PRIVACY POLICY FOR USERS OF THE WEBSITE dragon.com.pl

1. INTRODUCTION

When you use our website dragon.com.pl — whether by browsing it or undertaking any other activity on it — you may, even unintentionally, provide us with your personal data. ‘Personal data’ means any information which enables you to be identified, such as your full name, residential address, e‑mail address, and also, for example, the IP address of your device.

Your right to privacy and the security of your personal data are of paramount importance to us. For that reason, we have prepared this document — the Privacy Policy — in order to give you understandable information on which personal data may be collected or processed by us, why they are collected or processed, and what rights you have in relation to the protection of your personal data. The Privacy Policy also explains what cookies are and how and for what purposes we use them.

In issuing this Privacy Policy we endeavour to discharge the information obligations arising from applicable law, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (in Polish: Rozporządzenie Parlamentu Europejskiego i Rady (UE) 2016/679, hereinafter “the GDPR”), as well as provisions of electronic communications law, and to ensure that the processing of your personal data is carried out in accordance with national and European law.

2. WHO IS THE CONTROLLER OF YOUR PERSONAL DATA?

When we collect and process your personal data in connection with your use of our website, we act as the data controller. The controller of your personal data is DRAGON POLAND spółka z ograniczoną odpowiedzialnością with its registered office in Skawina, at ul. rtm. Witolda Pileckiego 5, 32‑050 Skawina, entered in the Register of Entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) by the District Court for Kraków‑Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number: 0000947181, NIP: 6772372006, REGON: 122707541, with a share capital of PLN 16,800,000.00 fully paid up (hereinafter also referred to as the “Controller”).

How can you contact us?

With respect to matters concerning the processing or protection of your personal data you may contact us electronically at: info@dragon.com.pl or by post at: DRAGON POLAND Sp. z o.o., ul. Rtm. W. Pileckiego 5, 32‑050 Skawina, Poland.

3. TYPES, PURPOSES, LEGAL BASES AND DURATION OF PERSONAL DATA PROCESSING

1. Technical data

When you visit our website, the IT system of our site automatically gains access to information concerning the device connected to the Internet that you use (e.g. desktop computer, laptop, smartphone, tablet or other similar device), such as: your device’s IP address (a unique number assigned to your device), device name, the type of web browser you use, the operating system version, date and time of access to the website, the address of the referrer (link), the amount of data transmitted, the manner in which you use the website and your cookie preferences. Access to such data is necessary for the website to be displayed and for it to function correctly and securely. These data do not disclose your identity (for example your name or contact details) but may include information about the device and its usage. If you do not want us to obtain such technical data from you, do not use our website. However, without such data the use of our website may be impossible.

• Legal basis for processing:
Article 6(1)(f) of the GDPR (Rozporządzenie Parlamentu Europejskiego i Rady (UE) 2016/679), insofar as the processing is necessary for the purposes of the legitimate interests pursued by the Controller, i.e. the proper functioning of the website and enabling technical access to it by users, as well as facilitating and optimising browsing.

• Retention period:
Such data will, as a rule, be processed for the duration of your session on our website and will be deleted upon termination of the session. Data may also be retained longer in the website’s system log files for a period resulting from technical conditions of the website, but no longer than until you lodge a justified objection to the processing of such data

2. Data provided when you contact us
When you contact us via the contact form published on the website or you send us e‑mails / SMS messages using the contact details provided on the website or otherwise contact us by other means, you provide us with personal data such as your name and surname, e‑mail address, telephone number or other data provided by you (for example gender, age, place of employment, home address). The provision of such data is not obligatory and the scope of data provided depends on your choice. In such a case we will process your personal data in order to respond to your enquiries and to be able to contact you. Without providing the data it may be impossible for us to reply to your enquiry or contact you.

• Legal basis for processing:
Article 6(1)(f) of the GDPR, as the processing is necessary for the purposes of the legitimate interests pursued by the Controller, i.e. enabling a response to communications from you; and Article 6(1)(b) of the GDPR, i.e. to take steps at the request of the data subject prior to entering into a contract where the contact may lead to entering into a contract with you.

• Retention period:
Such data will be processed for the period during which correspondence between us and you, or mutual contact in relation to your enquiry, may reasonably be expected.

3. Data processed in connection with our newsletter (bulletin)
On our website we offer the option of subscribing to a newsletter, i.e. an information bulletin containing the latest information about our company, campaigns, events and products, which is sent periodically by e‑mail. Subscription to the newsletter is voluntary. If you subscribe, we will process personal data such as your first name, last name and e‑mail address for the purpose of sending the newsletter. Providing such data is not mandatory, but failure to provide them will prevent us from providing the service.

• Legal basis for processing:
Article 6(1)(a) of the GDPR, as the processing results from the consent given by you for such processing, and Article 6(1)(b) of the GDPR as processing is necessary for the performance of a contract for the provision of the newsletter service.

• Retention period:
Such data will be processed by us for the period during which the newsletter is sent to you, i.e. from the moment of subscription until you unsubscribe or withdraw consent for processing personal data for the purposes of the newsletter.

4. Data processed in connection with an application for employment/internship/placement
If you apply for employment, an internship or work placement with our company via our website, whether by using a dedicated form (if made available) or by sending an application using contact details provided on the site, we will process personal data such as your name, surname, date of birth, address, education, employment history, professional qualifications, licences and other data contained in your CV or other application documents. You may always withdraw consent to the processing of such personal data, however withdrawal may result in your exclusion from the recruitment process. The provision of the data is not obligatory, but failure to provide them will render you unable to participate in the recruitment process.

• Legal basis for processing:
Article 6(1)(a) of the GDPR (consent), Article 6(1)(c) of the GDPR (processing necessary for compliance with legal obligations incumbent upon the Controller, e.g. labour law), and Article 6(1)(f) of the GDPR for the purposes of defending against potential claims relating to discrimination, which constitutes a legitimate interest of the Controller.

• Retention period:
Such data will be processed for the duration of the recruitment process, i.e. from receipt of your application until you are informed of the completion of recruitment and its outcome; data may also be processed for the purpose of defending against potential claims relating to discrimination.

5. Data processed in connection with the use of our social media accounts
On our website you may find links to our accounts on social media platforms such as Facebook (Meta), LinkedIn, Instagram and YouTube. We operate these accounts for promotional and marketing purposes. If you have an account on any such social network and you click on the link or perform any action available on our social account (like, share, comment, send a message etc.), then your personal data published on your social network profile may be processed by us. We therefore become a controller of personal data together with the owners of the social media platforms. It is, however, the social media platform operators who independently determine the purposes and means of processing personal data and who have their own data processing and protection rules, which you should review on those platforms. Through links (plugins) of such social networks on our website they may collect information about your activity on our website.

Data may also be processed on the basis of co‑control with:

Facebook - Meta Platforms, Inc. Details: www.facebook.com/privacy/policy 

Instagram - Meta Platforms, Inc. Details: https://privacycenter.instagram.com/policy 

LinkedIn - LinkedIn Ireland Unlimited Company Details: https://pl.linkedin.com/legal/privacy-policy? 

YouTube - Google Ireland Limited Details: https://policies.google.com/privacy?hl=pl

• Legal basis for processing:
Article 6(1)(f) of the GDPR, insofar as the processing is necessary for the purposes of the legitimate interests pursued by the Controller, i.e. operating social media accounts, informing about our activities, conducting promotional and marketing activities and statistical analyses.

• Retention period:
Such data will generally be processed for as long as you use our social media accounts; detailed rules on retention are governed by the privacy policies of the respective social media platforms.

6. Data relating to collection and analysis of statistics concerning the use of our website or our social media accounts
Alone or with the use of software provided by external entities, we may collect and process information regarding your activity on our website and our social media accounts to analyse how users use them and thereby to improve functionality, security and convenience of the website and social accounts. Providing such data is not obligatory and may be adjusted according to your preferences via the cookie settings panel, but refusal may limit the website’s functionality and prevent the collection of analytic and statistical data.

• Legal basis for processing:
Article 6(1)(f) of the GDPR, insofar as the processing is necessary for the legitimate interests pursued by the Controller, such as conducting analyses to improve and optimise our services.

• Retention period:
Such data will be processed for the time necessary to perform statistical analyses but not longer than until you lodge a justified objection to the processing.

7. Data necessary for establishment or defence of claims
If, in connection with your use of our website or social media accounts or other activity related thereto, claims arise or may arise on our part or we need to defend against claims, we will process those data obtained or disclosed to us as described above which are necessary to safeguard our rights.

• Legal basis for processing:
Article 6(1)(f) of the GDPR, insofar as processing is necessary for the purposes of the legitimate interests pursued by the Controller, namely the protection of our rights and claims.

• Retention period:
Such data will be processed for the period necessary for establishment or defence of claims but not longer than the statute of limitations for such claims.

8. Data relating to cookies
When you visit our website we, like most websites, use cookies which place or access information on your device used to browse our website. The use of cookies can amount to processing of personal data which under certain circumstances may constitute personal data. More information on cookies can be found in section 9 of this Privacy Policy.

4. WHO MAY BE THE RECIPENT OF YOUR PERSONAL DATA?

Personal data you provide to us or which we obtain in any other manner described above may be disclosed to other entities with which we cooperate or which provide services to us, including technical services for maintenance of the website. We endeavour to ensure that such recipients provide an appropriate level of protection for the personal data disclosed to them.

Data may be disclosed to:

• natural persons or companies providing services to us or supplying IT solutions, including providers of servers, hosting, website creation and IT maintenance;
• natural persons or companies providing legal, advisory, auditing or recruitment services;
• entities to whom data must be disclosed pursuant to applicable law or by virtue of a decision of a court or other public authority (e.g. at the request of law enforcement authorities);
• other recipients where you have given consent to disclosure of your data or where disclosure is necessary to protect your vital interests or the vital interests of other natural persons or for the public good.

5. WILL PERSONAL DATA BE TRANSFERRED TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS?

In certain circumstances your personal data may be transferred to third countries, i.e. countries outside the European Economic Area (EEA). This is connected to our use of services provided by other entities in the maintenance and support of our website. In particular this may relate to the use of IT services (server hosting), analytics and statistical services (software collecting and analysing statistical data), advertising and marketing services (personalisation and optimisation of content for users' activity on the web). For example, through browsing and activity on our website data may be collected by software operated by Facebook (Meta Platforms Inc.) or Google LLC and thereby transferred to the United States. The European Commission has recognised an adequate level of protection for transfers to that country. If transfers were to be made to countries not covered by an adequacy decision of the European Commission, the Controller will conclude agreements with recipients on the basis of the standard contractual clauses adopted by the European Commission in accordance with the GDPR.

6. DO WE PROCESS PERSONAL DATA IN AN AUTOMATED MANNER, INCLUDING BY WAY OF PROFILING?

We do not process your personal data in an automated manner (including profiling) in such a way that any decisions would be taken solely on the basis of such automated processing which would produce legal effects concerning you or significantly affect you.

7. LINKS TO OTHER WEBSITES AND SERVICES

Our website may contain links to other websites or portals. When you follow such a link you leave our website and are redirected to a website/portal of a third party. We have no control over the content or operation of such external websites/portals or over the data protection practices employed by them and cannot be held responsible for them. This Privacy Policy does not apply to such external sites and you should review their privacy policies.

8. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA?

With respect to the processing of your personal data you have the right to:

• request from us confirmation as to whether personal data concerning you are being processed and, where that is the case, to obtain access to the personal data together with information on the purposes of the processing, categories of personal data, recipients or categories of recipients (in particular recipients in third countries), where possible the envisaged retention period for personal data or, where that is not possible, the criteria used to determine that period, the right to request from us rectification, erasure or restriction of processing, the right to object to processing, the right to lodge a complaint with a supervisory authority, the source of the personal data if they were not collected from you, information about automated decision‑making, including profiling (Right to information).
• obtain a copy of the personal data subject to processing; we may charge a fee for additional copies to cover administrative costs (Right to obtain a copy).
• request rectification of your personal data where they are inaccurate or request completion where they are incomplete (Right to rectification).
• request the immediate erasure of your personal data where the personal data are no longer necessary for the purposes for which they were collected or processed, or where you have withdrawn consent and there is no other legal basis for processing, or you have objected to processing, or the personal data have been unlawfully processed, or personal data must be erased in order to comply with a legal obligation (Right to erasure).
• request restriction of processing where you contest the accuracy of the personal data for a period enabling us to verify their accuracy, where the processing is unlawful but you oppose erasure and request restriction instead, where the Controller no longer needs the personal data for the purposes of the processing but they are required by you for establishment, exercise or defence of legal claims, or where you have objected to processing pending verification of whether the Controller’s legitimate grounds override yours (Right to restriction of processing).
• receive your personal data which you have provided to us in a structured, commonly used and machine‑readable format and have the right to transmit those data to another controller where the processing is based on consent or contract and is carried out by automated means (Right to data portability).
• object at any time to the processing of personal data concerning you where processing is carried out on grounds of the Controller’s legitimate interests (Right to object).
• lodge a complaint with a supervisory authority dealing with personal data protection, in particular to the President of the Polish Personal Data Protection Office (Prezesa Urzędu Ochrony Danych Osobowych) (Right to lodge a complaint).

9. RULES FOR THE USE OF COOKIES

What are cookies?
In order for our website to operate more smoothly, small text files called cookies may sometimes be stored on the device you use when visiting our website (“cookies”). A cookie is a small text file stored on the device while using our website. They may be first‑party cookies readable only by our site to improve functionality and ease of use, and third‑party cookies from services we use to maintain the website, which may thereby obtain information about your device or activity. Cookies are not intended to process your personal data or identify you and do not affect your browser or device settings. Under certain circumstances, however, when combined with other personal data you have provided, cookies may enable identification of you and thus constitute personal data subject to this Privacy Policy.

Types of cookies used on the website:

• Session cookies, which are deleted after you close your web browser;

• Persistent cookies, which remain on your device for a longer period, including after closing the website or browser, in accordance with the cookie’s retention period which may range from 1 day up to 2 years; specific retention details for each cookie can be found in the cookie banner details. Some cookies may persist until manually removed.

What cookies do we use?

• Essential cookies — these are stored on your device to enable technical access to the website and its basic functionality. Due to their nature they do not require your consent.

• Optional cookies — stored on your device and used only if you consent. These include:

• Functional cookies — enabling remembrance of your selected website settings and adapting the site to your preferences (for example language, font size, appearance), thereby improving usability;

• Analytical (performance) cookies — cookies that check and analyse how users use the website (e.g. visit counts, popularity of content on the site) so that we can improve performance and functionality;

• Marketing (advertising) cookies — cookies enabling delivery of advertising and marketing content to users more tailored to their interests and preferences.

How to change cookie consent settings?

When you visit our website the system asks whether you accept all cookies, accept only some cookies, or refuse all cookies. You may therefore configure your preferences and may change them at any time. You may also change cookie settings in your web browser. Browsers by default allow cookies to be stored on the device. Settings for cookie handling are available from browser providers (for example Mozilla Firefox, Microsoft Edge, Google Chrome, Safari, Opera). Some cookies are however necessary for the site to function and changing these settings may result in the site not working properly or full functionality being unavailable.

Third‑party cookies

Our website uses tools provided by third parties to optimise and improve its operation which may store cookies on your device and collect data concerning your activity on our website and your device:

• Google Analytics — a service provided by Google Ireland Ltd enabling analysis of statistics concerning use of our website (visit statistics, activity on the site). It may access data such as IP address, network location, dates of visits, operating system and browser type.

• Facebook plugin — a service provided by Meta Platforms Ireland Ltd enabling redirection from our website to our Facebook page. Facebook receives information that a user has accessed the relevant page. If the user is logged in to Facebook, the visit may be associated with their Facebook account. If the user interacts with plugins (e.g. by using the Like button or leaving a comment), information is sent directly from the device to Facebook and stored there. If a user is not a Facebook member, Facebook may still obtain the IP address. If a user is a Facebook member and does not wish Facebook to collect data about them via this site and link it to their Facebook account, they should log out of Facebook and delete cookies before using our site. Other changes to advertising-related data processing are available in the user's Facebook profile settings.

• Facebook pixel — a service provided by Meta Platforms Ireland Ltd enabling tracking of user actions after viewing or clicking an advertisement on Facebook. It allows us to verify advertising effectiveness on Facebook, to conduct statistical analysis and to optimise our marketing. The collected data are anonymised and we can identify particular users and determine their personal data on that basis. However, such data are stored and processed by Facebook (Meta Platforms Ireland Ltd) under its own terms and conditions, over which we have no influence. You may prevent the display of ads on Facebook and beyond by adjusting Facebook settings or your browser settings.

How to opt‑out of Google Analytics processing?
Processing by Google Analytics can be prevented by configuring your browser accordingly and by installing the browser add‑on available at: https://tools.google.com/dlpage/gaoptout. Clicking the link will cause an opt‑out cookie to be stored in your browser, preventing access to data during future visits to our Service. For more information about Google's processing of personal data in connection with Google Analytics, please consult Google's privacy policy at: https://policies.google.com/technologies/partner-sites

Links to instructions for managing cookies in popular browsers:

- Google Chrome: https://support.google.com/chrome/ 

- Mozilla Firefox: https://support.mozilla.org/ 

- Safari (macOS): https://support.apple.com/ 

- Microsoft Edge: https://support.microsoft.com/ 

- Opera: https://help.opera.com/en/latest/web-preferences/#cookies 

10. EFFECTIVENESS AND AMENDMENTS TO THE PRIVACY POLICY

This Privacy Policy was introduced by us and is effective from 10 June 2025.
The Privacy Policy may be changed at any time, in particular in the event of changes to legal provisions or to the rules governing data processing described herein.

-------------------------------------------------

¹the full name of the Regulation is: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

²the full name is: Act of 12 July 2024 — Electronic Communications Law.

This English version of the Privacy Policy is a faithful translation of the original Polish document.