Appendix No. 5. Privacy Protection Policy

Table of Contents

• Section I. Definitions, Purposes and Scope of Application of the Policy
• Section II. Scope of Personal Data processed by the Company
• Section III. Purposes of, grounds for, and period of Personal Data processing by the Company
• Section IV. IP address, cookies or similar technologies, location, and identification numbers of mobile devices and information concerning profiling
• Section V. Users’ rights in the context of Personal Data processing and how to exercise them
• Section VI. Personal Data recipients
• Section VII. Transfers of Personal Data to countries outside the European Economic Area
• Section VIII. Amendments
• Section IX. Contact details

Section I. Definitions, Purposes and Scope of Application of the Policy

DEFINITIONS

1. Mobile Application – each of the applications that constitute Company software, intended for installation on mobile devices, enabling the use of Company services or Platforms.

2. Personal Data – within the meaning of the definition in Article 4(1) of the GDPR, personal data means any information relating to an identified natural person or a natural person identifiable by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including first and last name, contact number, email, delivery address for Goods purchased on Allegro, device IP, location data, an online identifier, data and information available in public registers (e.g., in CEIDG, in the REGON database), information collected by means of cookies or similar technologies (e.g. pixels, SDKs or tags), information provided through requests or User instructions.

3. Policy – this Privacy Protection Policy.

4. GDPR – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data, the free movement of such data, and repealing Directive 95/46/EC.

5. Marketplaces – online marketplaces operated as part of the Company’s business activities, in particular: Allegro, Allegro Lokalnie, wakacje.allegro.pl and the www.charytatywni.allegro.pl online platform.

6. Associated Services – services or functionalities provided or shared by the Company or by third parties, including services provided under separate terms and conditions, which support the core activities of the Company or facilitate the use of Company services or functionalities by Users, for instance, by providing Transaction financing and security or enabling Transaction complaints, as well as providing automated tools to assist or support the operation of the Platforms.

Purposes and Scope of Application of the Policy

The Personal Data Controller for Users that are natural persons is the Company. This means that the Company determines the purposes and means of processing your Personal Data.

The purpose of the Policy is to define the measures taken by the Company to protect your Personal Data processed while using the Marketplaces, the Mobile Application, and as part of the related services (including Associated Services). The Policy sets out, in particular, the scope of and legal grounds for processing your Personal Data that we collect in connection with your use of the Mobile Application, Marketplaces, and Associated Services. We receive your Personal Data from you when you set up the Allegro User Account, in connection with your activities (including Transactions) on the Marketplaces, posting or viewing of Offers, and in connection with updates of your Personal Data that you make using the Account. Personal Data processing can also be related to a range of other activities carried out by you that are directly associated with the use of the Mobile Application, Marketplaces and Associated Services. We can receive data regarding your shipments directly from the carrier or from the Seller. If you use Associated Services, your Personal Data can also be provided to us by third-party vendors who offer the Associated Services.

You may only use the Marketplaces, download the Mobile Application, or use the related services after you have read this Policy and Terms & Conditions.

If you click the links posted on the Marketplaces or in the Mobile Application, you can be redirected to websites or portals that are controlled or provided by entities other than Company. In that case, Personal Data processing follows the rules defined by such entities, for instance, in the privacy policy applicable to the services or applications available on third-party websites or portals.

Company activities are subject to data protection laws, in particular, the GDPR and the Personal Data Protection Act of 10 May 2018. If you have any questions or concerns about the protection of your Personal Data by the Company, please contact the Company. Our contact details are provided in Section 9 of the Policy.

Section II. Scope of Personal Data processed by the Company

The scope of Personal Data processed by the Company may vary depending on the services or functionalities provided by the Company that you use. To help you understand which of your Personal Data we collect, below we have provided information about the Personal Data categories that we process, categorizing them by processing purposes.

At Registration, we require you to provide the following Personal Data:

When you are registering a Regular Account:

• Email address or contact number, password;
• Email address or contact number, password and date of birth (in the case of a Junior Account).

When you are registering a Business Account:

• email, login, password, contact number and company (enterprise) details, including address.

If for any reason, you do not provide those Personal Data, unfortunately, we will be unable to enter into an agreement with you. Consequently, you will not be able to use the Company services available to registered Users.

After Registration, in order to fully enjoy your User Account, you are obliged to enter your identification data and inform us of your delivery address (where you will need to provide the street name, building number, apartment number, city, and postcode) as well as the contact details needed to get in touch with you (your email). In order to fully use the Marketplaces, you are additionally obligated to inform us about your age, so that we can verify your legal capacity to act and thus adjust the scope of authority you will enjoy in connection with your User Account. If we are provided with details of an account for withdrawals, we will be processing Personal Data related to such an account, i.e., first and last name, account number and residence address.

In order to fully activate the Account, you will be obliged to make a verification transfer or provide relevant documents for verification purposes. Thanks to that, we will be able to confirm the data provided by you during the Account-opening process. We will return the amount sent in the verification transfer within a few days. Personal Data related to the Transaction and included in verification documents will be processed for the purposes of the operations of the Platforms.

The Account activation can also be confirmed with the help of external authentication services provided by the Company.

By accepting the Allegro Terms & Conditions, you confirm that you authorize the payment service provider participating in the transaction to provide the Company with data accompanying the payment transaction for verification purposes.

Note that after registering your Account and using the services or functionalities of the Company, you are required to continually update any Personal Data you provide if changes occur in any scope.

When you use your User Account, we additionally collect information about your activities on the Marketplaces, such as your history of purchases, Offers posted, selected payment methods, and content of comments and reviews.

Using your User Account, you can also provide other optional Personal Data, such as uploading your photo or a graphic representation of your image (a profile picture), thus consenting to their processing. The provision of such Personal Data is fully optional.

Furthermore, we can obtain your Personal Data when you take the option to log in to the Platforms or Register on Platforms through third-party authentication services offered by other parties operating independently from the Company (e.g., services offered by Google, Apple, or services offered as part of websites including social media, such as Facebook, mall.cz, mall.sk, mall.hu). In that case, we obtain your Personal Data only in the form of your full name or login, email address, and profile picture published in such a service or website (the scope of the data acquired depends on the functionality you use), and these Data can be assigned to your Account or processed only for the purposes of logging in or Registration on Platforms. If it is necessary to obtain additional data, we will inform you about it, indicating its scope. When using third-party authentication services, you should read the relevant terms and conditions, and rules governing the processing of personal data by entities offering such services.

The Company may suggest that you use external authentication services to confirm your identity if the Company has reasonable concerns about the security of the Account or Transaction.

Signing in or Registration on the Platform using the functionalities of Meta Platforms Ireland Limited (Facebook) takes place through joint control of personal data by Meta and the Company.

The Company and Meta have agreed that Meta shall be responsible for ensuring the enforcement of data subjects' rights, in accordance with Articles 15-20 of the GDPR, in respect of data stored by Meta after the Joint Processing.

The arrangements for joint controlling between the Company and Meta are available at https://www.facebook.com/legal/controller_addendum, and the information on the data that may be processed as part of this joint controlling is available at https://www.facebook.com/legal/terms/businesstools_jointprocessing.

Irrespective of the above, please remember that when you use a public profile (i.e. a profile that can be accessed by any Internet user) when using social media for your own purposes, you share your Personal Data based on your own informed and conscious decision. You should carefully consider any risks that may be associated with sharing your Personal Data publicly, in particular, your address or precise location. Such risks may include identifiability, privacy compromise, and in extreme cases even identity theft.

Your purchases and sales on Allegro, including the execution of Transactions and payment of sales commission or for Goods sold through the Platforms, may entail the need to process other Personal Data, i.e. the data given in the Offer (in particular the content of the Offer), Transaction details (in particular bank account number, payment method, Goods pick-up address, delivery method), invoicing data as well as any data required for shipment tracking, messaging, communicating with other Users and paying for services provided by the Company via the Marketplaces. The Company may also access the content of messages exchanged between the Buyer and the Seller in discussions and disputes. We may use the Personal Data you provided when registering with Allegro for Transaction handling purposes.

In order to handle Transactions concluded without prior Registration or logging into the Account, we process your personal data, such as: name, surname, e-mail address, contact number and shipping address.

Making payments on Allegro, including applying for financing purchases with a deferred payment date, requires the Company to make your data available to financial institutions (e.g., Payment Service Providers, financing entities). This includes identification details (e.g., first name, last name, business name), contact details (e.g., email address, contact number, address), data concerning Transactions, their course and execution (e.g., name and category of products, price, delivery address, type of delivery), as well as information related to the device used to access Allegro services (e.g., the IP address).

In addition, in the scope of sales handling, we may also process your Personal Data including the value of turnover, information on orders (their completion or cancellation, tracking numbers) and information on how the quality of your sales as a Seller compares to other Sellers.

In addition, if you use the Delivery Service with the SwA Functionality, we will receive your Personal Data as the recipient of the Goods, including: first name, last name, delivery address, contact number, and email, address, from the Seller in accordance with the principles described in Appendix No. 16 to the Allegro Terms & Conditions.

If you use the Allegro Paczkomaty InPost delivery option, we may obtain your Personal Data, as the recipient of the Goods, from the delivery service provider, namely contact number.

In the case of explosives precursors sales, we may also process the email address that you put in the Offer to support you in the implementation of duties arising from Article 8 of Regulation (EU) No 2019/1148 of the European Parliament and of the Council of 20 June 2019 on the marketing and use of explosives precursors, amending Regulation (EC) No 1907/2006 and repealing Regulation (EU) No 98/2013.

If you use the Associated Services, we process your Personal Data which is necessary for the proper provision of those services. Where necessary for the provision of an Associated Service, we receive your Personal Data, including the current status of your loan application, the payment status, and the amount of the available revolving limit, details necessary to offer or make an insurance agreement, including to grant premium reductions, from third-party providers also offering their financial services and/or other services through the Company.

Regarding your use of contact forms, we process the contact details required to communicate with you (for example to answer your question) and to meet your request. These can include your first and last name, email address, or contact number.

Additionally, for User support purposes, we may contact you using the data you have posted for this purpose in your User Account or transmitted via social media channels (such as Facebook Messenger, Instagram, Twitter, WhatsApp, or WeChat). If Allegro is contacted through any third-party social media channels, the Company collects Personal Data in the form of Username (in the case of Facebook Messenger, Instagram, Twitter, etc.) or contact number (in the case of WhatsApp, WeChat, etc.) solely for the purpose of contacting you. Where permitted under the applicable law, the Company will also be entitled to obtain (and otherwise process, for example, to store) other Personal Data regarding communicating with you, e.g. information about support requests or reviews from Users.

Your Personal Data may also be processed in outgoing or incoming calls including to the Company call center.. Outgoing or incoming calls, including to the Company call center may be recorded. You will be informed of the recording at the beginning of the call. If you decide to call us, your Personal Data, such as a contact number and content of the recording (including information provided during the call) will be processed by us in order to handle your request.

In connection with your use of automated service systems, including in particular automated communication channels (e.g., chatbots) or AI assistants:

• In your communication with the Seller as part of the Business Account created by the Seller,
• In your communication with the Company,
• In your interactions with the Marketplaces, Associated Services, or Platform functionalities.

We process Personal Data that is necessary to safely implement, configure, and communicate with you, e.g., to provide automatic answers to questions you asked and to complete your request. For this purpose, we can also use artificial intelligence (AI) systems or models, in particular systems or models that facilitate the use of the Platform, obtaining information on the offered products, or accelerating the operation. Using such solutions, we monitor and process information on whether they operate correctly, e.g., whether the automatically generated answer was appropriate, satisfactory for you or if you decided to ask the question again. Using machine learning technology, we automatically analyze your correspondence or interaction for the presence of specific words and their combinations. Based on the keywords we found in your message or interaction, we assess whether the content of the automatic reply or interaction is relevant and met your expectations. This way, such automatic replies will be faster and more helpful.

For automated service systems, including in particular automated communication channels (e.g., chatbots) or AI assistants, we mark them in a way that allows them to be recognized as a tool or functionality based on such technology. The Company supervises the operation of such tools or functionalities and provides the possibility of human verification of any decisions made automatically.

If artificial intelligence (AI) systems or models are used, the Company processes Personal Data on the basis of a legitimate interest, unless the specific use requires other legal grounds, which we will specifically indicate in such cases.

In connection with your participation in loyalty programs, competitions or promotional campaigns, we will process your Personal Data, which is necessary in connection with such events. Depending on the type of event, this can be your first and last name, contact details (such as a contact number or email address) or any other data required to meet the participation criteria of the event concerned. If the event includes prizes, in order to deliver a prize to you, you may be obliged to add your residence address, the number of your identity card or other identity documents, PESEL number, Tax Identification Number (NIP) number, and other data required to hand over the prize (such as bank account number).

In connection with our marketing activities, we may based on the legitimate interests of the Company or the legitimate interests of the entities that cooperate with the Company, in particular, as part of Additional Services, or on your consent, or as part of the performance of a contract concluded with you, process information helping us to match advertising and content to your preferences and expectations (including in connection with displaying behavioral advertising). This information may include, for instance, data stored by cookies or similar technologies (e.g., pixels, SDK, or tags), data available in public registers concerning entrepreneurs (e.g., subject of entrepreneurs’ business activity, status of entrepreneurs’ business activity), or your viewing behavior, including the Offers viewed and your preferences in this respect. Additionally, based on the above prerequisites, we will also process your contact details, including the data necessary to send any information, including commercial information that you have specified (contact number or email).

We may also process your Personal Data for analytical and statistical purposes, including surveys.To this end, we will use mainly information about your activity on the Marketplaces, including that relating to the usage of individual services or functionalities, as well as Personal Data concerning your preferences and expectations. In addition, we may process data available in public registers concerning entrepreneurs (e.g., the subject of entrepreneurs’ business activity, the status of entrepreneurs’ business activity) or received from third-party suppliers (e.g., market position or company health data). The Company may collect your Personal Data, such as age, by means of surveys sent to Users by email or made available directly on the Marketplaces. Your Personal Data may also be used to guarantee an adequate level of security of the Marketplaces. In this context, the Company uses a digital fingerprinting technology, which involves taking the ‘digital fingerprints’ of User devices to identify a device you are using or an application you are installing. The information about you that we collect in this respect can be Personal Data. We may process Personal Data such as your IP address, data stored by cookies or similar technologies (e.g., pixels, SDK, or tags), specifications of your software and hardware, device setup (such as details of installed plugins) or your viewing behavior (including the use of network communication protocols), sites viewed, and use of the Mobile Application.

We may process your Personal Data in connection with our right to establish, exercise or defend claims. To this end, the Company processes your Personal Data as long as the claims arising from an agreement between you and the Company or associated with your use of the services or functionalities provided by Company, via Mobile Application, Marketplaces or Associated Services do not become statute-barred in accordance with the applicable laws and regulations. These data may include, for example, indebtedness, information about a specific Order or Offer, Transaction details, information necessary for the correct filing of a lawsuit or application or initiation of enforcement or information obtained in connection with outgoing or incoming calls, including as part of you making contact through the Company call center. The scope of Personal Data processed by us may vary from time to time depending on the subject of the claim.

Section III. Purposes of, grounds for and period of Personal Data processing by the Company

Depending on the Company services or functionalities you use, there are different purposes and legal grounds for Personal Data processing by the Company and different periods in which the Company may store or use your Personal Data.

For each of the processing purposes, we have defined the legal grounds for the processing and the maximum retention period of Personal Data. After the specified period, we will no longer use the Personal Data for the specified purpose. It does not mean, however, that we will remove them in each case. We will retain your Personal Data for the longest of the periods specified in relation to specific Company services. For example, when you opt out from using the Account, we will no longer process your Personal Data to provide Account services to you, but we will store your Personal Data for the period permitted by law to enable you to assert your rights and to make it possible to show the history of financial settlements between you and the Company.

Below, we have listed the typical operations performed on Personal Data in connection with the use of Company services or functionalities. More details on Personal Data processing in the case of using specific services can also be found in the terms and conditions of such services.

Account registration and management, handling of User’s Transactions

To use some functionalities available on the Marketplaces (including via the Mobile Application), you are required to Register in accordance with the Allegro Terms & Conditions, unless the Allegro Terms & Conditions explicitly provide for the possibility of using it without Registration or logging in (e.g., making a Transaction). We offer the Regular Account and the Business Account. Setting up and using a User Account entails the processing of your Personal Data by us.

In addition, the Company processes your Personal Data to handle your Transactions. Using the Marketplaces (including the Mobile Application), you can in particular:

• Make purchases as a natural person or business using a Regular Account;

• Make sales or publish Classifieds as a natural person using a Regular Account;

• sell or post classifieds as an entrepreneur (as part of your business activity) using a Business Account;

• make purchases without prior Registration or logging into the Account in the cases provided in the Allegro Terms & Conditions.

The information you post in Offers and “Messages to the Buyer” does not originate from the Company and is not initiated by the Company. For this reason, to the maximum extent permissible by applicable law, the Company will not be liable for information posted in Offers and for the “Messages to the Buyer”. As far as possible, you should refrain from providing any Personal Data in the Offers and the “Messages to the Buyer” in places other than dedicated for this purpose. Remember that if you share your Personal Data in Offers or the “Messages to the Buyer”, you are doing this based on your own informed and conscious decision. Therefore, you should carefully consider the risk associated with sharing such information. For more information about purchasing and executing Transactions using the Regular Account or Business Account, please see the Allegro Terms & Conditions.

We process your Personal Data in accordance with the rules described in the table below to manage your User Account and handle your Transactions. For the purposes described in this part, we may use artificial intelligence (AI) systems or models. Additionally, your Personal Data can be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

In relation to some of your Transactions, detailed in Appendix No. 20 to the Allegro Terms & Conditions (Transactions covered by the archiving obligation or VAT settlements made by the Company), we are obliged by applicable legal regulations to process (incl. to archive) personal data related to such Transactions.

In connection with the operation of your Account, we are required to process your Personal Data in order to comply with statutory obligations under REGULATION (EU) 2022/2065 of THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of October 19, 2022, on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (hereinafter: DSA). The Company is required to collect and disclose information on Allegro about sellers who have the status of an entrepreneur and collect and disclose information about entities that paid for advertising and on whose behalf such advertisements are presented.

In connection with the obligations imposed on the Company under the regulations governing the exchange of tax information with other countries, we are obliged to process your Personal Data, including collecting, verifying, and transferring it to competent authorities to the extent required by law. This is the result of the requirements of the DAC7, which aims, among other things, to prevent fraud, abuse or avoidance of legal obligations. In carrying out the activities described in this paragraph, the Company may also process your TIN number, i.e., the taxpayer identification number or its functional equivalent within the meaning of the Act of May 23, 2024, on the exchange of tax information with other countries.

Regulation (EU) 2023/988 of the European Parliament and of the Council of May 10, 2023, on general product safety, amending Regulation (EU) No 1025/2012 of the European Parliament and of the Council and Directive (EU) 2020/1828 of the European Parliament and the Council, and repealing Directive 2001/95/EC of the European Parliament and of the Council and Council Directive 87/357/EEC (GPSR) imposes obligations on the Company to cooperate with market surveillance authorities with respect to activities that could eliminate or reduce the risks posed by products made available by the Company, as appropriate to the case and role of the Company.

Associated Services, including third-party financial services

In connection with its business activities, the Company enables you to use Associated Services provided or shared by the Company or third parties. Associated Services include but are not limited to Deferred Payment for Business, Delivery Service (as part of which the Company provides the Ship with Allegro functionality for Sellers), Allegro Buyer Protection, Allegro Pay, Family Group Functionality, insurance services, payment services, or the provision of services in connection with the fulfillment of Fundraising Goals in Charity Offers (as defined in Appendix No. 17 to the Allegro Terms & Conditions). The above services or functionalities support the core activities of the Company or help you use the Company services, for instance, by financing the Transactions, securing them, or enabling complaints. Associated Services can be provided or shared on the terms set out in the Allegro Terms & Conditions (including its appendices) or subject to separate terms and conditions, including those issued without participation of the Company by suppliers of such services or functionalities. For the purposes described in this part, we may use artificial intelligence (AI) systems or models.

The Company may also participate in the provision of Associated Services by third parties, for example, by:

• Providing information on third-party services and offers;

• By acting as an intermediary in the conclusion of agreements for third-party Associated Services, including by providing access to services related to Transaction financing and securing such as Goods insurance or consumer loans for the purchase of Goods..

In the situation described above, the Company may operate as a Personal Data processor engaged by the controller who provides the services to you, as a controller or joint controller.

In order to offer you and provide you with certain financial services, the Company may collect and process Personal Data contained in public business registers, such as:

• identification data (e.g., NIP (Tax Identification Number, citizenship));

• data on your business activity (place of business activity, date of commencement, suspension, resumption, and termination, including business activity being removed from the register, and its subject matter);

• information about any bankruptcy/recovery proceedings.

In connection with the provision of Associated Services, we process Your Personal Data in accordance with the rules described in the table below. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further paragraphs of this Section of the Policy.

If you use Associated Services provided by third parties independent of the Company, the rules of processing your Personal Data may be set out in documents provided by those third parties on third-party websites or portals, for example, in terms and conditions of service or a privacy policy.

In a separate, dedicated part of Allegro (wakacje.allegro.pl) you can search for Travel Offers and conclude Travel Agreements directly with a selected Partner through a dedicated interface. In this case, the controller of your personal data for the purpose of concluding and performing the Travel Agreement is the Partner (the organizer of the Package Travel) with whom you conclude the agreement.

User support and contact form

When you contact the Company service department, either through outgoing or incoming calls, also by calling the Company call center, the Company may process (for example store or analyze) your Personal Data for Platform operating purposes.

The Company may also collect your Personal Data if you contact us using the tools available on Allegro, including the Allegro contact form. This Personal Data is necessary for the Company to contact you and to allow you to contact other Users, for purposes directly related to the operation of Allegro, for example, in connection with the conclusion of sales contracts as part of Transactions. The contact form provided by the Company must not be used to send private correspondence unrelated to the execution of Transactions and any use for such purposes may violate the Allegro Terms & Conditions. In order to prevent violations of law, including unfair practices, the Company collects data regarding communications made using the aforementioned form. The Company may also analyze and block, using special software, the content of messages exchanged between Users via the aforementioned contact form, in particular, if they are spam (unsolicited advertising information), contain prohibited content (e.g., they prompt to commit crimes), otherwise jeopardize the safety of services or functionalities e.g., their aim is to unlawfully obtain the password to a given Account or violate the Allegro Terms & Conditions.

To handle the queries addressed to Company, also through the contact form, we process your Personal Data in accordance with the rules described in the table below. For the purposes described in this part, we may use artificial intelligence (AI) systems or models. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Loyalty programs, competitions, promotional campaigns

From time to time, the Company runs competitions or promotional campaigns. Such events may also consist of making content or services available in return for providing your Personal Data or giving your consent to their processing. If you decide to take part in an event of that kind, your Personal Data (such as the necessary contact details) may be used by the Company to organize the competition in an efficient way, for example, to notify the winner. Contact details of Users taking part in the events voluntarily are processed by the Company in compliance with the applicable law and for the purposes of such events. Users may also join loyalty programs via the Marketplaces.

If you take part in a program, competition, or promotional campaign, your Personal Data may be used by the Company in accordance with the table below. However, more specific rules for processing Personal Data may be set out in dedicated event terms and conditions. For the purposes described in this part, we may use artificial intelligence (AI) systems or models. Additionally, your Personal Data can be processed for other purposes, including analytical and marketing purposes, creating autonomous tools to automate processes on the Platform, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

Marketing activities

The Company may also use your Personal Data to carry out marketing activities, also in situations where you provide your Personal Data, when we receive your Personal Data from entities cooperating with us or give your consent to its processing. In return the Company makes content or services available to you. Such activities may include:

• displaying marketing content not customized to your preferences on the Marketplaces or in the Mobile Application (contextual advertising). If Personal Data is used to display contextual advertising, they are processed in pursuance of the legitimate interest of the controller or a third-party in promoting Company’s own activities or third-party activities;

• displaying marketing content customized to your preferences, including customization of listing categories or individual offers in Platform settings or settings of platforms of entities cooperating with the Company based on your activity on the Marketplaces or platforms of entities cooperating with the Company (behavioral advertising). The display of marketing content in the indicated scope is also carried out jointly with entities cooperating with the Company, which means displaying marketing content also on the platforms of entities cooperating with the Company. Your Personal Data, including Personal Data collected by means of cookies or similar technologies (e.g., pixels, SDK, or tags), are then processed by the Company and cooperating entities for marketing purposes. Such activities are only undertaken based on your consent, which you can withdraw at any time, or if you meet specific conditions. For more information, see section 4 of the Policy or additional policies or Terms & Conditions describing the potential cooperation of the Company with cooperating entities, which we present at the time of obtaining consent or checking compliance with certain conditions;

• displaying marketing content (contextual and behavioral) in the advertising space of third-party platform operators (e.g., Meta Platforms Ireland Limited, Google Ireland Limited, TikTok Technology Limited, TikTok Information Technologies UK Limited, Microsoft Ireland Operations Limited) based on your activity on the Platform and personal data such as your email address, telephone number or mobile device identification number linked with your Account, allowing the third-party operator to identify you as its user (excluding Junior Accounts). The transfer of personal data takes place in a hashed form, which means that if you are not registered on the respective platform of a third-party operator or if you are registered with other identification data, the third-party platform operator cannot read the data provided to it. Such actions are taken on the basis of the legitimate interest of the Company, and you may object against them at any time;

• displaying marketing content on request of entities cooperating with the Company on the basis of identification data received from them, such as your e-mail address, contact number, or mobile device identification number (external advertisers may request us to create groups of recipients and select personalized ads based on data provided to them directly by you or obtained by them from other third parties). Such actions are taken on the basis of the legitimate interest of the Company, and you can object against them at any time;

• carrying out other activities related to the direct marketing of goods and services (sending of commercial information by electronic means or other marketing activities) through various electronic communication channels, including email, text/MMS and push messages. We may also contact you by telephone. Such activities are undertaken based on the legitimate interests of the Company or the legitimate interests of the entities cooperating with the Company, in particular, as part of Additional Services and on your consent to receive said messages or information. You may withdraw your consent at any time.

• sending satisfaction surveys in connection with the Company's participation in the "Customer Verified" program provided by the Heureka platform operator or other similar programs provided by the Zboží platform operator or another entity or entities. Once you have given your consent, you will receive an email with a satisfaction survey in connection with each Transaction you have concluded as a Buyer. The Heureka platform operator, the Zboží platform operator, or other similar entity cooperating with the Company, acting as the Company's processors, will receive your email address from the Company, along with the information on the Goods purchased. Personal Data will not be processed for any purpose other than sending the satisfaction survey and measuring conversion. Such actions are taken based on the legitimate interest of the Company, which involves assessing your satisfaction level in connection with the Transaction concluded and the Goods purchased and based on your consent for receiving these surveys. You can withdraw your consent at any time. In addition, you can opt out of receiving satisfaction surveys by clicking on the link in the survey — in this case, you will not receive another satisfaction survey.

We process your Personal Data in accordance with the rules described in the table below in connection with our marketing activities. Your Personal Data can also be processed for other purposes, including analytical purposes, creating autonomous tools to automate processes on the Platform, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy. For the purposes described in this part, we may use artificial intelligence (AI) systems or models.

Analytical and statistical activities and surveys

Your Personal Data can be processed by the Company for analytical and statistical purposes. For this purpose, we can also use artificial intelligence (AI) systems or models. In this case, we use your Personal Data for the purposes of activity analysis, identification of purchase preferences, creating autonomous tools to automate processes on the Platform, and improving the Company’s functionalities and service quality. Whether the Company will be permitted to process information collected through cookies or similar technologies (e.g., pixels, SDK, or tags) for analytical and statistical purposes depends on the User's consent to the storage of this information in the User’s terminal device. For more information, see Section 4 of the Policy.

The Company collects Personal Data from Users that can be used to investigate User preferences and adjust the offering of the Company to User needs by means of surveys sent to Users by email or made available directly on the Marketplaces. Such Personal Data is also used for the purposes of statistical analysis. Additionally, Personal Data collected by means of training surveys made available in connection with the provision of the Allegro Academy within User Accounts can be used to promote this training via the Company.

We process your Personal Data in accordance with the rules described in the table below in connection with our analytical and statistical activities. Your Personal Data can also be processed for other purposes, in particular, to guarantee the security of our services, as you will learn from further paragraphs of this Section of the Policy.

Ensuring the security of the provided services and enforcing the terms of the Allegro Terms & Conditions

Where necessary in order to ensure the security of services, including IT resources or security, including the safety of Users, services or functionalities, the Company may automatically obtain and record your Personal Data transmitted to the server by web browsers or your devices if you use the Marketplaces or the Mobile Application.

In order to guarantee an adequate security level, the Company obtains and records Personal Data transmitted to the server by web browsers or your devices (which include in particular: technical components of the device, the way it is used, your browser settings, and details of your viewing behavior on Allegro) in such a way as to create a unique digital ‘fingerprint’ of the devices or instances of applications that you use. The Company may also use this digital ‘fingerprint’ for the purpose of additional User authentication, as part of the authorization methods used. Such measures allow us to prevent abuse and fraud.

In order to counteract abuse, fraud, activities that violate rules of morality, the Allegro Terms & Conditions, and attempts to use your Account without authorization, the Company provides Lexisnexis Risk Solutions (EUROPE) Limited with Personal Data and certain Personal Data from your online interactions. These data allow querying the anonymous digital identity network (DIN) consisting of events originating from the entities participating in the network. Personal Data outside the IP address is provided by us in a masked form in such a way that it is not possible to identify you. Information about the processing of data by Lexisnexis Risk Solutions (EUROPE) Limited can be found here.

In order to counteract misuse, fraud, any activities that infringe the rules of good conduct, the Allegro Terms & Conditions or applicable laws (including national or international restrictive measures) or behaviors that have a negative impact on the security of operation of Allegro and harm other Users, we automatically process Personal Data concerning your activity on Allegro, links to other accounts and the functionalities and tools used.

In order to counteract the occurrences listed above, we will make decisions in your case based on automated data processing, including profiling. For the purposes described in this part, we may also use artificial intelligence (AI) systems or models.

Such operations may result in limiting the use of services or functionalities such as automatic suspension/reinstating of the Account or its particular functionalities participation in programs and payouts of amounts collected being allowed or blocked, reviews being canceled, or sales commission being re-charged automatically.

The Company, acting as a postal Provider, fulfils obligations in the scope of applying specific restrictive measures, including the obligation to freeze the assets of persons entered on the relevant sanctions lists, in accordance with the regulations on counteracting money laundering and terrorism financing.

We process your Personal Data according to the rules described in the table below.

Section IV. IP address, cookies or similar technologies, location, and identification numbers of mobile devices and information concerning profiling

Company may collect your Personal Data via the Marketplaces using such technologies as cookies or similar technologies (e.g., pixels, SDK, or tags). The use of such technologies by the Company is described in detail at https://allegro.pl/regulamin/pl/polityka-plikow-cookies.

The Mobile Application and Allegro Lokalnie service will collect information about the current location of your device if you provide such Personal Data to us. The Company will retain such Personal Data only where you use the remote parcel pick-up option in the apps. Before you start downloading the location information, you will be asked to give your consent to this. The use of such location-related Personal Data by the Company is described in detail at https://allegro.pl/regulaminy/udostepnianie-lokalizacji-yVx7ezEWySE.

The Mobile Application uses the Google Account service to authenticate the User’s device and verify the User’s identity. During the authentication and verification process, none of the User’s Personal Data is shared with the service operator.

For the purposes of processing indicated in Section 3, in particular to carry out marketing and analytical activities, and in connection with the operation of the Account, the Company uses profiling in some cases. This means that through automatic processing of Personal Data, we assess selected factors and information about Users, in particular their activities on Allegro, including on the basis of their purchases made, history of offers viewed, and services used, in order to analyze their behaviors or create a forecast for the future. This allows for better matching the displayed content to the individual preferences and interests of the User.

Section V. Users’ rights in the context of Personal Data processing and how to exercise them

We enable you to exercise all rights you may have under the GDPR, i.e. the rights described in Articles 15 to 22 of the GDPR. For a detailed description of each right, please see below.

The right of access to Personal Data enables you to be informed by the Company how your Personal Data is processed by the Company, including specifically the purposes of and legal grounds for the processing, the scope of Personal Data which is retained, the entities with which your data are shared and the planned time of erasure.

To obtain a copy of your Personal Data processed by the Company, you can exercise your right in this respect.

You may exercise the right to the rectification of Personal Data if you notice that your Personal Data are incorrect or incomplete. If this is the case, we undertake to remove any potential inaccuracies or errors in the Personal Data being processed and to complete the Personal Data where required.

You may exercise the right to the erasure of Personal Data if: your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Company; you withdraw your consent to Personal Data processing; you object to the processing of your Personal Data and there is no other legal ground for the processing; or your Personal Data have been unlawfully processed. In order to exercise your right to the erasure data, you have to terminate your agreement first. You will find a detailed description of how to exercise your right to erase Personal Data here.

You may exercise the right to the restriction of processing of Personal Data if you notice that your Personal Data are incorrect – you may obtain restriction of processing of your Personal Data for a period enabling us to verify the accuracy of the personal data; the processing is unlawful but you oppose the erasure of the personal data; we no longer need your Personal Data but you may require them for the defence or exercise of legal claims; or you have objected to processing of your Personal Data pending the verification whether our legitimate grounds override yours.

You may exercise the right to Personal Data portability if the processing of your Personal Data is based on consent or on a contract between you and the Company, and when the processing is carried out by automated means.

You may exercise the right to object to the processing of Personal Data for marketing purposes at any time if your Personal Data has been processed for marketing purposes, without the need to justify your objection.

You may exercise the right to object against the processing of Personal Data for other purposes at any time, on grounds relating to your particular situation, if your data have been processed for the purposes of the legitimate interests pursued by the Company (e.g. for analytical or statistical purposes). Any objection in this respect should be justified.

You may exercise the right to withdraw your consent at any time where your Personal Data are processed based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

You can exercise your right to human intervention, express your point of view, and contest an automated decision taken against you at any time; if an automated decision has been taken against you that produces legal effects or similarly significantly affects you.

Notwithstanding the provisions above, we have prepared a special instruction for Users who would like to exercise their rights under the GDPR. This document describes in detail how Users can exercise their rights against Company. and it is available here.

If you exercise the right to object to Personal Data profiling, you should log out of all devices and delete cookies from them (in some cases, the process may take up to 48 hours). The instruction how to delete cookies is available in the Cookies Policy here.

You can also contact the data protection officer using a contact form (available here for Buyers and here for Sellers)

Please note that you may lodge a complaint in relation to us processing your Personal Data with a supervisory authority, i.e. the President of the Office of Personal Data Protection (address: Prezes Urzędu Ochrony Danych Osobowych, ul. Moniuszki 1A, 00-014 Warszawa).

Section VI. Personal Data recipients

Company may share your Personal Data with the following third parties:

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications) in order to publish Users’ offers posted in classifieds categories;

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications) which enable a comparison of Transaction reviews, in order to collect reviews of Transactions made on the Marketplaces by means of surveys;

• entities cooperating with the Company that offer their financial services as Associated Services, to assess the User’s creditworthiness, analyze the credit risk, and to grant a potential loan, to perform the contract you concluded, including enforcing any amounts due;

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications), in order to handle the Registration process or use the Account.

Company may cooperate with third parties e.g. specialized providers of Personal Data storage services, analytical services, services related to AI systems or models, debt collection services, in order to enable such entities to provide services to Company. In this case, as a rule, such entities are not authorized to use your Personal Data for their own purposes (Personal Data will always be processed on behalf of and for the Company) and their activities are subject to applicable law and this Privacy Protection Policy;

The scope of collaboration includes:

• information storage and access: storing information or accessing information already stored in your devices such as advertising identifiers, device identifiers, cookies or similar technologies (e.g., pixels, SDK, or tags);

• personalization: collecting and processing information to personalize website or application advertisements and/or content;

• selecting, serving and reporting of advertisements: collecting information and merging it with existing information to select and serve advertisements to you and to measure how effective they are (what advertisements have been displayed; how often, when and where they have been displayed; or whether you have taken any action in relation to the advertisement, for instance clicked the ad or made a purchase);

• Conducting debt collection proceedings;

• Providing services that enable e-learning;

• Providing support/streamlining services for the fulfillment of orders placed on Allegro.

The Company may also share your Personal Data with other entities (such goods delivery companies) where necessary to conclude or perform their contract to which you are a party, or in order to support/improve order processing on Allegro, which includes in particular the following:

• Accepting the order for fulfillment;

• Packing the parcel;

• Delivery of the parcel to the indicated address, including informing on the parcel tracking status.

In the situations mentioned above, the entities with which your Personal Data are shared may become separate data controllers in respect of your Personal Data

We share your Personal Data with parties to your Transactions made on the Marketplaces (and to Charities as defined in Appendix No. 17 to the Allegro Terms & Conditions in the case of Transactions made in connection with Charity Offers) and to entities that support us in providing electronic services, i.e. to providers of payment services, credit services, insurance services, consulting or audit services, entities supporting User service and promotion of Offers, or entities cooperating in marketing campaigns.

We share your Personal Data relating to your image (profile picture) with other Users in the case of the communications through the Allegro Message Centre.

The Company may disclose your Personal Data to public authorities under the applicable laws and regulations in connection with proceedings concerning possible legal violations or addressing any other potential violations of the Allegro Terms & Conditions (including investigations carried out in connection with fraud and abuse committed on Allegro).

Pursuant to its Policy, the Company undertakes not to sell the Personal Data of the Users. In the event of restructuring or sale of the Company’s business or any part thereof, and the transfer of all or a substantial part of its assets to a new owner, the Personal Data of Users, including yours, may be transferred to the new owner in order to ensure the continuation of services provided on the Marketplaces, via the Mobile Application, or the Associated Services.

Based on your consent, the Company may disclose your Personal Data on charytatywni.allegro.pl to public benefit organizations in order to enable them to thank you for your contribution.

In connection with the use of the Family Group Functionality and sending of invitations, your data will be transferred to parties you invite to the Family Group (addressees of invitations); in the invitation we provide: your name indicated in your Account and your email address.

In addition, the User initiating an invitation to the Family Group, to be sent the addressee entrusts the Company for processing, on the basis of the provisions of the Allegro Terms & Conditions, the email address of the addressee of the invitation to the Family Group, in order to deliver the invitation and enable the addressee to use the Family Group Functionality.

By initiating the sending of an invitation to the Family Group to a recipient, the User consents to the Company engaging another processor to process the personal data of the recipient (subprocess) in order to deliver the invitation to the recipient.

The Company will process the invitation addressees’ personal data in accordance with the laws applicable in this respect, and undertakes to:

a. process the email of the invitation recipient only as a result of the User initiating the sending of the invitation to the Family Group to the recipient (taking due account of the provisions of Article 28(3)(a) of the GDPR);

b. ensure that persons authorized to process personal data of invitation recipients have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

c. take (implement) any and all appropriate technical and organizational measures (taking into account state of the art, the costs of implementation and the nature, scope, context, and purposes of the processing, as well as the risk for the rights and freedoms of natural persons, of varying likelihood and severity) to ensure a level of security appropriate to the risk, including, inter alia:

i. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

ii. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing;

iii. compliance with the conditions for engaging another processor under Article 28(2) and Article 28(4) of the GDPR.

Sub-processing of the personal data of the invitation recipient shall only take place in the period of communication with the invitation recipient preceding the acceptance or rejection of the invitation by the recipient. If the invitation is rejected, the Company will store the invitation recipient’s email address in order to monitor the frequency of invitations sent by the User to the same email address, however, for no longer than 30 days. Furthermore, the Company may store the email of the invitation recipient where the applicable law obligates the Company to continue to store the email throughout the retention periods arising from that law.

Within the Account settings, in connection with the use of the Family Group Functionality by the User, the Company displays the following personal data of other group members to the Family Group Members and Family Group Manager:

a. The following information is displayed to the Family Group Manager: the profile picture of the User available in the Account, the name set in the Account by the User, and email address, a badge: adult, youth, child.

b. The following information is displayed to a Family Group Member: the profile picture of the User available in the Account, the name set in the Account by the User, and email address without the domain of another Family Group Member, email address of the Family Group Manager, a badge: adult, youth, child.

As it is necessary to prevent web robots from performing certain functions on the Platforms, we use, in addition to our own tools and those of our processors, the Google reCAPTCHA solution provided by Google Ireland Ltd. This functionality involves the acquisition of hardware and software information (such as device and search engine data), and its independent analysis by Google.

Information collected through reCAPTCHA is used by Google to provide, maintain, and improve functionalities, and for general security purposes.

Company may share anonymized Personal Data (i.e. data that do not identify specific Users) with third-party service providers, trusted partners, or research agencies in order to better understand the attractiveness of advertisements and services to Users, improve the overall quality and performance of services provided by the Company or the aforementioned entities, or to participate in scientific research offering broadly understood benefits to the society.

If you sell via a Business Account, you are required — after obtaining from the Company the Personal Data of other Users who are natural persons — to comply with all obligations arising from the GDPR, including the information obligation, and to ensure that they may exercise their rights under the GDPR.

Section VII. Transfers of Personal Data to countries outside the European Economic Area

Your Personal Data may be transferred outside the European Economic Area, for example to:

• DataDog, Inc with its registered office in New York, USA, in connection with the use of Personal Data processing services offered by this party to ensure the provision of services offered on Allegro by the Company;

• Khoros, LLC. with its registered office in San Francisco, USA, in connection with using the community available at https://spolecznosc.allegro.pl/ by Users, for the exchange of knowledge and mutual assistance between its members,

• Regulatory DataCorp Limited with its registered office in London, United Kingdom, in connection with the use of services supporting analysis for the purpose of counteracting money laundering and terrorism financing,

• SFDC UK, Ltd (SalesForce) with its registered office in London, UK, in connection with the use of Personal Data processing services offered by this party to ensure the provision of services by the Company offered on Allegro.

At the same time, as part of cooperation with processors, data processing may be further entrusted to entities that may transfer data to countries outside the European Economic Area. Parties that systematically process data for Allegro include:

• EasyGenerator B.V. with its registered office in Rotterdam, the Netherlands, provider of e-learning services offered in the Allegro Academy,

• Google Cloud Poland sp. z o.o. with its registered office in Warsaw, Poland, in connection with the use of the electronic mail system and the Google Workspace tools, for statistical and administrative purposes and in connection with the use of Personal Data processing services offered by this party to ensure the provision of services by the Company offered on Allegro,

• Google Ireland Limited, with its registered office in Dublin, Ireland, in connection with the use of the Google reCAPTCHA system in order to ensure security,

• INFOBIP sp. z o.o., with its registered office in Wrocław, Poland, in connection with the use of Personal Data processing services offered by this entity for the sending of SMS messages,

• Lexisnexis Risk Solutions (EUROPE) Limited, based in Dublin, Ireland, in connection with the use of the ThreatMetrix service to ensure the security of the provision of services by the Company offered on Allegro,

• Microsoft Ireland Operations, Ltd with its registered office in Dublin, Ireland, in connection with the use of Personal Data processing services offered by this party to ensure the provision of services by the Company offered on Allegro,

• Meta Platforms Ireland Limited with its registered office in Dublin, Ireland, in connection with the use of the authentication services offered by this party,

• SFDC Ireland, Ltd (SalesForce) with its registered office in Dublin, Ireland, in connection with the use of Personal Data processing services offered by this party to ensure the provision of services by the Company offered on Allegro,

• Snowflake Computing Netherlands, B.V. with its registered office in Amsterdam, the Netherlands, in connection with the use of Personal Data processing services offered by this entity, aimed at ensuring the provision of services offered on Allegro by the Company.

• Genesys Cloud Services BV with its registered office in Amsterdam, the Netherlands, in connection with the use of Personal Data processing services offered by this party to ensure the provision of services offered on Allegro by the Company

The Company always relies on mechanisms ensuring an adequate level of protection, for example, by using standard contractual clauses for the transfer of Personal Data to Personal Data processors established in third countries approved by the European Commission. You can receive copies of such clauses from the Company by writing to iod@allegro.pl or iod@allegro.cz (dedicated to service in Czech) or iod@allegro.sk (dedicated to service in Slovak) or iod@allegro.hu (dedicated to service in Hungarian).

In the event of a Transaction made by the User with a Seller outside the European Economic Area, Personal Data are transferred outside the European Economic Area once for the purpose of making a specific Transaction. The transfer of Personal Data is necessary for the performance of the agreement between the Company and Users making Transactions, as well as for the execution of the Transaction itself between Users.

Section VIII. Amendments

If necessary, the Company may amend this Privacy Protection Policy. In this case, paragraphs 14.1 and 14.2 of the Allegro Terms & Conditions apply accordingly.

Section IX. Contact details

For more information on the processing of your Personal Data and answers to questions concerning the Privacy Policy, please contact our data protection officer. The contact details are as follows:

e-mail address: iod@allegro.pl or iod@allegro.cz (dedicated to service in Czech), or iod@allegro.sk (dedicated to service in Slovak) or iod@allegro.hu (dedicated to service in Hungarian),

mailing address: Inspektor Ochrony Danych Allegro sp. z o.o., ul. Wierzbięcice 1B, 61-569 Poznań.

You can also contact the data protection officer using a contact form (available here for Buyers and here for Sellers).