Version: 1.2
Update date: 13.12.2022
Record type: It comes in the electronic and paper version
Sharing Mode: A document made available for internal official use

Contents:
I. PRELIMINARY PROVISIONS
II. DEFINITIONS FOR WHAT PURPOSE AND ON WHAT BASIS WE PROCESS YOUR PERSONAL DATA
III. YOUR RIGHTS
IV. TO WHOM WE TRANSFER YOUR PERSONAL DATA
V. HOW LONG DO WE STORE YOUR PERSONAL DATA
VI. AUTOMATIC DATA COLLECTION. COOKIES. OPERATING DATA. GOOGLE TOOLS
VII. HOW WE SECURE PERSONAL DATA
VIII. CONTACT
IX. CHANGE IN PRIVACY POLICY

I. PRELIMINARY PROVISIONS
1.1 The administrator of your data, within the meaning of the law on the protection of personal data, is LUMAG Sp. z o. o. based in Budzyń, st. Rogozińska 72, 64-840 Budzyń, registered in the District Court Poznań – Nowe Miasto and Wilda in Poznań under KRS number 0000158327, NIP 764-24-00-940 (from now on referred to as „LUMAG”). This means that we are responsible for the use of your data in a safe manner and by applicable regulations, in particular with the provisions of Regulation (EU) 2016/679 of the European Parliament and the Council of 27/04/2016 on the protection of natural persons about the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal EU L 119, p. 1), from now on referred to as „GDPR”.
1.2 This document (from now on referred to as the „Privacy Policy”) is information on the principles of processing and protection of personal data collected by LUMAG from your in connection with the purchase of LUMAG products, the use of LUMAG services (including those provided electronically), inquiries addressed to LUMAG, the offer process, participation in events organized by LUMAG, participation in the recruitment process of LUMAG employees, subscription to the Newsletter or other channels of information about LUMAG products and services, exchange of correspondence, etc., including in particular in connection with the use of our website.
1.3 The Privacy Policy is informative, which means that it is not a source of obligations for persons whose personal data is processed by its provisions. One of its primary functions is to fulfill the information obligation referred to in art. 13 GDPR.

II. DEFINITIONS FOR WHAT PURPOSE AND ON WHAT BASIS WE
PROCESS YOUR DATA
2.1 Personal data obtained from you by LUMAG are processed for the following purposes, depending on the situation in which the data was provided:
a) for recruitment purposes, based on:
• a specific legal provision governing the collection of data from a person applying for employment based on an employment contract (Article 6(1)(c) of the GDPR in connection with joke. 221 § 1 of the Labor Code), i.e., in the case of offering employment based on an employment contract and providing data only covered by this provision, i.e., name (names) and surname, date of birth, contact details indicated by you and education, qualifications professional and the course of previous employment, if they are necessary for the Employer to perform work of a specific type or in a particular position or
• based on your consent – by art. 6 sec. 1 lit. a GDPR – which applies to cases when:

• in the case of the current recruitment process: an employment contract is offered, and for recruitment purposes, you provide in your CV or application documents data other than those that the Employer may process based on the Labor Code, i.e., other than the name(s) and surname, date of birth, contact details indicated by you as well as education, professional qualifications, and previous employment history if they are necessary for the Employer to perform work of a specific type or in a particular position, or
  à in the case of the current recruitment process: a contract other than an employment contract is offered (e.g., a warranty of mandate), and the processing of data applies to all data that you provide in your CV or application documents for processing to carry out the recruitment process, or
• you would like to participate in future recruitment processes at the Employer (data processing applies to all data you provide in your CV or application documents for
  processing to carry out future recruitment processes).
  b) conclusion and performance of the contract concluded with LUMAG (regardless of the form of its decision: in writing or by using our services provided electronically via the
  website) – to the extent necessary to establish, shape the content, amend, terminate and properly perform the contract;
  c) performance of our legal obligations, e.g., issuing and storing invoices and accounting documents, responding to complaints, fulfilling obligations arising from the warranty for product defects, ensuring the security of the services provided;
  d) establishing, defending, and pursuing claims;
  e) direct marketing of LUMAG products and services;
  f) creating reports, analyses, and statistics for LUMAG’s internal needs, including in particular reporting, marketing research, ad-targeting, remarketing, service development
  planning, development work in IT systems, creating statistical models; evaluating the functioning of the LUMAG website, including subpage viewing statistics;
  g) if you consent to LUMAG sending you commercial information by electronic means, your data will also be processed by us to provide you with information about our services, offer, and events organized by us, as well as information on products and services of entities cooperating with us (with our knowledge and express consent).
  2.2 Personal data is not used for purposes other than those specified in the Privacy Policy
  unless LUMAG obtains your consent to the processing of data for other purposes or any
  other use of the information is required or permitted by law.
  2.3 To the extent that the processing of your data is necessary to:
  a) performance of the contract concluded with you or to take action at your request before concluding the contract – the legal basis for the processing of your data by LUMAG is the contract;
  b) fulfillment of a legal obligation incumbent on us – the legal basis is this legal obligation;
  c) purposes resulting from legitimate interests pursued by LUMAG, i.e., for direct marketing of our products and services, preventing fraud, or hunting and defending claims – the legal basis is the legitimate interest of LUMAG.
  2.4 If our use of your data is not necessary for the performance of a contract, the fulfillment of a legal obligation, or does not constitute our legitimate interest, we may ask for your consent to specific ways of using your data. Giving consent may take the form of ticking a box when browsing a website, may consist in choosing technical settings for the use of information society services, or in another statement or behavior that indicates in a given context that you have accepted the proposed processing of personal data. You can withdraw your consent at any time (this will not affect the lawfulness of using your data before starting such consent).
  2.5 Providing your data is not mandatory. However, failure to do so will result in LUMAG being unable to perform the activities for which the information is required.
  2.6 Based on your data, LUMAG will not make automated decisions regarding you, including those resulting from profiling.

III. YOUR RIGHTS
3.1 Each person whose personal data is processed by LUMAG has the right to access their data and immediately rectify inaccurate data. Considering the processing purposes, the data subject has the right to request supplementation of incomplete personal data by submitting an additional statement.
3.2 In the event of your consent to the processing of data, particularly for marketing purposes (including sending commercial information by electronic means), your consent may be withdrawn at any time. A user who receives specific information or services, such as an electronic newsletter (the so-called Newsletter), may unsubscribe at any time by following the instructions in each sent document.
3.3 The person providing their data to LUMAG has the right to request LUMAG to delete their data immediately, and LUMAG is obliged to delete personal data without undue delay if one of the following circumstances occurs:
a) the personal data are no longer necessary for the purposes for which they were collected;
b) the data subject has withdrawn the consent on which the processing is based, and there is no other legal basis for the processing;
c) the data subject objects to the processing;
d) personal data has been processed unlawfully;
e) personal data must be deleted to comply with a legal obligation provided for in EU law or the law of a Member State to which LUMAG is subject.
3.4 Persons providing their data to LUMAG have the right to demand that the processing of personal data be limited if:
a) the data subject questions the correctness of the personal information – for a period allowing LUMAG to check the correctness of such data;
b) the processing is unlawful, and the data subject opposes the erasure of the personal data, requesting the restriction of their use instead;
c) LUMAG no longer needs personal data for processing, but they are required by the data subject to establish, pursue or defend claims;
d) the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of LUMAG override the settings for the objection of the data subject.
3.5 If the processing of personal data by LUMAG is carried out in an automated manner based on consent or a contract, the data subject has the right to receive in a structured, commonly used machine-readable format personal data provided by LUMAG and has the right to send this personal data to another controller. The data subject has the right to request that personal data be sent by LUMAG directly to another administrator.
3.6 To exercise the rights referred to above, contact LUMAG as indicated in point 9 below.
3.7 LUMAG will inform each recipient to whom the personal data have been disclosed about the rectification or deletion of personal data or the restriction of processing made at your request unless it proves impossible or will require a disproportionate effort.
3.8 In processing your data by LUMAG, you have the right to complain to the supervisory authority.

IV. TO WHOM WE TRANSFER YOUR DATA
4.1 We transfer your data to:
4.1.1 entities processing data on our behalf, participating in the performance of our activities:
a) entities servicing IT systems and computer hardware that we use;
b) our business partners, advertising agencies, and other intermediaries in the sale of
our products and services or the organization of marketing campaigns;
c) subcontractors supporting us, e.g., in the performance of our services, transport of ordered products, product service, correspondence handling, or in the customer service process;
d) entities providing us with advisory, consulting, auditing services, legal, tax, and accounting assistance; research agencies acting on our behalf;
4.1.2 other data controllers processing data on their behalf:
a) entities conducting postal or courier activities;
b) entities purchasing receivables or dealing with their recovery -if you fail to pay our invoices on time;
c) entities cooperating with us in handling accounting, tax, and legal matters – to the extent that they become data controllers.
4.2 LUMAG does not plan to transfer your data outside the EEA (including the European Union, Norway, Liechtenstein, and Iceland). But it may turn out that during the contract term, we will decide to transfer data outside the EEA – only to the extent that the law will allow us.
4.3 LUMAG may provide personal data at the request of authorities or law enforcement authorities or when relevant laws require it, court judgments, or other state regulations. The need to share personal data may also be caused by conducting data privacy or security audits and/or when investigating complaints or taking action related to a security threat. LUMAG does not sell personal data to third parties, nor does it entrust the processing of personal data provided by users to third parties, which information could be used by such third parties for their marketing purposes.

V. HOW LONG DO WE STORE YOUR DATA
5.1 Your data will be stored no longer than necessary, i.e., depending on the purpose of their
processing:
5.1.1 conclusion and performance of the contract between you and LUMAG – for the duration
of the contract and settlements after its completion, including for the time of the
warranty period for defects or quality guarantee provided in the agreement;
5.1.2 fulfillment of the legal obligation incumbent on LUMAG:
a) for the duration of the performance of duties;
P a g e | 8
Privacy policy
LUMAG Sp. z o.o.
b) for the time in which the regulations require us to store data (e.g., tax); or
c) for the time during which we may suffer legal consequences of non-performance,
e.g., receive a financial penalty from state offices;
5.1.3 purposes resulting from legitimate interests pursued by LUMAG:
a) direct marketing of our products and services – for the duration of the contract and
then for the period of providing warranty and/or post-warranty service;
b) preventing fraud – for the duration of proceedings before the competent authorities;
c) pursuing and defending claims – for the period in which the claims expire.
5.2 Suppose we process personal data based on your consent to specific ways of using data. In that case, your data will be processed for the period indicated when obtaining consent and in the absence of such indication – until you withdraw your consent.
5.3 Your data will be processed for the current recruitment process. In the event of additional consent, your data will also be processed for future recruitment until the consent is withdrawn, but no longer than for a period of 2 years. In the event of completion of the recruitment process, when no additional support was given for future recruitment
processes or withdrawal of consent to the processing of data for future recruitment, your data will be processed only in the form of archiving, for evidence purposes, for the period appropriate for the expiry of the limitation period for claims which will be up to 5 years.

VI. AUTOMATIC DATA COLLECTION. COOKIES. OPERATING
DATA. GOOGLE TOOLS
6.1 When using the LUMAG website, user data is also collected automatically. These data can
be ordered in the system logs of the website through the so-called cookies. Cookies are
small text information in the form of text files sent by the server and saved on the side of
the person visiting the website (e.g., on the hard drive of a computer, laptop, or smartphone
memory card).
6.2 By saving cookies on the website user’s device (computer, smartphone, tablet, etc.),
LUMAG may, among others:
a) Adjust the functioning of the website to your needs.
b) Eliminate the need to log in each time you visit the website (in the case of areas for
registered users/customers).
c) Remember your settings from session to session.
d) Increase the speed and security of the website.
e) Personalize the website according to your needs and enable users to find the information they need faster.
f) Continuously improve the website for its users.
g) Increase the effectiveness of marketing activities.
6.3 Cookies do not contain user identification data; on their basis, it is impossible to determine anyone’s identity. These files are in no way harmful to the user’s end device and do not change its settings or the settings of the software installed on it. The content of these files can only be read by the server that created them.
6.4 When the user uses our website, LUMAG uses three cookies: session, permanent, and marketing. Session files are temporary files stored in the user’s device until logging out of the website, leaving the website, or closing the browser. Permanent files are stored in the memory of the user’s device for the time specified in the parameters of these files or until the user deletes them. Marketing files are „cookies” saved by other external scripts used on our website. We use them mainly for remarketing purposes (see points 6.11.-6.14 below).
6.5 By default, most web browsers on the market accept cookies. The user can independently and at any time change the settings for Cookies, specifying the conditions for their storage and access by Cookies to the user’s device. Changes to the grounds referred to in the previous sentence can be made by the user using the web browser settings or the service configuration. These settings can be changed in such a way as to block the automatic handling of Cookies in the web browser settings or to inform each time Cookies are placed on the user’s device. Detailed information on the possibilities and ways of handling Cookies are available in the software (web browser) settings.
6.6 The User may delete Cookies at any time using the functions available in their web browser.
6.7 Restricting the use of cookies may affect some of the functionalities available on the LUMAG website.
6.8 Detailed information on changing the settings for Cookies and their self-removal in the most popular web browsers is available in the web browser’s help section.
6.9 LUMAG also processes anonymized operational data related to the use of its website (socalled logs – IP address, domain) to generate statistics helpful in administering the website. From the moment the user connects to the website, information about the number (including IP) and type of the user’s end device from which the user connects to the website appears in the system logs of the website. These data are aggregate and anonymous, i.e., they do not contain features that identify visitors to the website. Records are not disclosed to third parties.
6.10 LUMAG may use the Google Analytics service, which collects anonymous information about LUMAG websites you visit using cookies. Detailed rules regarding the Google. Analytics privacy policy can be found at: http://www.google.com/intl/pl/analytics/privacyoverview.html.
6.11 Additionally, LUMAG may use Google AdWords and Google Analytics remarketing codes of display advertisers. These codes are used to create remarketing lists to match
the users who have visited our website with individualized advertisements and then display them in the Google AdWords advertising network, Google search engine, and on websites of entities that are participants of the Google partner network.
6.12 Our website, using the „similar audiences” function, works within the Google AdWords system and checks what the browsing of sites in the advertising network was like in the last thirty days and subjects this information to the contextual targeting mechanism to determine the profile of remarketing audiences. On its basis, Google AdWords finds a group of new users with similar browsing patterns to those from the LUMAG remarketing list. This list is never created based on browsing history on sensitive topics, such as issues related to race, religion, sexual orientation, or health.
6.13 Using remarketing tools and the „similar recipients” function, our website does not collect your data via cookies but only the browsing history; thus, the user remains
anonymous.
6.14 The User can opt out of collecting remarketing codes and display advertiser codes through Google AdWords and Google Analytics, as well as from displaying non-standard ads in the Google Display Network in the manner specified in point 6.5 above.
6.15 The LUMAG website may contain functions that enable content sharing via third-party social networking applications, such as the Like button on Facebook or Twitter widget. These social applications may collect and use data on user activity on the LUMAG website. Any personal information provided by users through such social media applications may be collected and used by other users. Interactions conducted through them are governed by the privacy policies of the companies that provide the applications. We have no influence and are not responsible for the above companies and their use of user data.

VII. HOW WE SECURE PERSONAL DATA
7.1 LUMAG declares that it makes every effort to ensure a high level of security for the personal data it processes. Any events affecting data security, including suspected sharing of files containing viruses and other files of a similar nature or other than files of destructive mechanisms, should be reported to the e-mail address indicated in point 9
below.
7.2 LUMAG uses technical and organizational measures to ensure the protection of personal data being processed appropriate to the threats and categories of data
protected, and in particular, protects data against disclosure to unauthorized persons, removal by an unauthorized person, processing in violation of applicable laws and
alteration, loss, damage or destruction. In addition, LUMAG takes special care to ensure that personal information is:
a) correct and processed lawfully,
b) obtained only for specific purposes and not further processed in a manner incompatible with these purposes,
c) adequate, appropriate, and not excessive,
d) accurate and up-to-date,
e) not kept longer than necessary,
f) processed by the rights of the persons (to whom they relate), including the right to reserve access,
g) safely stored,
h) not transferred without adequate protection.
7.3 Personal data is stored in a database in which technical and organizational measures
have been applied to protect the processed data by the requirements set out in the
generally applicable provisions of the law on protecting personal data. Only persons
authorized by the data administrator have access to the database.
7.4 LUMAG applies appropriate policies and procedures to protect personal data against unauthorized loss, misuse, alteration, or destruction. We make every effort to ensure that access to your data is limited to those who need to know this information. Persons who have access to the data are obliged to keep it confidential. In addition, one of the
principles of LUMAG’s policy in this regard is to store personal information only for the period in which it is necessary to process the user’s request or until the user requests
the removal of such information.

VIII. CONTACT
In personal processing data, you can contact LUMAG as their administrator at the following address: ul. Rogozińska 72, 64-840 Budzyń, or by writing to: l.tokarz@lumag.pl or by calling: 67 2844800.

IX. CHANGE IN PRIVACY POLICY
LUMAG may make changes to this document that reflect the current Privacy Policy. In the case of a modification, the date of the last update, shown below, also changes.

Date of the last update of the Privacy Policy: December 13, 2022