Privacy and cookie policy of the Masterlease Group

Recitals

Whereas:

1. Protecting the privacy of customers and users of the Masterlease Group’s websites is very important.

2. The Masterlease Group companies limit the use and collection of information about website users to a level that is necessary to provide services at the highest level to customers and users.

The Company resolves to adopt the following Procedure.

§ 1. Purpose and application of the procedure

1. The Masterlease Group’s privacy policy and cookies policy apply to all cases in which a Masterlease Group company is the controller of personal data and processes personal data. This applies both to cases of processing personal data obtained directly from the data subject, as well as personal data obtained from other sources.

2. This policy is intended to highlight the Masterlease Group’s particular concern to protect the privacy of website users and to provide general information on the processed personal data and use of cookies.

3. This document states which data are collected by the companies of the Masterlease Group and what terms of processing are applied.

§ 2. Glossary of Terms

1. Controller – a company of the Masterlease Group. Information about companies of the Masterlease Group is available at masterlease.pl/grupa.

2. Personal data – any information related to a website user and identifying the user personally, by itself or in combination with other available information, e.g. e-mail address.

3. Masterlease Group – Capital Group with Prime Car Management S.A. as the controlling entity.

4. Processing – all types of activities and operations performed on personal data of website users, e.g. analysis for the purposes of providing vehicles leasing services.

5. GDPR – Regulation 2016/679 of the European Parliament and of the Council of the European Union of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the GDPR).

6. Websites – websites of the Masterlease Group:
a) www.masterlease.pl;
b) www.primecar.pl;
c) www.master1.pl;
d) www.masterbenefit.pl;
e) www.masterbenefit.pl;f) www.futuraleasing.pl.

7. User – any natural person visiting the websites of the Masterlease Group.

§ 3. Scope of data processing

1. The Masterlease Group processes personal data in particular for the following purposes:

a) presentation of an offer to finance rental or leasing of a vehicle;
b) preparation of optimal terms and conditions of the agreement concerning sale, rental or leasing of a vehicle;
c) implementation of the concluded sale, lease or rental agreement;
d) preventing fraud, counteracting money laundering and funding terrorism;
e) ensuring security of services provided by the Masterlease Group;
f) ensuring compliance with the legal provisions, regulations and guidelines for the given sector;
g) improvement of products and services offered by the companies of the PKO Bank Polski S.A. Capital Group (the current list thereof is available at www.pkobp.pl);
h) sending customised marketing materials;
i) adjusting the website content to users’ interests and optimisation of website navigation, so that the content search is convenient and intuitive;
j) managing interactions for the purpose of establishing, maintaining or deepening relations with clients/potential clients or vehicle users.

§ 4. Data collection by the Masterlease Group

1. Through operations of its companies, the Masterlease Group manages data, collects information voluntarily provided by service users through their activity on the websites.

2. The so-called web server logs are collected, i.e. records concerning certain parameters of users who gain access to the website.

3. In particular, the logs contain such data as the IP address of the device, time of the event, data about the downloaded content, referrer, user agent, cookie.

4. The Masterlease Group limits the use and collection of information about website users to the minimum required to provide services at the highest level.

5. The Masterlease Group does not collect data on political or religious beliefs, data on health or ethnic origin.

6. The Masterlease Group does not collect or verify information on the age of the websites’ users. People who do not have the full capacity to enter into legal transactions are not entitled, without relevant consents obtained under applicable law, to place orders or subscribe via websites of the Masterlease Group.

7. Personal data shall not be transferred to countries outside the European Economic Area.

§ 5. References to other websites

1. The websites of the Masterlease Group include links to other websites and services which constitute a service provided by third parties and are therefore outside the control of the Masterlease Group. The Masterlease Group shall not be held liable for practices applied by such websites with regard to the protection of personal data.

2. With reference to section 1 above, please read privacy statements available on the partners’ websites, especially if such websites collect personal data.

§ 6. Contact forms and external advertising agencies

1. The Masterlease Group provides users with the possibility of contact by electronic contact forms. Using the form requires provision of personal data necessary to maintain contact and to answer the enquiry, in particular: first name, e-mail address, contact phone number. The user may also provide other data in order to facilitate contact or handling of the enquiry. Provision of data marked as mandatory is required in order for the enquiry to be accepted and handled; failure to provide such data makes rendering services impossible. Provision of other data is voluntary.

2. The Masterlease Group enables users to create an account which requires the user to provide identification data, including contact details (i.e. in particular name, surname, e-mail address); failure to provide such data makes it impossible to create an account. The created account may also be used for the implementation of a contract and for mutual contacts. Providing a larger scope of personal data by the user than necessary for the creation and operation of the account is voluntary.

3. The Masterlease Group provides users with an option to complete transactions related to the financing of a vehicle through an electronic transaction system. The operation of this system involves the obligation for the user to provide specific personal data, in particular identification data (first name, surname) and contact data (e-mail address, telephone number) in order to perform the service of concluding and implementing the agreement.

4. When a user views content of websites where commercials of the Masterlease Group are displayed, the online marketing tools used by the Controller may send cookie files to the user’s device. This allows identification of the device upon future visits or the measuring of the user’s response to a given advertisement.

§ 7. Cookies Policy

1. Cookies are small files saved on users’ devices by websites that are visited by the user. Cookie files contain different information that is often necessary for the website to function properly.

2. Cookies are encrypted in such a way that unauthorised persons do not have access to them.

3. The information contained in cookies includes data about the user’s activity on the website from which the files were sent.

4. Cookies are saved on the storage medium of the end device, e.g. a computer, tablet, mobile phone of the user, in order to facilitate navigation and the adjusting of the website to user preferences.

5. The Controller may combine the information collected on the basis of cookies with other personal data it controls. This happens if the user gives the relevant consent and does not disable cookies. Combining information is intended to prepare a range of products or services that are tailored to the customer’s expectations.

6. The user may block the saving of cookies in the browser of the device they use or remove them after the correct configuration of their internet browser settings.

7. If the user’s mobile device uses the iOS system, it is necessary to include cookies in order to use the full version of the Masterlease Group Websites.

8. Depending on the time for which cookies are installed, they are classified as:

a) session, temporary cookies – not saved on the disk, necessary to maintain the context of the user session; they are very often used by various services due to the specificity of the HTTP protocol used to transmit websites;

b) persistent cookies – i.e. those that are not removed after closing the browser and can be used by the service in the future; they include:

– cookies within a given domain (first party) – the website configures cookies only for its own needs;

– cookies in the external domain (third party) – the service places cookies so that they can be used in other websites.

9. Depending on the purpose for which the Masterlease Group uses cookies, they can be divided into essential and marketing cookies:

a) essential cookies – they are installed if the user consented to use the software settings installed on their telecommunications device. Essential cookies can be classified as technical and analytical ones:

technical cookies – they are necessary for the website to function properly and are used by the Masterlease Group in particular in order to:
– ensure proper display of the page – depending on the device used;
– remember whether the user has consented for some content to be displayed;

analytical cookies – they are necessary for settlements with business partners, measuring the effectiveness of marketing activities and in order to improve the website’s functioning. They are used by Masterlease Group companies to:
– monitor statistics on user traffic on the masterlease.pl website and other websites of the Masterlease Group;
– detect various types of fraud;
– limit some marketing activities, e.g. to protect users from multiple displaying of the same advertisement;
– measure the effectiveness of actions organised for the benefit of the Masterlease Group companies, e.g. in the Google advertising network, in partner programmes;
– keep settlements with business partners concerning advertising services based on registered actions provided at users’ request.

b) Marketing cookies – saved on the device only if the user consents to it and does not disable cookies. The Masterlease Group uses these cookies, according to users’ preferences concerning service selection, based on data held by the Masterlease Group, including those concerning users’ behaviour on the Masterlease Group’s Websites,

10. Masterlease Groupto profile advertising displayed on both external websites and on the Masterlease Group websites.

11, When entering the Masterlease website, you may refuse to consent to the use of cookies by Masterlease for marketing purposes. However, in such cases, advertisements displayed on the Masterlease website will not be matched to the user’s preferences.

12. While performing analytical activities with respect to user activity in the online service, the Masterlease Group cooperates with external, local or foreign partners. The partners provide services to Masterlease Group companies consisting of the monitoring and generation of statistics and their analysis. Actions in this respect are carried out on the basis of the legitimate interest of the controller in order to optimise the website service.

13. The Masterlease Group’s website contains also a small image file enabling performance of analyses within the PKO BP S.A. Capital Group concerning traffic from published campaigns, user interaction on the website, remarketing activities within the Masterlease Group.

14. The Masterlease Group may build a user profile on the basis of data collected by each party as part of its own cookies, as well as combining them with other information about the data subject, only in the context of users who have agreed to use cookies for marketing purposes.

15. The Masterlease Group uses cookies in accordance with the browser software settings selected by the user, as installed on the used device. The user may verify whether they have authorised the use of cookies or not.

16. In many browsers, cookies are enabled by default. The user can change settings or disable cookies at any time by changing browser settings. However, disabling “cookies” may result in incorrect operation of the service.

17. Using the website https://masterlease.pl with integrated cookies in the browser means that these files will be saved in the memory of the user’s device. Using the Masterlease Group’s websites without changing the browser settings in the browser means that the user confirms having read the above information and accepting cookies.

18. More information about cookies is available in the “Support” section in the user’s web browser.

19. Information about cookies published by manufacturers of the most popular web browsers is available at the following addresses:
a) Internet Explorer browser cookies;
b) Chrome browser cookies;
c) Firefox browser cookies;
d) Opera browser cookies;
e) Safari browser cookies.
f) Edge browser cookies.

20. Users who, having read the information available on the Websites, do not want the cookies to remain stored in the device’s browser, should delete them from their browser after the end of their visit to the website.

§ 8 Disclosure of data

1. The Masterlease Group company, which is the Controller, may make personal data available to other companies of the Masterlease Group, within the framework of the signed agreements in order to enable users to use the same services at any place.

2. The Masterlease Group company, which is the Controller, may disclose personal data to other entities, i.e.:

a) PKO Bank Polski S.A. (“Bank”) with respect to implementation of the legitimate interests of the Company and the Bank, resulting from the parties’ rights to exchange information to prevent fraud or related to effective risk management within the Bank’s capital group, in connection with the applicable common law. As a result of making such disclosure of data by the Company, the Bank will become an independent controller and will process such data for the purposes indicated in this point. The terms of data processing by the Bank and your associated rights are described on the Bank’s website in the section dedicated to data protection (GDPR);

b) if you agree to the use of cookies for marketing purposes by entities of the PKO Bank Polski S.A. Capital Group (the current list can be found at www.pkobp.pl) for the purposes related to preparing these entities’ offers or organisation of marketing campaigns.

3. In reasonable cases the Masterlease Group may entrust the processing of data to other entities in accordance with applicable laws.

4. In order to execute the transaction, the Masterlease Group may share the personal data of users with dealers, entities providing services of maintenance, varnishing, insurance, logistics and marketing, which shall process these data on behalf of the Masterlease Group in order to implement the agreement, subject to appropriate security measures.

5. The Masterlease Group may disclose anonymised data (i.e. those that do not identify specific users) to third-party providers, trusted partners or research agencies in order to improve the overall quality and efficiency of services provided by the Controller or the above entities, or else to participate in scientific research of wide-ranging social benefit.

6. The Masterlease Group may, if legally permissible, transfer the personal data of users to courts, law enforcement authorities, regulatory authorities or law firms if this is necessary to ensure legal compliance or the establishment, exercise or defence from claims.

§ 9. Storage period

1. The Masterlease Group stores personal data of users of the websites for the period necessary to achieve the purposes for which the data were collected or for which they are processed or for the period necessary to secure the legal interests of the Masterlease Group.

2. The Masterlease Group stores personal data to the extent necessary to ensure compliance with applicable laws.

§ 10. Security

1. The Masterlease The Masterlease Group has implemented reasonable, adequate business, economic, physical, technical and organisational measures to protect personal data against accidental or illegal destruction or accidental loss, alteration, unauthorised disclosure or access and any other forms of illegal processing.

2. The Masterlease Group has implemented appropriate policies and procedures for the protection of personal data and IT infrastructure.

3. The Masterlease Group manages personal data in accordance with internal security and privacy requirements.

4. Forms of contact with the Personal Data Protection Officer:
a) by email to: iodo@masterlease.pl;
b) by mail to: ul. Polanki 4, 80-308 Gdańsk.

§ 11. Control by website users

1. The Masterlease Group ensures the exercise of rights of natural persons, on terms described in the procedure on the exercise of rights of natural persons and proceedings in the case of security breaches concerning the processed personal data, as available on the masterlease.pl website.

2. In particular, the Masterlease Group ensures that each service user:
a) has the right to resign from any advertising information received from the Masterlease Group (newsletters, e-mails containing commercial information);
b) has the right to request deletion of the given subject’s data from the Masterlease Group database;
c) has the right to suspend information sent by electronic mail or otherwise;
d) has the right to withdraw the given consent at any time;
e) has the right to modify their personal data provided to the Masterlease Group at any time.

3. The user who will use the right to object should log out of all devices and delete cookies.

§ 12. Terms of liability

1. The Procedure is supervised by the Data Protection and Compliance Officer.

2. The scope of responsibilities of the Personal Data Protection Officer:
a) verifying correctness and validity of the Procedure;
b) informing about the implementation of the Procedure, its updates;
c) verifying conformity of the Procedure or proposed changes with the generally applicable regulations, as well as standards of conduct adopted by the Masterlease Group;
d) updating the Procedure.

3. Scope of responsibilities of all Employees and co-workers:
a) knowledge and observance of the Procedure;
b) informing the Personal Data Protection Officer of any situations affecting processes described in the Procedure;
c) carrying out the tasks described in the Procedure.

§ 13. References

References to other Procedures binding at the PCM Group:

1. Compliance Policy of the Masterlease Group.
2. Procedure for counteracting money laundering and funding terrorism at Prime Car Management S.A.
3. Procedure for managing authorisations to process personal data at the companies of the PKO Leasing S.A. Group.
4. Procedure for managing personal data security breach incidents at the companies of the PKO Leasing S.A. Group.
5. Instruction for managing goodwill risks at the Masterlease Group.
6. Personal data security policy at the companies of the PKO Leasing S.A. Group.

§ 14. Version list

1. V1.0 of 25.05.2018
2. V2.0 of 30.06.2019
3. V3.0 of 31.07.2020

§ 15. Final provisions

1. Changes in the privacy policy of the Masterlease service may be affected by development of internet technologies, possible legal changes with respect to personal data protection and development of the website.
2. Changes to the Procedure shall be effective from the date of their publication. The version referred to in § 14(3) constitutes the consolidated text.