Privacy Policy

Privacy Policy

Last updated: [TO CONFIRM: publication date]

This policy explains how M.W. Trade S.A. processes the personal data of website visitors, people contacting the Company and investors and shareholders, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”).

1. Data controller

The controller of your personal data is M.W. Trade S.A. with its registered office in Wrocław, Poland, ul. Powstańców Śląskich 125/200, 53-317 Wrocław, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Wrocław, 6th Commercial Division of the National Court Register, KRS no. 0000286915, NIP (tax ID) 897-16-95-167, REGON 933004286, share capital PLN 255,253.90, fully paid up (the “Controller” or the “Company”).

2. Contact regarding personal data

The Controller has not appointed a Data Protection Officer. In all matters concerning the processing of personal data you can contact the Controller:

• e-mail: daneosobowe@mwtrade.pl,
• by post: M.W. Trade S.A., ul. Powstańców Śląskich 125/200, 53-317 Wrocław,
• by phone: (+48) 71 790 20 50.

3. Purposes, legal bases and retention periods

3.1. Correspondence (e-mail and phone)

The website has no forms. If you contact us by e-mail or phone, we process the data you give us (usually your name, e-mail address or phone number and the content of your message). Purposes and legal bases:

• replying and handling correspondence – the Controller’s legitimate interest in communicating with people who contact it (Art. 6(1)(f) GDPR),
• taking steps at your request prior to entering into a contract, if the message concerns cooperation (Art. 6(1)(b) GDPR).

We keep the data for the duration of the correspondence and thereafter for the limitation period of any claims [TO CONFIRM: we suggest 3 years after the correspondence ends].

3.2. Investor relations and public-company obligations

As a company whose shares are listed on the Warsaw Stock Exchange, we process the data of shareholders, investors and people contacting us on investor relations matters, including data contained in notifications submitted under Art. 19 of the Market Abuse Regulation (MAR) (address relacje_inwestorskie@mwtrade.pl). Legal bases: compliance with legal obligations (Art. 6(1)(c) GDPR) and the Controller’s legitimate interest in corresponding with investors (Art. 6(1)(f) GDPR). Data are kept for the period required by law and otherwise for the limitation period of claims [TO CONFIRM].

Information on the processing of shareholders’ and proxies’ data in connection with General Meetings is published separately, in Polish, together with the notice convening each General Meeting (see Walne Zgromadzenie). Information for participants in requests for proposals is included in the documents of each request.

3.3. Website analytics (Google Analytics 4)

We use Google Analytics 4 (loaded through Google Tag Manager) to measure website traffic and improve our content. The tool sets cookies and processes data about your device and how you use the website (e.g. pages visited, approximate location, browser and device type).

• We set analytics cookies only after you give your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law).
• Until you consent, Google Analytics may send limited, cookieless signals about visits (Google Consent Mode), based on the Controller’s legitimate interest in basic traffic measurement (Art. 6(1)(f) GDPR) [LEGAL DECISION: “advanced” mode (signals before consent) or “basic” mode (no data before consent)].

Analytics data are kept in Google Analytics for [TO CONFIRM: 14 months] and are not used to identify individuals.

3.4. Consent management (CookieYes)

We record your cookie choices in order to respect them and to be able to demonstrate that consent was given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR and Art. 6(1)(f) GDPR). Consent records are kept for [TO CONFIRM: 12 months].

3.5. Website operation and security

Our hosting provider automatically processes technical data (e.g. IP address, date and time of the visit, browser information) to ensure the operation and security of the website – the Controller’s legitimate interest (Art. 6(1)(f) GDPR).

3.6. Establishing, pursuing and defending claims

Where necessary, we process data to establish, pursue or defend legal claims – the Controller’s legitimate interest (Art. 6(1)(f) GDPR), for the limitation period of the claims.

4. Recipients

Data may be shared with entities processing them on behalf of the Controller or cooperating with it in running the website:

• Webflow, Inc. – website hosting,
• Google Ireland Limited – Google Analytics 4 and Google Tag Manager,
• CookieYes Limited – cookie consent management,
• IT and e-mail service providers [TO CONFIRM: e.g. e-mail provider],
• legal advisers and other professional advisers,
• public authorities and bodies entitled under the law (e.g. the Polish Financial Supervision Authority, courts, public administration).

5. Transfers outside the European Economic Area

In connection with the services of Webflow, Inc. and Google LLC, data may be transferred to the United States. Transfers are based on the European Commission’s adequacy decision of 10 July 2023 under the EU–US Data Privacy Framework (for certified entities) and otherwise on the Standard Contractual Clauses approved by the European Commission. CookieYes Limited is based in the United Kingdom, which benefits from an adequacy decision of the European Commission. You can obtain a copy of the safeguards by contacting the Controller.

6. Profiling and automated decision-making

We do not use profiling. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

7. Your rights

You have the right to:

• access your data and receive a copy,
• rectify inaccurate data,
• erasure or restriction of processing – in the cases set out in the GDPR,
• data portability – for data processed on the basis of consent or a contract,
• object to processing based on the Controller’s legitimate interest, on grounds relating to your particular situation,
• withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal – for cookies, via the cookie settings button on the website,
• lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority of your habitual residence.

The Controller responds without undue delay and in any event within one month of receiving a request. Where there are reasonable doubts about the identity of the person making the request, the Controller may ask for additional information to confirm it.

8. Is providing data required?

Providing data is voluntary but necessary to respond to your message. Consent to analytics cookies is entirely voluntary – refusing it does not limit your use of the website.

9. Cookies

Details of the cookies and similar technologies used on the website are set out in our Cookie Policy.

10. Changes to this policy

This policy may be updated following changes in the law or in the tools we use. The current version is always available on this page, with the date of the last update shown at the top.