The controller of your personal data is Krajowy Depozyt Papierów Wartościowych S.A. with its seat in Warsaw (00-498) at ul. Książęca 4 (“KDPW”). KDPW can be contacted by e-mail at: bb@kdpw.pl or in writing at the address indicated above.

Your personal data is processed for the following purposes:

1. protecting KDPW's legitimate interests consisting in:
   • enabling KDPW to take actions, at your request, as a person acting on his/her own behalf or on behalf of another entity, aimed at concluding an agreement under which KDPW will issue and maintain an LEI,
   • to identify you - in the application administered by KDPW and dedicated to obtaining, maintaining and servicing an LEI;
   • identify you in case KDPW needs to exercise its rights or defend itself against claims.
2. the performance of the agreement under which KDPW will issue and maintain the LEI.

KDPW may transfer your personal data to:

1. Global Legal Entity Identifier Foundation (GLEIF), a foundation based in Basel, Switzerland, whose mission is to implement and use legal entity identifiers (LEIs);
2. numbering agencies other than KDPW, which issue LEIs;
3. entities or bodies that are authorised to receive them by law.

In the event that you act on behalf of others in your relationship with KDPW, or if you intend to obtain personal data of third parties and then transfer such data to KDPW, by accepting this information notice you declare that each time you transfer the aforementioned personal data to KDPW:

1. it does not violate in any way the applicable laws or the rights of the data subject;
2. it means that, in relation to the data subject, you have fulfilled all obligations required by law to obtain such personal data and to transfer them to KDPW, including that you have fulfilled, on behalf of KDPW, the information obligations arising from Article 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

Your personal data may be transferred to a third country, i.e. outside the European Economic Area, whereby KDPW S.A. shall ensure that, in the event of transfer of personal data to a third country, this shall be done to a country/organisation ensuring an adequate level of protection in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

Your data may be transferred to entities providing technical, IT support services to KDPW, including accounting, archiving and database maintenance services, IT equipment maintenance, and such entities may process data on the basis of agreements concluded with us and only in accordance with KDPW's instructions.

Your personal data may also be transferred to the entity on whose behalf you are acting, in cases where KDPW deems it necessary, in order to obtain confirmation of your rights.

Your personal data will be retained for a period of up to 6 years from the expiry of the agreement under which the LEI is issued or, if no such agreement has been entered into, for a period of up to 6 years from the date on which such personal data is sent to KDPW. If a dispute, litigation or other proceedings are pending, the period of personal data retention will be calculated from the date of the final conclusion of the dispute, and in the case of multiple proceedings - the final conclusion of the last of them, regardless of the manner of its conclusion, unless the law provides for a longer period of data retention or a longer period of limitation for the claim or right to which the proceedings relate.

You have the right to request from KDPW access to your personal data, the right to rectify it if it is inconsistent with the actual state of affairs, and furthermore, in cases provided for by law, the right to request its erasure or restriction of processing. You have the right to object to the processing of your personal data. You have the right to data portability - in relation to your personal data processed by KDPW for the purpose of performing the agreement referred to in point (b) above.

You have the right to lodge a complaint with the supervisory authority with regard to the processing of your personal data.

The provision of your personal data is voluntary and results from your intention to conclude an agreement concerning the issuance and maintenance of an LEI by KDPW. Failure to provide your personal data will prevent KDPW from entering into and performing this agreement.

Your personal data will not be used for automated decision-making, including profiling.