From 25 May 2018, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / EC is applicable. (general data protection regulation) ("GDPR"), which grants you a number of new rights related to the processing of your personal data. Below we present the most important rules on which we process your personal data:

1. The administrator of your personal data is DEVCO Sp. z o.o., address of the registered office: ul. Strzegomska 46-56, 53-611 Wrocław, entered into the Register of Entrepreneurs under the number KRS 0000030207, REGON 931942566, NIP 8942418206, tel. (+48) 71 376 96 40, e-mail address biuro@devco.pl. Share capital PLN 1,040,507.

2. In the case of questions related to the processing of your personal data and making requests regarding the will to exercise your rights, please contact us at the following e-mail address: rodo@devco.pl

3. We take special care to protect the interests of the data subjects, and in particular we ensure that the data we collect are:

a. processed in accordance with the law;
b. collected for specified, legitimate purposes and not subject to further processing incompatible with these purposes;
c. Substantially correct and adequate in relation to the purposes for which they are processed and stored in a form allowing identification of persons they concern, no longer than it is necessary to achieve the purpose of processing.

4. The main activity of DEVCO Sp. z o.o. is renting commercial spaces. As part of our operations, we process personal data, in particular for the purposes of concluding rental agreements, contracts with contractors and clients, for promotional purposes: marketing and commercial communication (regarding own services and entities cooperating with us), employment of employees and co-workers for the purposes of our company. We process your personal data on the basis of applicable laws, concluded agreements and on the basis of granted consent.

5. The use of our services is voluntary, providing data in connection with the services we provide is necessary in order to conclude a contract, which is necessary if the applicable law (statutory requirement) is the basis. In the situation where the processing of personal data takes place on the basis of consent, the provision of personal data is voluntary.

6. We collect data directly from the person to whom they relate, except for the situation in which our tenant, contractor, client, entity cooperating with us in order to properly implement the contract and agreed principles of cooperation will appoint persons performing tasks on their behalf (among their employees or colleagues) or our employee will provide details of his family member or other person to fulfill his or her rights.

7. The basics of data processing will depend on the purposes for which data is collected:

1) Conclusion of contracts, ie taking action before the conclusion of the contract, or performance of the contract, to which the person to whom the data pertains to Art. 6 sec. 1 lit. b GDPR, in relation to the data of persons appointed to contact or designated for the implementation of the contract - the basis for processing these data will be a legitimate interest pursued by the administrator or by a third party (ie Article 6 paragraph 1 letter f),

2) Fulfilling the legal obligation incumbent on the Administrator, in particular issuing invoices and accounting and tax documents (6 item 1 letter c) and GDPR),

3) On the basis of the legally justified interest of the Administrator, i.e. marketing of own services, investigation or securing of claims, creation of statements, analysis of statistics for our internal needs (Article 6 (1) (f) of the GDPR),

4) On the basis of consent in cases where you voluntarily express your consent, we will be able to process your personal data on this basis, e.g. for the purpose of sending commercial information by email, newsletter, promotional materials regarding our activity and the activities of entities cooperating with us.

5) In terms of e-mail and correspondence using e-mail, and in a traditional way: for this purpose, we process your data based on our legitimate interest and the interest of the sender, i.e. art. 6 par. 1 letter f GDPR, this applies to incidental correspondence consisting in allowing contact with the Administrator. It will also be processed on the basis of art. 6 par. lit b GDPR - indispensability to implement the provisions of the contract concluded with our clients or contractors in the scope of correspondence carried out in order to perform the contract. When you agree to send commercial information via this communication channel, including promotional and commercial information of entities cooperating with us, the basis for data processing will be your consent art. 6 par. 1 liters and GDPR. The basis for the processing will also be your consent in the case of the inclusion of a particular category in the correspondence, in order to be able to store such data in the sent correspondence should be your consent, if you will not be asked to supplement it, the basis for processing will then be Art. 9 par. 2 liters and GDPR (concerns data of a specific category, e.g. in correspondence related to candidates for work or employment).

6) In connection with the employment of our employees, the conclusion of the contract is voluntary, providing the data in order to conclude the contract is necessary for its conclusion. We collect data directly from people you concern. Depending on the form of our cooperation, we rely on the following provisions:

a. Civil Code provisions - civil law contracts, including cooperation agreements - the basis for processing will be a contract or actions to conclude it (Article 6 paragraph 1 letter b) of the GDPR), as well as obligations arising from the law: on accounting, tax law, fulfillment of obligations towards ZUS (Social Insurance Institution) when applicable (Article 6.1 (c) of the GDPR);

b. the provisions of the Labor Code (employment contracts) in the case of recruitment and employment of labor law provisions oblige us to collect data from you according to the catalog listed in the Act of 26 June 1974. The Labor Code, including provisions, among others: Accounting Act , tax law, fulfilling duties to ZUS. The basis for processing will be fulfilling the legal obligation, i.e. art. 6 par. 1 lit. c GDPR in relation to ordinary data, and in relation to the data of a particular category it will be art. 9 (2) b. GDPR, ie processing is necessary to fulfill the obligations and exercise specific rights by the controller or data subject in the field of labor law, social security and social protection;

c. In addition, in connection with employment and applying for employment (both on a civil law contract or contract of employment) in relation to other data, we will process your data with your consent, when you provide us with additional data contained in the application documents, in the course of a contract that connects us (providing data on your initiative), in particular when it is a particular category, we will require your written consent. The basis for processing will be your consent, i.e. art. 6 par. 1 liters and GDPR, in relation to ordinary data and art. 9, 2 liters and GDPR in relation to data of a specific category (by specific category data we mean: data revealing racial or ethnic origin, political views, religious or ideological beliefs, trade union membership and processing of genetic data, biometric data to uniquely identify a natural person or data concerning a person's health, sexuality or sexual orientation).

8. Rights that you have in relation to the personal data we process:

1) the right to withdraw your consent, that is at any time, you may withdraw your consent to the processing of your personal data by us, if they are processed on the basis of your consent. At the same time, the withdrawal of consent does not affect the lawfulness of the processing which was carried out before that withdrawal;

2) access to personal data, that is, receiving information about what data we process;

3) correcting personal data, if the data is incorrect or incomplete, you may request that it be corrected or supplemented;

4) deletion of personal data ("the right to be forgotten"), you have the right to request the removal of your personal data, in particular if any of the following occurs:

• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• when you withdraw the consent on which the processing is based and there is no other legal ground for processing;
• when you object, for reasons related to your particular situation - in the processing which is based on our legitimate interest and there are no overarching, legitimate grounds for further processing that override your interests, rights and freedoms or are not necessary as a basis for establishing, investigating or defending claims.
• in the case of direct marketing after filing an objection, we will no longer process your data for this purpose;
• when your personal data have been processed unlawfully;
• when your personal data needs to be removed in order to comply with a legal obligation provided for in Union law or in Polish law.

5) the right to object to the processing, you can object at any time to the processing of your data for the purposes of direct marketing. In addition, at any time you may object to the processing of your personal data for reasons related to your particular situation - in the face of processing which is based on our legitimate interest and there are no overriding, legitimate grounds for further processing overriding your interests, rights and freedoms or they are not necessary as a basis for establishing, investigating or defending claims.

6) limiting the processing of personal data (eg stopping operations on data or not deleting data due to certain circumstances). You can use this right if:

• you question the accuracy of your personal data;
• data processing is unlawful and you object to the deletion of data, demanding their limitation instead;
• we no longer need your data for your purposes, but you need them to identify, defend or pursue claims;
• You objected to the processing of your personal data, pending determination of whether the legitimate grounds for processing on our side are overriding the basis of your objection.

7) transfer of personal data, i.e., receiving a copy of the data that you have provided to us and you have the right to send this personal data to another administrator. The right to transfer your data also applies to the possibility of requesting us to transfer this data to another administrator, indicated by you as far as technically feasible. The right to data transfer concerns a situation where the legal basis for processing is the contract or your consent that connects us, and the processing takes place in an automated manner;

8) the right to lodge a complaint to the supervisory body - the President of the Office for Personal Data Protection (address: Office for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw).

9. You are not profiled by us, which means that your data is not processed in an automated way to determine your needs or personality traits. We also do not take automated decisions in individual cases, including those based on profiling.

10. We do not send personal data to a third country within the meaning of the GDPR (outside the borders of the European Economic Area) and are not transferred to international organizations.

11. We declare that the recipients of data may only be entities authorized to receive them on the basis of legal provisions (public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for purposes that result from the provisions of generally applicable law), and trusted recipients who provide services to us, ie our host provider, IT service providers, law firms, personal data protection services (based on relevant agreements). We also agreed on co-administering a joint website and promotional and marketing activities, sending commercial information and sending a joint newsletter (marketing and commercial information of both companies and cooperating companies), conducting free trainings within Wrocław Business Parks with BFF Investments Polska Sp. z o.o. - for more information, please visit www.wpb.pl/gdpr.

12. The storage period of your data:

1) Your personal data will be stored for a period of time resulting from the purposes of processing, as defined in our retention policy.

2) In connection with the contracts we have concluded for the duration of the contract and the period resulting from the limitation of claims under the contract, as well as for a period resulting from legal provisions, in particular the Accounting Act, tax regulations.

3) Data collected in connection with the implementation of our legitimate interests or interests of a third party will be stored for the time necessary to implement legally justified our interest, in this respect, however, not longer than until considered justified by the specific situation of your objection, in the case of direct marketing pending raise objections (unconditionally).

4) Data collected on the basis of consent will be stored until the consent is withdrawn or until we deem it unnecessary (termination of the purpose of processing).

5) Data related to the employment of employees based on the codec of the Labor Code for the period of employment and for the period provided for in the law on the storage of specific documents, employees (personal files for the period of employment, then for 10 years for archival purposes / employment before January 1, 2019). 50 years). In the case of recruitment, after its completion, we will delete your data unless you agree to its further processing in order to participate in the next recruitment for the period specified in the consent form.

INFORMATION CLAUSE - STRZEGOMSKA PARK

regarding video monitoring with image registration in the Wrocław Business Park - Strzegomska Park ul. Strzegomska 46-56, 53-611 Wrocław

in accordance with art. 13 para. 1 and par. 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and the repeal of Directive 95/46 / EC (RODO), we would like to inform you that:

1) The administrator of your personal data coming from video monitoring is DEVCO Sp. z o.o., address of the registered office: ul. Strzegomska 46-56, 53-611 Wrocław, entered into the Register of Entrepreneurs under the number KRS 0000030207, REGON 931942566, NIP 8942418206, tel. (+48) 71 376 96 40, e-mail address biuro@devco.pl,

2) contact with the data protection administrator is possible at the electronic mail rodo@devco.pl,

3) Your personal data will be processed in order to ensure the safety of employees and property protection in buildings and the area around buildings as well as external car parks based on the legitimate interest of the administrator, ie art. 6 par. 1 lit. f of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (GDPR) and article 22² § 1 of the Act of June 26, 1974 - Labor Code,

4) Your personal data will not be made available to third parties, they can be made available only to bodies authorized under separate law, and also entrusted to the IT company that supports monitoring recordings, and the company that has protection in the park (subject to the requirements set out in Article 28 CHEZ),

5) the data will not be transferred to a third country (outside the European economic area) or an international organization,

6) Your personal data will be registered in electronic form in the form of a video monitoring image recorded continuously and stored for a period not longer than 14 days, and in the case where the recording is or may be evidence in proceedings conducted under the law - to the time when the proceedings are finally concluded,

7) you have the right

• access to recordings in justified cases;

• the right to object to the processing of your personal data, as well as the right to demand their rectification;

• the right to anonymize the image on registered images and / or remove personal data concerning it;

• the right to limit processing;

• the right to submit a complaint to the supervisory body when you feel that the processing of your personal data violates the provisions of the GDPR. The supervisory body is the President of the Office for Personal Data Protection.

8) on the basis of personal data processed in such a way, the Personal Data Administrator will not make automated decisions, including decisions resulting from profiling.

INFORMATION CLAUSE - WOŁOWSKA PARK

regarding video surveillance along with image registration in the Wrocław Business Park - Wołowska Park ul. Wołowska 4-20, 51-116 Wrocław

in accordance with art. 13 para. 1 and par. 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and the repeal of Directive 95/46 / EC (RODO), we would like to inform you that:

1) The administrator of your personal data coming from video monitoring is DEVCO Sp. z o.o., address of the registered office: ul. Strzegomska 46-56, 53-611 Wrocław, entered into the Register of Entrepreneurs under the number KRS 0000030207, REGON 931942566, NIP 8942418206, tel. (+48) 71 376 96 40, e-mail address biuro@devco.pl,

2) contact with the data protection administrator is possible at the electronic mail rodo@devco.pl,

3) Your personal data will be processed in order to ensure the safety of employees, tenants and people staying in the Wołowska Park and the halls of buildings B1, B2, B5, and property protection; on the basis of the legitimate interest of the administrator, i.e. art. 6 par. 1 lit. f of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (GDPR) and on the basis of art.22² § 1 of the Act of June 26, 1974 - Labor Code,

4) Your personal data will not be made available to third parties, they can be made available only to bodies authorized under separate law, and also entrusted to the IT company that supports monitoring recordings, and the company that has protection in the park (subject to the requirements set out in Article 28 CHEZ),

5) the data will not be transferred to a third country (outside the European economic area) or an international organization,

6) Your personal data will be registered in electronic form in the form of a video monitoring image recorded continuously and stored for a period not longer than 14 days, and in the case where the recording is or may be evidence in proceedings conducted under the law - to the time when the proceedings are finally concluded,

7) you have the right

• access to recordings in justified cases;

• the right to object to the processing of your personal data, as well as the right to demand their rectification;

• the right to anonymize the image on registered images and / or remove personal data concerning it;

• the right to limit processing;

• the right to submit a complaint to the supervisory body when you feel that the processing of your personal data violates the provisions of the GDPR. The supervisory body is the President of the Office for Personal Data Protection.

8) on the basis of personal data processed in such a way, the Personal Data Administrator will not make automated decisions, including decisions resulting from profiling.

Data processed in connection with the presentation of our videos on a YouTube channel

1. The administrator of personal data of people using the "Devco" channel on YouTube is DEVCO Sp. z o.o., registered office address: ul. Strzegomska 46-56, 53-611 Wrocław, entered into the register of entrepreneurs under the number KRS 0000030207, REGON 931942566, NIP 8942418206, tel. (+48) 71 376 96 40, e-mail address biuro@devco.pl, regarding personal data processing: email address rodo@devco.pl. The personal data administrator has not appointed a data protection officer.

2. A separate, independent Administrator is YouTube, which may, in accordance with its policy, process your personal data, including the collection and processing of information contained in cookies of website visitors. Based on the data collected in this way, anonymous statements and statistics (e.g. regarding the number or profile of people visiting our channel can be created, and then provide us with this data. More information about data processing by YouTube can be found at:

https://policies.google.com/privacy and https://www.youtube.com/intl/en/about/policies

3. The data is collected directly from you, you decide whether you want to subscribe to the "Devco" channel by clicking on the "Subscribe" icon or by posting comments under the film or other interaction related to watching our films "I like it" or "I don't like it".

These can be the following categories of data: name and surname, identifier with which you act as participants of the You Tube social networking site, content of comments placed, information whether you liked our channel or not, other data that is available to the Devco administrator in accordance with the functionality You Tube.

4. Your data will be processed for the following purposes:

• Administration and management of the Devco channel, where we place our promotional, marketing and advertising materials, as well as responding to your posts and comments and supervision of content published by users - on the basis of our legitimate interest (Article 6 paragraph 1 letter f RODO)

• The YouTube administrator processes your data for their own purposes based on the legal basis specified by them, information in the Privacy Policy for You Tube.

5. Providing data as part of using the "Devco" channel is voluntary. Failure to provide data may prevent you from using some of the features offered by You Tube, including subscription or posting comments. At the same time, all personal data contained in the comments posted on the Devco channel may also be available to other YouTube users.

6. Devco Sp. z o.o. as the Administrator does not provide for the transfer of your personal data to another recipient. Data recipients can only be entities authorized to receive them on the basis of legal provisions (including the Court, the Police).

7. You have the following rights:

• access to your personal data, obtain information that we process your data,

• requests to rectify the personal data being processed,

• requests to delete or limit the processing of personal data,

• objecting to the processing of personal data.

The request to exercise these rights can be submitted by correspondence (including electronically) using the addresses provided at the beginning. The possibility of responding to some requests may be limited due to the fact that the entity that has full access to your personal data is the entity managing the YouTube service, i.e. Google. In this case, the Administrator undertakes to forward any requests to Google and to support the user in their consideration.

8. You also have the right to lodge a complaint with the supervisory body - the President of the Office for Personal Data Protection (address: Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw).

9. You are not profiled by us, which means that your data is not processed in an automated manner to determine your needs or personality traits, as well as we do not make automated decisions in individual cases, including those based on profiling. The YouTube Administrator's activities in this regard are set out in the Portal's Privacy Policy.

10. We do not send personal data to a third country within the meaning of the GDPR (outside the European Economic Area) or are not transferred to international organizations. The YouTube Administrator's activities in this regard are set out in the Portal's Privacy Policy.