Information clause on the processing of personal data of persons
contacting Poltreg S.A.

In accordance with Regulation 2016/679 of the European Parliament and the
(EU) Council of 27 April 2016 on the protection of natural persons with regard to
the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/WE (General Data Protection Regulation), hereinafter
referred to as ‘GDPR’, pursuant to Article 13 of the GDPR, POLTREG S.A., with
its registered office in Gdańsk (hereinafter referred to as ‘POLTREG’), would
like to inform you about the principles of processing your personal data by
POLTREG in connection with your contacting POLTREG with the use of contact
details on the website of POLTREG, and on your rights in this respect:

1. The Controller of your personal data is POLTREG S.A., with its registered
   office at ul. Botaniczna 20, 80-298 Gdańsk, entered into the Register of
   Businesses of the National Court Register kept by the District Court
   Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court
   Register, under KRS number 0000637215, NIP 9571079577, REGON
   361945318, with its share capital amounting to PLN 466,344.80, fully paid
   up.

In matters concerning the manner and scope of processing your personal data
by the Controller, as well as in matters concerning your rights, you may contact
the Controller via e-mail: office@poltreg.com, or in writing by sending a letter to
the following address: POLTREG S.A., ul. Botaniczna 20, 80-298 Gdańsk.

1. Your personal data in the form of full name, e-mail address, contact
   phone number, as well as other data provided voluntarily will be
   processed by the Controller for the following purposes:
2. to contact you, including providing information and answers to your
   questions – the legal basis for processing is Article 6(1)(a) of the GDPR;
3. to pursue the legitimate interest of the Controller in case of legal need to
   prove facts or to demonstrate the performance of obligations (i.e. defence
   against possible claims against the Controller, or for the purpose of
   pursuing claims by the Controller) – the legal basis for processing is
   Article 6(1)(f) of the GDPR;
4. Your personal data may be transferred to the following entities:
5. entities having a right to contact you, including to provide information and
   answers to your questions;
6. entities having a right to obtain data under the applicable law, e.g. courts
   or law enforcement authorities;
7. entities which the Controller uses to maintain its IT infrastructure.

Regardless of the purpose of data processing, only authorised employees or
partners of the Controller and subcontractors of the Controller’s services with
whom the Controller has entered into data processing agreements may access
your personal data;

4. Your personal data processed in order to contact you, including to provide
   information and answers to your questions, will be processed for this
   purpose until you have requested erasure of your data, restriction of the
   scope of processing, objected to data processing, or withdrawn your
   consent to data processing.

Your personal data processed by the Controller in order to pursue the
Controller’s legitimate interest in case of legal need to prove the facts or to
demonstrate the fulfilment of obligations (Article 6(1)(f) of the GDPR) will be
processed for this purpose for the period of limitation of possible claims made
by or against the Controller in connection with contacting you and providing
information and answers to your questions.

5. You have the right to access your personal data and the right to demand
   rectification, erasure or restriction of processing, as well as the right to
   data portability, the right to object to processing and the right to withdraw
   your consent at any time without affecting the lawfulness of the
   processing performed on the basis of your consent before its withdrawal;
6. You have the right to lodge a complaint with the supervisory authority for
   the protection of personal data, i.e. the President of the Personal Data
   Protection Office, address: ul. Stawki 2, 00-193 Warsaw, if you believe
   that the processing of your personal data violates the provisions of the
   GDPR;
7. The provision of your personal data including your full name, e-mail
   address and contact phone number is necessary in order for the
   Controller to be able to contact you and provide you with information and
   answer your questions.

The provision of other personal data is voluntary;

8. Your personal data will not be processed in an automated manner,
   including profiling;
9. We do not intend to transfer your personal data to a third country or an
   international organisation.