Regulations

Information regarding the processing of personal data of users of our websites or mobile applications:

Who is the personal data controller:

Benefit Systems S.A. with its registered office in Warsaw, at Plac Europejski 2, 00-844 Warsaw (hereinafter "we" or "Benefit Systems").

If you are a user of the MyBenefit System and use HR tools, submit declarations or requests for your employer, or use other similar features, your employer is the controller of the personal data processed within these features. To obtain information regarding this processing, please contact your employer directly.

How to contact us: You can contact us in the following ways:

• via the contact form;
• by email: daneosobowe@benefitsystems.pl; and
• by mail at: Pl. Europejski 2, 00-844 Warsaw with the note "Personal data".

We have appointed a Data Protection Officer, whom you can contact regarding all matters related to our processing of your personal data. You can do this by sending an email to: iod@benefitsystems.pl or by mail to: Benefit Systems S.A., Pl. Europejski 2, 00-844 Warszawa, with the note "IOD".

What personal data we process and where we get it from:

‍We will process the personal data that you provide, leave behind, or to which we may gain access in connection with your use of our websites or mobile applications.

We may also process your data that we have received from your employer (e.g., to set up your account in the MyBenefit System).

We may also receive your data from entities that offer you additional services in connection with your account on our websites and mobile applications, or from third-party authentication service providers (e.g., Facebook, Apple).

Furthermore, if you have provided them to us, we may process your child's personal data.

The data we process includes, in particular:

• data provided by you or your employer during the account registration process on our websites and mobile applications, as well as during your use of our websites and applications;
• data regarding your activity on our websites and mobile applications (e.g., data on visited pages, tabs, time spent on them, etc.);
• if you use the facility search engine and enable geolocation, we will process your geolocation data to show you facilities located near your current location;
• if you upload a photo of yourself or your child to our MultiSport application in order to obtain

Confirmed Identity, we will process them to provide you or your child with the Confirmed Identity functionality and to return the photo to your email address if you wish to use a facility's services in the event that a QR code or token number cannot be generated in the MultiSport application;

• data regarding the device you use to access our websites or mobile applications: IP address, data stored in cookies or similar technologies (see: "Cookie Policy"). We also process data including the content of HTTP requests sent to our server by your device (URL, IP address, browser data, date and time of the request, HTTP response code, error information, cookie ID, viewed page resources). Data collected in this way is saved in server logs.

How we process personal data:

‍We will process your personal data and, if you have provided them to us, the personal data of your child, for the following purposes:

• providing access to or maintaining an account on our websites and mobile applications and enabling the use of services available on our websites and mobile applications (including enabling purchases, delivery, and billing of orders in the MyBenefit System or on the MultiLife Platform) – as this is necessary for the performance of the contract concluded between you and Benefit Systems (legal basis – Art. 6(1)(b) of the GDPR);
• if we collect special categories of data or transfer such personal data to third parties in order to provide you with a service, we process your data based on your explicit consent (legal basis – Art. 9(2)(a) of the GDPR). Providing this data is always voluntary, but it may be necessary to use a specific service;
• if you are a participant in the MultiSport or MultiLife Program, we provide you with services related to the use of the MultiSport or MultiLife Program because you have given us your consent, which may also be expressed through your explicit enrollment in the Program directly with us or through your employer (legal basis – Art. 6(1)(a) of the GDPR);
• related to the fulfillment of our legal obligations – applicable laws may impose obligations on us that require us to process your personal data, particularly regarding tax and accounting requirements (legal basis – Art. 6(1)(c) of the GDPR);
• server administration, ensuring its security, for statistical purposes, and to facilitate the use of our websites and mobile applications based on our legitimate interest in improving the functionality of the services we provide electronically (legal basis – Art. 6(1)(f) of the GDPR);
• pursuing, establishing, and defending against claims. We act based on our legitimate interest in being able to pursue or defend against claims (legal basis – Art. 6(1)(f) of the GDPR or Art. 9(2)(f) of the GDPR in the case of special categories of personal data);
• related to marketing activities - we may process your personal data: i) for the purpose of conducting marketing communication, including sending commercial information and presenting offers, in connection with the realization of our legitimate interest consisting of presenting you with marketing content, including content tailored to you based on profiling, in connection with your consent to use your chosen communication channel for this purpose; ii) for the purpose of conducting online marketing activities, in connection with the realization of our legitimate interest consisting of presenting advertisements and offers, including those tailored to your potential needs and interests based on profiling, in connection with your consent to the use of cookies or similar technologies or – where applicable - in connection with your consent to our use of your location information for marketing purposes; iii) for the purpose of conducting analyses and statistics for marketing needs and researching satisfaction with our services, in connection with the realization of our legitimate interest consisting of improving the quality of our customer service and enhancing our available products and services (legal basis – Art. 6(1)(f) of the GDPR).

How long we process personal data:

‍After you finish using our websites or mobile applications, we process your data for the period during which it is stored in server logs.

If you have an account on our websites or mobile applications, we store your data until your account is deleted.

Where we process your data for purposes related to the fulfillment of our legal obligations, we do so for the time necessary to fulfill those obligations, in particular as required by applicable regulations.

Where we process your personal data based on our legitimate interest, we will do so until you effectively object, unless it is no longer necessary for the realization of our legitimate interests (e.g., the statute of limitations for claims has expired).

Where we process data based on consent, we will process it no longer than until such consent is withdrawn.

Is providing data mandatory: As a rule, providing personal data is not your obligation, but it may be necessary to use the services provided by Benefit Systems, e.g., to enter into a contract with us. Failure to provide data may, in some cases, result in our inability to provide services. Our forms used to collect data clearly indicate which data is required.

Do we make automated decisions: We do not make decisions about you based solely on automated processing of your information that would produce legal effects or similarly significantly affect you.

Who we share your data with: Your personal data may be shared with the following entities: Benefit Systems Group entities, entities providing hosting and maintenance services for our websites and mobile applications, entities providing ICT services and IT support and security services, entities providing data storage and media destruction services, entities providing services related to customer support and other stakeholders (e.g., couriers, payment operators) and those supporting our marketing activities, legal advisors and audit firms, as well as your employer. Your data may also be shared with entities cooperating with us that offer you additional services in connection with your account in our websites and mobile applications (e.g., consultants and partners whose services you access through our websites or mobile applications), and social media operators.

Your data may also be transferred to public authorities in cases provided for by law.

If you use the functionality to share a Virtual Kids Card with other users registered in our MultiSport application, your child's personal data will be disclosed to those users you have specified.

Do we transfer your data outside the European Economic Area:

As a rule, your personal data is not transferred outside the European Economic Area (EEA). Some data recipients (e.g., technology solution providers) may process it in third countries.

We make every reasonable effort to ensure that the transfer of data to these entities is lawful.

If the European Commission has not issued an adequacy decision for a specific third country confirming an appropriate level of personal data protection, we ensure that data transfers are carried out based on other legal safeguards, such as standard contractual clauses or codes of conduct. You may contact us to obtain a copy of the implemented safeguards. Contact details can be found above in the section How to contact us.

Your rights:

The right to request access to personal data; the right to request rectification of personal data; the right to request erasure of personal data; the right to request restriction of processing of personal data; the right to object to the processing of personal data; the right to data portability; the right to withdraw consent to the processing of personal data; and the right to lodge a complaint with the President of the Personal Data Protection Office.

You can find more information about how we process your personal data in our privacy policy: https://www.benefitsystems.pl/polityka-prywatnosci/