I. Data Controller

The controller of your personal data is PRZEDSIĘBIORSTWO WIELOBRANŻOWE ZOF – STAL WOJCIECH WÓJCIK, with its registered office at Murarska 24, 43-100 Tychy, Poland, Tax Identification Number (NIP): 648-221-38-02 (hereinafter referred to as the "Controller").

II. Contact Details

For any matters relating to the processing and protection of personal data, you may contact the Controller:

• by email: rodo@zofstal.pl

• by post at the Controller's registered office address.

III. Purposes and Legal Basis for Processing Personal Data

Personal data are processed for the following purposes:

1. Entering into and performing contracts, including preparing quotations and commercial agreements, ensuring the proper sale of goods and services, coordinating the collection and delivery of goods, and providing technical support and complaint handling.

Legal basis:

• Article 6(1)(b) GDPR – processing is necessary for taking steps prior to entering into a contract or for the performance of a contract;

• Article 6(1)(f) GDPR – processing is necessary for the purposes of the Controller's legitimate interests.

2. Compliance with legal obligations arising from applicable laws governing the Controller's business activities, particularly accounting and tax regulations.

Legal basis:

• Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject.

3. Establishment, exercise or defence of legal claims in connection with dispute resolution, proceedings before public authorities, or other legal proceedings.

Legal basis:

• Article 6(1)(f) GDPR – processing is necessary for the purposes of the Controller's legitimate interests.

4. Direct marketing of the Controller's own products and services.

Legal basis:

• Article 6(1)(f) GDPR – processing is necessary for the purposes of the Controller's legitimate interests.

5. Processing based on the data subject's consent.

Legal basis:

• Article 6(1)(a) GDPR – consent of the data subject.

6. Other processing purposes specified in separate privacy notices provided to data subjects, together with the applicable legal basis for such processing.

IV. Data Retention Period

Personal data are processed only for as long as necessary to fulfil the purposes described above and are not processed in a manner incompatible with those purposes.

In particular, personal data will be retained:

• until the expiry of limitation periods for claims arising from contracts or services provided;

• until the expiration of statutory data retention obligations;

• for the period required under accounting and tax regulations.

Personal data processed for accounting and tax purposes will be retained for five (5) years, calculated from the end of the calendar year in which the relevant tax obligation arose.

V. Transfers of Personal Data Outside the European Economic Area

Personal data are not transferred outside the European Economic Area (EEA).

VI. Data Recipients

Personal data may be disclosed to entities processing data on behalf of the Controller, including in particular:

• law firms;

• transport and logistics companies;

• debt collection agencies;

• providers of accounting, IT and technical services;

• public authorities authorised to obtain such data under applicable law, including tax authorities.

VII. Rights of the Data Subject

Every individual whose personal data are processed has the following rights:

• the right to access their personal data, including the right to obtain a copy;

• the right to rectify inaccurate or incomplete personal data;

• the right to erasure ("right to be forgotten");

• the right to restriction of processing;

• the right to data portability;

• the right to object to the processing of personal data;

• the right to withdraw consent at any time where processing is based on consent;

• the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO) if they believe that the processing of their personal data infringes the GDPR.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.