Information clause for Partners, Suppliers and their representatives

Basic information on the processing of your personal data by an entity of the KRUK Group arising from Article 13(1) and (2) and Article 14(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons in relation to the with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as "RODO").

What kind of data are we talking about?

Personal data is information about an identified or identifiable natural person. First and foremost, it is data that allows you to be identified, such as your name and surname; contact data: phone number, e-mail address; official position; data on your business activities.

Administrator of personal data

The administrator of your personal data is that entity of the KRUK Group with which you are bound by a legal or factual relationship, consisting in particular of: employment with the Partner/Supplier,
in performing functions in the bodies of the Partner/Supplier and representing the Partner/Supplier. This entity may be:

• KRUK S.A., with its registered office in Wrocław (53-612), 3 Bolkowska Street,
• PROKURA Niestandaryzowany Fundusz Wierzytelności Fundusz Inwestycyjny Zamknięty (formerly: Prokura NS FIZ) with its registered office in Wrocław (53-612), 3 Bolkowska Street,
• Presco Niestandaryzowany Fundusz Wierzytelności Fundusz Inwestycyjny Zamknięty (formerly: P.R.E.S.C.O. Investment I NS FIZ) with its registered office in Wrocław (53-612), 3 Bolkowska Street,
• KRUK Towarzystwo Funduszy Inwestycyjnych S.A. with its registered office in Wrocław (53-612), 3 Bolkowska Street,
• Kancelaria Prawna Raven P. Krupa Spółka komandytowa with its registered office in Wrocław (53-612), 3 Bolkowska St.

You can address your inquiry to each of the above Administrators by directing it to the address indicated above or to the e-mail boxinfo@kruksa.pl , indicating the name of the KRUK Group entity, regarding which you are contacting.

Data Protection Officer

We have appointed a Data Protection Officer whom you can contact on all matters relating to the processing of your personal data and your rights thereunder. You can write to him at: Data Protection Inspector, 3 Bolkowska St, 53-612 Wrocław or contact him by e-mail:dpo@kruksa.pl indicating the name of the KRUK Group entity you are contacting.

Why and on what basis do we process your personal data?

Your personal data as a party to the contract and the person executing the contract, representative, proxy or contact person may be processed by us:

• to the extent necessary for the conclusion and performance of the contract between the Administrator and you as a Partner/Provider who is a party to the contract (legal basis: Article 6(1)(b)
  RODO), in other cases between the Administrator and you as the person who represents the Partner/Supplier or you are the designated contact person (legal basis: art. 6(1)(f) RODO),
• in order to fulfill the Administrator's legal obligations (legal basis: Article 6(1)(c) RODO), i.e. in order to prevent money laundering and terrorist financing - an obligation that stems from the AML Act and Financing of Terrorism (AML), in order to carry out the obligations imposed by national and EU sanction laws - this is an obligation that arises from the provisions of the Law on Special Arrangements for Counteracting Support for Aggression against Ukraine and for the Protection of National Security, and  in order to apply the adopted accounting principles - this is an obligation that arises from the provisions of the Law on Accounting,
• in order to realize the legitimate interests of the Administrator (legal basis: art. 6(1)(f) RODO), viz:

• preparing statistics and reports for its own purposes and within the group of companies,
• handling complaints and establishing, asserting or defending claims,
• ensure the safety of the Administrator's persons and property, including ensuring security within the scope of assigned tasks, in particular the prevention of abuse,
• verify that you are an individual who is a representative or beneficial owner of a company listed on international sanctions lists in connection with the Administrator's regulations,
• verification of the credibility of the counterparty, partner, supplier, i.e. implementation of necessary actions in the form of assessment of risks (legal, financial, image and reputational) before concluding a contract, after concluding a contract, during the execution of a contract, or extending the scope of a contract, for the period necessary to make such an assessment

•  for other activities, such as when we have your consent to process your data (legal basis: Article 6(1)(a) of the RODO).

How long do we keep your personal data?

The period of processing of your personal data by the Administrator depends on the purpose of the processing. It results, in the case of a contract, usually from:

• the duration of the contract,
• the period of limitation of claims arising from the contract,
• requirements of generally applicable law (e.g. 5-year obligation to store accounting documents, counting from the close of the fiscal year),
• realization of the Administrator's legitimate interests.

To whom may we transfer your personal data?

Your data may be shared with entities supporting our operations, such as companies of the KRUK Group, entities providing legal and accounting services, telecommunications operators, entities providing postal and courier services, entities supporting our IT infrastructure, our consultants or auditors and law enforcement agencies, as well as other authorities and entities, if the obligation to provide the data results from the law, such as the General Inspector of Financial Information (GIIF), the National Tax Administration (KAS), the Office of the Financial Supervision Commission (UKNF) and the Competent Authority for the Central Register of Beneficial Owners.

Do you have to provide us with your personal data?

Your provision of personal data is voluntary, but it is a prerequisite for the execution of the contract or for taking action prior to the conclusion of the contract. If you do not provide personal data, it will not be possible to execute the contract or take pre-contractual actions.

From whom may we receive your data?

In principle, we receive your data directly from you as a result of you providing it in the relevant contractual provisions. In some situations, we obtain your personal data in a manner other than directly from you, e.g. someone else provides you as a contact person, e.g. for the performance of a contract. We may obtain your data from business information registers and other publicly available information sources.

Profiling and automated decision-making

We would like to inform you that in the course of our activities your data will be processed by automated means, but not in the form of profiling. We do not make automated decisions in relation to you.

Transfer of your personal data outside the European Economic Area (EEA)

We use suppliers and partners outside the EEA and therefore it is possible to transfer personal data to countries outside the EEA. Such transfer of personal data may take place on the basis of a decision finding an adequate level of protection or subject to appropriate safeguards (Articles 45, 46 of the RODO). Information on EU Commission decisions finding an adequate degree of protection is available here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

What rights do you have in relation to your data and how can you exercise them?

In our business, we guarantee that you can exercise your rights under the RODO.

Under the RODO, you have the right to:

• to receive information regarding our data processing and a copy of your data (Article 15 RODO),
• to rectify your data if it is incorrect, such as outdated or incomplete (Article 16 RODO),
• erasure of data ("right to be forgotten"), in situations described in Article 17 RODO,
• to restrict data processing (Article 18 RODO),
• lodge an objection (Article 21 RODO),
• lodge a complaint to the supervisory authority in charge of personal data protection,
  i.e. the President of the Office for Personal Data Protection (Article 77 RODO).

Where the basis for the processing of your personal data is consent, you may withdraw it at any time. However, this will not affect the legality of the use of your data by the KRUK Group entity to which you gave such consent, prior to the withdrawal of such consent.

If you wish to exercise the above rights, you may submit your request to us via:

• e-mail to: info@kruksa.pl
• by telephone by calling: 800 700 020
• by regular mail to the address: KRUK S.A., ul. Bolkowska 3, 53-612 Wrocław, indicating the name of the KRUK Group entity about which you are contacting us.