Personal data

ORLEN Petrobaltic S.A. (or any other company belonging to ORLEN Petrobaltic S.A. Capital Group, listed in point 1) as the contracting entity (the Contracting Authority), processes the information contained in the non-public procurement procedure:

• in their applications to participate in the procurement procedure,
• in the offers,
• correspondence during the proceedings,
• found in publicly accessible registers,
• made available on the Internet

for the purpose of conducting and deciding on a non-public procurement procedure.

This information may include data that, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, constitutes personal data.

In relation to the above, the Contractor (understood as an entity submitting a tender as part of the contract award procedure) is obliged to read the following information clause concerning the processing of personal data, familiarise all persons whose data have been or will be made available to the Contracting Authority with the content of this clause, and submit a declaration with the content in accordance with the model under the information clause.

Information clause for the owners of the Contractor, members of the Contractor's statutory bodies, proxies representing the Contractor, its associates, as well as its employees who are the contact persons for the implementation of the non-public procurement procedure announced by ORLEN Petrobaltic S.A.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we hereby inform you that:

1. The controller of your personal data (CPD) is a company belonging to the ORLEN Petrobaltic S.A. Capital Group:

• ORLEN Petrobaltic S.A. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000171101.

or

• SPV Baltic Sp. z o.o. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000491509.

or

• SPV Petro Sp. z o.o. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000733859.

(hereinafter referred to as ORLEN Petrobaltic).

2. Our contact details are: e-mail address orlen.petrobaltic@orlen.pl postal address: 80-758 Gdańsk, ul. Stary Dwór 9.

3. ORLEN Petrobaltic has appointed a data protection officer. This is the person you can contact in all matters relating to the processing of personal data and the exercise of your rights in relation to the processing of personal data. The Data Protection Officer (DPO) can be contacted by email at: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by post at the ORLEN Petrobaltic address indicated in point 2, with the note “Data Protection Officer.” Information about the DPO is also available on the website https://petrobaltic.orlen.pl/pl/dane-osobowe.

4. ORLEN Petrobaltic has received your personal data from an economic entity (Contractor) that applied for/applied for the award of a contract or submitted a bid as part of a procurement procedure, or obtained it from publicly available sources.

5. Your personal data will be processed in connection with the implementation of the tender procedure announced by ORLEN Petrobaltic, in particular for the following purposes:

a. confirmation of the authority of the persons indicated to represent the Contractor or its subcontractor;

b. establishing (confirming) the authorisations or qualifications required to carry out the work in accordance with the requirements set out in the tender documentation/announcement;

c. confirming that the Contractor meets the requirements set by ORLEN Petrobaltic;

d. reporting, control of the implementation of the procurement procedure and its settlement;

e. maintaining business contacts and exchanging correspondence;

f. the transfer, archiving of records or their destruction after the retention period;

g. determining and pursuing claims or compensation, defending against possible claims;

h. fulfilment of obligations imposed on ORLEN Petrobaltic by law.

6. Personal data will be processed in accordance with:

a. Article 6(1)(b) of the GDPR in order to take action at the request of the data subject prior to entering into a contract or to enter into a contract to which the data subject is party (applies to natural persons, including those conducting business activity, who independently submit documents as part of a procurement procedure);

b. article 6(1)(c) of the GDPR in order to comply with legal obligations incumbent on ORLEN Petrobaltic, including, inter alia, those arising from the Anti-Money Laundering and Terrorist Financing Act, those related to the prevention of fraud and irregularities related to anti-corruption legislation, as well as the prevention of fraud and conflicts of interest in business processes, to ensure the employment of employees with appropriate qualifications or authorisations for certain work, to ensure safety during work on premises administered by ORLEN Petrobaltic and obligations arising from tax and accounting legislation;

c. article 6(1)(f) of the GDPR in order to pursue the legitimate interests of ORLEN Petrobaltic or a third party in conducting business in accordance with high ethical standards, in the application of internal procedures for the supervision of legal compliance, in establishing or maintaining business relations (including correspondence or telephone contacts), in conducting internal business analyses and in order to carry out a procurement procedure. ORLEN Petrobaltic's legitimate interest also includes pursuing claims under the law, ensuring the protection of persons and property, exercising the rights of a parent company in capital groups, and fulfilling contracts concluded by ORLEN Petrobaltic.

7. Scope of personal data processed by ORLEN Petrobaltic in connection with participation in the procurement procedure:

a. identification data (name and surname): natural persons applying for the award of the contract, members of the bodies, representatives and employees of the Contractor, subcontractors and other persons indicated in the documents submitted during the tender procedure;

b. details of persons listed in point a above contained in publicly available databases, e.g. KRS (National Court Register);

c. details of the persons referred to in point a) above contained in the certificate from the National Criminal Register, if the representative/proxy of the Contractor is required to present (submit) such a certificate under generally applicable law;

d. identification data of the Economic Operator's proxies: first name, surname, PESEL number (if present in the power of attorney) and other personal data included in the power of attorney;

e. contact details (e-mail address and work telephone number provided for communication purposes, position or function) of the above-mentioned persons, if this is necessary for participation in the procurement procedure and is specified in the tender announcement;

f. data on professional licences and qualifications, training completed, and data contained in documents confirming licences/qualifications, if the tender announcement requires this data to be provided.

8. The recipients of personal data may be:

a. public authorities and bodies entitled to obtain the data on the basis of applicable law, e.g. courts, law enforcement agencies, state institutions, bodies entitled to carry out inspections, when they request the data on the basis of the applicable legal basis;

b. Orlen Group Parent and other Orlen Group entities in order to exercise their powers and to comply with the contracts binding ORLEN Petrobaltic and these entities;

c. providers of correspondence, including in electronic form;

d. external auditors, certified auditors, legal advisers and tax advisers;

e. entities providing services in the field of litigation;

f. authorised financial institutions e.g. execution banks, insurance companies;

g. entities providing document shredding and archiving services;

h. entities providing service and maintenance of equipment used by ORLEN Petrobaltic;

i. entities providing IT services in support and maintenance of systems used to process personal data by ORLEN Petrobaltic, including e-mail.

ORLEN Petrobaltic may entrust the processing of personal data to service or product providers acting on its behalf on the basis of personal data processing agreements, requiring such entities to perform activities on the documented instructions of ORLEN Petrobaltic, provided that they maintain confidentiality and ensure the protection of privacy and security of the entrusted personal data at a level not lower than that of ORLEN Petrobaltic.

9. Your personal data may be transferred to third countries or international organisations within the meaning of the GDPR. The transfer of personal data to receiving entities will be allowed, provided that these entities comply with the requirements set out in the GDPR. We have limited our data storage to data centres in the European Union. However, we cannot exclude the transmission of data via web servers located outside the EU. This may be the case, in particular, where participants in online meetings are located in a third country. In addition, we cannot exclude the possibility that Microsoft US may gain access to the data storage we use for maintenance and support purposes.

10. The processing of your personal data will not be used to make decisions concerning you in an automated manner or for profiling.

11. Your personal data will be processed for the period necessary for the purposes of the processing indicated in para. 5 or until you have successfully raised an objection to the processing.

12. The period for which personal data will be processed will be determined based on, among other things, the following criteria:

a. the time necessary to maintain business contacts with you related to the tender procedure;

b. the duration of the tender procedure and the time necessary for its resolution;

c. the deadline for performance and settlement of the contract concluded following the award of the tender;

d. the deadline for fulfilling the legal obligations incumbent on ORLEN Petrobaltic under general provisions of law;

e. the period for archiving documentation relating to the tender procedure and contract performance;

f. the time necessary to establish, assert or defend legal claims.

13. The provision of data is voluntary but necessary to participate in the tender procedure.

14. The data subject has the right to:

a. access to and request a copy of the personal data concerning it, taking into account the fact that ORLEN Petrobaltic may require the data subject to indicate additional information aimed at specifying the request,

b. rectify or supplement their personal data,

c. request ORLEN Petrobaltic to restrict the processing of personal data, although separate provisions may exclude the possibility of exercising this right, including, among others, in the cases referred to in Article 18(2) of the GDPR (the right to restrict processing does not apply to storage for the purpose of ensuring the use of legal remedies or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State),

d. erasure of personal data, unless there are grounds for exclusion as specified in Article 17(3) of the GDPR,

e. object to the processing of personal data,

You can exercise your rights by contacting ORLEN Petrobaltic or the DPO in writing or by email.

You have the right to lodge a complaint with the President of the Personal Data Protection Office regarding the processing of your personal data at the following address: Personal Data Protection Office, ul. Moniuszki 1A, 00-014 Warsaw, or in electronic form. Detailed information on filing complaints is available on the office's website at www.uodo.gov.pl.

STATEMENT BY THE CONTRACTOR

after reading the information clause and fulfilling, on behalf of the Ordering Party, the information obligation towards persons whose data has been or will be transferred in the course of the proceedings

I declare that I have read the "Information clause for members of the Contractor's statutory bodies, proxies representing the Contractor, its associates, and its employees who are designated as contact persons in the tender procedure announced by ORLEN Petrobaltic S.A. (or another company belonging to the ORLEN Petrobaltic S.A. Capital Group, listed above in point 1)" (hereinafter: Information Clause).

I hereby declare that on behalf of the Ordering Party – the Personal Data Controller, i.e. ORLEN Petrobaltic S.A. (or another company belonging to the ORLEN Petrobaltic S.A. Capital Group, listed above in point 1 of the Information Clause), I have informed all natural persons whose personal data I have provided to the Ordering Party as part of applying for a non-public contract in a tender procedure about the content of the Information Clause, and I have provided the information required under Article 14 of the GDPR.

I hereby declare that on behalf of the Ordering Party – the Personal Data Controller, i.e. ORLEN Petrobaltic S.A. (or another company belonging to the ORLEN Petrobaltic S.A. Capital Group, listed above in point 1), I will inform all natural persons whose personal data I will transfer to the Ordering Party in the course of further tender proceedings, immediately but no later than within one month from the date of data transfer, about the content of the Information Clause, including the information required under Article 14 of the GDPR.

………………………………………………….

(Signature(s) of the Contractor, as represented)

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: GDPR), ORLEN Petrobaltic S.A. with its registered office in Gdańsk (80-758) at ul. Stary Dwór 9, informs that:
1. CONTROLLER
The controller of your personal data (CPD) is ORLEN Petrobaltic S.A., hereinafter referred to as ORLEN Petrobaltic, with its registered office in Gdańsk (80-758), ul. Stary Dwór 9. The contact details are: e-mail: orlen.petrobaltic@orlen.pl, postal address: 80-758 Gdańsk, ul. Stary Dwór 9, tel. + 48 58 301 30 61.
2. DATA PROTECTION OFFICER
ORLEN Petrobaltic has appointed a Data Protection Officer. This is the person you can contact for all matters concerning the processing of your personal data and the exercise of your rights in relation to the processing of your personal data. The Data Protection Officer (DPO) can be contacted at e-mail address: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by correspondence to the address of ORLEN Petrobaltic indicated in point. 1.
Details of the DPO are also available at: https://petrobaltic.orlen.pl/pl/dane-osobowe
3. Purpose and grounds for processing Personal data will be processed for and on the basis of:
a. carrying out the job recruitment process, on the basis of Article 22¹ of the Labour Code, pursuant to Article 6(1)(c) of the GDPR;
b. carrying out the recruitment process, on the basis of the consents given, if you provide personal data on your own initiative other than that resulting from the law, in accordance with Article 6(1)(a) of the GDPR, in the case of ordinary data or Article 9(2)(a) of the GDPR in the case of the inclusion of special categories of data in your application documents;
c. carrying out future recruitment processes, in the event of written consent, on the basis of Article 6(1)(a) of the GDPR;
d. taking the necessary steps to conclude a contract with the successful candidate in the recruitment process, in accordance with Article 6(1)(b) of the GDPR;
e. in the event that you are a foreigner, verification of your consent to employment;
f. to pursue the legitimate interests of ORLEN Petrobaltic in accordance with Article 6(1)(f) of the GDPR, including but not limited to verification of your qualifications and skills necessary to work in the position you are applying for, archiving of the recruitment protocol containing your basic data (name and surname), keeping correspondence with you and maintaining contact in the course of the recruitment process, conducting a survey of your satisfaction level from the participation in the recruitment process, pursuing internal administrative purposes in the scope of personnel management and reporting in accordance with internal regulations. In a situation where the position for which you are applying requires the submission of a certificate of no criminal record, in accordance with generally applicable laws, ORLEN Petrobaltic will require the provision of information about no criminal record from the National Criminal Register (legal basis Article 6(1)(c) of the GDPR). Entry into recruitment and consent to the processing of personal data are voluntary. If you have decided to apply for recruitment, it is necessary to provide the data resulting from Article 22¹ of the Labour Code in order to participate in the recruitment procedure. The range of data required includes:
a. name(s);
b. date of birth;
c. contact details of the candidate;
d. education;
e. professional qualifications;
f. history of previous employment; Other personal data is voluntary and may include:
g. other data not normally required by law, if included in the application documents;
h. special categories of data (as specified in Article 9 of the GDPR, e.g. concerning health (disability certificates ), if they are included in your application documents and you have given your explicit written consent to their processing. Criminal record data, in accordance with Article 10 of the GDPR, may only be processed where this is required by generally applicable law.
4. RECIPIENTS OF THE DATA
Recipients of your data may be: Orlen Group Parent Company and other Orlen Group entities for the purpose of exercising their rights and performing concluded agreements, including entities cooperating with ORLEN Petrobaltic that have been commissioned to provide services related to the processing of personal data, e.g. providers of IT systems and services, entities supporting ORLEN Petrobaltic in recruitment processes. The entities referred to above process data on the basis of contracts concluded with ORLEN
Petrobaltic. ORLEN Petrobaltic may entrust personal data to providers of services or products acting on its behalf on the basis of an entrustment agreement for the processing of personal data, requiring such entities to carry out activities on ORLEN Petrobaltic's documented instructions, subject to confidentiality and ensuring the protection of privacy and security of the entrusted personal data at a level no lower than that of ORLEN Petrobaltic.
5. PROCESSING TIME
Your data collected in the recruitment process will be processed until the end of the recruitment process, but no longer than for a period of 12 months from the date of sending your application within the recruitment process in question or withdrawal of your consent or submission of an effective objection to the data being processed for the purposes of realising the legally justified interests of ORLEN Petrobaltic. Where you have given additional consent for your personal data to be used for future recruitment, your data will be processed for a period of 12 months from the date of submission of your application or until you withdraw your previously given consent. In the event that your candidature is used in a future recruitment process, these data will be processed for the period indicated in the first sentence.
6. RIGHTS OF THE DATA SUBJECT
We inform you of your right to:
a. access to and request a copy of the personal data concerning it, taking into account the fact that ORLEN Petrobaltic may require the data subject to indicate additional information aimed at specifying the request;
b. rectify or complete your personal data;
c. request ORLEN Petrobaltic to restrict the processing of personal data, although separate provisions may exclude the possibility of exercising this right, including, inter alia, in cases referred to in Article 18(2) of the GDPR (the right to restrict processing does not apply in relation to storage, in order to ensure the exercise of legal remedies or in order to protect the rights of another natural or legal person, or for compelling reasons of public interest of the European Union or of a Member State;
d. object to the processing of personal data within the scope of the controller's legitimate interest;
e. withdraw consent at any time, whereby the withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal;
f. transfer of your personal data (transmission to you or another controller) in a structured, commonly used IT format suitable for machine reading, provided that the personal data are processed on the basis of the consent obtained and by automated means and where technically possible;
g. erasure if no other purpose of the processing is pursued and the grounds for exclusion of the right, as indicated in Article 17(3) of the GDPR, does not apply. You may exercise your rights by contacting ORLEN Petrobaltic or the DPO in writing or by email (contact details are indicated in Section 1 and Section 2).
7. RIGHT TO LODGE A COMPLAINT
You have the right to lodge a complaint to the President of the Office for Personal Data Protection about the processing of your personal data by ORLEN Petrobaltic, to the address: Office for the Protection of Personal Data, ul. Moniuszki 1A, 00-014 Warsaw or electronically. Details of how to complain are available on the office's website www.uodo.gov.pl.

As part of its business activities, ORLEN Petrobaltic S.A. processes data contained in correspondence, offers, contract applications, contracts, and documents related to the performance of contracts/orders/commissions, as well as data contained in publicly available registers (e.g., the National Court Register, Central Register and Information on Economic Activity of the Republic of Poland) and the Internet. This information includes data that, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, is considered personal data.

ORLEN Petrobaltic S.A. undertakes to secure personal data by applying appropriate technical and organizational measures required by applicable laws on personal data protection, and shall bear full responsibility for any damage caused in connection with the processing of personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we hereby inform you that:

1. The controller of your personal data (CPD) is ORLEN Petrobaltic S.A. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000171101 (hereinafter referred to as ORLEN Petrobaltic).

2. Our contact details are: e-mail address orlen.petrobaltic@orlen.pl postal address: 80-758 Gdańsk, ul. Stary Dwór 9.

3. ORLEN Petrobaltic has appointed a data protection officer. This is the person you can contact in all matters relating to the processing of personal data and the exercise of your rights in relation to the processing of personal data. The Data Protection Officer (DPO) can be contacted by email at: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by post at the ORLEN Petrobaltic address indicated in point 2, with the note “Data Protection Officer.” Information about the DPO is also available on the website https://petrobaltic.orlen.pl/pl/dane-osobowe.

4. ORLEN Petrobaltic has obtained your personal data directly from you or from a business entity (hereinafter referred to as the Contractor) with which ORLEN Petrobaltic cooperates on the basis of a concluded contract or which is applying for a contract (hereinafter referred to as the Contract) or from publicly available sources, including the Internet.

5. Your personal data will be processed in connection with applying for the conclusion of the Contract, concluding the Contract and performing the Contract for the following purposes:

a. establishing/confirming the rights of persons designated for representation;

b. determination/confirmation of the rights to perform/implement the provisions of the Contract or to meet other requirements specified in the Contract;

c. implementation of the subject matter of the Contract;

d. exercising of the powers of parent entities in groups;

e. keeping records of matters (e.g. contracts) that are the subject of cooperation;

f. reporting, monitoring, control of the performance of the Contract and its settlement;

g. maintaining business contacts and exchanging correspondence;

h. monitoring compliance with the rules on confidentiality and the protection of information, including personal data;

i. applying internal procedures for monitoring compliance with the law and protecting ORLEN Petrobaltic against abuse and irregularities, including in particular the application of anti-corruption procedures, counteracting abuse and conflicts of interest, detecting abuse, and ensuring the business security of ORLEN Petrobaltic;

j. sending, archiving or destroying documentation;

k. determining and pursuing claims and compensation, defending against possible claims;

l. complying with the obligations imposed on ORLEN Petrobaltic by law.

6. Personal data will be processed in accordance with:

a. Article 6(1)(b) of the GDPR – for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

b. Article 6(1)(c) of the GDPR – in order to comply with legal obligations incumbent on ORLEN Petrobaltic under applicable law, including tax regulations, accounting regulations, the Act on Counteracting Money Laundering and Terrorist Financing, Regulation (EU) of the European Parliament and of the Council on market abuse, regulations on access to public information, health and safety regulations, regulations for the protection of life and health and for the protection of the environment, regulations requiring the employment of workers with appropriate qualifications or licences for specific jobs;

c. Article 6(1)(f) of the GDPR – for the purposes of the legitimate interests pursued by the controller or a third party, and for the purposes of performing the Contract. The legitimate interests of ORLEN Petrobaltic include pursuing claims under the law, applying internal procedures for monitoring compliance with the law, ensuring the protection of persons, interests and property of ORLEN Petrobaltic, exercising the rights of the parent company in capital groups, fulfilling the provisions of the Contract, and archiving documentation.

7. The scope of personal data processed by ORLEN Petrobaltic in connection with the conclusion, performance and settlement of the Contract:

a. identification data (name and surname, PESEL number, NIP number, Regon number): natural persons, sole traders, members of bodies, representatives and employees of the contractor, subcontractors and other persons indicated in the documents submitted in the course of concluding and performing the Contract;

b. data of persons listed in point a above contained in publicly available databases or on the Internet;

c. details of the persons referred to in point a) above contained in the certificate from the National Criminal Register, if the Contractor is required to present (submit) such a certificate under generally applicable law;

d. identification and address details, including PESEL numbers, of the Counterparty's/contractor's representatives and subcontractors contained in the power of attorney;

e. contact details (e-mail address, telephone number provided for communication purposes), position or function of the above-mentioned persons, if necessary for the performance of the Contract and resulting from the provisions of the Contract;

f. data on professional licences and qualifications, training completed, and data contained in documents confirming licences/qualifications, if the Contract requires this data to be provided.

8. The recipients of personal data may be:

a. public authorities and bodies entitled to obtain the data on the basis of applicable law, e.g. courts, law enforcement agencies, state institutions, bodies entitled to carry out inspections, when they request the data on the basis of the applicable legal basis;

b. ORLEN S.A. as the parent company of the ORLEN Group to exercise its powers;

c. authorised entities of the Orlen Group, for the purpose of performing contracts binding on ORLEN Petrobaltic and those entities;

d. other counterparties of ORLEN Petrobaltic, if the processing of your personal data is directly or indirectly related to the performance of a contract binding ORLEN Petrobaltic and the counterparty and if the scope of business cooperation/contract implies the obligation to provide them with your personal data;

e. correspondence providers;

f. entities providing document shredding and archiving services;

g. providers of legal advice and litigation;

h. external auditors, chartered accountants and tax advisors;

i. authorised financial institutions e.g. execution banks, insurance companies;

j. entities providing service and maintenance of equipment used by ORLEN Petrobaltic;

k. entities providing IT services in support and maintenance of systems used to process personal data by ORLEN Petrobaltic, including e-mail. ORLEN Petrobaltic may entrust the processing of personal data to service or product providers acting on its behalf on the basis of personal data processing agreements, requiring such entities to perform activities on the documented instructions of ORLEN Petrobaltic, provided that they maintain confidentiality and ensure the protection of privacy and security of the entrusted personal data at a level not lower than that of ORLEN Petrobaltic.

8. Your personal data may be transferred to third countries or international organizations within the meaning of the GDPR. The transfer of personal data will be possible provided that the recipients comply with the requirements set out in the GDPR. We have limited our data storage to data centres in the European Union. However, we cannot exclude the transmission of data via web servers located outside the EU. This may be the case, in particular, where participants in online meetings are located in a third country. In addition, we cannot exclude the possibility that Microsoft US may gain access to the data storage we use for maintenance and support purposes.

9. The processing of your personal data will not be used to make decisions concerning you in an automated manner or for profiling.

10. Your personal data will be processed for the period necessary for the purposes of the processing indicated in para. 5 or until you have successfully raised an objection to the processing.

11. The period for which personal data will be processed will be determined, inter alia, on the basis of the following criteria:

a. the time necessary to maintain business contacts with you related to the implementation of the Contract;

b. the deadline for execution and settlement of the Contract;

c. deadline for fulfilling legal obligations incumbent on ORLEN Petrobaltic under applicable law;

d. the period of archiving documentation relating to the performance of the Contract;

e. the time necessary to establish, assert or defend legal claims.

12. If we obtain personal data directly from you, we inform you that the provision of data is voluntary but necessary for the implementation of business ventures/conclusion and implementation of the Contract.

13. The data subject has the right to:

a. access to and request a copy of the personal data concerning it, taking into account the fact that ORLEN Petrobaltic may require the data subject to indicate additional information aimed at specifying the request;

b. rectify or supplement their personal data;

c. request ORLEN Petrobaltic to restrict the processing of personal data, although separate provisions may exclude the possibility of exercising this right, including, among others, in the cases referred to in Article 18(2) of the GDPR (the right to restrict processing does not apply to storage for the purpose of ensuring the use of legal remedies or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State),

d. erasure of personal data, unless there are grounds for exclusion as specified in Article 17(3) of the GDPR,

e. object to the processing of personal data.

You may exercise your rights by contacting ORLEN Petrobaltic or the Data Protection Officer in writing or by e-mail.

You have the right to lodge a complaint with the President of the Personal Data Protection Office regarding the processing of your personal data at the following address: Personal Data Protection Office, ul. Moniuszki 1A, 00-014 Warsaw, or in electronic form. Detailed information on filing complaints is available on the office's website at

www.uodo.gov.pl.

As part of its business activities, ORLEN Petrobaltic S.A. processes data contained in correspondence, offers, contract applications, contracts, and documents related to the performance of contracts/orders/commissions, as well as data contained in publicly available registers (e.g., the National Court Register, Central Register and Information on Economic Activity of the Republic of Poland) and the Internet. This information includes data that, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, is considered personal data.

ORLEN Petrobaltic S.A. undertakes to secure personal data by applying appropriate technical and organizational measures required by applicable laws on personal data protection, and shall bear full responsibility for any damage caused in connection with the processing of personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we hereby inform you that:

1. The controller of your personal data (CPD) is ORLEN Petrobaltic S.A. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000171101 (hereinafter referred to as ORLEN Petrobaltic).

2. Our contact details are: e-mail address orlen.petrobaltic@orlen.pl postal address: 80-758 Gdańsk, ul. Stary Dwór 9.

3. ORLEN Petrobaltic has appointed a data protection officer. This is the person you can contact in all matters relating to the processing of personal data and the exercise of your rights in relation to the processing of personal data. The Data Protection Officer (DPO) can be contacted by email at: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by post at the ORLEN Petrobaltic address indicated in point 2, with the note “Data Protection Officer.” Information about the DPO is also available on the website https://petrobaltic.orlen.pl/pl/dane-osobowe.

4. ORLEN Petrobaltic has obtained your personal data from an entity (hereinafter referred to as the Contractor) with which the company maintains business contacts, cooperates on the basis of a concluded contract, or which is applying for a contract/order (hereinafter referred to as the Contract) or has obtained it from publicly available databases or the Internet or directly from you.

5. Your personal data will be processed in connection with maintaining business contacts, the Contractor's application for the conclusion of a Contract, or the conclusion and performance of a Contract for the following purposes:

a. determining/confirming the authorizations of persons designated to represent the Contractor;

b. determination/confirmation of the rights to perform/implement the provisions of the Contract or to meet other requirements specified in the Contract;

c. implementation of the subject matter of the Contract;

d. performance of the functions, powers and duties of the governing bodies of the Parent Company in the Orlen Capital Group and authorised entities within the Orlen Capital Group, i.e. where necessary, transfer of your personal data to Orlen S.A. or other companies in the Capital Group for the purpose of performing their duties;

e. reporting, monitoring, control of the performance of the Contract and its settlement;

f. applying internal procedures for monitoring compliance with the law and protecting ORLEN Petrobaltic against abuse and irregularities, including in particular the application of anti-corruption procedures, counteracting abuse and conflicts of interest, detecting abuse, and ensuring the business security of ORLEN Petrobaltic;

g. ensuring the protection of ORLEN Petrobaltic personnel and property;

h. ensuring the safety of persons and compliance with health and safety regulations on the premises and in the facilities of ORLEN Petrobaltic by introducing special supervision of the workplace or the area around the workplace in the form of technical security measures (SKD, SSWiN) and measures enabling image recording (video surveillance);

i. monitoring compliance with the rules on confidentiality and the protection of information, including personal data;

j. fulfilment of legal obligations incumbent on ORLEN Petrobaltic, including, among others, the obligations of an obligated institution under the Act of 1 March 2018 on counteracting money laundering and terrorist financing (the “AML Act”);

k. maintaining business contacts and exchanging correspondence;

l. fulfilment of obligations under contracts concluded with other contractors by ORLEN Petrobaltic;

m. sending, archiving or destroying documentation;

n. determining and pursuing claims and compensation, defending against possible claims;

o. complying with the obligations imposed on ORLEN Petrobaltic by law.

6. Personal data will be processed in accordance with:

a. Article 6(1)(c) of the GDPR – in order to comply with legal obligations incumbent on ORLEN Petrobaltic under generally applicable laws, including tax regulations, the Accounting Act, the Act on Counteracting Money Laundering and Terrorist Financing (applies to members of statutory bodies or proxies), Regulation (EU) of the European Parliament and of the Council on market abuse, provisions on access to public information, provisions for the protection of life and health or for the protection of the environment,

b. Article 6(1)(f) of the GDPR – for the purposes of the legitimate interests pursued by the controller or a third party, and for the purposes of performing the Contract. The legitimate interests of ORLEN Petrobaltic include pursuing claims under the law, applying internal procedures for monitoring compliance with the law, ensuring the protection of persons and property, exercising the rights of a parent company in capital groups, and fulfilling the provisions of contracts.

7. The scope of personal data processed by ORLEN Petrobaltic in connection with maintaining business contacts or with the conclusion, implementation and settlement of the Contract:

a. identification data (name and surname): members of bodies, representatives, proxies of the Contractor, contractors, subcontractors, and other persons indicated in documents submitted in connection with the conclusion of the Contract and during the performance of the Contract or as part of business cooperation;

b. data of persons listed in point a above contained in publicly available databases, e.g. the National Court Register (KRS) or on the Internet,

c. details of the persons referred to in point a) above contained in the certificate from the National Criminal Register, if the representative/proxy of the Contractor is required to present (submit) such a certificate under generally applicable law;

d. identification data (including PESEL number) and address details of the Contractor's representatives, contractors, and subcontractors contained in the power of attorney;

e. identification data (including PESEL number) of persons listed in point a above, entering ORLEN Petrobaltic facilities;

f. identification data (including PESEL number, identity document number) necessary for the organisation and execution of air or sea transport to the platforms;

g. data on professional licences and qualifications, training completed, and data contained in documents confirming licences/qualifications, if the business cooperation or Contract requires the provision of such data;

h. contact details (business email address, telephone number) provided for the purpose of maintaining contact, and position or function of the above-mentioned persons, if necessary for the conclusion and performance of the Contract or resulting from the provisions of the Contract;

8. The recipients of personal data may be:

a. public authorities and bodies entitled to obtain the data on the basis of applicable law, e.g. courts, law enforcement agencies, state institutions, bodies entitled to carry out inspections, when they request the data on the basis of the applicable legal basis;

b. Orlen S.A., as the parent company of the ORLEN Group, and other entities from the ORLEN Group, for the purpose of exercising their rights or performing contracts binding on ORLEN Petrobaltic and those entities;

c. external auditors, chartered accountants and tax advisors;

d. providers of legal advice and litigation;

e. authorised financial institutions e.g. execution banks, insurance companies;

f. other contractors cooperating with ORLEN Petrobaltic, if the scope of such business cooperation/contract involves the obligation to provide them with your personal data;

g. correspondence providers;

h. entities providing document shredding and archiving services;

i. entities providing service and maintenance of equipment used by ORLEN Petrobaltic;

j. entities providing IT services in support and maintenance of systems used to process personal data by ORLEN Petrobaltic, including e-mail. ORLEN Petrobaltic may entrust the processing of personal data to service or product providers acting on its behalf on the basis of personal data processing agreements, requiring such entities to perform activities on the documented instructions of ORLEN Petrobaltic, provided that they maintain confidentiality and ensure the protection of privacy and security of the entrusted personal data at a level not lower than that of ORLEN Petrobaltic.

9. Your personal data may be transferred to third countries or international organisations within the meaning of the GDPR. The transfer of personal data will be possible provided that the recipients comply with the requirements set out in the GDPR. We have limited our data storage to data centres in the European Union. However, we cannot exclude the transmission of data via web servers located outside the EU. This may be the case, in particular, where participants in online meetings are located in a third country. In addition, we cannot exclude the possibility that Microsoft US may gain access to the data storage we use for maintenance and support purposes.

10. The processing of personal data will not be used to make decisions concerning you in an automated manner or for profiling.

11. Your personal data will be processed for the period necessary for the purposes of the processing indicated in para. 5 or until you have successfully raised an objection to the processing.

12. The period during which personal data will be processed will be determined based on, among others, the following criteria:

a. the time necessary to maintain business contacts with you related to business cooperation, conclusion and performance of the Contract;

b. the deadline for execution and settlement of the Contract;

c. deadline for fulfilling legal obligations incumbent on ORLEN Petrobaltic under applicable law;

d. the period of archiving documentation relating to the implementation of the Contract or business cooperation;

e. the time necessary to establish, assert or defend legal claims.

13. If we obtain personal data directly from you, we inform you that the provision of data is voluntary but necessary for the implementation of business ventures/conclusion and implementation of the Contract.

14. The data subject has the right to:

a. access to and request a copy of the personal data concerning it, taking into account the fact that ORLEN Petrobaltic may require the data subject to indicate additional information aimed at specifying the request;

b. rectify or supplement their personal data;

c. request ORLEN Petrobaltic to restrict the processing of personal data, although separate provisions may exclude the possibility of exercising this right, including, among others, in the cases referred to in Article 18(2) of the GDPR (the right to restrict processing does not apply to storage for the purpose of ensuring the use of legal remedies or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State);

d. deletion of personal data if the grounds for exclusion, as indicated in Article 17(3) of the GDPR, do not follow;

e. object to the processing of personal data. You can exercise your rights by contacting ORLEN Petrobaltic in writing or by email. You have the right to lodge a complaint with the President of the Personal Data Protection Office regarding the processing of your personal data at the following address: Personal Data Protection Office, ul. Moniuszki 1A, 00-014 Warsaw, or in electronic form. Detailed information on filing complaints is available on the office's website at www.uodo.gov.pl.

ORLEN Petrobaltic S.A. conducts video surveillance to ensure the safety of persons staying on the premises and in the facilities administered by the company and to protect property. The area, buildings and rooms covered by video surveillance are marked with information boards or pictograms. ORLEN Petrobaltic S.A. undertakes to secure personal data by applying appropriate technical and organizational measures required by applicable laws on personal data protection, and shall bear full responsibility for any damage caused in connection with the processing of personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we kindly inform you that:

1) The controller of your personal data (CPD) is ORLEN Petrobaltic S.A. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000171101 (hereinafter referred to as ORLEN Petrobaltic).

2) Our contact details are: e-mail address orlen.petrobaltic@orlen.pl postal address: 80-758 Gdańsk, ul. Stary Dwór 9.

3) ORLEN Petrobaltic has appointed a data protection officer. This is the person you can contact in all matters relating to the processing of personal data and the exercise of your rights in relation to the processing of personal data. The Data Protection Officer (DPO) can be contacted by email at: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by post at the ORLEN Petrobaltic address indicated in point 2, with the note “Data Protection Officer.” Information about the DPO is also available on the website https://petrobaltic.orlen.pl/pl/dane-osobowe.

4) Personal data in the form of images will be processed in accordance with Article 6(1)(f) of the GDPR and on the basis of Article 222 of the Labour Code, in order to pursue the legitimate interests of ORLEN Petrobaltic, related to the protection of property and ensuring security on the premises and in the facilities used by ORLEN Petrobaltic, in particular:

• in order to ensure the safety of persons (employees, customers, contractors, visitors), protect the property of ORLEN Petrobaltic and ensure the confidentiality of information whose disclosure could expose ORLEN Petrobaltic to damage;
• determining, investigating or defending claims arising from legal provisions;
• providing authorised state authorities with responses in ongoing proceedings concerning events in surveilled areas.

5) The recipients of personal data may be:

• state authorities and public institutions authorised to obtain personal data on the basis of applicable law, e.g. courts, law enforcement authorities or state institutions, when they make a request based on an appropriate legal basis;
• natural persons who request access to their personal data, indicate their legitimate interest and whose request is granted;
• parent entity in the Orlen Group and other entities from the Orlen Group, for the purpose of exercising their rights or on the basis of contracts binding ORLEN Petrobaltic and these entities;
• insurance company with which ORLEN Petrobaltic has signed an insurance contract;
• trade unions within the scope of applicable law;
• entities providing occupational health and safety and fire protection services;
• entities providing service and maintenance of equipment used by ORLEN Petrobaltic;
• correspondence providers;
• entities providing document shredding;
• entities providing legal services.

ORLEN Petrobaltic may entrust your personal data to service or product providers acting on its behalf on the basis of a personal data processing agreement, requiring such entities to perform activities on the documented instructions of ORLEN Petrobaltic, provided that they maintain confidentiality and ensure the protection of privacy and security of your personal data.

6) Your personal data will not be transferred to third countries.

7) The processing of your personal data will not be used for automated decision-making and will not be used for profiling.

8) The period of personal data processing depends on the purpose for which it is processed, i.e. the data will be processed for the following periods:

• in the case of video surveillance, for a maximum period of 3 months;
• until the final conclusion of proceedings in which the processed personal data may be or will be evidence in the case;
• With regard to legitimate interests, the data will be processed until the expiry of the limitation period for pursuing claims or until an objection to the processing of data is upheld.

9) We would like to inform you about your right to:

• access to their personal data and request a copy thereof (provided that exercising this right does not violate the rights of other persons), taking into account the fact that ORLEN Petrobaltic may request the data subject to provide additional information in order to clarify the request;
• erasure of data, unless there are grounds for exclusion under Article 17(3) of the GDPR;
• request the restriction of the processing of their data, whereby separate provisions may exclude the possibility of exercising this right, including, inter alia, in the cases referred to in Article 18(2) of the GDPR (the right to restriction of processing does not apply to storage for the purpose of ensuring the exercise of legal remedies or for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State);
• object to the processing of personal data;

You may exercise your rights by contacting ORLEN Petrobaltic (point 2) or the Data Protection Officer (point 3) in writing or by e-mail.

10) We would like to inform you that you have the right to lodge a complaint with the President of the Personal Data Protection Office regarding the processing of your personal data at the following address: Personal Data Protection Office, ul. Moniuszki 1A, 00-014 Warsaw, or in electronic form. Detailed information on filing complaints is available on the office's website at www.uodo.gov.pl.

As part of its business activities, ORLEN Petrobaltic S.A. processes data contained in correspondence, offers, contract applications, contracts, and documents related to the performance of contracts, as well as data contained in publicly available registers (e.g., the National Court Register, Central Register and Information on Economic Activity of the Republic of Poland) and the Internet. This information may include data that, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, constitutes personal data.

ORLEN Petrobaltic S.A. undertakes to secure personal data by applying appropriate technical and organizational measures required by applicable laws on personal data protection, and shall bear full responsibility for any damage caused in connection with the processing of personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR), we hereby inform you that:

1. The controller of your personal data (CPD) is ORLEN Petrobaltic S.A. with its registered office at ul. Stary Dwór 9 in Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number 0000171101 (hereinafter referred to as ORLEN Petrobaltic).

2. Our contact details are: e-mail address orlen.petrobaltic@orlen.pl postal address: 80-758 Gdańsk, ul. Stary Dwór 9.

3. ORLEN Petrobaltic has appointed a data protection officer. This is the person you can contact in all matters relating to the processing of personal data and the exercise of your rights in relation to the processing of personal data. The Data Protection Officer (DPO) can be contacted by email at: iod.petrobaltic@orlen.pl or iod.lpb@energa.pl or by post at the ORLEN Petrobaltic address indicated in point 2, with the note “Data Protection Officer.” Information about the DPO is also available on the website https://petrobaltic.orlen.pl/pl/dane-osobowe.

4. ORLEN Petrobaltic has obtained your personal data from an entity (hereinafter referred to as the Contractor) with which our company maintains business relations and cooperates on the basis of a concluded contract/order (hereinafter referred to as the Contract), from publicly available databases (e.g. the National Court Register) or the Internet, or directly from you.

5. Your personal data will be processed in connection with the conclusion and performance of the Contract between ORLEN Petrobaltic and the Contractor for the following purposes:

a. determination/confirmation of the rights to perform/implement the provisions of the Contract or to meet other requirements specified in the Contract;

b. implementation of the subject matter of the Contract;

c. determination/confirmation of the rights or qualifications required to perform work in accordance with the Contract or to meet other requirements specified in the Contract;

d. carrying out the necessary training, including fire protection and health and safety at work, and/or to establish the validity of the training received;

e. conducting post-accident investigations or investigations;

f. carrying out sobriety checks in accordance with the regulations in force at ORLEN Petrobaltic;

g. determining the validity of the necessary occupational health certificates;

h. monitoring compliance with the rules on confidentiality and the protection of information, including personal data;

i. application of internal procedures for monitoring compliance with the law;

j. ensuring the safety of persons and protection of property;

k. exercising of the powers of parent entities in groups;

l. fulfilling contracts concluded with other entities, if this results from the content of contracts concluded with contractors;

m. monitoring, control of the performance of the Contract and its settlement;

n. maintaining business contacts and exchanging correspondence;

o. reporting, sending, and archiving documentation;

p. determining and pursuing claims and compensation, defending against possible claims;

q. fulfillment of legal obligations incumbent on ORLEN Petrobaltic.

6. The basis for the processing of personal data is:

a. article 6(1)(b) of the GDPR - i.e. to take action at the request of the data subject prior to entering into a contract, or to enter into a contract to which the data subject is a party, (applicable to individuals, including sole traders, who are party to a contract and provide their personal data themselves in the context of applying for a contract or during the performance of a contract);

b. Article 6(1)(c) of the GDPR – in relation to the fulfillment of legal obligations incumbent on ORLEN Petrobaltic under generally applicable regulations, including tax regulations, accounting regulations, anti-money laundering and counter-terrorist financing regulations, Regulation (EU) of the European Parliament and of the Council (EU) on market abuse, regulations on access to public information, regulations for the protection of life and health and for the protection of the environment, regulations requiring the employment of workers with appropriate qualifications or licenses for specific jobs, ensuring safety on site and during work, ensuring the protection of persons and property,

c. article 6(1)(f) of the GDPR - in order to pursue the legitimate interests of ORLEN Petrobaltic or a third party and to fulfil the subject matter of the contract. The legitimate interests of ORLEN Petrobaltic include establishing and pursuing claims arising from legal provisions, applying internal procedures for monitoring compliance with the law, ensuring the protection of ORLEN Petrobaltic's interests and property, fulfilling the provisions of the Contract, and ensuring the exercise of the rights of parent entities in capital groups.

7. Scope of personal data processed by ORLEN Petrobaltic in connection with the conclusion, performance, and settlement of the contract:

a. identification data (name and surname, PESEL number): of the Contractor's employees, subcontractors' employees, and other persons indicated in the documents submitted in the course of the contract performance, if it is necessary for the performance of the contract and results from the provisions of the contract;

b. contact details (business e-mail address, business telephone number, position or function,) of the aforementioned persons, if this is necessary for the performance of the contract and arises from the provisions of the contract;

c. the image of the above-mentioned persons, if necessary for issuing passes authorizing entry to the ORLEN Petrobaltic premises and in connection with video surveillance;

d. data on professional entitlements and qualifications, insofar as the contract requires the provision of such data;

e. data contained in the documents evidencing the authorisations and qualifications held, insofar as the contract requires the production of such documents;

f. data on the expiry dates of necessary training courses, including health and safety training, and occupational health certificates;

g. data contained in ZUS ZUA forms of the Contractor's employees, subcontractors (or other documents confirming employment) who should be employed on the basis of an employment contract.

8. The recipients of personal data may be:

a. public authorities and bodies entitled to obtain the data on the basis of applicable law, e.g. courts, law enforcement agencies, state institutions, bodies entitled to carry out inspections, when they request the data on the basis of the applicable legal basis;

b. ORLEN S.A. as the parent company of the ORLEN Group to exercise its powers;

c. authorised ORLEN Group entities in order to exercise their rights or to perform contracts binding ORLEN Petrobaltic;

d. external auditors, chartered accountants and tax advisors;

e. providers of legal advice and litigation;

f. authorised financial institutions e.g. execution banks, insurance companies;

g. other contractors cooperating with ORLEN Petrobaltic, if the scope of this business cooperation/Contract implies an obligation to provide them with your personal data;

h. correspondence providers;

i. entities providing document shredding and archiving services;

j. entities providing service and maintenance of equipment used by ORLEN Petrobaltic;

k. entities providing IT services in support and maintenance of systems used to process personal data by ORLEN Petrobaltic, including e-mail.