to withdraw your consent to personal data processing, it is sufficient to send an email directly to the Company at: rodo.niechorze@multico.pl.
3. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. In other words, we have the right to process your data until the consent is revoked.

V. Requirement to Provide Personal Data

1. Providing any personal data is voluntary and depends on your decision. However, in some cases, providing specific personal data is necessary to meet your expectations regarding our services – primarily, to enable the conclusion of a development agreement and a property sale agreement.

VI. Automated Decision-Making and Profiling

Please be informed that we do not engage in automated decision-making, including profiling.

VII. Recipients of Personal Data

1. Like most businesses, we utilize the assistance of external entities in our operations, which often involves transferring personal data. Consequently, when necessary, we share your data with our IT specialists, accountants, and lawyers.
2. Additionally, based on applicable legal provisions or a decision of a competent authority, we may be required to share your personal data with public or private bodies. While it is difficult to predict who might request such data, we assure you that every request is scrutinized carefully to prevent unauthorized disclosures.

VIII. Transfer of Personal Data to Third Countries

Please be informed that your personal data is not transferred outside the European Economic Area (EEA).

IX. Period of Personal Data Processing

1. In accordance with applicable law, we do not store your personal data "indefinitely", but only for the time required to achieve the specified purpose. After this period, your personal data will be irreversibly deleted or destroyed.
2. Regarding specific periods, we process personal data for the duration of:
   • the agreement — with respect to personal data processed for the conclusion and performance of a contract;
   • 3 years or 10 years + 1 year — with respect to data processed to establish, pursue, or defend claims (the length depends on whether both parties are businesses);
   • 5 years — with respect to data related to compliance with tax law obligations;
   • until consent is withdrawn or the purpose is met, but no longer than 5 years — for data processed based on consent;
   • until an objection is successfully lodged or the purpose is met, but no longer than 5 years — for data processed based on the legitimate interest of the Data Controller or for marketing purposes.
3. Periods in years are calculated from the end of the year in which processing began to optimize data destruction workflows. Individual calculations for every single event would pose significant organizational and technical difficulties.
4. The additional year for data collected for contract performance is a precautionary measure in case a claim is submitted right before the limitation period expires or if delivery is significantly delayed.

X. Data Subject Rights

1. Please be informed that you have the right to:
   • access your personal data;
   • rectify your personal data;
   • erase your personal data;
   • restrict the processing of your personal data;
   • object to the processing of your personal data;
   • data portability.
2. We respect your rights under data protection laws and strive to facilitate their implementation to the highest degree possible.
3. Please note that these rights are not absolute, and we may legally refuse them in certain situations after thorough legal analysis.
4. Regarding your right to object, you may object to data processing based on the Controller's legitimate interest at any time due to your particular situation. However, we may refuse if we demonstrate compelling legitimate grounds that override your interests, or for the establishment, exercise, or defense of legal claims.
5. You can exercise your rights by sending an email directly to the Company at: rodo.niechorze@multico.pl.

XI. Right to Lodge a Complaint

If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

XII. Final Provisions

1. In matters not covered by this Privacy Policy, applicable data protection regulations shall apply.
2. This Privacy Policy is effective as of May 25, 2018.