The administrator of personal data processed in connection with the implementation of the tasks referred to in art. 12-13 of the Act of 5 September 2008 on the commercialization of the State Public Company "Poczta Polska" and in the Act of 21 April 2005 on subscription fees is Poczta Polska Spółka Akcyjna with its registered office in Warsaw at ul. Spanish families 8, 00-940 Warsaw.

Contact with the Personal Data Protection Inspector: Data Protection Inspector Poczta Polska SA, ul. Spanish families 8, 00-940 Warsaw, e-mail address: inspectorodo@poczta-polska.pl

1. Personal data obtained in connection with the implementation of services may be processed for:

• their implementation (detailed information on the purpose of processing personal data, category of processed personal data, their sources and the period or criteria for determining the period of processing this data are available in the regulations of individual services made public. In the case of services that do not have separate regulations, personal data are processed to the extent necessary for their implementation on the basis of the contract concluded with the sender),,

• conducting complaint and complaint proceedings,

• issuing invoices and accounting documents in order to fulfill the obligations arising from the provisions of tax and accounting law,

• findings, defends and pursuing claims (including debt collection or sale),

• fulfillment of legal obligations incumbent at Poczta Polska, arising from the Act of 1 March 2018 on counteracting money laundering and financing of terrorism - until these obligations are fulfilled,

• presentation of a parcel sent from abroad for customs control and notification of goods in it placed for the procedure for allowing the postal trading and service of a parcel sent from abroad intended for a further customs procedure implemented by the addressee,

• research on opinions, needs and satisfaction of customers regarding products and services, subject to anonymity of the results of the research,

• performing internal audit and control activities (in particular including verification of the quality of services, process efficiency, security of postal trade, detection of abuse and preventing them),

• document archiving,

Based on art. 6 para. 1 lit. B, C, D, F GDPR.

Personal data will be stored for the period:

• service implementation,

• 3 years for the documentation produced and collected in connection with the implementation of the service, including evidence of posting and receipt evidence, quantitative and valuable statements of sent parcels, records of accepted and issued parcels (from the year following the year after which the parcel was sent) in accordance with the relevant archival category specified in a uniform material list of Poczta Polska SA

• necessary to carry out complaints and in the case of the case of a complaint for a period of 5 years (from the year following the year in which the complaint was completed) in accordance with the relevant archival category specified in the uniform material list of the file of Poczta Polska SA (in the case of the separation of selected documentation under archival expertise, for archival materials, the storage period will be not longer than 25 years, in accordance with the ordinance. Minister of Culture and National Heritage of October 20, 2015 on classifying and qualifying documentation, transferring archival materials to state archives and lack of archival documentation),

• storage of evidence - in the case of a public service of registered electronic service (PURDE) for 36 months from the date of issuing evidence, and in the case of a public hybrid service (PUH) for 18 months from the date of posting,

• resulting from the provisions of tax and accounting law for financial and accounting documents (applies to persons receiving an invoice or other accounting document),

• after which the claims expire,

• 5 years in the event of a customs declaration by Poczta Polska SA, i.e. a presentation sent from abroad for customs control and notification of goods placed in it for the procedure for allowing postage and service of a parcel sent from abroad intended for a further customs procedure carried out by the addressee (starting from the year after which the case was completed) specified in a uniform material list of Poczta Polska SA,

• 10 years in the case of complaint proceedings (starting from 1 January of the following year from the date of termination of the case) in accordance with the relevant archival category specified in a uniform material list of Poczta Polska SA, and in the case of the separation of selected documentation as part of archival expertise, to the category of archival materials, the storage period will be no longer than 25 years, in accordance with the Regulation of the Minister of Culture and National Heritage of October 20, 2015 in the case classifying and qualifying documentation, transferring archival materials to state archives and lack of archival documentation,

• Until the objection is raised, if the basis for the processing of personal data is the legitimate interest of Poczta Polska SA

• Not longer than for a period of five years from the first day of the year following a year of regulation of all claims or their termination in a different way.

2. Personal data of those obliged or exempt from paying subscription fees will be processed for the purpose of implementing tasks resulting from the Act of 21 April 2005 on subscription fees pursuant to art. 6 para. 1 lit. C GDPR.

Removal of personal data of natural persons after deregistration of the receiver takes place after 5 years from the end of the calendar year in which this receiver was de -registered, provided that there is no debt in subscription fees and when the proceedings regarding arrears in paying subscription fees or enforcement proceedings are pending. In the case of repayment of debt in subscription fees or termination of pending proceedings, the removal of personal data will take place after 5 years from the end of the calendar year in which the obligation has expired.

3. Visual monitoring

Postal facilities in which vision monitoring (Czech TV) is used to protect persons and property (pursuant to Article 6 (1) lit. f GDPR), are properly marked at the entrance. The image is recorded and stored up to 3 months (unless it provides evidence in the proceedings conducted by law enforcement authorities, then this period is extended until its final ending) and used in the event of the need for security incidents.

A source of personal data:

• people using the services of Poczta Polska SA is the sender (e.g. parcel, message, postal parcel, Purde or PUH) to the extent necessary to provide a specific service,

• persons using Purde and Puh is the minister competent for computerization and the minister competent for the economy, in accordance with the Act of November 18, 2020 on electronic delivery,

• In the case of receipt on a mobile device, parameters such as: Xiy point coordinates, point of marking the point, strength and pressure as well as approximate geolocation data, are recorded,

• Subscribers (persons registering the RTV receiver), the register of the universal electronic population registration system (PESEL) on the principles set out in the Act of 24 September 2010 on population records (Poczta Polska SA, verifies or the data categories in the scope of: name, name, Date birth), and the National Broadcasting Council (in the scope of information on the redemption of the arrears in the payment of subscription fees, interest for delay in their payment and the fee imposed in the event of the use of an unregistered radio or television receiver and interest for delay in its payment),

• In connection with the presentation of a parcel sent from abroad for customs control and notification of goods placed in it for the procedure for allowing postage and service of a parcel sent from abroad intended for a further customs procedure implemented by the addressee is the sender, country operator and the National Tax Administration in the scope of a certified customs declaration,

• processed for determining, defending and pursuing claims may be publicly available sources (i.e. CEIDG, KRS, MSIG, KRZ, EUKW, Economic Information Bureau, Credit Information Bureau), PESEL register, REGON Register, authorities conducting enforcement proceedings (civil and administrative), administrative, administrative, court -administrative, court, bankruptcy, repair. restructuring and criminal proceedings. Personal data categories include the current data contained in the statement from these registers and the information contained in the documents confirming the existence of the claim.

Providing personal data is voluntary but necessary to use the services provided by Poczta Polska SA and to consider and settle applications, applications and other speeches.

The obligation to provide personal data may result from the law: the Act of 21 April 2005 on subscription fees and the Act of 1 March 2018 on counteracting money laundering and financing of terrorism.

The supervisory authority, competent for data protection, to which the complaint is entitled to, is the President of the Office for Personal Data Protection ul. Stawki 2, 00-193 Warsaw.

The recipients of personal data may be:

• the sender (receiving the recipient of the parcel if they use the options for confirming the opposite or electronic confirmation of receipt (EPO - containing, among others, the coordinates of the Xiy point, the time of selection of the point, strength and pressure, approximate geolocation data), in the case of proof of receipt in the PURDE service, and also in connection with the answer given to the submitted complaint, if it is justified), if it is justified)

• postal agents (if you use the services of a postal agency),

• Subcontractors of Poczta Polska SA in the case where the service is implemented with the participation of the processing entity (sorting, movement, delivery of shipments, service of the ICT system),

• Other postal operators in order to provide information on changing the address (based on your consent) and to provide returns to the relevant postal operators who included information on the parcels confirming the receipt of their fee for the postal service (pursuant to the provisions of the Act of 23 November 2012 Postal Law),

• other providers of registered electronic service service in the event that the addressee of the parcel sent as part of the PURDE has an address for electronic service at a given supplier,

• payment service providers in the case in which the service is provided through another payment service provider within the meaning of the Act on payment services,

• National Tax Administration and the European Commission in order to submit a customs application by Poczta Polska SA,

• Tax authorities (in the case of collecting an advance on personal income tax on pensions and disability pensions received from foreign institutions by Polish tax residents in accordance with relevant legal provisions),

• General Inspector of Financial Information or Prosecutor's Office (in the case of performing obligations arising from the Act of 1 March 2018 on counteracting money laundering and financing of terrorism),

• entrepreneurs dealing with the provision of services related to the management of claims and debt collection of claims, debtors' registers (BIG, KRD),

• Entrepreneurs dealing with the provision of services related to the management of claims and debt collection of claims, legal services, advisory and audit services, buyers of debt, debtors' registers (i.e.: KRZ, Economic Information Bureau, Credit Information Bureau), bodies conducting enforcement proceedings (civil and administrative and administrative), judicial, court -administrative, administrative, administrative, bankruptcy, administrative, bankruptcy, administrative, bankruptcy, administrative, bankruptcy, administrative, administrative, administrative, administrative, administrative, administrative, bankruptcy, administrative, administrative, bankruptcy, administrative, administrative, administrative, bankruptcy, administrative, administrative, administrative, administrative, bankruptcy repair, restructuring and criminal proceedings, tax administration bodies and other state bodies, as well as other entities on the basis of legal provisions,

• entities providing audit services, advisory, legal assistance, research agencies acting on behalf of and for Poczta Polska SA,

• Heads of tax offices in the event of the need to enforce subscription fees, as well as court bodies as part of conducted proceedings,

• The National Broadcasting Council based on the Act of 21 April 2005 on subscription fees in order to discontinue the arrears in the payment of subscription fees, interest for delay in their payment, and the fee imposed in the event of the use of an unregistered radio or television receiver and interest for the delay in its payment,

• Telewizja Polska Spółka Akcyjna with headquarters in Warsaw (TVP) in connection with the access of the Subscriber or a person exempt from the obligation to pay subscription fees to the VOD website conducted by TVP (transfer of data to TVP is carried out only if the consent is given by the person subject),

• State Archives - in the case of creating archival materials intended for perpetual storage,

• Control authorities (in the event of the control of a given operation of the processing of personal data by NIK, UKE or other authorized authority).

Personal data may be transferred to a third country, i.e.

• postal operators in the case of foreign shipments (country of purpose or posting) for:

• service implementation,

• obtaining information necessary to consider the complaint on the basis of the World Postal Convention (drawn up in Dausa on October 11, 2012, Journal of Laws of 2015, item 1522),

• postal operators and banks in the case of foreign messages (country of purpose or granting) in order to:

- service implementation,

- obtaining information necessary to consider the complaint,

• on the basis of the World Postal Convention (drawn up in Daesa on October 11, 2012, Journal of Laws of 2015, item 1522) and pursuant to the Act of 19 August 2011 on payment services,

• customs authorities in the country of destination (in order to fulfill the obligation imposed on Poczta Polska SA as a data administrator on the basis of legal provisions),

• The United States of North America based on the decision of the European Commission of July 10, 2023, confirming the adequate degree of protection, provided by the "EU-US data protection framework" (EU-Us Data Privacy Framework), in connection with the administrator's use of cloud solutions provided by Microsoft. Wykaz podmiotów, które przystąpiły do programu „Ram ochrony danych UE-USA” dostępny jest pod adresem: Participant Search (dataprivacyframework.gov)

• access to personal data. In order to exercise this right, you must submit an application for information whether Poczta Polska SA processes your personal data. Wniosek powinien zawierać dane umożliwiające identyfikację wnioskodawcy: w przypadku korzystania z usług Poczty Polskiej SA: imię i nazwisko, adres a także opcjonalnie dodatkowo: numer telefonu, adres e-mail, rodzaj usługi: przesyłka listowa, przesyłka paczkowa, przesyłka kurierska, przekaz pieniężny, usługa płatnicza, wpłata na rachunek bankowy, usługi filatelistyczne, skrytka pocztowa, inne – w zależności od usługi, której dotyczy wniosek. In the case of obliged persons or exempt from paying subscription fees: name and surname, PESEL number and INI number (the subscriber's 8-digit identification number); In the absence of INI: name and surname, PESEL number and address. Note: In the case of archival documentation, the right to access personal data (i.e. confirmation of whether personal data is processed and obtaining copies of this data) occurs to the extent that personal data subject to sharing may be determined by means of existing registration measures.

• to rectify personal data. At the same time, in the case of using the services of Poczta Polska SA SA, the implementation of this right is carried out by requesting a change in the contract for the provision of return on return, change of address, change of the addressee within the time limit resulting from the Postal Law. In the case of obliged persons or exempt from paying subscription fees, information on changing personal data is made on a separate form, available in post offices and on the Poczta Polska website SA in the RTV subscription tab.

• to delete personal data (the right to be forgotten). In order to exercise this right, the process to which the application and circumstances justify the deletion of data relate, e.g. data, are no longer necessary to implement the complaint process for which they were collected and there are no legal grounds for further data processing (archival periods have passed). The right to delete personal data will only be implemented in the case in which Poczta Polska SA will not have legal grounds for further data processing. Personal data may not be deleted, e.g. in the case where the processing of your personal data is necessary to perform the service of paying subscription fees or for archival purposes.

• to limit the processing of personal data. In order to exercise this right, you should indicate the process to which the application and the occurrence of one of the conditions specified in art. 18 GDPR.

• for transferring personal data. In order to exercise this right, you should apply for the Personal Data of Personal Data, which has been provided by you by Poczta Polska SA, the right to transfer personal data will only be implemented in the case in which Poczta Polska SA processes your personal data on the basis of consent or contract and in an automated manner.

• until withdrawing consent. If the processing of your personal data takes place on the basis of consent (Article 6 (1) lit. and GDPR), it may be withdrawn at any time (this will not affect the lawfulness of the processing that was carried out before the withdrawal of such consent). The consent should first be withdrawn in the manner indicated during its expressing (e.g. to a dedicated e-mail address). In the case in which you do not remember the way you can withdraw your consent, the process in which consent has been obtained, e.g. consent to future recruitment, should be indicated.

• to oppose. In order to exercise this right, you must object to the processing of your personal data in the event that personal data is processed for the purposes of direct marketing. In special situations, you may object to the processing of personal data (including profiling), if the basis for their processing is the performance of a task implemented in the public interest or legitimate interest of Poczta Polska SA (in such a situation your personal data can be processed only if you demonstrate that there are valid legally justified interests that will be superior to your interests, rights and freedom or a basis for establish claims).