Data Controller shall process Personal Data based on the prerequisite of data controller's legitimate interest (legal basis: Article 6 clause 1 letter "f" GDPR), manifested in this case in the following purposes of data processing:

1. contact in cases related to performance of the Agreement;
2. administrative purposes, including organization of cooperation and supervision of performance of services or other obligations by Business Partner under the Agreement;
3. purposes related to the evidencing of performance of the Agreement,
4. enforcement of claims on account of business activity pursued,
5. realization of the provisions of the Anticorruption Policy of the Jeronimo Martins Group in order to prevent corruption in the Jeronimo Martins Group companies and also in order to establish, enforce and defend against claims.

For the purposes listed in point 1, Data Controller may in principle process the following Categories of Personal Data:

1. identification data, e.g. : first name and surname, series and number of personal identity card,
2. business data, e.g.: position, place of work,
3. contact data, e.g. : telephone number, e-mail address, fax number
4. potential information regarding personal or business relations with Data Controller's employees/associates (detailed information on which information are collected from our employees/associates in this respect can be received by contacting the following e-mail address: dpo.polska@jeronimo-martins.com).

Access to Personal Data may be granted to:
– other companies of the Jeronimo Martins Group;
- service providers providing serviced to Data Controller, including specifically: entities operating IT systems or providing IT tools, entities conducting postal and courier activities, entities cooperating with Data Controller in handling accounting, tax, legal, advisory and audit matters, document archiving and shredding companies, however solely to an extent required for proper provision of such services - access to Personal Data shall only be granted to persons whose access is justified in view of the tasks they perform and services they provide. All persons authorized to process Personal Data are obliged to keep the secrecy of data and to protect them against disclosure to unauthorized persons
- legal authorities receiving data in connection with enforcing or defending against claims by Data Controller or in connection with realization of legal obligations by Data Controller.

1. Personal Data shall be stored at least for the period of duration of the Agreement between Data Controller and Business Partner in the performance of which the data subjects were involved.
2. If required for evidencing purposes, Personal Data may also be stored until prescription of claims on account of business activity pursued or until conclusion of judicial proceedings related to the aforementioned Agreement.
3. for accounting data the retention period is set at 5 years according to the accounting provisions.
4. for realisation of the provisions of the Anticorruption Policy of the Jeronimo Martins Group Personal Data shall be stored no longer than for 5 years after the termination of the legal relationship with the person who has submitted the report to Data Controller. In case specific anticorruption provisions oblige Data Controller to store data then Data Controller shall store data for the period indicated in such provisions.

In principle, Personal Data shall be obtained from Business Partner. Business Partner shall be responsible for informing data subjects about any planned release of their Personal Data to Data Controller and about the scope and reasons of such release. Personal Data may also be obtained directly from the data subject. Provision of Personal Data is voluntary but required for performance of the Agreement. Failure to provide the data may obstruct or totally prevent cooperation with Business Partner's specific employee or associate.

If we have not obtained Personal data directly from the Business Partner/data subjects, the source of their acquisition is our employee/associate. Providing personal data by them is necessary for the proper verification of the report in accordance with the anti-corruption policies applicable in the Jeronimo Martins Group.

The data subject may exercise the following rights against Data Controller:

1. the right to demand access to his/her Personal Data and to be informed about their processing, and if the data are incorrect – the right to demand their rectification (pursuant to Articles 15 and 16 GDPR),
2. the right to demand restriction of data processing in situations and on terms stated in Article 18 GDPR (the data subject may demand restriction of processing of his/her data for a period enabling verification of their accuracy or until disposal of his/her objection to data processing. The right may also be exercised if the data subject considers the processing of his/her data to be illegal but does not wish such data erased immediately, or if the data are needed longer than the assumed processing period for the purposes of determination or defense of claims),
3. the right to demand erasure of his/her Personal Data pursuant to Article 17 GDPR ("right to be forgotten"),
4. the right to object at any time against the processing of his/her Personal Data for reasons related to the data subject's special situation (pursuant to Article 21 clause 1 GDPR).

In matters related to Personal Data processing and to the exercise of data subjects' rights, Data Controller may be contacted (address: bok@biedronka.pl). The person who has filed an application or demand relating to the processing of his/her Personal Data within the exercise of his hear rights may be requested to answer several questions permitting verification of such person's identity.

Besides, the data subject may lodge a complaint against the processing of his/her Personal Data; the complaint is lodged via Data Controller to President of the Personal Data Protection Office.

The Data Controller has appointed a Data Protection Officer who can be contacted via email: dpo.polska@jeronimo-martins.com. The Data Protection Officer can be contacted in all matters concerning the processing of personal data.