For shareholders

INFORMATION ABOUT PERSONAL DATA PROCESSING
for persons disclosed in registries kept by the Brokerage Office of PKO Bank Polski (“PKO BP BM”)

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27th, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Regulation), we inform that:

1. Data Administrator:

   The Administrator of your personal data is Powszechna Kasa Oszczędności Bank Polski Spółka Akcyjna (Joint-Stock Company) with registered seat in Warsaw, address: ul. Puławska 15, 02-515 Warsaw, registered in the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Registry, under no. KRS 0000026438, NIP (Taxpayer Identification Number): 525-000-77-38, REGON (Official Business Registry Number): 016298263, initial capital (paid-in capital) PLN 1,250,000,000, infoline: 800 302 302, including PKO BP BM, as an organizational unit of PKO Bank Polski S.A. (“Bank”).

2. Data Protection Inspector

   The Data Protection Inspector has been appointed at the Bank. Address: Data Protection Inspector, ul. Puławska 15, 02-515 Warsaw, e-mail address: iod@pkobp.pl.

3. Personal data categories – information pertains to personal data acquired in a manner other than from the person to whom the data pertain

   The Bank processes the following categories of your personal data: identification data, address data and contact data.

4. Purpose of data processing and legal grounds
   Personal data may be processed by the Bank for the following purposes, in particular:

   • to fulfill the legal obligation involving keeping of registries – pursuant to art. 6 par. 1 letter c of the Regulation,

   • consideration of claims and complaints – pursuant to art. 6 par. 1 letter c and letter f of the Regulation,

   • exercising of rights arising from representation (including power of attorney), sureties – pursuant to art. 6 par. 1 letter c of the Regulation,

   • determinations and pursuit of claims by the Bank in relation to conducted activity, including restructuring, debt collection, enforcement of receivables or defense against claims addressed to the Bank, before law enforcement authorities, judicial authorities, including general courts, administrative courts, the Supreme Court, in administrative proceedings, including tax proceedings – pursuant to art. 6 par. 1 letter f of the Regulation,

   • detection and limitation of financial abuses associated with the activity of PKO BP BM, as well as for the purpose of ensuring the security of storage of the cash funds of PKO BP BM’s clients and conducting investigations – pursuant to art. 6 par. 1 letter f of the Regulation.

5. Sharing of personal data
   Your data may be shared by the Bank with:

   • entities and authorities with regard to whom the Bank is obliged or authorized to share personal data on the grounds of generally applicable legal regulations, including entities and authorities authorized to receive personal data from the Bank or authorized to demand access to personal data based on generally applicable legal regulations, in particular pursuant to art. 149 or art. 150 of the Act on trading of financial instruments,

   • entities to whom PKO BP BM has entrusted the performance of brokering activities or actions related to brokering activity conducted by PKO BP BM,

6. Transferring personal data to a third country

   Your data may be transferred to the government administration of the United States of America in relation to execution of international cash transfers via SWIFT.

7. Period of personal data storage
   Your personal data will be stored for the period:

   • for which registries are kept, and following its conclusion, in relation to PKO BP BM’s legal obligation arising from generally applicable legal regulations,

   • indispensable for pursuit of claims by the Bank in relation to conducted activity or defense against claims addressed to the Bank, on the grounds of generally applicable legal regulations, with consideration of the periods with which claims lapse, defined in generally applicable legal regulations, particularly the Civil Code,

   • of validity of the power of attorney granted to you, and following its expiration, in relation to PKO BP BM’s legal obligation arising from generally applicable legal regulations,

   • for which your right to represent a person disclosed in registries kept by PKO BP BM remains binding. Information concerning data storage periods are available on the Bank’s website under the “GDPR” tab.

8. Your rights
   In relation to processing by the Bank of your personal data, you are entitled to the following rights:

   • right of access to your personal data,

   • right of rectify to your personal data,

   • right to delete personal data (right to be forgotten),

   • right to restrict personal data processing,

   • right to transfer data,

   • right to raise an objection to data processing, including profiling, and for the purpose of direct marketing, including profiling,

   • right to revoke consent in the case where the Bank will processes your personal data based on consent, at any time and by any means, without affecting the legal compliance of processing performed on the grounds of consent prior to its revocation,

   • right to file a complaint to the President of the Personal Data Protection Office, when you find that processing of personal data is in breach of the Regulation’s provisions;

9. Source of data origination – information pertains to personal data acquired in a manner other than from the person to whom the data pertain

   Your personal data may originate from a statutory representative or principal in the case of granted power of attorney, an employer, party to a contract concluded with the Bank, as well as from generally accessible sources, particularly the following databases and registries: PESEL (Personal ID No.), Personal Identity Card Registry, National Court Registry (KRS), Central Register and Information on Economic Activity (CEIDG), REGON (Official Business Registry).

10. Requirement to provide data
    Provision of your personal data is required for realization of the objective specified in par. 4 above, for:

    • keeping of registries by PKO BP BM, and the consequence of not providing your personal data will be the inability by PKO BP BM to keep registries,

    • consideration of claims or complaints, and the consequence of not providing your personal data will be the inability to consider claims or complaints,

11. Automated decision-making, including profiling

    Personal data will not be subject to automated processing, including profiling.