PRIVACY POLICY FOR INVESTOR NOTIFICATIONS (NEWSLETTER) OF MERIT S.A.

The Privacy Policy outlines the methods and principles for the processing of personal data of subscribers to the investor notification service for interested investors or shareholders of Merit S.A. with its registered office in Łódź (“Investors”), in particular provided in the form of a Newsletter. The Privacy Policy informs you how we will use the personal data you have entrusted to us. You will also learn from the Privacy Policy what your rights are regarding the processing of your personal data and how to contact us.

The personal data entrusted to us is secure. We undertake to use them in accordance with the provisions of Polish law and in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”).

Personal Data Controller

The controller (controller is the entity which, based on your consent, determines the purpose and manner of the processing of your data) of the personal data provided by you is the company Merit S.A. with its registered office in Łódź, ul. Łąkowa 3/5, 90-562 Łódź, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Łódź-Śródmieście in Łódź, 20^th Commercial Division of the National Court Register under the KRS number 0000362881 (“Company”).

This means that the Company will only hold and use your personal data for the purposes you have agreed to.

How to contact us regarding personal data?

You can contact the personal data officer, who is a representative of the Company, at the following e-mail address: biuro@grupaklepsydra.pl.

We endeavour to make it convenient for you to manage the personal data you have entrusted to us. If, for example, you do not wish to receive e-mails from us, all you have to do is click on the relevant opt-out box, which is included in the body of every e-mail you receive from us.

What data do we process?

We collect basic data that allows us to contact our Investors. These are: name, e-mail address, telephone number, address.

What is the legal basis for processing the data and how long will the data be processed?

We will only process your data in order to enable access to the Newsletter service through which we will communicate information about the Company that is important from the point of view of Investors. The legal basis for the processing of your personal data is your consent to the processing and the requirement to provide the service (Terms and Conditions of the Newsletter Service) (pursuant to Article 6(1)(a) and (b) GDPR).

We send our Newsletters based on your consent to receive e-mails and other notifications and our legitimate interest, which is the right to carry out direct marketing, i.e., to communicate with our Investors in order to present new information.

The provision of personal data to us is not a statutory requirement and you are not obliged to provide such data. The provision of personal data to access the Newsletter service is voluntary, but necessary in order to use this service.

Insofar as you have given the appropriate consent to the processing of your data for the purpose of accessing the Newsletter service, your data will be processed permanently unless you withdraw your consent to its use. Nevertheless, we may store your data after you have withdrawn your consent or after the provision of the service to you has been terminated, if such processing is justified by law (e.g., for accounting and tax purposes) or we anticipate that archiving your data is necessary to protect our rights.

Data processing methods and purposes

We collect personal data provided by Investors in the manner set out above, electronically, and we process such data electronically or manually. We also make use of the sending of automated electronic correspondence.

We use the information you provide for the following purposes:

• In order to provide you with access to the Newsletter service (i.e., on the basis of Article 6(1)(b) GDPR), i.e., as necessary for the performance of the concluded agreement (Terms and Conditions of the Newsletter Service) – in order to send you information on the Company’s activities, e.g., by e-mail or by sms, mms, push messages or messengers of similar use assigned directly to your telephone number (e.g., Messenger, WhatsApp). You may unsubscribe from the Newsletter.
• In order to pursue the following legitimate interests of the Company (i.e., the data controller) or a third party (i.e., on the basis of Article 6(1)(f) GDPR):
  • ensuring the security of the service,
  • internal purposes related to the provision of services and the conduct of business, including; making statistical and analytical measurements,
  • for own direct marketing or promotion of own services,
• In order to perform legal obligations, e.g., for tax, accounting purposes (i.e., on the basis of Article 6(1)(c) GDPR).

The personal data provided by Investors and subsequently collected in the manner described above only enables the Company to identify Investors. The data may be transferred to third parties only if we use subcontractors, especially those who provide analytical or statistical services on our behalf or for our benefit, manage our databases or perform legal or accounting services. These entities are not data controllers and use the entrusted data only for the purposes indicated by us and resulting from the above-described basis.

How do I change or delete information? What rights do I have?

You have the right to request us to provide access to your personal data (we will inform you which of your data we are using), the right to rectification (we will correct your data if you wish), erasure or restriction of processing (you can choose which data we will process or request that we erase all your data), the right to object and the right to have your data transferred to another entity.

We ensure that we secure our IT systems to protect your data. You have the right to obtain a copy of the data you have provided to us.

In connection with entrusting us with your data, you have the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection (UODO).

In order to exercise the above rights, you should contact us in writing by sending a letter to the Company’s address or by sending an e-mail to the following e-mail address: biuro@grupaklepsydra.pl.

If you request the rectification, erasure or restriction of the processing of your personal data, we will inform the recipients of the data to whom the personal data have been disclosed, unless this proves impossible or requires a disproportionate effort, and we will inform you of such recipients upon your request concerning your data.