Information on the processing of personal data

We hereby inform you that VivaDrive Polska sp.oo, ul. Dobra 56/66, 00-312 Warsaw, NIP: 7010929600, KRS 0000789919 (hereinafter: "Company" or "Administrator") processes your personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR").

In order to fulfil the information obligation specified in Article 13 and Article 14 of the GDPR, we inform you that:

• 1. The administrator of personal data is the company under the name of VivaDrive Polska sp.zoo

• 2. You can contact the Administrator:

• a .   in writing to the following address: VivaDrive Polska spółka z ograniczoną odpowiedzialnością, ul. Dobra 56/66, 00-312 Warsaw

• a .   via email to: bok@vivadrive.io

• 3. The Administrator has not appointed a Data Protection Officer,

• 4. Your personal data are processed for the purpose of providing the service electronically (“Service” or “Services”), in particular, when browsing the PZU iFlota website ( PZU iFlota Website (“Website”), maintaining an account in the PZU iFlota service ( PZU iFlota Service ) (“Service”), performing concluded agreements, including paying for services, sending notifications about order fulfillment, carrying out the complaint process and ensuring proper customer service, matching the advertising offer to customer needs, presenting advertisements and sending commercial information, handling notifications and complaints, as well as enabling contact between buyers and sellers.

• 5. The PZU iFlota Service is an internet application (CRM) in the web model, which supports the work of the fleet manager, among others, by collecting data on the fleet (vehicles, drivers, operating costs), providing information on concluded insurance contracts and motor vehicle damages, providing the possibility of reporting motor vehicle damages, the possibility of reporting vehicles for insurance, providing the possibility of signing an insurance contract for new vehicles. The application also has a unique Insurance Module and e-learning prepared in cooperation with PZU SA, based on data provided by PZU SA. The purpose of these functionalities is to improve the safety of fleet drivers and reduce the costs of maintaining the car fleet. The Administrator ensures that he does not have access to insurance data sent to the Insurance Module by PZU SA. Only the client of the Service has access to his own insurance data in the Service. The Administrator ensures that PZU SA does not have access to fleet data created by the client, stored in the Service. Detailed terms of access to the PZU iFlota Service are available at https://pzuiflota.pl/regulamin.

• 6. the legal basis for the processing of personal data may be your consent (Article 6 paragraph 1 letter a of the GDPR), the need to take action at your request (Article 6 paragraph 1 letter b of the GDPR) or the purposes related to the legitimate interest pursued by the controller or by a third party (Article 6 paragraph 1 letter f of the GDPR). The legitimate interest of the controller is the need to offer customers the best possible quality of service, to adapt the offer of Services to the needs and expectations of buyers, as well as to conduct marketing, promotional and advertising activities,

• 7. the source of the data is the form you filled out and your activity on the Service and the Website, also resulting from the use of the Services provided,

• 8. The recipients of your personal data may be entities cooperating with the Administrator in the performance of the tasks specified in point 4, in particular subcontracting companies that handle the processes necessary to send notifications about the execution of orders, service providers providing advertising and marketing services, as well as in the scope of settlement of receivables.

• 9. Your personal data may be transferred to third countries, i.e. outside the European Economic Area (EEA) or to international organisations, but only to entities that provide appropriate safeguards and guarantee the rights of data subjects and effective legal remedies.

• 10. Your personal data will be processed by the Administrator for the period necessary to provide services, i.e. until the termination or cancellation of the contract, or for other purposes indicated in point 4 above,

• 11. you have the right to:

• a .   request from the Administrator access to your personal data

• b .   request the Administrator to rectify your personal data,

• c .   requesting the Administrator to delete or limit the processing of your personal data

• d .   to file an objection to the Administrator against the processing of personal data for direct marketing purposes,

• e .   to file an objection to profiling with the Administrator to the extent that the processing is related to direct marketing

• f .   withdrawal of consent to the processing of your personal data,

• g .   lodge a complaint with the supervisory authority,

• 12. We inform you that you have no statutory obligation to provide personal data, however, this obligation may result from specific provisions. The consequence of not providing personal data may be in particular the inability to provide Services to you, in particular the inability to conclude a contract for the sale of goods in the online store or to use the Service.

• 13. to the extent that the processed data was not obtained from you, you have the right to lodge a complaint with the supervisory authority - i.e. the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw

Personal data administrator

The controller of personal data provided via the Website and the Service is VivaDrive Polska Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, ul. Dobra 56/66, 00-312 Warsaw, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0000789919, REGON 383580710, NIP 7010929600, with the share capital paid in full in the amount of PLN 11,250.00 ("Controller"). Contact details of the Controller: bok@vivadrive.io

Cookies

The Service automatically collects only information contained in cookie files. Cookies are text files that are stored on the end device of the service user. They are intended for use with the Websites. First of all, they contain the name of the website of their origin, their unique number, and the time of storage on the end device.

The Administrator uses cookies for the following purposes:

• 1. matching the content of the Website to the individual preferences of the user, primarily these files recognize his device in order to display the page in accordance with his preferences;

• 2. preparing statistics that help to learn about user preferences and behaviors; the analysis of these statistics is anonymous and enables the adjustment of the content and appearance of the website to prevailing trends; the statistics are also used to assess the popularity of the website;

• 3. possibilities of logging in to the Service

• 4. keeping the user logged in on each subsequent page of the Service

The Service and Website use two basic types of files (cookies) – session and persistent. Session files are temporary, they are stored until you leave the service page (by entering another page, logging out or turning off the browser). Persistent files are stored on the user's end device until they are deleted by the user or for a time resulting from their settings.

The user can change the settings of their browser at any time to block the use of files (cookies) or to obtain information about their placement on their device each time. Other available options can be checked in the settings of your internet browser. Please note that most browsers are set to accept the storage of files (cookies) on the end device by default.

The Administrator of the Service and the Website informs that changes to the settings in the user's web browser may limit access to some functions of the website.

Cookies used by the Service and the Website (placed on the user's end device) may be made available to its partners and advertisers cooperating with it.

Information about web browser settings is available in its menu (help) or on its manufacturer's website.

Personal data

The User may be asked to provide their personal data when using the Service. The Administrator declares that they will use this data only and exclusively for purposes related to the functioning of the Service or for the provision of Services. The Services are primarily the fleet management services provided by the Administrator for light and heavy vehicles, as well as access to the Service available in the Administrator's domain (https://pzuiflota.pl/).

Purposes of data processing

The User wants to use the contact form provided on the Website,

• 1. matching the content of the Website to the individual preferences of the user, primarily these files recognize his device in order to display the page in accordance with his preferences;

• 2. preparing statistics that help to learn about user preferences and behaviors; the analysis of these statistics is anonymous and enables the adjustment of the content and appearance of the website to prevailing trends; the statistics are also used to assess the popularity of the website;

• 3. possibilities of logging in to the Service

• 4. keeping the user logged in on each subsequent page of the Service

Data processing

The Administrator uses organizational and technical measures in accordance with the applicable legal provisions (especially the GDPR), as well as by encrypting the connection using an SSL certificate.

The Administrator processes the following User data:

• 1. name, surname, e-mail address, IP address and telephone number in the event that the User uses the contact form on the Website or for the purpose of direct marketing regarding the offered products and services, performed using telecommunications terminal equipment and automatic calling systems,

• 2. name, surname, e-mail address, IP address, telephone number and data of his company, in particular: number of vehicles in the fleet, information about vehicles and drivers, information about settlements, purchase invoices regarding costs in the vehicle fleet, in the case when the User uses the Administrator's Services.

Legal basis for processing personal data

The User’s personal data are processed only and exclusively when the Administrator has a legal basis for it, i.e.:

• 1. a contract for the provision of Services or taking action at the request of the data subject before entering into that contract (Article 6 (1) (b) of the GDPR).

• 2. legal obligation related to accounting in the case of paid services (Article 6 (1) (c) of the GDPR).

• 3. the legitimate interest of the Administrator, consisting in the processing of personal data for the purpose of determining, pursuing or defending possible claims related to the Website, including the Services provided (Article 6, paragraph 1, letter f of the GDPR).

• 4. legitimate interest in collecting data for statistical and analytical purposes, which allows us to optimise our Website (Article 6, paragraph 1, letter f of the GDPR).

• 5. the User's consent expressed on the Website to the processing of data (Article 6, paragraph 1, letter a of the GDPR). The User may at any time withdraw or limit the consent to the processing of personal data by the Administrator. Data processing until the User withdraws the consent remains lawful.

Providing data

The User provides personal data on the Website and in the Service voluntarily. Providing data is necessary when the User intends to or uses the Services or wants to receive marketing information electronically.

User Rights

The User has the right to access, rectify, request deletion or request restriction of processing of their personal data. The User also has the right to object to processing in the event that:

• 1. for reasons related to the specific situation of the User – in relation to the processing of personal data based on Article 6 paragraph 1 letter f of the GDPR (i.e. on the legitimate interests pursued by the controller), including profiling based on these provisions,

• 2. If personal data are processed for the purposes of direct marketing, including profiling, to the extent that the processing is related to such direct marketing.

If the User considers that their data is being processed unlawfully, they have the right to file a complaint with the supervisory authority. To exercise their rights, the User should notify the Administrator of this fact by e-mail by sending a message to bok@vivadrive.io

Data recipients

The recipients of data processed by the Administrator are:

• 1. hosting companies providing the Administrator with space on servers

• 2. Internet service providers,

• 3. software providers for servicing customers and potential customers in connection with the Services provided by the Administrator,

• 4. payment platform providers through which the User can pay for access to the Services

• 5. entities providing software for sending marketing messages

• 6. entities processing data on our behalf, i.e. companies providing legal, accounting or customer service services.

Such entities will process data only on the basis of appropriate agreements and only in accordance with our instructions. We require our partners to maintain confidentiality and provide appropriate security measures.

Your data may also be made available to entities authorized to obtain it under applicable law, e.g. law enforcement authorities.

If you have expressed your desire to use additional services by accepting the appropriate consent or regulations of additional services within the Marketplace module, your personal data may be transferred to our Partners in connection with the subject of our cooperation. The list of our partners is available at www.pzuiflota.pl/partners.

Data processing period

User Data will be processed by the Administrator only for the period in which the Administrator has a legal basis to do so, i.e. until:

• 1. User data will be processed by the Administrator only for the period in which the Administrator has a legal basis for it, i.e. until:

• 2. the possibility of pursuing any claims related to the cooperation by either party will cease, or

• 3. The User withdraws consent to data processing if it was the basis for it or

• 4. the User's objection to the processing of personal data will be accepted if the basis for the processing of such data was the legitimate interest of the Administrator or the data were processed for the purpose of direct marketing, depending on what is applicable in a given case and what will happen at the latest