Information on the processing of data of Bosch Rexroth sp. z o.o. contractors, theiremployees and persons representing contractors
Data Controller
Data controller of persons who:
• directly concluded an agreement with Bosch Rexroth sp. z o.o.;••represent a natural or legal person who concluded an agreement with Bosch Rexroth sp.
z o.o.;
are employees of an entity which concluded an agreement with Bosch Rexroth sp. z o.o.
is Bosch Rexroth sp. z o.o. (ul. Jutrzenki 102/104, 02-230 Warsaw).

How are the data of the above-mentioned persons obtained and what data may beprocessed in connection with establishing business cooperation with Bosch Rexroth sp.
z o.o.?
The data of the above-mentioned persons are obtained directly from them, from publicly available
registers (e.g. CEIDG, KRS) or from persons who participated in establishing cooperation withour company.
In connection with establishing business cooperation, Bosch Rexroth sp. z o.o. may process datacontained in the agreement itself or provided in any other way during its conclusion, e.g. name,surname, NIP, REGON number, PESEL, KRS, company, name of a legal person, businessaddress or address of residence, email address, telephone number, official position, etc. The
scope of data depends mainly on whether the agreement is concluded by a natural person or alegal person.
In addition, during the term of the agreement, additional information being personal data, e.g.
information about payments, obligations or claims, may be generated.
In the case of persons who are appointed as contact persons on the part of the entity whichconcluded the agreement with Bosch Rexroth sp. z o.o., usually only basic data such as name,surname, telephone number, email address or official position are processed.
The processing of the above-mentioned data is necessary to establish and implement businesscooperation with our company.
Purposes of processing and legal bases
In connection with establishing business cooperation, Bosch Rexroth sp. z o.o. may process thedata of the above-mentioned persons for the purpose of:•••executing the agreement;
performing accounting and tax obligations specified by law;
defending against potential claims or asserting potential claims related to the execution ofthe agreement.

What are the legal bases for the processing of personal data?
The legal bases for the processing of personal data are:••••agreement (if the party to the agreement is a natural person) – Article 6(1)(b) of GDPR;
legitimate interest consisting in the execution of the agreement (in the case of data ofpersons representing the entity which concludes the agreement with Bosch Rexroth sp. zo.o. or persons who are its employees) – Article 6(1)(f) of GDPR;
accounting and tax obligations resulting from the legislation – Article 6(1)(c) of GDPR;
legitimate interest of Bosch Rexroth sp. z o.o., consisting in asserting potential claims ordefending against potential claims – Article 6(1)(f) of GDPR.

Who can access personal data?
The following may access personal data in the appropriate scope:••••

Authorised employees of Bosch Rexroth sp. z o.o;entities operating IT systems in which personal data are processed;
entities providing administrative services for Bosch Rexroth sp. z o.o. (e.g. companies
involved in archiving and destroying documents, delivering consignments);
law firms providing legal services related to the execution of the agreement, audit
companies, consulting companies, banks, etc.

The above-mentioned entities may belong to the Bosch group or be completely external
companies providing various services necessary for our business activities.
Data storage period
Personal data will be stored for a maximum period necessary to perform accounting and tax
obligations by Bosch Rexroth sp. z o.o. The data may be stored for a longer time in the case of adispute regarding the execution of the agreement. Then, the data will be stored until the potential
court or enforcement procedure is validly concluded.
Are the data used for profiling or automated decision-making?
The data are not used for profiling or automated decision-making.
What are the rights of persons whose data are processed by Bosch Rexroth sp. z o.o.?
Confirmation of processing of personal data and the right of access to them
The data subject may request and obtain access to information as to whether their data areprocessed (Article 15 of GDPR).
Rectification and erasure of personal data
It is also possible to request the rectification of incorrect personal data (Article 16 of GDPR). In
addition, the data subject may request the erasure of personal data (Article 17 of GDPR). This
right may be limited in certain cases, e.g. when data must be stored so as to comply with legal
obligations incumbent on Bosch Rexroth sp. z o.o., e.g. accounting and tax obligations.
Restriction of processing
In certain cases, it is possible to request the restriction of processing of personal data (Article 18of GDPR).

Objection to the processing of personal data
If personal data are processed based on a legitimate interest, it is possible to object to theprocessing of such data (Article 21 of GDPR). In this case, we will cease to process personaldata, unless there are other legal grounds for their processing e.g. when the data must be stored
so as to comply with legal obligations incumbent on Bosch Rexroth sp. z o.o., e.g. accounting andtax obligations.
Data portability
In certain cases (Article 20 of GDPR), it is possible to request a copy of personal data provided
in connection with the conclusion of an agreement, in a structured, commonly used and machinereadable format. It is also possible to request to transmit them to another data controller, wheretechnically feasible.
Lodging a complaint
The person whose data are processed may lodge a complaint with the President of the Personal
Data Protection Office, regarding the processing of their personal data
Contact details of the Personal Data Protection Office:
Personal Data Protection Officeul. Stawki 200-193 Warsaw
kancelaria@uodo.gov.pl
How to make requests regarding the processing of personal data and contact the datacontroller?
In order to exercise the above-mentioned rights or to report information regarding a breach ofpersonal data protection, you can use the website: https://request.privacy-bosch.com/lang/pl-PL/.
In addition, you can send a letter to the registered office of Bosch Rexroth sp. z o.o. or contact
the data protection officer appointed for the Bosch Group by email at dpo@bosch.com or by postat the following address:
Robert Bosch GmbHP.O. Box 30 02 2070442 Stuttgart, GERMANY
As of 1 April 2023.