PERSONAL DATA PROCESSING INFORMATION CLAUSE

Due to the implementation of the requirements of the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (General Data Protection Regulation “GDPR”), we would like to inform you about the principles of processing your personal data and your rights related thereto.

The following rules apply as of May 25, 2018.

The Controller of your personal data is: Bielenda Group S.A. (formerly Bielenda Kosmetyki Naturalne S.A.) declares that it has the status of a large enterprise within the meaning of the Act of March 8, 2013 on preventing excessive delays in business transactions (Journal of Laws 2019, item 118 as amended) based in Kraków, ul. Fabryczna 20 Data Protection Officer: Maciej Rymaszewski; Contact: [email protected] The Controller processes your personal data pursuant to applicable laws, concluded agreements and on the basis of the consent provided. Your personal data is processed for the following purpose(s): a) 6 point 1 a) the data subject agreed to the processing of its personal data for one or more specified purposes; b) 6 point 1 b) processing is necessary for the performance of an agreement to which the data subject is a party; c) 6 point 1 c) processing is necessary for the fulfillment of a legal obligation imposed on the Controller. With regard to the processing of data for the purposes referred to in point 4, the recipients of your personal data may be public authorities and entities performing public tasks or acting on behalf of public authorities, or other entities processing personal data in the Controller’s databases under relevant entrustment agreements. Your personal data will be stored for the period necessary to achieve the purposes specified in point 4, and thereafter for the period and to the extent required by generally applicable law. With regard to the processing of your personal data, you are entitled to the following rights: the right to access your personal data, the right to provide access to your data, the right to correct your data - if the data is incorrect or incomplete, the right to request the erasure of your personal data (the so-called right to be forgotten), the right to request the restriction of processing, the right to object to the processing of your data. If the processing of your personal data is carried out on the basis of a subject’s consent to the processing of personal data (Article 6(1)(a) of the GDPR), you have the right to withdraw this consent at any time. Such withdrawal does not affect the compliance of the processing carried out on the basis of consent prior to its withdrawal with the applicable law. In case you become aware of unlawful processing of your personal data, it is your right to lodge a complaint to the supervisory authority competent in matters of personal data protection. When the processing of personal data is carried out on the basis of the consent of the data subject, the provision of personal data by you to the Controller is voluntary. Providing personal data by you is mandatory in a situation where the premise for the processing of personal data is a provision of law or an agreement concluded between the parties. Your data may be processed in an automated way and will not be profiled. Your personal data will not be transferred to a third country/international organization