Privacy Policy

By using the www.valvex.com website, the User declares that they have read our Privacy Policy and agree to it.

GENERAL PROVISIONS

Valvex S.A. (hereinafter referred to as “Valvex” or the “Controller”) pays particular attention to respecting the privacy of Persons whose data it processes in the course of its business, including the privacy of Users visiting the https://valvex.com website administered by Valvex (hereinafter referred to as: “Website”).

Valvex is responsible for controlling personal data that is collected and processed in cooperation with you. We respect privacy and will protect the personal data we process. All personal data are processed in accordance with applicable personal data protection regulations.

The purpose of this privacy policy is to inform you about the types of personal data we collect when you enter into a particular relationship with us, use our Website or cooperate with us directly and the steps we take to protect and secure your personal information.

This policy and its principles apply to personal identification information (personal data) that we may ask you for and which we use, whether based on your consent or other premises authorizing us to process personal data. You will find more on this subject later in this Policy.

1. DEFINITIONS

a. Personal data controller – within the meaning of Article 4(7) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”) the Controller of personal data is Valvex S.A. with its registered office in Jordanów, at ul. Nad Skawą 2, 34-240 Jordanów, entered into the register of entrepreneurs of the National Court Register by the District Court for Kraków – Śródmieście in Kraków, 12th Commercial Division of the National Court Register under KRS number 0000026818, NIP (tax ID): 735-00-24-499, REGON (business ID): 490399956.

b. Personal data – information about a natural person identified or identifiable by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including image, voice recording, contact details, location data, information contained in correspondence, information collected through recording equipment or other similar technology.

c. Policy – this Policy (transparency) for the processing of personal data of persons entering into relations with Valvex on their own behalf or on behalf of represented entities.

d. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

e. Data subject – a natural person to whom personal data processed by Valvex relates.

2. PROCESSING OF PERSONAL DATA BY VALVEX

2.1. In connection with its business activities, Valvex collects and processes personal data in accordance with the applicable legal provisions, in particular the GDPR, and the data processing principles provided for therein.

2.2. The Controller ensures transparency of personal data processing, in particular always informs about data processing at the time of collection, including the purpose and legal basis of processing (e.g. when concluding a contract for the sale of goods or services). Valvex ensures that data is collected only to the extent necessary to achieve the indicated purpose and processed only for the period for which it is necessary.

2.3. When processing personal data, Valvex ensures their security and confidentiality as well as access to information about processing to data subjects. If, despite the security measures in place, a breach of personal data protection occurs (e.g. data “leakage” or loss), Valvex will inform data subjects about such an event in a manner consistent with the regulations.

3. CONTACT WITH THE PERSONAL DATA CONTROLLER

3.1. Any demands, requests, notifications or inquiries regarding your personal data processed by the Controller, including access to their content, method of updating or withdrawal of consent to their processing, can be sent by e-mail to rodo@valvex.com or in writing to the following address: VALVEX S.A., ul. Nad Skawą 2, 34-240 Jordanów.

3.2. Valvex is not obliged to appoint a Data Protection Officer, nor was such a person appointed by Valvex’ voluntary decision.

4. PERSONAL DATA SECURITY

4.1. In order to ensure data integrity and confidentiality, Valvex has implemented procedures enabling access to personal data only to authorized persons and only to the extent necessary for the tasks they perform. Valvex uses organizational and technical solutions to ensure that all operations on personal data are recorded and performed only by authorized persons.

4.2. Valvex also takes all necessary steps to ensure that its subcontractors and other associates guarantee the use of appropriate security measures whenever they process personal data on behalf of Valvex.

4.3. Valvex conducts ongoing analysis of the risks associated with the processing of personal data and monitors the adequacy of the data security measures used to address the identified threats. Where necessary, Valvex implements additional measures to enhance data security.

5. INFORMATION REGARDING THE PURPOSE OF PROCESSING

5.1. APPLYING FOR ANY POSITIONS

a. PURPOSE OF PROCESSING: If you apply for a job at Valvex, your personal data will be processed for the following purposes:

• conducting the recruitment process, based on the authorization resulting from Article 22¹ of the Labour Code, in the scope of: first and last name, date of birth, contact details, education, professional qualifications and previous employment history;

• carrying out the recruitment process, based on your consent to the processing of your personal data, i.e. personal data other than those indicated above, provided in the CV, form, cover letter and other documents;

• pursuing the legitimate interest of the Controller in the scope of data obtained from you during the recruitment process in connection with checking your skills and abilities needed to work in the position specified in the job advertisement;

• pursuing the legitimate interest of the Controller in the scope of data obtained from you during the recruitment process in connection with checking your skills and abilities needed to work in the position specified in the job advertisement;

• pursuing the legitimate interest of the Controller in the event of a legal need to prove facts, demonstrate the fulfilment of obligations to pursue or defend against claims, if the claims concern our recruitment, in proceedings before courts or state authorities and to be able to respond to letters, applications and demands;

• in order to conduct future recruitment processes, based on your consent to the processing of personal data provided in the CV, form, cover letter and other documents.

If the processing of your personal data is to be carried out for a purpose other than those indicated above, it each time takes place after obtaining your consent to the processing of personal data, to the extent and for the purpose indicated in the consent (under Article 6(1)(a) of the GDPR).

b. LEGAL BASIS: The basis for the processing of the above-mentioned personal data is the fulfilment of the obligation imposed by law (Article 6(1)(c) of the GDPR) or our legitimate interest (Article 6(1)(f) of the GDPR), as well as consent in the cases indicated above.

c. DATA SOURCES: We collect your personal data directly from you when you apply for a given position; through another person who recommends you to work at Valvex, if you have previously agreed to this; from publicly available sources such as LinkedIn or recruitment platforms; as part of cooperation with recruitment agencies and other employment agencies.

d. SCOPE OF DATA: We process the following types of personal data: first name(s) and last name, date of birth, contact details provided by you, including telephone number, e-mail address, citizenship, education, date of birth, place of birth, professional qualifications, previous employment history, included in the curriculum vitae (CV) and cover letter and made available during a job interview or in connection with conducting qualification or verification tests.

e. PROCESSING TIME – DATA RETENTION: The processing period of your personal data depends on the purpose for which the data are processed:

• personal data processed for the purpose of carrying out the recruitment process, pursuant to Article 6(1)(c) of the GDPR, are processed for a period of up to 3 months from the end of the recruitment process;

• personal data processed for the purpose of carrying out the recruitment process, based on your consent, pursuant to Article 6(1)(a) of the GDPR, are processed until consent is withdrawn or for a period of up to 3 months from the end of the recruitment process;

• personal data processed in order to pursue the legitimate interest of the Controller in the scope of data obtained from you during the recruitment process in connection with checking your skills and abilities needed to work in the position specified in the advertisement, pursuant to Article 6(1)(f) of the GDPR, are processed until consent is withdrawn or for a period of up to 3 months from the end of the recruitment process;

• personal data processed in order to pursue the legitimate interest of the Controller in the event of a legal need to prove facts, demonstrate the fulfilment of obligations to pursue or defend against claims, if the claims concern our recruitment, in proceedings before courts or state authorities and for the purpose of responding to letters, applications and demands, pursuant to Article 6(1)(f) of the GDPR, are processed for the period of limitation of claims arising from the provisions of law, as well as for the period during which the provisions require us to store the data;

• in order to conduct future recruitment processes, based on your consent to the processing of personal data provided in the CV, form, cover letter and other documents, pursuant to Article 6(1)(a) of the GDPR, are processed until consent is withdrawn, no longer than for a period of one year from the date of consent.

f. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to include the application in the recruitment process.

5.2. E-MAIL AND TRADITIONAL CORRESPONDENCE

a. PURPOSE OF PROCESSING: If you send Valvex via e-mail or traditional mail correspondence unrelated to the concluded contract or otherwise unrelated to any relationship with Valvex, the personal data contained in this correspondence are processed solely for the purpose of communication and resolving the matter to which the correspondence relates.

b. LEGAL BASIS: The legal basis for processing is the legitimate interest of Valvex (Article 6(1)(f) of the GDPR), consisting in conducting correspondence addressed to it in connection with its business activities.

c. SCOPE OF DATA: Valvex only processes personal data relevant to the case to which the correspondence relates, e.g. e-mail address, first and last name of the sender/recipient, position, personal data included by the sender in the content of the correspondence. All correspondence is stored in a manner that ensures the security of the personal data contained therein (and other information) and disclosed only to authorised persons.

d. PROCESSING TIME – DATA RETENTION: In the case of data processing on the basis of the legitimate interest, the data are processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted in the form of an e-mail message on the mail server. The data processing period may be extended if the processing is necessary to establish or pursue claims or defend against claims, and after this period – only if and to the extent required by law.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to handle matters and maintain correspondence.

5.3. ENABLING SHAREHOLDERS TO EXERCISE THEIR RIGHTS

a. PURPOSE OF PROCESSING: The purpose of data processing is to fulfil the obligations arising from the provisions of the Civil Code, the Commercial Companies Code and resolutions of the shareholders’ meeting in the scope of maintaining the share register, dematerialization of shares, maintaining the register of shareholders, executing the Valvex share sale agreement, enabling Shareholders to exercise their rights in relation to the Company, as well as determining facts for the purposes of pursuing any claims by the Company or defending against claims.

b. LEGAL BASIS: The legal basis for the Company’s processing of your personal data is: a) Article 6(1)(b) of the GDPR – processing is necessary to perform an agreement to which the data subject is a party, or to take action at the request of the data subject before concluding the agreement; b) Article 6(1)(c) of the GDPR – the obligation resulting from the provisions of the Commercial Companies Code regarding keeping a share register, dematerialization of shares, maintaining a register of shareholders and the tax law regarding the settlement of public law liabilities; c) Article 6(1)(f) of the GDPR – the legitimate interest of the Company in the form of (i) enabling contact with Shareholders and verifying their identity and (ii) pursuing possible claims or defending against claims.

c. SCOPE OF DATA: The Company processes (i) personal data identifying the Shareholder, such as first name, last name, address of residence or address for service and PESEL (Polish National Identification Number), (ii) data contained in the powers of attorney, (iii) data regarding the shares and the resulting rights, such as: the number , type and numbers of shares, as well as (iv) – in cases where Shareholders contact the Company electronically – an e-mail address, (v) bank account number.

d. PROCESSING TIME – DATA RETENTION: Personal data included in the lists of shareholders and powers of attorney are stored for the duration of the Company’s existence and may then be transferred to the entity designated to store documents in accordance with the provisions of the Commercial Companies Code; personal data related to contact via e-mail are stored for a period enabling the Company to demonstrate compliance with the obligations arising from the provisions of the Commercial Companies Code and the limitation period for any claims of the Company or against the Company.

e. OBLIGATION TO PROVIDE DATA: If you are a shareholder holding rights under registered shares, a pledgee or a User of these shares, providing personal data is necessary to enter you in the share register, determine your rights and exercise your rights resulting from the shares. If you are an attorney-in-fact of a shareholder or another person holding right under the Company’s shares, providing personal data is necessary for you to exercise the rights resulting from the shares on behalf of the principal.

5.4. TELEPHONE CONTACT

a. PURPOSE OF PROCESSING: If you contact Valvex by phone, in matters unrelated to a concluded contract or business relations, Valvex may request personal data only if it is necessary to handle the matter to which the contact relates. Telephone conversations may also be recorded – in such a case, appropriate information is provided to the individual at the beginning of the conversation. Conversations are recorded in order to capture the course of the conversation and generate records of the arrangements or conclusions contained therein, as well as for statistical purposes. The recordings are available only to people directly related to the matters covered by the recorded conversations.

b. LEGAL BASIS: In such a case, the legal basis is the legitimate interest of Valvex (Article 6(1)(f) of the GDPR), consisting in the need to resolve the reported issue related to its business activity. Personal data in the form of a conversation recording are processed in order to monitor the course of the conversation and document conclusions, as well as for analytical and statistical purposes – the legal basis for processing is the consent of the recorded person (Article 6(1)(a) of the GDPR).

c. SCOPE OF DATA: Valvex only processes personal data relevant to the matter to which the contact relates, i.e. the interlocutor’s telephone number, first and last name of the interlocutor, their position, personal data provided by the interlocutor relevant to the activities carried out covered by the consent to recording. All correspondence is stored in a manner that ensures the security of the personal data contained therein (and other information) and disclosed only to authorised persons.

d. PROCESSING TIME – DATA RETENTION: The period of data processing by Valvex depends on the purpose of the processing. In the case of data processing on the basis of the legitimate interest of Valvex, the data is processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted. If the processing is based on consent, the data is processed until it is withdrawn.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to handle matters and maintain a telephone conversation. In case of recording the conversation, you can withdraw your consent at any time.

5.5. VIDEO MONITORING AND ACCESS CONTROL

a. PURPOSE OF PROCESSING: Due to the need to ensure the safety of people, property and business information, as well as to prevent incidents that threaten social order, Valvex uses video monitoring and access control with regard to the premises and rooms managed by it. Personal data obtained through monitoring and access control may also be processed for the purpose of defending against claims made against Valvex or establishing and pursuing claims by Valvex in connection with the original purpose of the processing.

b. LEGAL BASIS: The legal basis for the processing of personal data is the legitimate interest of Valvex (Article 6(1)(f) of the GDPR), consisting in ensuring the safety of persons and property located in the area managed by Valvex and the protection of its rights.

c. SCOPE OF DATA: Video monitoring complements physical security and electronic records of entries/exits at Valvex facilities. The monitoring works 24 hours a day, with only image recorded and saved. The electronic access control system, thanks to the identification of people based on access cards, records the time and place of people’s stay.

The necessary data for the purpose of identifying people include: first and last name obtained from a reliable source, e.g. based on an ID document or other identifying document, vehicle registration number on the license plate, time of stay on the premises recorded by cameras and the system for recording entries and exits from the Company’s premises.

d. PROCESSING TIME – DATA RETENTION: In the case of data processing on the basis of the legitimate interest of Valvex, the data is processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted. The data storage period is limited to the minimum necessary to achieve the purpose of identifying people. Personal data contained in the software installed on Valvex resources are stored on the local server for 90 days from the date of image recording. Other data recording the duration of stay on the premises, recorded in electronic or paper documentation, are stored indefinitely.

e. OBLIGATION TO PROVIDE DATA: Providing personal data is independent of the will of the data subject. A person staying on Valvex premises has no real possibility of refusing to provide personal data whenever they are in the area subject to monitoring and recording of the movement of people using electronic access cards.

f. OBLIGATION TO PROVIDE IDENTIFICATION DATA: Providing data from an identity document or other approved identifier is generally done by presenting it. You can object to the method of obtaining the data, but data in the form of your first and last name are information necessary for us to issue an identification card.

NOTE – you can decide not to enter the area covered by the recording of people, including the monitoring. The entire monitored area is marked with appropriate graphic signs.

5.6. HANDLING CONTRACTS WITH SUPPLIERS AND TRADE CONTRACTS (INCLUDING NEGOTIATION AND CONCLUSION OF CONTRACTS)

a. PURPOSE OF PROCESSING: In connection with concluding trade and service contracts as part of its business activities, Valvex obtains data of persons representing the Parties from contractors in order to conclude the contract and to fulfil contractual obligations, including financial obligations. It is possible to obtain such data already at the stage of negotiating the terms of the contract, at the stage of request for quotation, a proposal, a contract with appendices and annexes amending the terms of the contract, and as part of correspondence related to the performance of contracts.

b. LEGAL BASIS: The processing of personal data is necessary for the performance of a contract with the Party you represent or, at the request, taking action on behalf of the Party before signing such a contract (Article 6(1)(b) of the GDPR), as well as necessary to fulfil the legal obligations of Valvex consisting in maintaining accounting and tax documentation (Article 6(1)(c) of the GDPR), and may also be necessary for the purposes of legitimate interests pursued by Valvex, i.e. pursuing claims and defending against claims, Article 6(1)(f) of the GDPR.

c. SCOPE OF DATA: Valvex only processes data identifying persons representing the parties to the contract, data necessary to settle contractual obligations.

d. PROCESSING TIME – DATA RETENTION: When the basis for the processing is the necessity to conclude and perform a contract, the data are processed until its termination. The processing period of data contained in accounting and tax documentation results from the provisions of law. Due to possible claims of the Parties to the contract, personal data may be processed for another 3 years – for claims related to the business activity, 6 years – for consumer claims, 10 years – for consumer claims confirmed by a final and binding decision of a court or authority, arising and not time-barred before 9 July 2018 (except for accounting documents) or to submit an effective objection to data processing.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to sign the contract.

5.7. PROCESSING OF PERSONAL DATA OF STAFF MEMBERS OF CONTRACTORS COOPERATING WITH VALVEX

a. PURPOSE OF PROCESSING: In connection with concluding trade and service contracts as part of its business activities, Valvex obtains from contractors data of persons involved in the implementation of such contracts (e.g. persons authorised to contact, placing orders, executing orders, etc.). The scope of data transferred is in each case limited to the extent necessary for the performance of the contract and usually does not include information other than first and last name and business contact details.

b. LEGAL BASIS: Such personal data are processed in order to pursue the legitimate interest of Valvex and its contractor (Article 6(1)(f) of the GDPR), which is to enable the correct and effective performance of the contract. Such data may be disclosed to third parties involved in the implementation of the contract, as well as to entities obtaining access to data based on the provisions on the transparency of public information and proceedings conducted based on public procurement law, to the extent provided for by these provisions.

c. SCOPE OF DATA: Valvex only processes personal data relevant to the implementation of the contractual relations to which the communication relates, i.e. a business telephone number, business e-mail address, first and last name, position.

d. PROCESSING TIME – DATA RETENTION: The period of data processing by Valvex depends on the purpose of the processing. The data processing period may also result from regulations when they constitute the basis for the processing. In the case of data processing based on the legitimate interest of Valvex (e.g. for security reasons), the data are processed for a period enabling the implementation of this interest, i.e. at least for the duration of the contract binding Valvex and the entity you represent or until you submit an effective objection to data processing.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to establish commercial cooperation with your employer or principal. Without providing your data, it is impossible to establish any cooperation in the form planned by your employer in connection with your scope of duties.

5.8. COLLECTION OF DATA IN OTHER CASES

a. PURPOSE OF PROCESSING: In connection with its activities, Valvex also collects personal data in other cases – e.g. by building and using permanent business contacts (networking) during business meetings, at industry events or by exchanging business cards – for purposes related to initiating and maintaining business contacts.

b. LEGAL BASIS: The legal basis for processing in this case is the legitimate interest of Valvex (Article 6(1)(f) of the GDPR), consisting in creating a network of contacts in connection with its business activity.

c. SCOPE OF DATA: Valvex only processes personal data relevant to the achievement of communication purposes in business relations, e.g. a business telephone number, business e-mail address, first and last name, position.

d. PROCESSING TIME – DATA RETENTION: In the case of data processing on the basis of Valvex’ legitimate interest (e.g. for security reasons), the data are processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to establish business relations. Without providing your data, it is impossible to establish any relationship.

5.9. USE OF THE WEBSITE AND CONTACT FORMS

a. PURPOSE OF PROCESSING: The User’s activity on the Website, including their personal data, are recorded using cookies and social media plug-ins, which you can read more about in the Cookies Policy dedicated to them. We process personal data provided in the form used to contact Suppliers in order to maintain business relations and communicate regarding the services provided.

b. LEGAL BASIS: The legal basis for the processing of personal data is the legitimate interest of Valvex (Article 6(1)(f) of the GDPR), consisting in the need to guarantee Website Users access to the content of the Website and communication via channels available via the Website, as well as to keep statistics via the Website in order to improve its functionality.

c. SCOPE OF DATA: Valvex only processes personal data recorded via cookies and data provided in connection with an inquiry sent via the Website’s contact form.

d. PROCESSING TIME – DATA RETENTION: In the case of data processing on the basis of Valvex’ legitimate interest (e.g. for security reasons), the data are processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted. In the case of installed cookies, their processing continues until consent is withdrawn.

e. OBLIGATION TO PROVIDE DATA: Providing data is voluntary, but necessary to handle matters and maintain the relationship established in communication via the Website.

5.10. SOCIAL MEDIA

a. PURPOSE OF PROCESSING: Valvex processes personal data of Users visiting Valvex profiles on social media (Facebook, LinkedIn, YouTube channel). This data is processed solely in connection with maintaining the profile, including to inform Users about Valvex’ activity and to promote various types of events, educational publications, services and products.

b. LEGAL BASIS: The legal basis for the processing of personal data by Valvex for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR), consisting in promoting its own brand.

c. SCOPE OF DATA: Valvex processes basic identification data (first and last name, your profile name) to the extent published by you on your own profile on the Facebook social networking site; other data published by the User on the Facebook profile.

d. PROCESSING TIME – DATA RETENTION: Valvex processes the data of Website Users for the duration of Valvex’ legitimate interest, for the period when the User follows Valvex’ profile and, in the case of communication via the Websites, for the time necessary to close the conversation.

e. OBLIGATION TO PROVIDE DATA: We obtain all your data via companies operating social networking sites from your public profile and entries on the Valvex fanpage. Providing data is voluntary, although in the case of communication via social networking sites it is necessary to handle matters and maintain the relationship established in the communication.

6. DATA RECIPIENTS

6.1. In connection with running a business activity that requires processing, personal data are disclosed to external entities, in particular suppliers responsible for operating IT systems and equipment, security agencies carrying out tasks related to monitoring, entities providing legal or accounting services, couriers and transport companies.

6.2. Sharing personal data is permitted only if one of the conditions referred to in Article 6(1) or in Article 9(2) of the GDPR is met.

6.3. The processing of personal data is entrusted to a third party on the basis of a data processing agreement.

6.4. Valvex reserves the right to disclose selected pieces of information regarding the data subject to competent authorities or third parties that request such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.

7. TRANSFER OF DATA OUTSIDE THE EEA

The level of protection for personal data outside the European Economic Area (“EEA”) differs from that provided by European law. For this reason, Valvex transfers personal data outside the EEA only when necessary and with an adequate level of protection, in particular in the form of:

• cooperation with entities processing personal data in countries for which an appropriate decision of the European Commission has been issued regarding the assurance of an adequate level of personal data protection;

• application of standard contractual clauses issued by the European Commission, provided that an adequate level of personal data protection is ensured;

• application of binding corporate rules approved by the relevant supervisory authority;

Valvex always informs about its intention to transfer personal data outside the EEA at the stage of collection.

8. PERSONAL DATA PROCESSING PERIOD

The period of data processing by Valvex depends on the purpose of the processing. The data processing period may also result from regulations when they constitute the basis for the processing. In the case of data processing on the basis of Valvex’ legitimate interest (e.g. for security reasons), the data are processed for a period enabling the implementation of this interest or until an effective objection to data processing is submitted. If the processing is based on consent, the data is processed until it is withdrawn. When the basis for the processing is the necessity to conclude and perform a contract, the data are processed until its termination.

The data processing period may be extended if the processing is necessary to establish or pursue claims or defend against claims, and after this period – only if and to the extent required by law.

9. RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA, RIGHTS OF DATA SUBJECTS

Data subjects have the following rights:

• the right to information about the processing of personal data – on this basis, Valvex provides the natural person submitting the request with information about the data processing, including, in particular, the purposes and legal basis for the processing, the scope of data held, entities to which the data are disclosed, and the planned date of data deletion;

• the right to obtain a copy of the data – on this basis, Valvex provides a copy of the processed data regarding the natural person submitting the request;

• the right to rectification – Valvex is obliged to remove any possible inconsistencies or errors in the personal data being processed and to supplement them if they are incomplete;

• the right to delete data – on this basis you can request the deletion of data the processing of which is no longer necessary to achieve any of the purposes for which they were collected;

• the right to limit processing – if such a request is made, Valvex will cease to perform operations on personal data – except for operations to which the data subject has consented and store data in accordance with the adopted retention principles – or until the reasons for limiting processing no longer exist (e.g. a decision of the supervisory authority authorising further data processing issued);

• the right to data portability – on this basis, to the extent that data is processed in an automated manner in connection with a concluded contract or consent, Valvex issues data provided by the person to whom they relate in a format that allows the data to be read by a computer. It is also possible to request that the data be sent to another entity, provided that there are technical possibilities in this respect both on the part of Valvex and the indicated entity;

• the right to object to the processing of data for marketing purposes – the data subject may object to the processing of personal data for marketing purposes at any time, without the need to justify such objection;

• the right to object to other purposes of data processing – The data subject may at any time object, for reasons related to their particular situation, to the processing of personal data which is carried out on the basis of Valvex’ legitimate interest (e.g. for analytical or statistical purposes or for reasons related to property protection); objections in this respect should include justification;

• the right to withdraw consent – if data are processed on the basis of consent, the data subject has the right to withdraw it at any time, which, however, does not affect the lawfulness of the processing carried out before its withdrawal;

• the right to complain – if it is considered that the processing of personal data violates the provisions of the GDPR or other provisions on the protection of personal data, the data subject may submit a complaint to the authority supervising the processing of personal data competent for the place of residence of the data subject, their place of work or the place where the alleged infringement occurred. In Poland, the supervisory authority is the President of the Personal Data Protection Office.

10. SUBMITTING REQUESTS RELATED TO THE EXERCISE OF RIGHTS

10.1. A request to exercise the rights of data subjects may be submitted:

• in writing to the following address: VALVEX S.A., ul. Nad Skawą 2, 34-240 Jordanów.

• electronically to the e-mail address: rodo@valvex.com

10.2. If Valvex is unable to identify a natural person based on a request, Valvex will ask the applicant for additional information. Providing such data is not obligatory, but failure to provide them will result in the request being rejected.

10.3. The request may be submitted in person or through a representative (e.g. a family member). For data security reasons, Valvex encourages you to use a power of attorney in a form certified by a notary or an authorised attorney at law or counsel, which will significantly speed up the verification of the authenticity of the request.

10.4. A response to the request should be provided within one month of its receipt. If it is necessary to extend this deadline, Valvex informs the applicant of the reasons for this action.

10.5. In the event that the request is addressed to the Company electronically, the response is provided in the same form, unless the applicant requested a response in a different form. In other cases, the answer is provided in writing. If the deadline for fulfilling the request makes it impossible to respond in writing, and the scope of the applicant’s data processed by Valvex allows contact by electronic means, the response is provided electronically.

10.6. The Company stores information regarding the submitted request and the person who submitted the request in order to ensure compliance and to establish, defend or pursue possible claims of data subjects. The request register is stored in a way that ensures the integrity and confidentiality of the data contained therein.

11. RULES FOR COLLECTING FEES

11.1. The procedure for submitted applications is free of charge. Fees may only be charged in the case of:

• submitting a request for the second and each subsequent copy of the data (the first copy of the data is free of charge); in such a case, Valvex may require payment of a fee estimated on the basis of the administrative costs associated with fulfilling the request;

• the same person submitting requests that are excessive (e.g. extremely frequent) or clearly unjustified; in such a case, Valvex may require payment of a fee estimated on the basis of the costs of communication and the costs associated with taking the requested action.

11.2. If the decision to impose a fee is questioned, the data subject may submit a complaint to the authority supervising the processing of personal data competent for the person’s place of residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office.

12. CHANGES TO THE PERSONAL DATA PROCESSING POLICY

The policy is verified on an ongoing basis and updated, if necessary.