The confidentiality of your personal data is extremely important to us. We would like to inform you about how we protect your privacy in connection with the use of oxoplast.com. This privacy policy (hereinafter the “Policy”) comprehensively describes the methods of personal data processing and your rights related to this processing. This Privacy Policy is addressed to natural persons who:

– visit the oxoplast.com website;

– subscribe the oxoplast.com newsletter;

– provide their personal data on the oxoplast.com website in order to contact the administrator of personal data, submit an inquiry, complaint etc.

(hereinafter “you”).

1. According to article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”), we would like to inform you that the administrator of your personal data is Grupa Azoty Zakłady Azotowe Kędzierzyn S.A. With its registered office in Kędzierzyn – Koźle, ul. Mostowa 30A, 47-220 Kędzierzyn – Koźle, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court in Opole, 8th Commercial Department of the National Court Register under KRS [National Court Register] number 0000008993, with share capital of PLN 285 064 300 and paid-up capital of PLN 285 064 300, with NIP [Tax Identification Number] 749-00-05-094, REGON [National Register of Business Units] 530544497, (hereinafter “we” or the “Administrator”).
2. The Administrator appointed a data protection officer. You may contact the data protection officer via the email address iod.zak@grupaazoty.com.
3. Your personal data will be processed:
   • based on your consent (article 6 (1) (a) of the GDPR) – the Administrator processes your personal data for direct marketing carried out using the newsletter only on the basis of your explicit, voluntary and previously expressed consent. Any provided consent may be withdrawn at any time. Remember that withdrawal of consent is only effective for the future and does not affect the lawfulness of processing based on consent before its withdrawal.
   • in order to perform the agreement or take actions before the conclusion of the agreement (article 6 (1) (b) of the GDPR); by using the contact forms, you may contact us with a question or complaint regarding the agreement concluded between you and us, or the agreement to the conclusion of which you are seeking. In this case, we will process your personal data in connection with the performance or conclusion of such an agreement.
   • for purposes resulting from legitimate interests pursued by the Administrator or a third party (article 6 (1) (f) of the GDPR) – Processing may be considered necessary for the implementation of the legitimate interests of the Administrator or a third party, if it does not unduly affect your interests or basic interests rights and freedoms. When processing personal data on this basis, we always try to balance our legitimate interest and your privacy.
   • The Administrator’s legitimate interests are:

• pursuing claims arising out of business operations or defense against claims;
• conducting statistical activities for marketing purposes;
• taking care of the security of our IT systems;
• carrying out analyses regarding the methods of using the website or its individual parts, as well as the possibilities of making corrections or improvements to the website;
• handling inquiries or complaints using the contact forms;
1. The Administrator processes the following categories of your personal data:

• a. identification data provided by you in the newsletter form, i.e. name, surname and e-mail address.
• b. identification and contact details provided by you in the contact form, i.e. name, surname, company name and e-mail address, as well as all data provided via the contact form;
• c. personal data that you provided to us voluntarily by entering our website, such as the addresses of the internet protocol of visitors to our website, as well as automatically collected so-called collective data. In order to learn more about the collection of collective data by us, please read our information about cookies available on the website https://oxoplast.com/polityka-cookies/
1. The Administrator collects your personal data listed in point 4 above directly from you.
2. Your personal data may be transferred to entities providing delivery or hosting services for IT systems or tools used by the Administrator.
3. We process your personal data for the purposes indicated below for the time specified below. Regardless of the above periods, your data may be processed by the Administrator for the purposes of determining or pursuing by the Administrator civil-law claims as part of business, as well as defense against such claims, for appropriate periods of limitation of such claims, i.e. as a rule no longer than 6 years from the occurrence of the event resulting in the claim.

Name of processing purpose	Description of processing purpose	Legal basis for processing	Processing period
Direct marketing of the Administrator’s products and services	Conducting direct marketing by the Administrator in the form of sending newsletters	Consent (article 6 (1) (a) of the GDPR)	Until consent is withdrawn
Handling of complaints and inquiries	Handling of complaints and inquiries, including those regarding the conclusion or performance of an agreement	Legitimate interests of the Administrator (article 6 (1) (f) of the GDPR) or performance or conclusion of an agreement by the Administrator (article 6 (1) (b) of the GDPR)	The period necessary to handle the inquiry or complaint
Development of statistics for marketing purposes	Allowing the Administrator to develop statistics based on the collected data	Legitimate interest of the Administrator (article 6 (1) (f) of the GDPR).	The period during which the Administrator uses personal data contained in cookies

• Regardless of the above periods, your data may be processed by the Administrator for the purposes of determining or pursuing by the Administrator civil-law claims as part of business, as well as defense against such claims, for appropriate periods of limitation of such claims, i.e. as a rule no longer than 6 years from the occurrence of the event resulting in the claim.
1. You have the right to:
   • request access to the content of your personal data,
   • request to rectify your data,
   • request to remove your data,
   • requests to limit the processing of your data,
   • request to transfer your data,
   • object to the data processing,
   • withdraw your consent for processing at any time without affecting the legality of the processing, which was made on the basis of consent before its withdrawal.
   • You can exercise the above rights by sending an appropriate letter to the following address: ul. Mostowa 30A, 47-220 Kędzierzyn-Koźle, by sending an email to the address of the Administrator’s data protection inspector: iod.zak@grupaazoty.com or by sending an inquiry via the contact form on the website www.oxoplast.com/kontakt/.
2. You have the right to lodge a complaint to the competent supervisory authority (in Poland, the authority is: the President of the Office for Personal Data Protection), if you consider that the processing of your personal data violates the provisions of the GDPR.
3. Providing your personal data collected by the Administrator is voluntary, but failure to provide it (depending on the purpose for which it is collected) may lead to:
   • impossibility to send you the newsletter;
   • impossibility to contact via the contact form;
   • impossibility to use the oxoplast.com website.
4. This clause was updated on 4 February, 2019 and may be subject to further changes. If it is required by law, any information regarding future changes or additions to the processing of personal data described in this clause, which may apply to you, will be provided to you through the appropriate form of communication usually used by the Administrator during contact with you.