ESOTIQ & HENDERSON S.A. with its registered office in Gdańsk, ul. Budowlanych 31C, 80-298 Gdańsk, registered in the Gdańsk-Północ District Court in Gdańsk, 7th Commercial Division of the National Court Register, at KRS No. 0000370553, with NIP: 583-311-72-20, REGON: 221133543, hereinafter the “Data Controller,” is the controller of your Personal Data.

The Data Controller collects your Personal Data (e-mail address only) obtained when you consented to the NEWSLETTER (“Personal Data”):

We collect your Personal Data for the following purposes:

a) to inform you about our marketing activities and to send you commercial information (NEWSLETTER);

b) to send you information about special offers, competitions and the news published on the Website by electronic means (by e-mail).

The Data Controller may transfer the Personal Data to the following third parties for the purposes defined in this document:

1. to its employees for the purpose of their activities connected with sending the NEWSLETTER – after the employees are first communicated the Personal Data safety rules, and primarily the Personal Data Safety Policy of ESOTIQ & HENDERSON S.A. with its registered office in Gdańsk,

2. to entities with whom the Data Controller have signed a framework contract (“Processor”) in order to implement NEWSLETTER assumptions; the Data Controller may in particular transfer your personal data to such entities as: accounting service providers, postal and courier service providers, our marketing partners, IT service providers. These entities will be obligated under contracts signed with the Data Controller to apply appropriate safety, technical and organisational measures to protect Personal Data and process them only in accordance with the law,

3. to supervisory authorities, government authorities and other third parties; where necessary for the performance of the above purposes and for the discharge of legal obligations, Personal Data may be transmitted to supervisory authorities, courts and other government authorities (e.g. tax authorities and law enforcement), independent third-party advisors (e.g. auditors) or service providers.

The Data Controller shall use appropriate safety measures, both technical and organisational, to protect your personal data. Personal Data shall be retained by the Data Controller and/or the Processors only for the time required to complete the purpose for which such data were collected.

You have rights connected with personal data protection. According to applicable data protection legislation, you have the right to complain to a competent authority (e.g. the President of the Data Protection Office or its successor authority).

Furthermore, you have the right to:

1. request access to Personal Data; the data subject shall have the right to obtain from the Data Controller confirmation as to whether or not Personal Data concerning him or her are being processed, and, where that is the case, access to the Personal Data. At your request, the Data Controller shall provide you with a copy of your data that are being processed. For any further copies you request, the Data Controller may charge a reasonable fee based on administrative costs.

2. Personal Data rectification; you have the right to have any Personal Data that concern you and are incorrect rectified. Taking into account the purposes of the processing, you have the right to have your incomplete Personal Data completed, also based on your additional statement,

3. Personal Data erasure (“right to be forgotten”); you have the right to request, on condition that the circumstances provided for by the laws have arisen, to have your Personal Data promptly erased, and the Data Controller must erase such Personal Data without undue delay,

4. restriction of Personal Data processing; in such a case, the Data Controller will, at your request, indicate such Personal Data, and their processing may be restricted to specific purposes only,

5. Personal Data portability; under certain conditions, you have the right to receive the Personal Data that concern you and that are processed by the Data Controller in a structured, commonly used and machine-readable format, and you have the right to transfer such Personal Data to another entity,

6. objection; in certain cases you have the right to object at any time, for reasons connected with your special situation, to the processing of the Personal Data that concern you, and the Data Controller may be obligated to stop processing such Personal Data.

Furthermore, please be informed that:

a) your Personal Data are processed under the voluntary consent you expressed while subscribing for the NEWSLETTER;

b) your consent to Personal Data processing remains valid. You may withdraw it at any time;

c) the Data Controller does not process sensitive data;

d) Personal Data are only processed for the purpose of sending marketing information through the ESOTIQ NEWSLETTER (including information about special offers in ESOTIQ points of sale);

e) the Data Controller does not transfer Personal Data outside the European Union and the European Economic Area countries (Norway, Iceland and Lichtenstein) and Switzerland;

f) the Data Controller allows you to exercise your right of access to the content of your Personal Data and the right to their rectification, erasure, restriction of processing, the right of data portability, the right to object to the processing, the right to withdraw the consent at any time.

For any questions regarding Personal Data or the exercise of the privacy rights, please contact the Data Protection Officer appointed by the Data Controller. Please find below the contact details of the Data Protection Officer: iod@esotiq.com