Polityka Prywatności

The purpose of this privacy policy (hereinafter: Policy) is to set out the principles and the terms of processing personal data deriving from natural persons (hereinafter: Users), as well as personal data of other persons, including our business partners and persons representing them, candidates for work and persons who contact us with respect to other issues via post, e-mail, telephone and in person in the registered office of the Data Controller or in any other mode.

The policy also contains information about the rights of data subjects in reference to the processing of their personal data.

Depending on the recipient of the communication, the Administrator of your personal data is the appropriate company indicated below (hereinafter referred to as the Company or the Administrator).

Nexera Sp. z o.o. adress: Al. Jana Pawła II 29, 00-806 Warsaw Nexera Fiber Sp. z o.o. adress: Al. Jana Pawła II 29, 00-806 Warsaw Nexera F2 Sp. z o.o. adress: Al. Jana Pawła II 29, 00-806 Warsaw Nexera F3 Sp. z o.o. adress Al. Jana Pawła II 29, 00-806 Warsaw

Your personal data are processed pursuant to Regulation 2016/679 of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Processing Regulation; Journal of Laws of the European Union L.2016.119.1; hereinafter: GDPR).

With respect to any issues related to the processing of personal data, you can contact the Data Protection Officer designated in the Company by sending an e-mail to the e-mail address, the aforementioned registered office of the Company.

Data Protection Officer: Mikołaj Otmianowski e-mail address: dane.osobowe@nexera.pl

Purposes and Legal Bases of Personal Data Processing, Term of Data Storage

I. Contact in Issues Related to the Company’s Operation Via E-Mail, Chat-Bots, Voice-Bots or Traditional Post:

• We process your personal data and other data provided in the content of correspondence, sourced directly from the sender of the message. • Your data are processed in order to pursue the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR) consisting in: a) servicing of ongoing contacts, including processing of inquiries and offering answers to them; b) establishment, exercise and defence of claims; • Provision of personal data is voluntary yet necessary for receiving an answer. Refusal to provide personal data will result in no possibility of processing the message that was sent and thus its removal. • Personal data are stored:

1. In case of contact via e-mail, traditional post, chat-bot, voice-bot or in another mode: personal data shall be stored for the time when the message sent to us is being processed;
2. In case the data are processed to establish, exercise or defend claims, they shall be stored for a period necessary to meet this purpose.

II. Use of Our Social Networking Sites

• As we wish to remain in touch with you, we have accounts at social networking sites, where you can visit us and interact with us (e.g. leave a comment, like a post or share it). In such case, your personal data are processed. Details about the processing of data as part of social networking sites are presented HERE.

III. Cooperation with Business Partners

• If you are a party to an agreement entered with us or if you intend to enter into such agreement, your data that are processed are contact details and other data necessary to enter into and to execute the agreement. Such data are sourced directly from you. We can source or verify your personal data also with the use of generally accessible registers (Central Registration and Information on Business, CEiDG and the National Court Register - KRS). • Your personal data are processed for the following purposes and based on the following legal bases:

1. Establishment of cooperation and entering into and execution of an agreement binding us (Art. 6(1)(b) of the GDPR);
2. Maintenance of the Data Controller’s accounting documents pertaining to the cooperation, in line with the legal obligation encumbering the Data Controller (Art. 6(1)(c) of the GDPR), resulting, in particular, from the Tax Ordinance of 29 August 1997, the Accounting Act of 29 September 1994 and the VAT Act of 11 March 2004;
3. Pursuing the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR), consisting in: a) performance of actions aimed at improving and coordinating the Data Controller’s work, including maintenance of internal registers (e.g. correspondence records); b) establishment, exercise and defence of claims. • Provision of data is a condition precedent for entering into an agreement, while failure to provide data shall result in no possibility of entering into and execution of the agreement. • Personal data are stored for a period necessary for the performance and settlement of current cooperation or establishment of future cooperation, as well as until the periods resulting from relevant legal provisions have elapsed (i.e. the expiry of tax obligations related to the accounting documents), which may be, in relevant cases, extended by the statute of limitations of civil law claims. If no cooperation has been established, personal data shall be stored until a decision on no cooperation has been made.

IV. Entering into Agreements with Real Property Owners

• If you are a party to an agreement entered into with us or if you intend to enter into such agreement to make a real property available to us where the Company's infrastructure will be located or to connect the real property to the network, the data that we process are necessary for entering into and execution of the agreement. Such data are sourced directly from you. We can source or verify your personal data also with the use of generally accessible registers (e.g. land and building record). • Your personal data are processed for the following purposes and based on the following legal bases:

1. establishment of cooperation and entering into and execution of an agreement binding us (Art. 6(1)(b) of the GDPR);
2. maintenance of the Data Controller’s accounting documents pertaining to the cooperation, in line with the legal obligation encumbering the Data Controller (Art. 6(1)(c) of the GDPR), resulting, in particular, from the Tax Ordinance of 29 August 1997, the Accounting Act of 29 September 1994 and the VAT Act of 11 March 2004;
3. pursuing the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR), consisting in:

a) performance of actions aimed at improving and coordinating the work of the Data Controller, including maintenance of internal registers (e.g. correspondence records);

b) establishment, exercise and defence of claims.

• Provision of data is a condition precedent for entering into an agreement, while failure to provide data shall result in no possibility of entering into and execution of the agreement.

• Personal data are stored for a period necessary for the performance and settlement of an existing agreement, as well as until the periods resulting from relevant legal provisions have elapsed (i.e. the expiry of tax obligations related to accounting documents), which may be, in relevant cases, extended by the statute of limitations of civil law claims. If no agreement has been entered into, personal data shall be stored until a decision on no agreement has been made.

V. Representing Persons, Contact Persons, Employees and Attorneys-In-Fact of Our Clients or Business Partners

• We process your contact details and data related to the position held or relation to the entity on behalf of which you are acting (as a standard, these are: first name and surname, position, place of work, business e-mail and business telephone number, potentially also information indicating authorisation to represent the entity). Such data are sourced directly from you or are received from the entity on whose behalf you are acting. We can source or verify your personal data also with the use of generally accessible registers (e.g. the National Court Register - KRS). • Your personal data are processed for the following purposes and based on the following legal bases:

1. Meeting the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR consisting in:

a) provision of information and contacts necessary for the performance of business, including establishment and performance of cooperation with an entity on whose behalf you are acting, as well as servicing and implementation of actions taken by you;

b) performance of activities aimed at improving and coordinating the work of the Data Controller, including maintenance of internal registers (e.g. correspondence records); c) establishment, exercise and defence of claims.

2. Meeting the legal obligations encumbering us (Art. 6(1)(c) of the GDPR, including the obligation of maintaining accounting documents with respect to cooperation with the entity on behalf of which you are acting, in line with the Tax Ordinance of 29 August 1997, the Accounting Act of 29 September 1994 and the VAT Act of 11 March 2004.

• Provision of data is voluntary, yet failing to provide such data will result in no possibility of cooperating with the entity on behalf of which you are acting.

• Personal data are stored for a period necessary for the performance and settlement of current cooperation or establishment of future cooperation, as well as until the periods resulting from relevant legal provisions have elapsed (i.e. the expiry of tax obligations related to the accounting documents), which may be, in relevant cases, extended by the statute of limitations of civil law claims. If no cooperation has been established, personal data shall be stored until a decision on no cooperation has been made.

VI. Participation in Recruitment

1. If you respond to our job offers: • We process your data to carry out the recruitment process for the position specified in the job offer and to select a proper person for employment, including assessment of qualifications, capacity and skills of the candidate for work. Such data are sourced directly from you. • The legal basis for the processing of personal data within the scope resulting from Art. 22(1) of the Polish Labour Code is our legal obligation (Art. 6(1)(c) of the GDPR); in case you provide personal data within a broader scope than specified in the labour law provisions, the legal basis for the processing of such data for the aforementioned purpose is your consent (Art. 6(1)(a) of the GDPR). We do not request provision of such data, yet submission of such data is tantamount to giving your consent for the processing thereof. • Provision of personal data is voluntary. However, failure to provide data may prevent participation in the recruitment process.• Personal data are stored until the completion of the recruitment process for which they were collected or until you withdraw your consent (whichever takes place first).

2. If you submit your application and there is no recruitment process at that time:

• Your personal data are processed for the purpose of future recruitment processes and selection of an adequate person to be employed at the vacant position, including assessment of qualifications, skills and capacity of the candidate for work.

• The legal basis for the processing of personal data for the needs of future recruitment processes is your consent (Art. 6(1)(a) of the GDPR). Sending the application documents to us is tantamount to giving your consent for the processing of data contained therein.

• Provision of personal data is voluntary. However, failure to provide data may prevent participation in the future recruitment processes.

• Personal data are stored for a period of 1 year, unless the consent has been withdrawn earlier.

VII. Exercise of Rights in Line with the GDPR Provisions

• We process the data submitted by you to examine a request submitted to us in the context of exercise of rights with which you are vested in line with the GDPR provisions, as well as data held by us, necessary for such examination. • Your personal data are processed for the following purposes and based on the following legal bases:

1. Processing a request pertaining to personal data, in line with the legal obligation encumbering the Data Controller (Art. 6(1)(c) of the GDPR resulting from the GDPR provisions, including verification of the identity of person submitting the request;
2. Pursuing the Data Controller’s legitimate interest (Art. 6(1)(f) of the GDPR) consisting in establishment, exercise and defence of claims, as well as processing of potential administrative suits related to the exercise of rights of data subjects.

• Provision of data is necessary to process a submitted request, while failing to do so will result in no possibility of examining it.

• Data are stored for the period of expiry of claims of data subjects, resulting from the exercise of their rights pursuant to Art. 12-22 of the GDPR (i.e. period of expiry of claims on violation of personal assets) and also a period required to process the potential administrative suits related to the exercise of rights of data subjects.

The recipients of your personal data, depending on the purpose of their processing, are associated entities, sub-contractors, post, courier companies, insurance carriers, banks, transport companies and other entities providing services to us (in particular companies offering IT services and technical assistance services, cooperating law firms and tax companies, marketing companies, external auditors and other entities providing services for us) which must have access to the data in order to perform their obligations. Such entities will have access to the data exclusively to perform their tasks and on the as-needed basis. Also authorised state authorities may be given access to your personal data, in particular tax offices.

Exercise of such rights by Nexera depends on the possibility of identifying the person filing the request in order to be sure that it has been filed by an authorised person. The scope of each right and the situations in which it may be exercised result from legal provisions. The exercise of such rights by the Provider depends, in particular, on the legal basis and the purpose of data processing.

You are vested with a right to: • demand access to your personal data, rectification, removal or limitation of data processing, as well as the right to transfer data; • in case when the basis for processing of personal data is our legitimate interest - the right to file an objection at any moment with respect to the processing of data due to causes related to your special situation, • in case when the basis for personal data processing is our legitimate interest consisting in direct marketing - the right to file an objection against the processing of personal data at any moment for the needs of performance of marketing activities. If you give your consent for the processing of personal data or for receiving information from us (e.g. commercial information), you are also vested with a right to withdraw the consents given without affecting the legitimacy of processing or dispatch of information made on the basis of your consent prior to its withdrawal. If we intend to process your data based on a consent, we will inform you thereof in advance and we shall take actions to guarantee the possibility of giving your consent. Giving your consent is always voluntary and not giving your consent has no negative consequences. With respect to the exercise of rights with which you are vested, please contact the Personal Data Protection Officer: Mikołaj Otmianowski, e-mail address: dane.osobowe@nexera.pl. You also have a right the to file a complaint to a supervisory authority, the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.

Your data shall not be used for automated decision-making, including profiling.

We secure your personal data from being illegally shared with unauthorised persons, capture of data by unauthorised persons, destruction, loss, damage or change and the processing of personal data in a mode inconsistent with the GDPR provisions. To secure the personal data, we apply technical and organisational measures meeting the GDPR requirements, in particular the measures listed in Art. 24 and Art. 32 of the GDPR, ensuring confidentiality, integrity and availability of processing of the provided personal data. Entities associated with us, trusted partners and external service providers are liable for processing data in line with the security requirements and privacy protection requirements adopted by us.

Information about the policy on cookies and other technologies of NEXERA is available HERE

We systematically review the Policy in relation to which we reserve the right to make changes in it. If you notice that the content of the Policy requires updates, please let us know.

Date of last Policy update: 12.09.2022.