Introduction As of 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (commonly referred to as "RODO") is in force. RODO applies to an identical extent in all countries of the European Union, thus also in Poland, and has introduced a number of changes to the rules governing the processing of personal data that affect many areas of life, including the use of online services. In this information, we provide a summary of the most important issues concerning the processing of personal data that have taken place since 25 May 2018 in relation to the use of our services. Personal data means information about an identified or identifiable natural person. Archispace sp. z o. o. processes personal data for various purposes, and depending on the purpose, different means of collection, legal basis for processing, use, disclosure and retention periods may apply. When collecting and using personal data, we wish to be transparent about the basis and manner of processing.

Data controller and contact details The data controller is Archispace sp. z o. o. with its registered office in Gdańsk, Kartuska 215 St. If you have any questions regarding this document and the manner and purposes of our processing of your personal data, please contact us at: Archispace sp. z o. o, Kartuska 215 Street, 80-122 Gdańsk, with the annotation ("Administrator"). and via e-mail address: archispace@archispace.pl in order to contact the Data Protection Officer. Basis and purposes of data processing Personal data shall be processed by Archispace sp. z o. o. in particular for the following purposes: 1. to take steps prior to concluding an agreement or to perform an agreement, [based on Article 6(1)(b) and (c) RODO] in order to: a. to take steps prior to entering into a contract at the request of the data subject or to perform a contract to which the data subject is a party and which is necessary for entering into a contract, b. to take steps prior to entering into a contract at the request of persons obtained from chat-type systems on websites c. to comply with a legal obligation incumbent on the Administrator. 2. based on the legitimate interest of Archispace sp. z o. o. [based on Article 6(1)(f) RODO] for the purpose of: a. marketing own products or services, including personalised ones based on the customer's profile, b. asserting or securing claims, c. conducting analyses of the technical quality of the services and equipment provided, d. analysing the customer's preferences or interests, audience analyses or the development of the services provided based on automated processing by the Data Controller. 3. on the basis of a separate consent [i.e. on the basis of Article 6(1)(a) RODO] in order to: a. a. verify the customer's creditworthiness on the basis of information from business information bureaus, in particular the National Debt Register with its registered office in Wrocław, or contained in the Administrator's database, b. provide the customer with information about proposed changes to the Agreement, including Terms and Conditions, confirm the acceptance of a complaint and respond to it by e-mail, c. direct marketing of products or services of entities cooperating with Archispace sp. z o. o, in particular companies of the www.archispace.pl website in accordance with the terms and conditions of the website, d. direct marketing may be carried out by Archispace sp. z o. o by means of electronic communication (e.g. SMS, e-mail).

The period for which personal data will be stored: Data shall be stored until there is a basis for their processing, including: 1. Personal data processed for the purpose of concluding or performing a contract and fulfilling a legal obligation of the Administrator shall be stored for the duration of the contract, and after its expiry for the period necessary for: personal data processed for the purpose of marketing the products or services of Archispace sp. z o. o on the basis of a legitimate legal interest, will be processed until the data subject raises an objection; a. post-sale customer service (e.g. handling complaints), b. securing or asserting potential claims to which Archispace sp. z o. o. is entitled,

c. fulfilment of the Administrator's legal obligation (e.g. resulting from tax or accounting regulations); 2. Personal data, when the basis for data processing is the legitimate interest of the Administrator, will be processed until the existence of this legitimate interest; 3. Personal data processed on the basis of a separate consent will be stored until revoked. **Rights of personal data subjects and the manner of their exercise** Individuals have certain rights concerning their personal data and data controllers are responsible for the exercise of these rights. Where the decision on how and for what purpose personal data is processed is ours, we are the data controller and we provide information below on the rights of individuals and how they can be exercised: 1. The right to access the content of their personal data, i.e. the right to obtain confirmation as to whether the Controller is processing the data and information concerning such processing, 2. The right to rectification of the data if the data processed by the Controller is inaccurate or incomplete, 3. The right to request the Administrator to delete the data, 4. The right to request the Administrator to restrict the processing of the data, 5. The right to data portability, i.e. the right to receive the personal data provided to the Administrator and send it to another controller, 6. The right to object to the processing of the data on the basis of the Administrator's legitimate interest or to the processing for direct marketing purposes, 7. The right to lodge a complaint to the Polish supervisory authority or to the supervisory authority of another Member State of the European Union competent for the place of habitual residence or work of the data subject or for the place of the alleged breach of the RODO, 8. The right to withdraw consent at any time (without affecting the lawfulness of the processing performed on the basis of consent before its withdrawal), 9. The right to obtain human intervention on the part of the Controller, to express one's position and to contest a decision based on automated data processing. The rights mentioned in points 1)-6) and 8)-9) above can be exercised, among others, by contacting the Data Protection Officer archispace@archispace.pl or by contacting Archispace sp. z o. o. (address given at the beginning, with the note: "Personal data protection") **When and how we provide personal data to third parties:** Collected personal data may be shared with entities indicated by law and with entities cooperating with Archispace sp. z o. o.. In this case, we provide for provisions and security mechanisms in the contract in order to protect the data and to maintain standards of data protection, confidentiality and security. Personal data stored by us may be transferred to external entities, including in particular such as: 1. business partners (e.g. agents, call centres), 2. telecommunications companies, 3. debt collection companies, 4. banks, 5. postal operators, 6. carriers, 7. printing and printing companies, 8. business information offices, 9. companies archiving documents, 10. partners providing technical services (e.g. development and maintenance of website IT systems), 11. auditors and other professional advisors, 12. law enforcement, regulatory and other governmental authorities or third parties if required by applicable law (in a manner consistent with such law), 13. third party organisations that otherwise assist us in providing goods or information or services.

Other information concerning the processing of personal data 1. Where personal data is obtained from sources other than the data subject, the Controller shall obtain the personal data from publicly available sources, including, but not limited to, websites, flyers, business cards, publicly maintained business registers (e.g. KRS and CEDiG), the press and/or from other providers of personal data. 2. In the case of obtaining personal data from other sources than the data subject, the Administrator will customarily process such data as: name and surname, address of residence/site, e-mail address, telephone number and/or other data obtained by the Administrator. 3. In the case of obtaining personal data directly from the data subject, the provision of data is voluntary when based on the consent of the person. Failure to provide the data will not have any negative consequences for the person. The provision of data in the case of the conclusion of a contract or in situations stipulated by generally applicable laws is obligatory. The consequence of failing to provide data will be the inability to conclude a contract or perform a task resulting from a provision of the law. 4. Data may be transferred to third countries in compliance with the standards arising from the provisions of the RODO Cookies 1. Archispace sp. z o. o. websites use cookies. These are small text files sent by the web server and stored by the browser's computer software. When the browser reconnects to the site, the site recognises the type of device from which the user is connecting. The parameters only allow the server that created them to read the information they contain. Cookies therefore facilitate the use of previously visited sites. The information collected relates to the IP address, the type of browser used, the language, the type of operating system, the internet service provider, the time and date information, the location and the information sent to the site via the contact form. 2. The data collected is used to monitor and check how users use our sites in order to improve the functioning of the site by providing a more efficient and seamless navigation. We monitor user information using the Google Analytics tool, which records user behaviour on the site. Cookies identify the user so that the content of the site they are using is tailored to their needs. By remembering your preferences, it makes it possible to tailor targeted advertising to you. We use cookies to guarantee the highest standard of comfort on our website, and the data collected is only used internally by Archispace sp. z o. o. to optimise operations. 3. The following cookies are used on our websites: The user has the possibility at any time to disable or restore the option of collecting cookies by changing the settings in the web browser. a. "necessary" cookies to enable the use of services available on the website, e.g. authentication cookies used for services that require authentication on the website, b. security cookies, e.g. used to detect misuse of authentication on the website, c. "performance" cookies, enabling the collection of information on the use of the website, d. "functional" cookies, enabling "remembering" the user's selected settings and personalizing the user's interface, e.g. with regard to the selected language or region of the user's origin, font size, website design etc., e. "advertising" cookies, enabling us to provide users with advertising content more tailored to their interests Changes to this document We recognise that transparency is an ongoing obligation, so we will regularly review and update this document.