The confidentiality of your personal data is extremely important for us. We would like to inform you about how we protect your privacy in connection with your use of the Grupa Azoty Group’s website (grupaazoty.com) and the pages in the grupaazoty.com domain (the “Website”).

This privacy policy (the “Privacy Policy”) presents a comprehensive description of how we process your personal data and your rights in connection with such processing.

In matters related to the protection of personal data, Users may contact the Data Protection Officer of the relevant company at the email address specified in Schedule 1.

This Privacy Policy is addressed to individuals who:

1. Intend to grant or have granted the Joint Controllers (as defined below) consent to the processing of their personal data for marketing purposes, including for direct marketing via electronic means (including emails) and telephone marketing (text messages);
2. Want to register as users in the Website;
3. Provide their personal data on the Website in order to contact Grupa Azoty Group companies, send them enquiries, complaints, receive the Newsletter, etc. (“you”, “your”).
4. Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), we inform you that the Grupa Azoty Group companies listed in Schedule 1 are the Joint Controllers of Your personal data.
5. Your personal data will be processed:
   1. exercise or defence of legal claims;
   2. traditional direct marketing (e.g. direct mail);
   3. handling of enquiries and complaints;
   4. use of cookies and profiling for marketing purposes;
   5. ensuring the security of our IT systems;
   6. analysis of the use of the website or its parts, as well as of the possibility of correcting or improving the website;
   7. internal administrative purposes, including statistical ones;
   8. on the basis of your consent (Article 6(1)(a) of the GDPR)  Your personal data may be processed for direct marketing purposes, that is in order to send you the Newsletter or contact you by telephone, solely on the basis of your freely given explicit prior consent. The lawfulness of such processing is based on your consent. Your consent may be withdrawn at any time. It should be borne in mind that withdrawal of consent does not operate retroactively and shall not affect the lawfulness of processing based on consent before its withdrawal.
   9. for the purposes of the legitimate interests pursued by individual Joint Controllers or by a third party (Article 6(1)(f) of the GDPR); processing may be deemed necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. When processing personal data on this basis, we always seek to strike a balance between our legitimate interests and your privacy and the Joint Controllers have analysed the risk of violating your rights or freedoms and have assessed the technical and organisational measures applied for personal data protection. In connection with our website, legitimate interests may include:
   10. processing is necessary for compliance with a legal obligation to which the Joint Controllers are subject (Article 6(1)(c) of the GDPR).
       E.g. in cases where the provision of your data is required by competent public authorities or courts.
6. The following categories of your personal data will be processed on the Website:
   1. identification details given in the Newsletter request form, email address, first name and surname,
   2. identification and contact details given in the contact form, i.e. first name and surname, company name, email address and telephone number,
   3. personal data you provide to us voluntarily by entering the Website, such as the IP addresses of the visitors to our Website, as well as aggregate information, i.e. information on how many visitors have logged on to our website, what websites they visited previously etc. Such data is collected automatically. For more information on how we gather aggregate information, please read our cookies notice available on the Website.
   4. other data provided by you in connection with your use of the Website (IP address, user history)
7. The Joint Controllers collect your personal data listed in item 3 above directly from you.
8. In connection with the Joint Controllers’ activities, your personal data may be entrusted and made available to the following entities:
   1. the website administrator;
   2. providers of IT systems and hosting services;
   3. providers of document archiving services;
   4. courier firms and postal operators.
9. If you withdraw your consent to the processing of your personal data for direct marketing, your data will be erased without undue delay.
10. We will process your personal data for the following purposes for the period of time specified below:
    
    

    Purpose of processing	Description of purpose of processing	Legal basis for processing	Duration of processing
    Direct marketing of Joint Controllers’ products and services	Joint Controllers’ direct marketing activities – sending out Newsletters and commercial information by electronic means (including emails).	Data subject’s consent (Article 6(1)(a) of the GDPR)	Until consent withdrawal
    Traditional marketing	Sending advertising materials to users of the Website by mail	Legitimate interests of the Joint Controllers (Article 6(1)(f) of the GDPR)	The period for which the Joint Controllers process personal data for other purposes
    Handling of complaints and enquiries	Handling of users’ complaints regarding matters related to the operation of the Website, as well as other enquiries	Legitimate interests of the Joint Controllers (Article 6(1)(f) of the GDPR) or the Joint Controllers’ performance of a contract (Article 6(1)(b) of the GDPR)	The period for which the Joint Controllers process personal data for other purposes
    Internal administrative purposes of the Joint Controllers, including statistical ones	Preparation of statistics on the basis of personal data collected	Legitimate interests of the Joint Controllers (Article 6(1)(f) of the GDPR)	The period for which the Joint Controllers process personal data for other purposes
    Profiling for marketing purposes and preparation of statistics for marketing purposes	Enabling the Controller to adapt the offering to customer profile and to prepare statistics on the basis of personal data collected	Legitimate interests of the Controller (Article 6(1)(f) of the GDPR)	The period for which the Controller uses personal data contained in cookies [The cookies storage periods should be specified in the cookies notice.] (after that time the data may be stored if rendered anonymous)
    Exercise or defence of legal claims	Establishment, exercise and defence of claims under civil law by the Joint Controllers in the course of their business activities	Legitimate interests of the Joint Controllers (Article 6(1)(f) of the GDPR)	Until claims become time-barred, that is in principle not more than six years

11. You have the right to:
    1. Request access to your personal data;
    2. Request that your personal data be rectified;
    3. Have your personal data erased;
    4. Request that the processing of your personal data be restricted;
    5. Request that your personal data be ported;
    6. Object to the processing of your personal data;
    7. Withdraw your consent for data processing at any time, without affecting the lawfulness of processing based on consent before its withdrawal. 
12. Under a joint control agreement, the main provisions of which are available on the odo.grupaazoty.com website, the Joint Controllers have agreed that the contact point for the matters pertaining to the protection of your personal data is Grupa Azoty S.A. You may exercise your rights specified above by sending a letter to ul. E. Kwiatkowskiego 8, 33-101 Tarnów, Poland, with the annotation “Personal data – Website”, or by sending an email to the address of the Data Protection Officer of Grupa Azoty S.A.: ##xds.ipgcdl#at#vgjeppodin.rdb##.
13. You have the right to lodge a complaint with the President of the Personal Data Protection Office (to the address: Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland) if you consider that the processing of your personal data is in breach of the GDPR.
14. The provision by you of personal data collected by the Joint Controllers is voluntary, but your refusal to provide personal data may result in (depending on the purpose for which the data is collected):
    1. the Joint Controllers’ inability of to conduct direct marketing addressed to you,
    2. the Joint Controllers’ inability of to send out the Newsletter to you,
    3. inability to respond to your enquiry or complaint.