I. General information

This website is administered by Budimex S.A. with its registered office at Siedmiogrodzka 9, 01-204 Warsaw (hereinafter "Budimex" or "we"), which is the controller of your personal data.

Budimex S.A. attaches importance to the protection of privacy and personal data. The Privacy Policy defines the way in which we take care of your personal data and your rights related to its processing. In the online environment, we use cookies that may collect certain information about you. The exact use of cookies is described below.

In all matters related to the protection of your personal data, you can contact us via the following e-mail address: dane.osobowe@budimex.pl

The purposes, legal bases and period of personal data processing are indicated separately for each purpose of data processing together with the explanation how we use personal data that we collect through the website.

II. Data Protection Officer

We have appointed a Data Protection Officer whom you can contact via e-mail: dane.osobowe@budimex.pl. The task of the Data Protection Officer is to ensure that your rights are respected in connection with the processing of your personal data by Budimex.

Purposes and legal bases for data processing related to the use of the website

a) Use of the website

We process personal data of all persons using this website, including IP address, time spent on the website or other identifiers and information collected through cookies. It may be recorded in system logs. It is a special software that is used to store a chronological record containing information about events and activities that relate to the IT system used to provide our services. The information collected in the logs is processed primarily for purposes related to the provision of services available on our website. We also process it for technical and administrative purposes, to ensure the security of the IT system and to manage this system, as well as for analytical and statistical purposes.

Personal data is processed to:

• provide services electronically in terms of providing access to content collected on the website, among others, in the case of personal data processed in cookies used for technical configuration purposes - the legal basis for processing is necessary for the performance of the contract - Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter "GDPR").
• perform analytical and statistical research – then the legal basis for processing is our legitimate interest - Article 6(1)(f) of the GDPR, consisting in conducting analyses of your activity, as well as preferences, to improve the functionalities used and services provided.
• definition and pursuit of claims or defense against them – the legal basis for processing is our legitimate interest - Article 6 (1) (f) of the GDPR, consisting in the protection of our rights.

Your personal data retention period:

• in the scope of providing services by electronic means – for the duration of use of the website or for the duration of the cookie saved. Information on the duration of storage of individual cookies is available on the cookie board.
• where the basis for processing is our legitimate interest – also until submission an effective objection to the processing of data.

b) Contact forms

We provide the opportunity to contact us using the electronic contact form. Your personal data will be processed by Budimex for the purpose of correspondence in connection with questions concerning, among others: (a) invoices and payments, (b) information for the media, (c) corporate responsibility (CSR), (d) offers, (e) work, (f) advertising and promotion, (g) investor relations, (h) internships, (i) other scope specified in the content of your inquiry. Using the form requires providing personal data necessary to contact and respond to your inquiry. You can also provide additional data to facilitate contact with us or to manage your inquiry. Providing the data listed in the form as mandatory is required to accept and manage the inquiry, and failure to provide it results in the inability to address it. Providing other data is voluntary.

Personal data is processed for the purpose of:

• managing your inquiry sent via contact form, and for the purpose of making claims and protection against them: the legal basis for processing is our legitimate interest - Article 6 (1) (f) GDPR.

Your data will be processed for the duration of managing your inquiry and for the period of limitation of claims, i.e., six years or until you raise an effective objection to the processing of your data.

c) Newsletter

If you agree, we will provide you with a newsletter service consisting in sending you marketing messages and offers to the e-mail address that you have provided. Providing data is voluntary, and failure to provide it results in the inability to send the newsletter.

Personal data is processed for the purpose of:

• sending you promotional and information materials, including commercial information. The legal basis for such processing will be Article 6 (1) (a) GDPR.

Your data will be processed until the newsletter functions or until your consent is withdrawn.

d) Social media

We process personal data of visitors to our social media profiles (Facebook, YouTube, Instagram, Twitter, LinkedIn). This data is processed only in connection with running a profile, including to inform about our activities and promote diverse types of events and services offered by Budimex.

Personal data is processed for the purpose of:

• maintaining our profile in social networks and promote our own brand, which is our legitimate interest - Article 6 (1) (f) of the GDPR.

Your personal data will be processed for the period of our maintaining active profiles on social networks or until you raise an effective objection.

e) Qualification questionnaire

Companies interested in establishing cooperation with us can complete a qualification questionnaire. The aim of the questionnaire is to collect data that will allow us to verify a potential contractor in terms of our needs and expectations. The data from the questionnaire will be entered into our database and will serve as a source of information for establishing detailed cooperation.

Personal data is processed for the purpose of:

• collecting data that will allow us to verify and select potential contractors. The legal basis for such processing will be Article 6 (1) (a) GDPR.

Your data will be stored for the duration of the operation of our database of contractors or until your consent will be withdrawn.

f) User account for the purpose of job application via website

You can create a user account to apply in our recruitment processes. You must therefore provide the data necessary to set up an account, such as your e-mail address, name and surname. Providing data is voluntary, but necessary to set up an account.

Personal data is processed for the purpose of:

• concluding a contract for digital services of setting up and maintaining an account – the legal basis for processing is Article 6 (1) (b) of the GDPR.

The data contained in the user panel will be processed for the duration of the account's operation. When you decide to delete your account, we will delete the data that it contains.

g) Application for a particular job offer in the recruitment form

If you are interested in our job offers, you have the option of applying for a given position on our website via the recruitment form.

Personal data is processed for the following purposes:

• conduct the recruitment process, and if you grant consent, also in order to carry out future recruitment processes - the legal basis of Article 6 (1) (c) of the GDPR, in the scope of data required by the Polish Labour Code and Article 6 (1) (a) of the GDPR in the scope of additional information contained in the application and in the case of consent to participate in subsequent recruitments,
• conduct recruitment marketing activities, if you grant consent - the legal basis of Article (6) (1) (a) of the GDPR,
• use complex application documents for the purpose of conducting research in terms of satisfaction of the recruitment process or employment - legal basis of Article 6 (1) (f) of the GDPR - legitimate interest, i.e. testing satisfaction with the recruitment process by conducting research over employment,
• draw up an employment contract or a civil law contract, in the event of a positive recruitment result - legal basis of Article 6 (1) (b) of the GDPR.

Your personal data retention period:

• in the case of consent to the processing of personal data in future recruitment processes - until the withdrawal of this consent or for a period of five years from the date of consent,
• in the case of consent to the processing of data for the purposes of recruitment marketing - until the withdrawal of this consent or the decision to cease conducting recruitment marketing activities,
• in order to use the submitted application documents for the purposes of the survey in terms of satisfaction with the recruitment process or employment, personal data are stored for a period of one year from applying for a given job offer, or until you submit an effective objection to the processing of personal data;
• in the case of conducting the recruitment process and in the case of drawing up an employment contract or a civil law contract, for the time that the applicable law requires the storage of data.

IV. Cookies and similar technologies

a) Cookie consent

When you first visit our website, information about our use of cookies is displayed. As part of a dedicated tool that is displayed during your first visit to the website, you have the option of managing cookies. In addition, you can always change your cookie settings from the website by clicking on the lower corner of the circular box "Cookie settings". In addition, you can also delete cookies from your browser. Browsers manage cookie settings in different ways. In the auxiliary menu of your web browser, you will find explanations regarding the change of cookie settings.

b) Necessary cookies

We use necessary cookies to ensure proper functioning of the website and proper use of its functionalities.

c) Third party cookies

Our website uses functions provided by third parties, which involves the use of cookies from third parties. The use of these cookies is described below.

Social media tools

Budimex and our partners, i.e. social networks, such as: Facebook, LinkedIn, Twitter, Google, YouTube use various solutions and tools used for analytical and marketing purposes. Below you will find basic information about these tools. Detailed information in this respect can be found in the privacy policy of the respective partner.

• Google Analytics

Google Analytics cookies are files applied to analyze the user's use of the website, to create statistics and reports on its functioning. Google does not use the collected data to identify the user of the website nor combines this information to enable identification. Detailed information about the scope and principles of data collection in connection with this service can be found at the link: https://www.google.com/intl/pl/policies/privacy/partners

• Google AdWords

Google AdWords is a tool that allows you to measure the effectiveness of advertising campaigns conducted by Budimex, allowing you to analyze data such as keywords or the number of unique users. The Google Adwords platform also allows us to display our ads to people who have visited our websites in the past. Information on the processing of data by Google in the scope of the above service is available at the following link: https://policies.google.com/technologies/ads?hl=pl

• Facebook Pixels

Facebook Pixels are a tool that allows you to measure the effectiveness of advertising campaigns conducted by Budimex on Facebook. The tool allows for advanced data analytics to optimize our activities, also using other tools offered by Facebook. Detailed information on the processing of data by Facebook can be found at this link: https://pl-pl.facebook.com/help/
443357099140264?helpref=about_content

• Social media plug-ins

Our website uses social media plug-ins (Facebook, Google+, Twitter, YouTube). Plugins allow the user to share the content published on the selected social network. The use of plug-ins on the website means that the given social network receives information about your use of our website and can assign it to the user profile created on the respective social network. Budimex has no knowledge of the purpose and scope of data collection by social networks. Detailed information on this subject can be found at the following links:

• Facebook: https://www.facebook.com/policy.php
• Google: https://privacy.google.com/take-control.html?categories_activeEl=sign-in
• Twitter: https://twitter.com/en/privacy
• YouTube: https://policies.google.com/privacy?hl=pl

V. Your rights concerning the processing of your personal data

You have the right of access to the data and request their rectification, erasure (right to be forgotten), restriction of processing, the right to data portability, as well as the right to file a complaint to the supervisory body, in Poland it is the Office for Personal Data Protection.

In case we process your data based on our legitimate interest you have the right to object to the processing. You can do this by contacting us via the e-mail address: dane.osobowe@budimex.pl.

To the extent that your data is processed based on consent, you can withdraw this consent at any time by contacting us via the e-mail address: dane.osobowe@budimex.pl. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

VI. Personal data security

We conduct risk analysis on an ongoing basis to ensure that personal data is processed in a secure manner, only authorized persons have access to the data and only to the extent that it is necessary due to the tasks performed by them. We make sure that all operations on personal data are recorded and carried out only by authorized employees and associates.

Budimex takes all necessary actions to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures every time when they process personal data on our behalf.

VII. Server logs

The use of the website involves sending queries to the server on which the website is stored. Each query addressed to the server is saved in the server logs. Logs include, among other things, your IP address, the date and time of the server, information about your web browser and the operating system you are using. Logs are saved and stored on the server. The data stored in the server logs are not combined with specific people using the website and are not used by Budimex to identify visitors to the website. Server logs are only auxiliary material used to manage the site, and their content is disclosed only to persons authorized to manage the server.

VIII. Changes in the privacy and cookies policy

The policy is constantly reviewed and updated if necessary. The current version of the document is valid from 22.06.2022.