Privacy and Data Processing Policy by Protolab

This "Privacy and Data Processing Policy" aims to provide clear and accessible information about the processing of personal data of users of the online store "n2o3.com", owned by Protolab (hereinafter referred to as "Protolab" or "administrator").

The legal basis for the processing of personal data and the obligation to provide information about it is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Accordingly, Protolab exercises due diligence to ensure full compliance of personal data processing with the law and to guarantee the security of users' personal data. To this end, Protolab:

• strives to present all information on personal data protection and processing in a simple, understandable and precise manner;
• continuously improves its personal data protection procedures and updates this policy to reflect best practices;
• encourages users to contact us in case of any comments, clarification needs, or questions regarding the protection and processing of personal data by Protolab.

The administrator of personal data processed in the "n2o3.com" service is Protolab.

Protolab processes the personal data of "n2o3.com" users for the following purposes:

• conclusion and performance of a sales agreement or any other contract;
• fulfillment of legal obligations imposed on the administrator under separate provisions (e.g., tax documentation storage, cooperation with public authorities);
• pursuit of legitimate interests of Protolab.

Personal data is processed primarily on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation). Additionally, processing may take place based on the Criminal Procedure Code, Fiscal Penal Code, Accounting Act (for storing tax documentation), or the Civil Code (to protect the administrator's legal interests).

Protolab's legitimate interests include, above all, securing the ability to pursue claims resulting from improper or non-performance of contracts by the buyer.

Personal data is processed in compliance with the principles of data minimization and purpose limitation, meaning only data necessary for achieving a lawful purpose is collected.

Providing personal data is voluntary, but it is also a condition for concluding a contract with Protolab. This includes: name and surname or company name, correspondence and invoice address, as well as VAT number. Additionally, providing a contact phone number and email address is required, but not essential for concluding and performing the contract.

Failure to provide mandatory data results in the inability to conclude a contract, while failure to provide optional data results in the inability to use those data for contract performance purposes.

Data sharing by the administrator is always legally justified. Consequently, data is disclosed to the user or an authorized person. Third parties to whom the administrator may disclose personal data include:

• state authorities (e.g., Sanitary Inspectorate, Inspector for Chemical Substances, Central Bureau of Investigation, Police);
• entities cooperating with the administrator in conducting its business (such as the server administrator or accounting office), which have signed an appropriate data processing agreement.

The administrator does not transfer personal data outside the European Union or to international organizations.

Personal data is stored:

• for the purpose of contract conclusion and performance – from the moment of data collection (via the contact form, phone, or in person) until the termination or execution of the contract;
• for the purpose of fulfilling legal obligations – until the obligation is fulfilled or the statutory retention period expires (e.g., up to 5 years after the end of the year in which the transaction took place for VAT invoice retention);
• for the purpose of pursuing the administrator's legitimate interests – no longer than the limitation period for Protolab's claims against the user (i.e., 2 years after the invoice due date);
• when processing is based on user consent – until the consent is withdrawn, unless there is another legal basis for data processing.

In connection with data processing by Protolab, the user has the right to:

• access their personal data, request its deletion, withdraw consent to processing at any time (right to be forgotten), and object to processing;
• request correction or restriction of processing;
• data portability;
• file a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (UODO) in Warsaw, ul. Stawki 2, 00-193 Warsaw.

Personal data provided by the user will not be processed automatically or subject to profiling.

This policy has been in force since May 25, 2018.