The contents of the arrangements under the Joint Data Control Agreement in the group of enterprises

Please be kindly informed that the company

TPA Sp. z o.o. Sp. k., ul. Młyńska 12, 61-730 Poznań, NIP 7781432033 REGON 300184858, National Court Register kept by the District Court Poznań – Nowe Miasto and Wilda, VIII Commercial Division of the National Court Register under the number KRS 0000671994, hereinafter referred to as the “Coordinating Data Controller”,

and the companies listed below, hereinafter jointly referred to as Joint Data Controllers, and individually as a Joint Data Controller:

1. TPA Management Sp. z o.o.  ul. Młyńska 12, NIP 1070010139, REGON: 141252235, National Court Register kept by the District Court Poznań – Nowe Miasto and Wilda, VIII Commercial Department of the National Court Register under the number KRS 0000293747, share capital 50 000,00 PLN paid in full
2. TPA Real Estate Services Sp. z o.o. Sp.k., ul. Nowogrodzka 33, 01-208 Warszawa 5272920674, REGON: 385552480, District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register KRS 0000828268
3. Baker Tilly Gajda Legal Sp. k. | ul. Młyńska 12 | 61-730 Poznań, NIP 7831753177. REGON 366428591, District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under the number KRS 0000660736
4. Baker Tilly TPA Sp. z o.o. k ul. Młyńska 12, 61-730 Poznań, NIP 1070018709 REGON 142798338, National Court Register kept by the District Court Poznań – Nowe Miasto and Wilda, VIII Commercial Division of the National Court Register under the number KRS 0000377626
5. Digital TPA Sp. z o.o. Sp.k. | ul. Młyńska 12 | 61-730 Poznań | NIP [tax identification number] 7831867001 | REGON [statistical number] 523492113 | National Court Register kept by the District Court Poznań – Nowe Miasto i Wilda, VIII Commercial Division of the National Court Register, KRS number 0000997190

entered into an agreement for the joint data control as part of conducting their information and marketing activities. This means that each of these entities processes your personal data for a mutually agreed purpose and scope. According to the agreement the Coordinating Data Controller shall be responsible for:

1. the operation and management of the websites and the IT system(s) used to carry out marketing activities,
2. providing access to the IT system(s) used to carry out marketing activities,
3. securing the IT system(s) used to carry out the marketing activities,
4. ensuring that only authorized persons have access to the IT system(s),
5. fulfilling the obligations referred to in Articles 13 and 14 of the GDPR with respect to Data Subjects,
6. ensuring that Data Subjects can effectively exercise their rights (data subject rights) in accordance with the principles set out in Article 7, and Articles 15 to 22 of the GDPR,
7. determining when it is necessary to notify the President of the Polish Personal Data Protection Office and Data Subjects of personal data breaches,
8. establishing a common point of contact for Data Subjects at the agreed email address: iodo@tpa-group.pl ,

Each Joint Data Controller is responsible for:

1. ensuring data confidentiality,
2. ensuring that only authorized persons have access to the data,
3. keeping records related to the protection of personal data,
4. receiving and processing requests and demands in relation to the GDPR in accordance with internal procedures,
5. communicating with data subjects regarding their rights under the GDPR in accordance with internal procedures,
6. proper execution of the procedures established in connection with the GDPR,
7. notifying the President of the Polish Personal Data Protection Office and Data Subjects of personal data protection violations in accordance with internal procedures,
8. supporting the Coordinating Data Controller in all proceedings under data protection legislation.

Notwithstanding the above division of responsibilities, each of the Joint Data Controllers is equally responsible to you for the due and lawful processing of your personal data.

You can exercise your rights related to your personal data in person, by mail or electronically. To facilitate exercising the above rights, we have established a common point of contact for all Joint Data Controllers at the email address: iodo@tpa-group.pl

However, regardless of these arrangements and the established point of contact, you may exercise your rights against any of the Joint Data (in which case we will forward your request to the appropriate entity – the Controller).