Appendix No. 5. Privacy Protection Policy

Table of Contents

• Section I. Definitions, purposes and scope of application of the Policy
• Section II. Scope of Personal Data processed by the Company
• Section III. Purposes of, grounds for and period of Personal Data processing by the Company
• Section IV. IP address, cookies, location, and identification numbers of mobile devices and information concerning profiling
• Section V. Users’ rights in the context of Personal Data processing and how to exercise them
• Section VI. Personal Data recipients
• Section VII. Transfers of Personal Data to countries outside the European Economic Area
• Section VIII. Amendments
• Section IX. Contact details

Section I. Definitions, purposes and scope of application of the Policy

DEFINITIONS

1. Mobile Application – each of the applications that constitute Company software, intended for installation on mobile devices, enabling the use of Company services or Platforms.

2. Personal Data – within the meaning of the definition in Article 4(1) of the GDPR, personal data means any information relating to an identified natural person or a natural person identifiable by one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including first and last name, contact number, email, delivery address for Goods purchased on Allegro, device IP, location data, an online identifier and information collected by means of cookies and other similar technologies.

3. Policy – this Privacy Protection Policy.

4. GDPR – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data, the free movement of such data, and repealing Directive 95/46/EC.

5. Marketplaces – online marketplaces operated as part of the Company’s business activities, in particular: Allegro, Allegro Lokalnie, and the www.charytatywni.allegro.pl online platform.

6. Associated Services – services or functionalities provided or shared by the Company or by third parties, including services provided under separate terms and conditions, which support the core activities of the Company or facilitate the use of Company services or functionalities by Users, for instance, by providing Transaction financing and security or enabling Transaction complaints.

PURPOSES AND SCOPE OF APPLICATION OF THE POLICY

The Personal Data Controller for Users that are natural persons is the Company. This means that the Company determines the purposes and means of processing your Personal Data.

The purpose of the Policy is to define the measures taken by the Company to protect your Personal Data processed while using the Marketplaces, the Mobile Application, and as part of the related services (including Associated Services). The Policy sets out, in particular, the scope of and legal grounds for processing your Personal Data that we collect in connection with your use of the Mobile Application, Marketplaces, and Associated Services. We receive your Personal Data from you when you set up the Allegro User Account, in connection with your activities (including Transactions) on the Marketplaces, posting or viewing of Offers, and in connection with updates of your Personal Data that you make using the Account. Personal Data processing can also be related to a range of other activities carried out by you that are directly associated with the use of the Mobile Application, Marketplaces and Associated Services. We can receive data regarding your shipments directly from the carrier or from the Seller. If you use Associated Services, your Personal Data can also be provided to us by third-party vendors who offer the Associated Services.

You may only use the Marketplaces, download the Mobile Application, or use the related services after you have read this Policy and Terms & Conditions.

If you click the links posted on the Marketplaces or in the Mobile Application, you can be redirected to websites or portals that are controlled or provided by entities other than Company. In that case, Personal Data processing follows the rules defined by such entities, for instance, in the privacy policy applicable to the services or applications available on third-party websites or portals.

Company activities are subject to data protection laws, in particular, the GDPR and the Personal Data Protection Act of 10 May 2018. If you have any questions or concerns about the protection of your Personal Data by the Company, please contact the Company. Our contact details are provided in section IX of the Policy.

Section II. Scope of Personal Data processed by the Company

The scope of Personal Data processed by the Company may vary depending on the services or functionalities provided by the Company that you use. To help you understand which of your Personal Data we collect, below we have provided information about the Personal Data categories that we process, categorizing them by processing purposes.

At Registration, we require you to provide the following Personal Data:

When you are registering a Regular Account:

• email address or telephone number, password;
• Email or contact number, password and birth date

When you are registering a Business Account:

• email, login, password, contact number and company (enterprise) details, including address.

If for any reason, you do not provide those Personal Data, unfortunately, we will be unable to enter into an agreement with you. Consequently, you will not be able to use the Company services available to registered Users.

After Registration, in order to fully enjoy your Account, you are obliged to enter your identification data and inform us of your delivery address (where you will need to provide the street name, building number, apartment number, city, and postcode) as well as the contact details needed to get in touch with you (your email). In order to fully use the Marketplaces, you are additionally obligated to inform us about your age, so that we can verify your legal capacity to act and thus adjust the scope of authority you will enjoy in connection with your User Account. If we are provided with details of an account for withdrawals, we will be processing personal data related to such an account, i.e., first and last name, account number and residence address.

In order to fully activate the Account, you will be obliged to make a verification transfer or provide relevant documents for verification purposes. Thanks to that, we will be able to confirm the data provided by you during the Account-opening process. We will return the amount sent in the verification transfer within a few days. Personal data related to the Transaction and included in verification documents will be processed for the purposes of the operations of the Platforms.

The Account activation can also be confirmed by any payment transaction executed through our Partners, i.e., entities performing payment processing services.

By accepting Allegro Terms & Conditions, you confirm that you authorize the payment services provider that participates in transaction processing to transfer to Company data intended for verification purposes, related to the payment transaction.

Please remember that after registering your Account and using Company services or functionalities, you are obliged to update your Personal Data on an ongoing basis if they change in any manner.

When you use your Account, we additionally collect information about your activities on the Marketplaces, such as your history of purchases, Offers posted, selected payment methods, and content of comments and reviews.

Using your User Account, you can also provide other optional Personal Data, such as uploading your photo or a graphic representation of your image (a profile picture), thus consenting to their processing. The provision of such Personal Data is fully optional.

Furthermore, we can obtain your Personal Data when you take the option to log in to the Platforms or Register on Platforms through third-party authentication services offered by other parties operating independently from the Company (e.g., services offered by Google, Apple, or services offered as part of websites including social media, such as Facebook, mall.cz, mall.sk). In that case, we obtain your Personal Data only in the form of your full name or login, email address, and profile picture published in such a service or website (the scope of the data acquired depends on the functionality you use), and these Data can be assigned to your Account or processed only for the purposes of logging in or Registration on Platforms. If it is necessary to obtain additional data, we will inform you about it, indicating its scope. When using third-party authentication services, you should read the relevant terms and conditions, and rules governing the processing of personal data by entities offering such services.

Signing in or Registration on the Platform using the functionalities of Meta Platforms Ireland Limited (Facebook) takes place through joint controlling of personal data by Meta and Allegro.

Allegro and Meta have agreed that Meta shall be responsible for ensuring the enforcement of data subjects’ rights, in accordance with Articles 15-20 of the GDPR, in respect of data stored by Meta after the Joint Processing.

The arrangements for joint controlling between Allegro and Meta are available at https://www.facebook.com/legal/controller_addendum, and the information on the data that may be processed as part of this joint controlling is available at https://www.facebook.com/legal/terms/businesstools_jointprocessing.

Irrespective of the above, please remember that when you use a public profile (i.e. a profile that can be accessed by any Internet user) when using social media for your own purposes, you share your Personal Data based on your own informed and conscious decision. You should carefully consider any risks that may be associated with sharing your Personal Data publicly, in particular, your address or precise location. Such risks may include identifiability, privacy compromise, and in extreme cases even identity theft.

Your purchases and sales on Allegro, including the execution of Transactions and payment of sales commission or for Items sold through the Platforms, may entail the need to process other Personal Data, i.e. the data given in the Offer (in particular the content of the Offer), Transaction details (in particular bank account number, payment method, Goods pick-up address, delivery method), invoicing data as well as any data required for shipment tracking, messaging, communicating with other Users and paying for services provided by the Company via the Marketplaces. The Company may also access the content of messages exchanged between the Buyer and the Seller in discussions and disputes. We may use the Personal Data you provided when registering with Allegro for Transaction handling purposes.

In order to handle Transactions concluded without prior Registration or logging into the Account, we process your personal data, such as: name, surname, e-mail address, contact number and shipping address.

Additionally, for the purposes of sales support, we may also process your Personal Data such as turnover value, order details (execution or cancellation, shipment numbers), and information about how your sales quality as a Seller compares to other Sellers.

Furthermore, if you use the Delivery Service with the WzA Functionality, we will receive your Personal Data as the recipient of the Goods from the Seller, including name, Shipment delivery address, contact number and email, subject to the terms set out in Appendix No. 16 to the Terms & Conditions.

If you use the Allegro Paczkomaty InPost delivery option, we may obtain your Personal Data, as the recipient of the Goods, from the delivery service provider, namely contact number.

In the case of explosives precursors sales, we may also process the email address that you put in the Offer to support you in the implementation of duties arising from Article 8 of Regulation (EU) No 2019/1148 of the European Parliament and of the Council of 20 June 2019 on the marketing and use of explosives precursors, amending Regulation (EC) No 1907/2006 and repealing Regulation (EU) No 98/2013.

If you use the Associated Services, we process your Personal Data which is necessary for the proper provision of those services. Where necessary for the provision of an Associated Service, we receive your Personal Data, including the current status of your loan application, the payment status, and the amount of the available revolving limit, details necessary to offer or make an insurance agreement, including to grant premium reductions, from third-party providers also offering their financial services and/or other services through Allegro.

Regarding your use of contact forms, we process the contact details required to communicate with you (for example to answer your question) and to meet your request. These can include your first and last name, email address, or contact number.

Additionally, for User support purposes, we may contact you using the data you have posted for this purpose in your User Account or transmitted via social media channels (such as Facebook Messenger, Instagram, Twitter, WhatsApp, or WeChat). If Allegro is contacted through any third-party social media channels, the Company collects Personal Data in the form of User name (in the case of Facebook Messenger, Instagram, Twitter, etc.) or contact number (in the case of WhatsApp, WeChat, etc.) solely for the purpose of contacting you. Where permitted under the applicable law, the Company will also be entitled to obtain (and otherwise process, for example, to store) other Personal Data regarding communicating with you, e.g. information about support requests or reviews from Users.

Your Personal Data may also be processed in outgoing or incoming calls including to the Company call center.. Outgoing or incoming calls, including to the Company call center may be recorded. You will be informed of the recording at the beginning of the call. If you decide to call us, your Personal Data, such as a contact number and content of the recording (including information provided during the call) will be processed by us in order to handle your request.

In connection with your use of the channels for automated communication (chatbots) provided by the Company:

• in your communication with the Seller as part of the Business Account by them,
• in your communication with the Company,

we process Personal Data that is necessary to communicate with you, e.g., to provide automatic answers to questions you asked and to complete your request. We collect information on whether the automatically generated answer was satisfactory for you or if you decided to ask the question again. Using machine learning technology, we automatically analyze your correspondence for the presence of specific words and their combinations. Based on the keywords found in your message, the automatic reply sent and your decision, we assess whether the content of the automatic reply met your expectations. This way, such automatic replies will be faster and more helpful.

In connection with your participation in loyalty programs, competitions or promotional campaigns, we will process your Personal Data, which is necessary in connection with such events. Depending on the type of event, this can be your first and last name, contact details (such as a contact number or email address) or any other data required to meet the participation criteria of the event concerned. If the event includes prizes, in order to deliver a prize to you, you may be obliged to add your residence address, the number of your identity card or other identity documents, PESEL number, Tax Identification Number (NIP) number, and other data required to hand over the prize (such as bank account number).

In connection with our marketing activities, we may based on the legitimate interests of the Company or the legitimate interests of the entities that cooperate with the Company, in particular, as part of Additional Services, or on your consent, or as part of the performance of a contract concluded with you, process information helping us to match advertising and content to your preferences and expectations (including in connection with displaying behavioral advertising). This information may include, for instance, data stored by cookies or your viewing behavior, including the Offers viewed and your preferences in this respect. Additionally, based on the above prerequisites, we will also process your contact details, including the data necessary to send any information, including commercial information that you have specified (contact number or email).

We may also process your Personal Data for analytical and statistical purposes, including surveys.To this end, we will use mainly information about your activity on the Marketplaces, including that relating to the usage of individual services or functionalities, as well as Personal Data concerning your preferences and expectations. The Company may collect your Personal Data, such as age, by means of surveys sent to Users by email or made available directly on the Marketplaces.

Your Personal Data may also be used to guarantee an adequate level of security of the Marketplaces. In this context, the Company uses a digital fingerprinting technology, which involves taking the ‘digital fingerprints’ of User devices to identify a device you are using or an application you are installing. The information about you that we collect in this respect can be Personal Data. We may process Personal Data such as your IP address, data stored by cookies, specifications of your software and hardware, device setup (such as details of installed plugins) or your viewing behavior (including the use of network communication protocols), sites viewed, and use of the Mobile Application.

We may process your Personal Data in connection with our right to establish, exercise or defend claims. To this end, the Company processes your Personal Data as long as the claims arising from an agreement between you and the Company or associated with your use of the services or functionalities provided by Company, Mobile Application, Marketplaces or Associated Services do not become statute-barred in accordance with the applicable laws and regulations. These data may include, for example, indebtedness, information about a specific Order or Offer, Transaction details, information necessary for the correct filing of a lawsuit or application or initiation of enforcement or information obtained in connection with outgoing or incoming calls, including as part of you making contact through the Company call center. The scope of Personal Data processed by us may vary from time to time depending on the subject of the claim.

Section III. Purposes of, grounds for and period of Personal Data processing by the Company

Depending on the Company services or functionalities you use, there are different purposes and legal grounds for Personal Data processing by the Company and different periods in which the Company may store or use your Personal Data.

For each of the processing purposes, we have defined the legal grounds for the processing and the maximum retention period of Personal Data. After the specified period, we will no longer use the Personal Data for the specified purpose. It does not mean, however, that we will remove them in each case. We will retain your Personal Data for the longest of the periods specified in relation to specific Company services. For example, when you opt out from using the Account, we will no longer process your Personal Data to provide Account services to you, but we will store your Personal Data for the period permitted by law to enable you to assert your rights and to make it possible to show the history of financial settlements between you and the Company.

Below, we have listed the typical operations performed on Personal Data in connection with the use of Company services or functionalities. More details on Personal Data processing in the case of using specific services can also be found in the terms and conditions of such services.

ACCOUNT REGISTRATION AND MANAGEMENT, HANDLING OF USER'S TRANSACTIONS

To use some functionalities available on the Marketplaces (including via the Mobile Application), you are required to Register in accordance with the Terms & Conditions, unless the Terms & Conditions explicitly provide for the possibility of using it without Registration or logging in (e.g., making a Transaction). We offer the Regular Account and the Business Account. Setting up and using a User Account entails the processing of your Personal Data by us.

In addition, the Company processes your Personal Data to handle your Transactions. Using the Marketplaces (including the Mobile Application), you can in particular:

• buy as a natural person or entrepreneur using a Regular Account;

• sell or post Classifieds as a natural person using a Regular Account;

• sell or post Classifieds as an entrepreneur (as part of your business activity) using a Business Account;

• make purchases without prior Registration or logging into the Account in the cases provided in the Terms & Conditions.

The information you post in Offers and “Messages to the Buyer” does not originate from the Company and is not initiated by the Company. For this reason, to the maximum extent permissible by applicable law, the Company will not be liable for information posted in Offers and for the “Messages to the Buyer”. As far as possible, you should refrain from providing any Personal Data in the Offers and the “Messages to the Buyer” in places other than dedicated for this purpose. Remember that if you share your Personal Data in Offers or the “Messages to the Buyer”, you are doing this based on your own informed and conscious decision. Therefore, you should carefully consider the risk associated with sharing such information. For more information about purchasing and executing Transactions using the Regular Account or Business Account, please see the Terms & Conditions.

We process your Personal Data in accordance with the rules described in the table below to manage your User Account and handle your Transactions. Additionally, your Personal Data can be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

In relation to some of your Transactions, detailed in Appendix No. 20 to the Terms & Conditions (Transactions covered by the archiving obligation or VAT settlements made by the Company), we are obliged by applicable legal regulations to process (incl. to archive) personal data related to such Transactions.

In connection with the operation of your Account, we are required to process your Personal Data in order to comply with statutory obligations under REGULATION (EU) 2022/2065 of THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of October 19, 2022, on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (hereinafter: DSA). The Company is required to collect and disclose information on Allegro about sellers who have the status of an entrepreneur and collect and disclose information about entities that paid for advertising and on whose behalf such advertisements are presented.

ASSOCIATED SERVICES, INCLUDING THIRD-PARTY FINANCIAL SERVICES

In connection with its business activities, the Company enables you to use Associated Services provided or shared by the Company or third parties. Associated Services include but are not limited to Odroczona Płatność dla Firm (Deferred Payment for Business), Usługa Dostawy (Delivery Service) (as part of which the Company provides the Wysyłam z Allegro (Shipping with Allegro) functionality for Sellers), Allegro Protect, Allegro Pay, Family Group Functionality, insurance services, or the provision of services in connection with the fulfillment of Fundraising Goals in Charity Offers (as defined in Appendix No. 17 to the Terms & Conditions). The above services or functionalities support the core activities of the Company or help you use the Company services, for instance, by financing the Transactions, securing them, or enabling complaints. Associated Services can be provided or shared on the terms set out in the Terms & Conditions (including its appendices) or subject to separate terms and conditions of such services or functionalities.

The Company may also participate in the provision of Associated Services by third parties, for example, by:

• providing information on third-party services and proposals;

• intermediating in the conclusion of agreements for third party Associated Services, including by providing access to services related to Transaction financing and securing such as goods insurance or consumer loans for purchases.

In the situation described above, the Company may operate as a Personal Data processor engaged by the controller who provides the services to you.

In connection with the provision of Associated Services, we process Your Personal Data in accordance with the rules described in the table below. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

If you use Associated Services provided by third parties independent of the Company, the rules of processing your Personal Data may be set out in documents provided by those third parties on third-party websites or portals, for example, in terms and conditions of service or a privacy policy.

USER SUPPORT AND CONTACT FORM

When you contact the Company service department, either through outgoing or incoming calls, also by calling the Company call center, Company may process (for example store or analyze) your Personal Data for Platform operating purposes.

The Company may also collect your Personal Data if you contact us using the tools available on Allegro, including the Allegro contact form. This Personal Data is necessary for the Company to contact you and to allow you to contact other Users, for purposes directly related to the operation of Allegro, for example, in connection with the conclusion of sales contracts as part of Transactions. The contact form provided by the Company must not be used to send private correspondence unrelated to the execution of Transactions and any use for such purposes may violate the Terms & Conditions. In order to prevent violations of law, including unfair practices, the Company collects data regarding communications made using the aforementioned form. The Company may also analyze and block, using special software, the content of messages exchanged between Users via the aforementioned contact form, in particular, if they are spam (unsolicited advertising information), contain prohibited content (e.g., they prompt to commit crimes), otherwise jeopardize the safety of services or functionalities e.g., their aim is to unlawfully obtain the password to a given Account or violate the Terms & Conditions.

To handle the queries addressed to Company, also through the contact form, we process your Personal Data in accordance with the rules described in the table below. Your Personal Data can also be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

LOYALTY PROGRAMS, COMPETITIONS, PROMOTIONAL CAMPAIGNS

From time to time, the Company runs competitions or promotional campaigns. Such events may also consist of making content or services available in return for providing your Personal Data or giving your consent to their processing. If you decide to take part in an event of that kind, your Personal Data (such as the necessary contact details) may be used by the Company to organize the competition in an efficient way, for example, to notify the winner. Contact details of Users taking part in the events voluntarily are processed by the Company in compliance with the applicable law and for the purposes of such events. Users may also join loyalty programs via the Marketplaces.

If you take part in a program, competition, or promotional campaign, your Personal Data may be used by the Company in accordance with the table below. However, more specific rules for processing Personal Data may be set out in dedicated event terms and conditions. Additionally, your Personal Data can be processed for other purposes, including analytical and marketing purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

MARKETING ACTIVITIES

The Company may also use your Personal Data to carry out marketing activities, also in situations where you provide your Personal Data or give your consent to its processing in return the Company makes content or services available to you. Such activities may include:

• displaying marketing content not customized to your preferences on the Marketplaces or in the Mobile Application (contextual advertising). If Personal Data is used to display contextual advertising, they are processed in pursuance of the legitimate interest of the controller or a third-party in promoting Company’s own activities or third-party activities;

• displaying marketing content customized to your preferences, including customization of listing categories or individual offers in Platform settings or settings of third-party services based on your activity on the Marketplaces (behavioral advertising). Your Personal Data, including Personal Data collected by means of cookies and other similar technologies, are then processed by the Company and third parties for marketing purposes. Such activities are only undertaken based on your consent, which you can withdraw at any time. For more information, see section IV of the Policy;

• displaying marketing content (contextual and behavioral) in the advertising space of third-party platform operators (e.g., Meta Platforms Ireland Limited, Google Ireland Limited) based on your activity on the Platform and your email address or telephone number or mobile device identification number linked with your Account, allowing the third-party operator to identify you as its user (excluding Junior Accounts). The transfer of personal data takes place in a hashed form, which means that if you are not registered on the respective platform of a third-party operator or if you are registered with other identification data, the third-party platform operator cannot read the data provided to it. Such actions are taken on the basis of the legitimate interest of the Company, and you may object against them at any time;

• carrying out other activities related to the direct marketing of goods and services (sending of commercial information by electronic means or other marketing activities) through various electronic communication channels, including email, text/MMS and push messages. We may also contact you by telephone. Such activities are undertaken based on the legitimate interests of the Company or the legitimate interests of the entities cooperating with the Company, in particular, as part of Additional Services and on your consent to receive said messages or information. You may withdraw your consent at any time.

• sending satisfaction surveys in connection with the Company’s participation in the “Customer Verified” program provided by the Heureka platform operator or other similar programs provided by another entity or entities. Once you have given your consent, you will receive an email with a satisfaction survey in connection with each Transaction you have concluded as a Buyer. The Heureka platform operator or other similar entity cooperating with the Company, acting as the Company’s processors, will receive your email address from the Company, along with the information on the Goods purchased. Personal Data will not be processed for any purpose other than sending the satisfaction survey. Such actions are taken based on the legitimate interest of the Company, which involves assessing your satisfaction level in connection with the Transaction concluded and the Goods purchased, and based on your consent for receiving these surveys. You can withdraw your consent at any time. In addition, you can opt out of receiving satisfaction surveys by clicking on the link in the survey — in this case, you will not receive another satisfaction survey.

We process your Personal Data in accordance with the rules described in the table below in connection with our marketing activities. Your Personal Data can also be processed for other purposes, including analytical purposes, and to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

ANALYTICAL AND STATISTICAL ACTIVITIES AND SURVEYS

Your Personal Data can be processed by the Company for analytical and statistical purposes. In this case, we use your Personal Data for the purposes of activity analysis, identification of purchase preferences, and improving the Company’s functionalities and service quality. Whether Company will be permitted to process information collected through cookies and similar technologies for analytical and statistical purposes depends on the User's consent to the storage of this information in the User’s terminal device. For more information, see section IV of the Policy.

The Company collects Personal Data from Users that can be used to investigate User preferences and adjust the offering of the Company to User needs by means of surveys sent to Users by email or made available directly on the Marketplaces. Such Personal Data is also used for the purposes of statistical analysis. Additionally, Personal Data collected by means of training surveys made available in connection with the provision of the Allegro Academy within User Accounts can be used to promote this training via the Company.

We process your Personal Data in accordance with the rules described in the table below in connection with our analytical and statistical activities. Your Personal Data can also be processed for other purposes, in particular, to guarantee the security of our services, as you will learn from further sections of this section of the Policy.

ENSURING THE SECURITY OF THE PROVIDED SERVICES AND ENFORCING THE TERMS OF THE ALLEGRO TERMS & CONDITIONS

Where necessary in order to ensure the security of services, including IT resources or security, including the safety of Users, services or functionalities, the Company may automatically obtain and record your Personal Data transmitted to the server by web browsers or your devices if you use the Marketplaces or the Mobile Application.

In order to guarantee an adequate security level, the Company obtains and records Personal Data transmitted to the server by web browsers or your devices (which include in particular: technical components of the device, your browser settings, and details of your viewing behavior on Allegro) in such a way as to create a unique digital ‘fingerprint’ of the devices or instances of applications that you use. The Company may also use this digital ‘fingerprint’ for the purpose of additional User authentication. Such measures allow us to prevent abuse and fraud.

In order to counteract misuse, fraud, infringement of decorum, the Allegro Terms & Conditions or applicable laws (including national or international restrictive measures) or behaviors that have a negative impact on the security of operation of Allegro and harm other Users, we automatically process the Personal Data concerning your activity on Allegro, links to other accounts and the functionalities and tools used.

In order to counteract the occurrences listed above, we will make decisions in your case based on automated data processing, including profiling.

Such operations may result in limiting the use of services or functionalities, e.g., the Account or its particular functionalities getting suspended/unsuspended, participation in programs and withdrawing the amounts collected being allowed or blocked, reviews being canceled, or sales commission being re-charged automatically.

We process your Personal Data pursuant to the rules described in the table below.

Section IV. IP address, cookies, location, and identification numbers of mobile devices and information concerning profiling

Company may collect your Personal Data via the Marketplaces using such technologies as cookies, tracking pixels, and local shared objects (e.g. in a browser or device). The use of such technologies by the Company is described in detail at https://allegro.pl/regulamin/pl/polityka-plikow-cookies.

The Mobile Application and Allegro Lokalnie service will collect information about the current location of your device if you provide such Personal Data to us. The Company will retain such Personal Data only where you use the remote parcel pick-up option in the apps. Before you start downloading the location information, you will be asked to give your consent to this. The use of such location-related Personal Data by the Company is described in detail at https://allegro.pl/regulaminy/udostepnianie-lokalizacji-yVx7ezEWySE.

The Mobile Application uses the Google Account service to authenticate the User’s device and verify the User’s identity. During the authentication and verification process, none of the User’s Personal Data is shared with the service operator.

For the purposes of processing indicated in Section 3, in particular to carry out marketing and analytical activities, and in connection with the operation of the Account, the Company uses profiling in some cases. This means that through automatic processing of Personal Data, we assess selected factors and information about Users, in particular their activities on Allegro, including on the basis of their purchases made, history of offers viewed, and services used, in order to analyze their behaviors or create a forecast for the future. This allows for better matching the displayed content to the individual preferences and interests of the User.

Section V. Users’ rights in the context of Personal Data processing and how to exercise them

We enable you to exercise all rights you may have under the GDPR, i.e. the rights described in Articles 15 to 22 of the GDPR. For a detailed description of each right, please see below.

The right of access to Personal Data enables you to be informed by the Company how your Personal Data is processed by the Company, including specifically the purposes of and legal grounds for the processing, the scope of Personal Data which is retained, the entities with which your data are shared and the planned time of erasure.

You may exercise the right to obtain a copy of your Personal Data in order to receive a copy of your Personal Data which is processed by the Company.

You may exercise the right to rectification of Personal Data if you notice that your Personal Data are incorrect or incomplete. If this is the case, we undertake to remove any potential inaccuracies or errors in the Personal Data being processed and to complete the Personal Data where required.

You may exercise the right to erasure of Personal Data if: your Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Company; you withdraw your consent to Personal Data processing; you object to the processing of your Personal Data and there is no other legal ground for the processing; or your Personal Data have been unlawfully processed. In order to exercise your right to the erasure data, you have to terminate your agreement first. You will find a detailed description of how to exercise your right to erase Personal Data here.

You may exercise the right to restriction of processing of Personal Data if you notice that your Personal Data are incorrect – you may obtain restriction of processing of your Personal Data for a period enabling us to verify the accuracy of the personal data; the processing is unlawful but you oppose the erasure of the personal data; we no longer need your Personal Data but you may require them for the defence or exercise of legal claims; or you have objected to processing of your Personal Data pending the verification whether our legitimate grounds override yours.

You may exercise the right to Personal Data portability if the processing of your Personal Data is based on consent or on a contract between you and the Company, and when the processing is carried out by automated means.

You may exercise the right to object against the processing of Personal Data for marketing purposes at any time if your Personal Data have been processed for marketing purposes, without the need to justify your objection.

You may exercise the right to object against the processing of Personal Data for other purposes at any time, on grounds relating to your particular situation, if your data have been processed for the purposes of the legitimate interests pursued by the Company (e.g. for analytical or statistical purposes). Any objection in this respect should be justified.

You may exercise the right to withdraw your consent at any time where your Personal Data are processed based on consent, without affecting the lawfulness of processing based on consent before its withdrawal.

You may exercise your right to human intervention, express your position, and question an automatic decision made towards you at any moment; if the automatic decision made towards you has legal effects or substantially affects you in a similar way.

Notwithstanding the provisions above, we have prepared a special instruction for Users who would like to exercise their rights under the GDPR. This document describes in detail how Users can exercise their rights against Company. and it is available here.

If you exercise your right to object to Personal Data profiling, you should log out of all devices and delete cookies from them (in some cases, the process may take up to 48 hours). The instruction how to delete cookies is available in the Cookies Policy here.

You can also contact the data protection officer using a contact form (available here for Buyers and here for Sellers)

Please note that you may lodge a complaint in relation to us processing your Personal Data with a supervisory authority, i.e. the President of the Office of Personal Data Protection (address: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193, Warszawa).

Section VI. Personal Data recipients

Company may share your Personal Data with the following third parties:

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications) in order to publish Users’ offers posted in classifieds categories;

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications) which enable a comparison of Transaction reviews, in order to collect reviews of Transactions made on the Marketplaces by means of surveys;

• entities cooperating with the Company that offer their financial services as Associated Services, to assess the User’s creditworthiness, analyze the credit risk, and to grant a potential loan, to perform the contract you concluded, including enforcing any amounts due;

• entities cooperating with the Company and operating websites or providing online applications (including mobile applications), in order to handle the Registration process or use the Account.

Company may cooperate with third parties e.g. specialized providers of Personal Data storage services, analytical services, debt collection services, in order to enable such entities to provide services to Company. In this case, such entities are not authorized to use your Personal Data for their own purposes (Personal Data will always be processed on behalf of and for the Company) and their activities are subject to applicable law and this Privacy Protection Policy;

The scope of collaboration includes:

• information storage and access: storing information or accessing information already stored in your device such as advertising identifiers, device identifiers, cookies and similar technologies;

• personalisation: collecting and processing information to personalise website or application advertisements and/or content;

• selecting, serving and reporting of advertisements: collecting information and merging it with existing information to select and serve advertisements to you and to measure how effective they are (what advertisements have been displayed; how often, when and where they have been displayed; or whether you have taken any action in relation to the advertisement, for instance clicked the ad or made a purchase);

• conducting debt collection proceedings;

• delivery of services to support the provision of e-learning;

• delivery of services to support/improve order processing on Allegro.

The Company may also share your Personal Data with other entities (such goods delivery companies) where necessary to conclude or perform their contract to which you are a party, or in order to support/improve order processing on Allegro, which includes in particular the following:

• accepting the order for execution;

• packing the parcel;

• shipping the parcel to a specified address, including the provision of tracking information.

In the situations mentioned above, the entities with which your Personal Data are shared may become separate data controllers in respect of your Personal Data

We share your Personal Data with parties to your Transactions made on the Marketplaces (and to Charities as defined in Appendix No. 17 to the Terms & Conditions in the case of Transactions made in connection with Charity Offers) and to entities that support us in providing electronic services, i.e. to providers of payment services, credit services, insurance services, consulting or audit services, entities supporting User service and promotion of Offers, or entities cooperating in marketing campaigns.

We share your Personal Data relating to your image (profile picture) with other Users in the case of the communications through the Allegro Message Centre.

The Company may disclose your Personal Data to public authorities under the applicable laws and regulations in connection with proceedings concerning possible legal violations or addressing any other potential violations of the Terms & Conditions (including investigations carried out in connection with fraud and abuse committed on Allegro).

Pursuant to its Policy, the Company undertakes not to sell the Personal Data of the Users. In the event of restructuring or sale of the Company’s business or any part thereof, and the transfer of all or a substantial part of its assets to a new owner, the Personal Data of Users, including yours, may be transferred to the new owner in order to ensure the continuation of services provided on the Marketplaces, via the Mobile Application, or the Associated Services.

Based on your consent, the Company may disclose your Personal Data on charytatywni.allegro.pl to public benefit organisations in order to enable them to thank you for your contribution.

In connection with the use of the Family Group Functionality and sending of invitations, your data will be provided to the persons you invite to the Family Group (invitation recipients). Your name specified in the Account and your email address will be disclosed in the invitation.

Furthermore, by initiating the sending of an invitation to the Family Group, the User hands over the email address of the invitation recipient to Company pursuant to the Allegro Terms & Conditions in order to deliver the invitation and enable the recipient to use the Family Group Functionality.

By initiating the sending of an invitation to the Family Group to a recipient, the User consents to Company engaging another processor to process the personal data of the recipient (subprocess) in order to deliver the invitation to the recipient.

Company shall process the personal data of invitation recipients in accordance with the applicable laws and undertakes to:

a. process the email of the invitation recipient only as a result of the User initiating the sending of the invitation to the Family Group to the recipient (taking due account of the provisions of Article 28(3)(a) of the GDPR);

b. ensure that persons authorized to process personal data of invitation recipients have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;

c. take (implement) any and all appropriate technical and organizational measures (taking into account state of the art, the costs of implementation and the nature, scope, context, and purposes of the processing, as well as the risk for the rights and freedoms of natural persons, of varying likelihood and severity) to ensure a level of security appropriate to the risk, including, inter alia:

i. the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;

ii. a process for regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing;

iii. compliance with the conditions for engaging another processor under Article 28(2) and Article 28(4) of the GDPR.

Sub-processing of the personal data of the invitation recipient shall only take place in the period of communication with the invitation recipient preceding the acceptance or rejection of the invitation by the recipient. If the invitation is rejected, the Company will store the invitation recipient’s email address in order to monitor the frequency of invitations sent by the User to the same email address, however, for no longer than 30 days. Furthermore, the Company may store the email of the invitation recipient where the applicable law obligates the Company to continue to store the email throughout the retention periods arising from that law.

Within the Account settings, in connection with the use of the Family Group Functionality by the User, the Company displays the following personal data of other group members to the Family Group Members and Family Group Manager:

a. The following information is displayed to the Family Group Manager: the profile picture of the User available in the Account, the name set in the Account by the User, and email address, a badge: adult, youth, child.

b. The following information is displayed to a Family Group Member: the profile picture of the User available in the Account, the name set in the Account by the User, and email address without the domain of another Family Group Member, email address of the Family Group Manager, a badge: adult, youth, child.

As it is necessary to prevent bots from performing certain functions on the Platforms, in addition to our own tools and the tools of our processors, we use the Google reCAPTCHA solution provided by Google Ireland Ltd. This functionality involves obtaining information about hardware and software (such as the device and search engine data) and their independent analysis by Google.

Information collected through reCAPTCHA is used by Google to provide, maintain, and improve functionalities, and for general security purposes.

Company may share anonymised Personal Data (i.e. data that do not identify specific Users) with third-party service providers, trusted partners, or research agencies in order to better understand the attractiveness of advertisements and services to Users, improve the overall quality and performance of services provided by the Company or the aforementioned entities, or to participate in scientific research offering broadly understood benefits to the society.

If you sell Goods using a Business Account, you are obliged to, whenever you obtain Personal Data of other Users that are natural persons from the Company, meet any obligations towards such Users under the GDPR, including the information obligation, and ensure that they can exercise their rights under the GDPR.

Section VII. Transfers of Personal Data to countries outside the European Economic Area

Your Personal Data may be transferred outside the European Economic Area, for example to:

• DataDog, Inc with its registered office in New York, USA, in connection with the use of Personal Data processing services offered by this entity to ensure the provision of services offered on Allegro by the Company;

• Khoros, LLC. with its registered office in San Francisco, USA, in connection with using the community available at https://spolecznosc.allegro.pl/ by Users, for the exchange of knowledge and mutual assistance between its members,

• SFDC UK, Ltd (SalesForce) with its registered office in London, UK, in connection with the use of Personal Data processing services offered by this entity to ensure the provision of services offered on Allegro by the Company.

At the same time, as part of cooperation with processors, data processing may be further entrusted to entities that may transfer data to countries outside the European Economic Area. Parties that systematically process data for Allegro include:

• EasyGenerator B.V. with its registered office in Rotterdam, the Netherlands, provider of elearning services offered in the Allegro Academy,

• Google Cloud Poland sp. z o.o. with its registered office in Warsaw, Poland, in connection with the use of the electronic mail system and the Google Workspace tools, for statistical and administrative purposes and in connection with the use of Personal Data processing services offered by this entity to ensure the provision of services by the Company offered on Allegro,

• Google Ireland Limited, with its registered office in Dublin, Ireland, in connection with the use of the Google reCAPTCHA system in order to ensure security,

• INFOBIP sp. z o.o., with its registered office in Wrocław, Poland, in connection with the use of Personal Data processing services offered by this entity for the sending of SMS messages,

• Microsoft Ireland Operations, Ltd with its registered office in Dublin, Ireland, in connection with the use of Personal Data processing services offered by this entity, aimed at ensuring the provision of services offered on Allegro by the Company,

• Meta Platforms Ireland Limited with its registered office in Dublin, Ireland, in connection with the use of the authentication services offered by this entity,

• SFDC Ireland, Ltd (SalesForce) with its registered office in Dublin, Ireland, in connection with the use of Personal Data processing services offered by this entity, aimed at ensuring the provision of services offered on Allegro by the Company,

• Snowflake Computing Netherlands, B.V. with its registered office in Amsterdam, the Netherlands, in connection with the use of Personal Data processing services offered by this entity, aimed at ensuring the provision of services offered on Allegro by the Company.

The Company always relies on mechanisms ensuring an adequate level of protection, for example, by using standard contractual clauses for the transfer of Personal Data to Personal Data processors established in third countries approved by the European Commission. You can receive copies of such clauses from the Company by writing to [email protected] or [email protected] (dedicated to service in Czech) or [email protected] (dedicated to service in Slovak).

Section VIII. Amendments

If necessary, the Company may amend this Privacy Protection Policy. In this case, paragraphs 14.1 and 14.2 of the Terms & Conditions apply accordingly.

Section IX. Contact details

For more information on the processing of your Personal Data and answers to questions concerning the Privacy Policy, please contact our data protection officer. The contact details are as follows:

e-mail address: [email protected] or [email protected] (dedicated to service in Czech), or [email protected] (dedicated to service in Slovak),

mailing address: Inspektor Ochrony Danych Allegro sp. z o.o., ul. Wierzbięcice 1B, 61-569 Poznań.

You can also contact the data protection officer using a contact form (available here for Buyers and here for Sellers).