PRIVACY POLICY
DENI CLER MILANO

PRIVACY POLICY

This website ("Website”) is operated by DCG S.A. with its registered office in Warsaw, ul. Bystrzycka 81A, 04-907 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 13^th Commercial Division of the National Court Register under the KRS number 0000285675, tax ID 1130015696, REGON 01251364100000 ("Administrator" or "we").

The Privacy Policy (the "Policy") sets out the principles for the processing and protection of the User's personal data and the principles for storing and accessing information on the User's devices using cookies, for the purpose of the provision of electronic Websites by the Administrator, as well as the principles for the use of Web Push notifications by the Website.

Terms used in the Policy shall have the same meaning as in Regulation EU 2016/679 of the European Parliament and of the Council of 27^th of April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119 of 04.05.2016, p. 1, as amended announced in Official Journal of the EU L 127 of 23.05.2018, p. 2), unless otherwise defined in this Policy.

Users can change the settings for Cookies in their browsers, e.g. they can partially restrict or completely disable the storage of Cookies. If you do not change your settings in this respect, cookies will be stored on your Device. Changing the settings of Cookies may restrict the functionality of the Website (for example, in an online shop, it may not be possible to follow the order path through the order form due to the products in the shopping cart not being remembered during the subsequent steps of ordering).

Please read these terms and conditions carefully before using the Website. By using the Website, you confirm your acceptance of these terms and conditions whether or not you choose to register with the Administrator’s Website.

If you have any questions, comments or requests regarding this privacy policy and cookies or Web Push notifications, please contact us at the following address: GDPR@denicler.eu.

• 1. Definitions

1. Administrator - shall mean DCG Spółka Akcyjna with its registered office in Warsaw (04-907) at ul. Bystrzycka 81A, entered into the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 13^th Commercial Division of the National Court Register under KRS no. 0000285675, tax ID 1130015696, REGON 012513641, which provides services electronically, stores and gains access to information in User's devices, processes personal data concerning the User obtained, inter alia, through the Website, as well as makes Web Push notifications available through the Website.
2. Cookies - means IT data, in particular small text files, recorded and stored on the devices through which the User accesses the Website.
3. Administrator Cookies - means Cookies placed by the Administrator, related to the provision of electronic Websites by the Administrator through the Website.
4. External Cookies - means Cookies placed by the Administrator's partners, through the website of the Website.
5. Partners - legal entities with personal or capital ties to DCG. These entities may be part of the same corporate group, which means that they have common business interests with DCG and often cooperate with DCG at different levels to achieve common goals. Partners may provide different products, Websites or technologies and may also collaborate with DCG on other levels such as marketing, sales, customer Website. DCG's relationship with Partners serves to benefit each other by increasing operational efficiency.
6. Web Push Notifications - means communications containing, inter alia, marketing information, including about current promotions available on the Website, sent by the Website to the User's web browser. Web Push Notifications are sent to the User's web browser only after the User has consented to this type of communication.
7. Website - means the website or application under which the Administrator operates the website, operating in the domain(s): www.denicler.eu.
8. Device - means the electronic device through which the User accesses the Website.
9. User - means an entity to whom, in accordance with the Terms and Conditions and the law, electronic Websites may be provided or with whom an Agreement for the provision of electronic Websites may be concluded.

• 2. Data Protection Officer

The Admnistrator has appointed a data protection officer. His duties are performed by Maciej Strycharz. In all matters related to the processing of personal data, in particular for the purposes of exercising rights in connection with data processing, the inspector can be contacted at the following e-mail address: GDPR@denicler.eu.

• 3. Data subjects

Customers

We process the data for the purpose of concluding or performing a contract (Article 6(1)(b) GDPR) and, in certain cases, for the purposes of legitimate interests (Article 6(1)(f) GDPR). The cases of our legitimate interests are described in § 4.

The categories of personal data processed may include: identification data, contact data, contact details, data related to current orders or order history.

Data will be stored for a period of min. 5 years from the end of the calendar year in which the deadline for payment of tax in connection with the concluded agreement expired - however, the law may provide for a longer period of data storage, the right to limit processing, the right to object to processing, the right to lodge a complaint to the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

Personal data may be processed in the form of analytical, sales and marketing profiling, in order to make measurements to improve services. The provision of data is a contractual requirement. The consequence of failing to provide personal data may be a request to complete the deficiencies. The consequence of failing to provide personal data may be a request for rectification. A complete refusal to provide them will prevent the conclusion or execution of the contract.

Registered customers

We process the data for the purpose of concluding or performing a contract (Article 6(1)(b) GDPR) and, in certain cases, for the purposes of legitimate interests (Article 6(1)(f) GDPR). The cases of our legitimate interests are described in § 4.

The categories of personal data processed may include: identification data, contact data, contact details, data related to current orders or order history.

Data will be stored for a period of min. 5 years from the end of the calendar year in which the deadline for the payment of tax in connection with the concluded agreement has expired - however, the law may provide for a longer retention period, in particular for the assertion or defence of claims. The cases of longer data processing periods are described in § 4.

In relation to the processing, you have the right to access and rectify data, the right to erasure, the right to restrict processing, the right to object to processing, the right to lodge a complaint to the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on individual rights can be found in § 7.

Personal data may be processed in the form of analytical, sales and marketing profiling, in order to make measurements to improve services. The provision of data is a contractual requirement. The consequence of failing to provide personal data may be a request for rectification. A complete refusal to provide them will prevent the conclusion or execution of the contract.

Suppliers of goods and services

We process the data of agents, representative persons, designated contact persons for the purpose of performing a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR). Data may also be processed for the purposes of our legitimate interests of establishing and pursuing claims or defending against claims, and for the purposes of determining whether the persons appointed for representation are authorised to act on behalf of the principal (Article 6(1)(f) GDPR).

Categories of personal data processed may include identification data, contact data, contact details, data of an official/business nature.

Data will be stored for a period of min. 5 years from the end of the calendar year in which the deadline for the payment of tax in connection with the concluded agreement has expired - however, the law may provide for a longer retention period, in particular for the assertion or defence of claims. The cases of longer data processing periods are described in § 4.

In relation to the processing, you have the right to access and rectify data, the right to erasure, the right to restrict processing, the right to object to processing, the right to lodge a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

The provision of personal data is a contractual requirement. The consequence of failure to provide personal data may be a request for rectification. A complete refusal to provide them will prevent the conclusion or execution of the contract.

Newsletter subscribers

Data will be processed on the basis of freely given consent (Article 6(1)(a)). Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before the withdrawal. In certain cases, data may also be processed for the purposes of legitimate interests (Article 6(1)(f) GDPR). The cases of our legitimate interests are described in § 4.

Categories of personal data processed will include email address, telephone number. Data will be stored until consent is withdrawn.

DCG may transmit newsletters both on its behalf and on behalf of Partners. However, this does not involve sharing personal data with Partners.

In relation to the processing, you have the right to withdraw your consent at any time (without affecting the lawfulness of the processing performed before its withdrawal), the right to access and rectify your data, the right to restrict processing, the right to object to processing, the right to withdraw your consent at any time, the right to erasure, the right to lodge a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

Persons visiting the Website or using its services

Personal data is processed for the purposes of legitimate interests (Article 6(1)(f) GDPR) such as communication and correspondence, the production of statistics to improve the Website’s services and the adaptation of the Website and services to Users' preferences.

The categories of personal data processed may include identification data, IP data, location data, contact data, contact details, data related to current orders or order history.

The data will be kept for the period necessary to respond to the requests submitted.

In relation to the processing, you have the right to access and rectify data, the right to erasure, the right to restrict processing, the right to object to processing, the right to lodge a complaint to the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

We may also process information that enables us to remember your preferences - we use cookies to collect this type of data (see §§ 9-11 for more information).

Personal data will not be processed in the form of analytical profiling. Binding decisions will not be automated, i.e. they will never be made without human involvement.

Website usage data may be used for internal statistical purposes and to develop and improve the Website's services, communication methods and functionality, as well as to ensure IT security.

Candidates for work and cooperation

Personal data will be processed for recruitment purposes on the basis of voluntary consent - Article 6(1)(a) GDPR. Where information involving special categories of data (so-called sensitive data) is provided in recruitment documents, the basis for processing is also the freely given consent (Article 9(2)(a) GDPR). Consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out before its withdrawal. In certain cases, data may also be processed for the purposes of legitimate interests (Article 6(1)(f) GDPR). The cases of our legitimate interests are described in § 4.

The categories of personal data concerned include identification data, contact details indicated by the applicant, education, professional qualifications, previous employment history or other data provided by the applicant in the application documents. In the case of recruitment concerning employment within the framework of a civil law relationship, the catalogue of personal data provided in the application documents may be arbitrary. In the case of recruitment concerning employment within the framework of an employment relationship, the scope of processed personal data should not go beyond the catalogue indicated in Article 22(1) § 1 of the Act of 26^th of June 1974 of the Labour Code. The provision of personal data beyond this catalogue will be based on voluntary consent (Art. 6(1)(a) GDPR, Art. 9(2)(a) GDPR). However, we point out that, in accordance with the principles of data minimisation and purpose limitation, redundant data will be anonymised or deleted.

Recipients of personal data may be providers of telecommunications and IT, legal, hosting services.

Data will be stored for no longer than until the end of the recruitment process to which the advertisement refers, i.e. for a period of 3 months or until the withdrawal of consent. For the purposes of establishing and investigating or defending against claims, personal data will be stored in accordance with Article 118 of the Act of 23^rd of April 1964 - Civil Code (the general limitation period is 6 years., the end of the limitation period falls on the last day of a calendar year).

In relation to the processing, you have the right to withdraw your consent at any time (without affecting the lawfulness of the processing performed before its withdrawal), the right to access and rectify your data, the right to restrict processing, the right to object to processing, the right to withdraw your consent at any time, the right to erasure, the right to lodge a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

Customer service office visitors

Personal data is processed for contact purposes, for the purposes of correspondence, providing information, technical assistance and answering questions (Article 6(1)(f) of the GDPR).

The categories of personal data concerned may include identification data, contact data and other data contained in the content of correspondence, data relating to current orders or order history.

The data will be stored for the period of time necessary to provide information, technical assistance and answer your questions - however, the law may provide for a longer retention period, in particular for the assertion or defence of claims. The cases of longer data processing periods are described in § 4.

In relation to the processing, you have the right to access and rectify data, the right to erasure, the right to restrict processing, the right to object to processing, the right to lodge a complaint to the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw). Detailed information on the individual rights can be found in § 7.

• 4. Other purposes, legal bases and periods of processing of personal data

For the purposes necessary to comply with our legal obligations (Article 6(1)(c) GDPR), we will process the data:

- for as long as we comply with the legal obligations imposed on us by applicable legislation, including but not limited to tax law;

- for the period of time for which we are required by law to keep the data (these laws may provide for different retention periods).

Where we process personal data for purposes arising from our legitimate interests (Article 6(1)(f) GDPR), we do so for:

- the establishment, defence and assertion of claims, which also includes the sale of our claims to another party (the general limitation period for claims is six years, while for claims relating to periodic performance it is three years; the limitation period ends on the last day of the calendar year);

- promoting our products and services;

- the production of summaries, analyses and statistics;

- archiving.

• 5. Recipients of personal data

Recipients of personal data may be separate controllers of personal data or processors. If we outsource operations whose essence is the processing of personal data to another entity, this will be done in accordance with Article 28 and Article 32 of the GDPR, i.e. within the framework of entrustment of personal data processing. The entrustment of personal data will only concern operations where the processing of data is the main, primary activity and not the result of other, side processes.

Personal data may also be accessed by so-called third parties. According to the definition set out in the GDPR, a third party is not the data subject, the controller or processor, or a representative of the controller or processor. These will mainly be public authorities, which are not considered recipients under the GDPR, but may receive personal data in the context of a specific proceeding in accordance with European Union or Member State law.

• 6. Other purposes, legal bases and periods for processing personal data

As a general rule, personal data will not be transferred to countries outside the European Economic Area (EEA), where the law may not provide the same level of protection.

However, if there was a need to transfer data outside the EEA, we would do so:

- on the basis of a decision establishing an adequate level of protection (Article 45 GDPR) or

- subject to appropriate safeguards, including standard data protection clauses, an approved code of conduct, an approved certification mechanism (Article 46 GDPR) or

- in accordance with binding corporate rules (Article 47 GDPR) or

- subject to exceptions in specific situations (Article 49 GDPR).

• 7. Rights in relation to the processing of personal data

At any time you can request the exercise of certain rights you have under the GDPR in relation to the processing of your personal data. Below, we describe the specific rights, the circumstances in which they may apply and how to exercise them.

Right to withdraw consent at any time (Article 7(3) GDPR)

If the data are processed on the basis of freely given consent, you can opt out of data operations on this basis at any time. We will then immediately cease processing the data for the purpose for which the consent was collected. However, we would like to point out that the withdrawal of consent does not affect the fact that the processing of personal data on the basis of consent was lawful before the withdrawal.

The right to access and obtain a copy of personal data (Article 15 GDPR)

You can receive information from us regarding our processing of your personal data and obtain a copy. This will be made available in a common IT file format. The first copy will be provided free of charge, but we may charge a fee for the issuing of a subsequent copy, which we will determine in accordance with the terms of the GDPR.

Right to rectification of data (Article 16 GDPR)

We are committed to ensuring the accuracy of the data we process. You may request that your data be corrected or deleted if it is inaccurate, incomplete or has been collected unlawfully. However, the burden of proving these inaccuracies lies with the data subject.

The right to erasure, including the "right to be forgotten" (Article 17 GDPR)

Upon request, we are obliged to delete your personal data. We will do this if:

- the purposes for which the data was collected have already been achieved;

- the only legal basis for processing personal data was consent, which was subsequently withdrawn, and there is no other legal basis for further processing of personal data;

- the only legal basis for the processing was the consent given by the person under the age of thirteen;

- an objection to the processing has been lodged based on Article 21 GDPR and we have no overriding legal grounds to continue processing your personal data;

- personal data have been processed unlawfully, i.e. for unlawful purposes or without any basis for processing the personal data.

"The right to be forgotten", is a special form of the right to erasure. If data has been published, for example on this website, and you have the right to request the deletion of this data, we are obliged to delete any copies of this data and any links leading to this data. We must also take steps to ensure that other entities that have processed the personal data also delete it from their resources. However, this right is not absolute - in taking steps to exercise it, we must take into account available technology and costs, which may limit its application.

Right to restrict processing (Article 18 GDPR)

We are obliged to restrict the processing of personal data upon request. In this case, we must refrain from performing any operations on the data other than storing it. If the data subject has doubts about the accuracy of the data, we will restrict processing for a period of time to allow us to check the issue. We will also restrict processing if the data subject objects to the processing.

Right to data portability (Article 20 GDPR)

The data subject has the right to receive the personal data and to have them transferred to another controller of his choice. The right to data portability applies when we process personal data on the basis of consent (Article 6(1)(a) GDPR) or when this is necessary for the performance of a contract (Article 6(1)(b) GDPR) and the data operations are carried out by automated means, i.e. without human intervention.

Right to object (Article 21 GDPR)

The data subject may request the cessation of the processing of personal data, in particular on grounds relating to his or her particular situation. However, the objection does not apply if consent to the processing has been given. In such a situation, the consent in question must be withdrawn - the effect will be the same, but from a legal point of view, opposition and withdrawal of consent are two different institutions that apply in different cases.

No effective objection can be lodged if:

- the processing of personal data is necessary for the performance of the contract (Art. 6(1)(b) GDPR);

- the processing is necessary for the fulfilment of a legal obligation incumbent on us (Article 6(1)(c) GDPR);

- the processing is necessary to protect the vital interests of the data subject or of another natural person (Article 6(1)(d) GDPR).

The right not to be subject to automated decisions in individual cases, including profiling (Article 22 GDPR)

The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, where such decisions would produce legal effects on him or her or similarly significantly affect him or her.

However, automated data processing, including profiling, is permissible if:

- this is necessary for the conclusion or performance of the contract;

- this is allowed by the law of the European Union or by the law of the Member State to which we are subject and which provides for adequate safeguards for the protection of rights, freedoms and legitimate interests;

- is based on explicit (unstated) consent.

Right to lodge a complaint with a supervisory authority (Article 77 GDPR)

If a data subject believes that his or her rights have been violated by our processing activities, he or she may lodge a complaint with a supervisory authority, i.e. an independent public authority responsible for monitoring the application of the GDPR. On the territory of Poland, this function is performed by the President of the Office for Personal Data Protection. Contact with the supervisory authority is possible:

- by mail: ul. Stawki 2, 00-193 Warsaw;

- electronically via the ePUAP application form;

- by telephone on the hotline number: 606 950 000.

The rights listed above may be limited in certain situations, e.g. when we can demonstrate that we are legally obliged to process your data. In order to exercise your due rights, you should send an appropriate request using our contact details indicated in the Policy.

• 8. Other purposes, legal bases and periods of processing of personal data

As a general rule, most of the data we process is information that you have provided to us personally. In some cases, however, we may process personal data that we are able to infer from other information obtained from you and that we acquire in the course of our relationship. This data will not be processed for longer than is necessary for the purpose for which it was collected or will be deleted immediately. Where we have not obtained personal data directly, we inform you that:

- data may have been obtained from another person or entity;

- data could have been obtained from other publicly available sources of information.

• 9. Types of cookies used

The Cookies used by the Administrator are safe for the User Device. In particular, it is not possible for viruses or other unwanted software or malware to enter the User's Device through this method. These Cookies allow the software used by the User to be identified and the Website to be customised for each individual User. Cookies usually contain the name of the domain from which they originate, the length of time they are stored on the Device and the assigned value.

The Administrator uses two types of cookies:

1. a) Session cookies: these are stored on the User's Device and remain there until the session of the respective browser ends. The stored information is then permanently deleted from the Device's memory. The mechanism of session cookies does not allow any personal data or any confidential information to be collected from the User's Device;

1. b) Persistent cookies: these are stored on the User's Device and remain there until they are deleted. The end of the session of the browser in question or the switching off of the Device does not delete them from the User's Device. The Persistent Cookies mechanism does not allow any personal data or any confidential information to be retrieved from the User Device.

The User has the option to restrict or disable access to Cookies on his/her Device. If this option is exercised, the use of the Website will be possible, except for functions that by their nature require Cookies.

• 10. Purposes for which cookies are used

The Administrator uses Custom Cookies for the following purposes:

1. a) configuration of the Website - adjustment of the content of the Website's webpages to the User's preferences and optimisation of use of the Website's webpages;

1. b) analysis and research as well as audience auditing - collection of general and anonymous statistical data, creation of anonymous statistics through analytical tools which help to understand how Website Users use the Website's websites, which enables improvement of their structure and content;

1. c) the provision of advertising services - presenting advertising messages tailored to the User's preferences.

The Website administrator uses External Cookies for the following purposes:

(a) analysis and research as well as audience auditing - collection of general and anonymous statistical data via the analytical tools of Google Analytics - administrator of Cookies: Google Inc. in the USA;

1. b) provision of advertising services - presentation of advertising messages tailored to the User's preferences using Google Adwords analytical tools - administrator of Cookies: Google Inc. in the USA.

• 11. Possibility of defining the conditions for storing or accessing Cookies

The User may, independently and at any time, change the settings concerning Cookies, specifying the conditions for storing and accessing Cookies on the User's Device. The User may change the settings referred to in the preceding sentence by means of the settings of the Internet browser or by means of the configuration of the Website. These settings can be changed, in particular, in such a way as to block the automatic handling of cookies in the settings of the web browser or inform on their placement on the User's device each time. Detailed information on the possibility and methods of using cookies is available in the settings of your software (web browser).

The User can delete cookies at any time using the available functions in the web browser they are using. Detailed instructions on the settings for the use of cookies depending on the web browser used are available below:

- the cookie settings in Chrome browser;

- the cookie settings in Firefox browser;

- the cookie settings of the Opera browser;

- the cookie settings in your Safari browser.

Your browser settings also allow you to delete cookies already stored on your Device. However, we would like to point out that deleting or blocking cookies may limit the functionality of the website. If you experience any problems after deleting cookies, please contact the provider of the relevant web browser.

Restricting the use of cookies, may affect some of the functionalities available on the Website.

• 12. Newsletter

Users may agree to receive, at the e-mail address provided, the Website Provider's informative and marketing content by providing their e-mail address and ticking the appropriate box with their consent to receive the aforementioned content.

The Newsletter Website is voluntary and free of charge.

The Newsletter Website is provided for an indefinite period of time and the User may cancel it at any time by unchecking the appropriate box under "Customer Account" or by contacting GDPR@denicler.eu.

• 13. Facebook plugin

Our Website contains a plug-in for the social network Facebook (Meta Platforms Inc., 1601 Willow Road, Menlo Park, California, 94025, USA). The Facebook plug-in on our Website is marked with the Facebook logo. This plug-in will directly link you to our profile on the Facebook server. Facebook can then obtain information that you have visited our Site from your IP address. If you visit our website while logged in to your Facebook profile, Facebook will register the information about your visit. Even if you are not logged in, Facebook is able to obtain information about your IP address.

We would like to point out that Facebook does not provide us with information about the data collected and how it is used. The purpose and scope of the data collected by Facebook are not known to us. For further information regarding Facebook's privacy, we suggest that you contact Facebook directly or refer to Facebook's privacy policy at: https://www.facebook.com/about/privacy/

If you do not wish Facebook to be able to obtain information regarding your visits to our pages, we advise you to log out of your Facebook account beforehand.

• 14. Web Push Notifications

Web Push notifications are sent to the User's web browser only after the User has consented to receive them. In order to agree to receive Web Push notifications, the User should select the option "display notifications" or something close to it on the message sent by his/her web browser (each browser may call this option differently).

Consent to receive Web Push notifications can be revoked at any time by changing the User's browser settings.

The Administrator does not process any personal data of Users who use Web Push notifications. Users are identified solely on the basis of information stored by their web browsers, to which the Administrator does not have access.

• 15.

Changes in policy

We reserve the right to update the Policy. Changes may be due to the following reasons:

1. a) due to the need to adapt the provisions of the Policy to current legislation or decisions of authorised public authorities;

1. b) as a result of a change in the interpretation of common law (affecting the content of the Policy);

1. c) as a result of court rulings, decisions, recommendations or recommendations of competent authorities or bodies;

1. d) due to the need to rectify errors or clerical mistakes in the content of the Policy;

1. e) changing data, including, for example, contact details, names, contact information or updating links provided in the content of the Policy.

Any changes will be made available on the Website and will take effect immediately upon publication.