1/6

PRIVACY STATEMENT RELATED TO THE WHISTLEBLOWING SYSTEM
This privacy statement aims to provide you with an overview of how ENEOS MOL SyntheticRubber Ltd. (hereinafter: “EMSR” or “controller”) manages your personal data within its
whistleblowing system (SpeakUp!), in accordance with Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protection of natural persons withregard to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation; “GDPR”), and Act CXII of 2011 on theRight of Informational Self-Determination and on Freedom of Information.
Data Controller
The Data Controller is ENEOS MOL Synthetic Rubber Ltd. (registered seat: 1117 Budapest,Dombóvári út 28.; website: www.emsr.hu; email address: contact@emsr.hu).
Data Protection Officer
If you have any questions about the processing of your personal data or wish to exercise your rights,
please contact our Data Protection Officer (Dr. Róbert Szűcs) at dpo_EMSR@emsr.hu.
Access to personal data
The documents generated during the reporting and subsequent investigation may contain personaland special categories of personal data relating to natural persons.
Personal data: means any information relating to an identified or identifiable naturalperson (‘data subject’); an identifiable natural person is one who can be identified, directly
or indirectly, in particular by reference to an identifier such as a name, an identification
number, location data, an online identifier or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that natural person.
Special categories of personal data: personal data revealing racial or ethnic origin,political opinions, religious or philosophical beliefs, or trade union membership, as well asgenetic and biometric data processed for the purpose of uniquely identifying a natural
person, data concerning health, and data concerning a natural person’s sex life or sexual
orientation.
Your personal data will be treated confidentially within the framework of the whistleblowing system.
Our system is designed to ensure that the personal data of the whistleblower who discloses his or
her identity and of the person who is the subject of the whistleblowing report is not disclosed toanyone other than the authorized person.
The following persons are entitled to access the report, the investigation, and the decision on a“need to know” basis:− chairman of Ethics Council;− members of the Ethics Council;− the person making the notification (Whistleblower/Reporter);− a person suspected of committing abuse (Reported);− employees participating in the investigation of the case and contributing to it with information andprofessional support (including the manager exercising employer authority over the ReportedParty), to the extent absolutely necessary for their cooperation.

2/6

Data transfer
We may transfer your personal data to third parties (e.g., courts, authorities, etc.) if necessary forthe conduct of judicial or administrative proceedings and if we have the appropriate legal basis todo so.
In the course of the management of a specific whistleblowing report and the related investigation,
personal data may be transferred to the parent companies or a third party involved in the case,solely for the purposes of investigating and solving the case and only to the extent necessary tofollow up on the legal consequences, while maintaining the safeguards (preservation of anonymity,
strictly limited access to the details of the case within the individual companies, etc.) granted during
the whistleblowing procedure. The recipients of such transfers of data are considered to becontrollers.
Where necessary for handling a case, to the required extent, personal data (for e.g. informationnecessary to clarify the facts, investigation documents, etc.) may be transferred to a third country.
In such a case, the controller shall comply at all times with the provisions of Chapter V of the GDPR.
Data processor(s)We use the services of the assigned companies as our data processor for the purposes of dataprocessing detailed above.
Detailed description of the data processing

3/6
Description andpurpose of the dataprocessing
Operating a whistleblowing
system, investigations ofcomplaints and reports,
consequence
management

Legal basis of thedata processing

Scope and source of theprocessed personal data

Duration of the dataprocessing

In the case of a company employing at least
50 persons in the framework of a legal
relationship aimed at employment, the dataprocessing is in order to fulfill legal
obligation based on Article 6(1)(c) andArticle 9(2) (g) of GDPR. The legal
obligation is based on XXV of 2023 law oncomplaints, reports in the public interest,
and rules related to reporting abuses(hereinafter: Whistleblower Act) Section 18(1).

Your personal data is obtained
directly from you.

Where,basedontheinvestigation,areportisunfounded or no further action isrequired, any data relating to thereport should be erased within 60
days of the completion of theinvestigation. If a measure istaken based on the investigation including the initiation of a legal
procedure or a labor law
consequenceagainsttheReporter - the data related to thereport can be processed within
the framework of the reporting
system: for 3 years, in case of an
employee, based on Section 286(1) of the Hungarian Labor Code,in other cases, for 5 years, basedon the Hungarian Civil Code 6:22
Section (1).
If a measure is taken based on
the investigation – including theinitiation of a legal procedure or alabor law consequence against
the Reporter – the data related tothe report may be processed
within the framework of thereporting system until the final
conclusion of the proceedings
initiated on the basis of the report.

In case of not anonymous report:− Personal data of the Report(name, e-mail, address, phone
number).
− Personal data of the person
againstwhom
thewhistleblowing report wasmade and of any other data
subject possessing relevant
information regarding the case(for example witness).
− Content of the whistleblowing
report; any other personal data
provided in the description.
In case of anonymous report:− Personal data of the person
againstwhomthewhistleblowing report wasmade and of any other data
subject concerned by thewhistleblowing.
− Content of the whistleblowing
report; any other personal andsensitive data provided in thedescription.

Legal claims related to thecomplaint or report asserted
by the data controller or thedata subject

GDPR Article 6 (1) point f) - data
management is necessary to assert thelegitimate interests of the data controller.
Legitimate interest: legal enforcement on
the part of the data controller based on
Article 17 (3) e) of the GDPR or successful
defense in a possibly initiated legal disputeor official procedure (e.g. court proceedings
initiated by the data subject, official or outof-court proceedings, etc.). Upon individual
request, additional information about theconducted interest assessment tests can beprovided.

As defined above.

As defined above.

Recipient of datatransfers−−−

Parentcompanies
involvedin
theinvestigation;
whistleblower protection
legal counsel orother external persons
and organisations.

According to Act XXV of 2023
on Complaints and Public
Interest Disclosures, and on
the Rules of Whistleblowing
Notifications Section 6 (4) If
determined beyond doubt thatthe complainant or thewhistleblower has provided
false data or information in bad
faith, and a) it gives rise to anindication that a crime or an
infraction was committed, thepersonal data of such person
shall be handed over to thebody or person entitled to carryout proceedings, b) where it islikely that the complainant or
the whistleblower caused
unlawful damage or otherharm to the rights of others, hisor her personal data shall behanded over upon request to
the body or person entitled toinitiateor
carry
out
proceedings.
The recipients of the datatransfer may be courts andauthorities involved in theprocedure.

Processor and its
processing
activity
KMAK
KeletMagyarországi
Adatközpont Szolgáltató
Kft.
Takes
careofoperation of thewebsite, including
whistleblowerinterface.

thetheServergarden Kft.
Operateshosting.

theserver

MOL IT & Digital GBS Kft.
Provides cyber security.
The system sends anautomatic notification to
SpeakUp_EMSR@emsr.
hu; only members of theEthics Council has accessto this electronic mailbox.

As defined above.

4/6

Automated decision-making, including profiling
No automated decision-making takes place in the course of the processing.
Data subject rights
You have the following data subject rights:
Right to information:
Where the controller processes personal data concerning you, it must provide you information
concerning the data relating to you – even without your special request to that effect – including themain characteristics of the data processing, such as the purpose, legal basis and duration of theprocessing, the name and address of the controller and its representative, the recipients of thepersonal data (in case of data transfer to third countries indicating also the appropriate or suitablesafeguards), the legitimate interests of the controller and/or third parties in case of a data processing
based on a legitimate interest, furthermore your data protection rights and your possibilities ofseeking a legal remedy (including the right of lodging a complaint with the supervisory authority),
where this information is not yet available to you. The controller provides you the abovementioned
information by making this privacy notice available to you.
Right of access:You have the right to obtain from the controller confirmation as to whether or not personal data
concerning you are being processed, and, where that is the case, access to the personal data andcertain information related to the data processing such as the purpose of the data processing, thecategories of the personal data processed, the recipients of the personal data, the (scheduled)
duration of the data processing, the data subject’s data protection rights and possibilities of seeking
a legal remedy (including the right of lodging a complaint with the supervisory authority), furthermore
information on the source of the data, where they are collected from the data subject. Upon yourrequest, the controller shall provide you with a copy of your personal data undergoing processing.
For any further copies requested by you, the controller may charge a reasonable fee based on
administrative costs. The right to obtain a copy shall not adversely affect the rights and freedoms ofothers. The controller gives you with information on the possibility, the procedure, the potential costs
and other details of providing the copy after receiving your request.
Right to rectification:
You have the right to obtain from the controller without undue delay the rectification of inaccurate
personal data concerning you. Taking into account the purposes of the processing, you have theright to have incomplete personal data completed, including by means of providing a supplementarystatement.
Right to erasure:You have the right to obtain from the controller the erasure of personal data concerning you without
undue delay and the controller shall have the obligation to erase personal data without undue delay
where certain grounds apply or certain conditions are met. Among other grounds, the controller isobliged to erase your personal data at your request if, for example, the personal data are no longer
necessary in relation to the purposes for which they were collected or otherwise processed; if you
withdraw your consent on which the processing is based, and where there is no other legal groundfor the processing; if the personal data have been unlawfully processed; or if you object to theprocessing and there are no overriding legitimate grounds for the processing; or if the personal data
have to be erased for compliance with a legal obligation in Union or Member State law to which thecontroller is subject.

5/6

Where the processing is based on your consent, consequence of the withdrawal of yourconsent:
Please note that the withdrawal of your consent shall be without prejudice to any data processing
carried out based on you consent prior to the date of such withdrawal.
Right to restriction of processing:
You have the right to obtain from the controller restriction of processing where one of the following
applies:a) the accuracy of the personal data is contested by you, for a period enabling the controller toverify the accuracy of the personal data;b) the processing is unlawful and you oppose the erasure of the personal data and request therestriction of their use instead;c) the controller no longer needs the personal data for the purposes of the processing, but they
are required by you for the establishment, exercise or defense of legal claims;d) you have objected to processing, pending the verification whether the legitimate grounds ofthe controller override your legitimate grounds.
Where the processing has been restricted for any of the above-mentioned reasons, such personal
data shall, with the exception of storage, only be processed with your consent or for theestablishment, exercise or defense of legal claims or for the protection of the rights of another naturalor legal person or for reasons of important public interest of the Union or of a Member State You
shall be informed by the controller before the restriction of processing is lifted.
Right to data portability:
You shall have the right to receive the personal data concerning you, which you have provided to acontroller, in a structured, commonly used and machinereadable format and have the right totransmit those data to another controller without hindrance from the controller to which the personal
data have been provided, where:a) the processing is based on your consent or on the performance of a contract (to which you
are a party); andb) the processing is carried out by automated means.
In exercising your to data portability, you shall have the right to have your personal data transmitted
directly from one controller to another, where technically feasible. The right to data portability may
not infringe the provisions governing the right to erasure, and may not adversely affect the rights
and freedoms of others.
Right to object:
You have the right to object, on grounds relating to your particular situation, at any time to processingof personal data concerning you which is based on the legitimate interests of the controller, including
profiling based on those provisions. The controller shall no longer process the personal data unlessthe controller demonstrates compelling legitimate grounds for the processing which override yourinterests, rights and freedoms or for the establishment, exercise or defense of legal claims.
Framework of exercising rights
The data controller will inform you without undue delay, but in any case within one month of thereceipt of the request, of the measures taken following the request regarding your rights listed above.
If necessary, taking into account the complexity of the application and the number of applications,this deadline can be extended by another two months. The data controller will inform you of theextension of the deadline, indicating the reasons for the delay, within one month of receiving therequest.

6/6

If the data controller does not take measures following your request, it will inform you without delay,
but at the latest within one month of the receipt of the request, of the reasons for the failure to takeaction, and of the fact that you can file a complaint with the competent data protection supervisoryauthority (National Data Protection and Freedom of Information Authority; "NAIH") and can exercise
its right to judicial remedy.
NAIH contact details:
Address: 1055 Budapest, Falk Miksa street 9-11., postal address: 1373 Budapest, Postbox 9., Tel:
+36 1 391 1400, +36 (30) 683-5969 or +36 (30) 549- 6838 Fax: +36-1-391-1410, e-mail:ugyfelszolgalat@naih.hu, website: http://naih.hu/.
If your rights are violated, you can go to court. The lawsuit falls within the jurisdiction of the court.
According to the choice of the person concerned, the lawsuit can also be initiated before the courtof the place of residence or residence of the person concerned. The court may oblige the datacontroller to provide information, to correct, restrict or delete the data, to annul the decision madeby automated data processing, and to take into account your right to protest. The court may orderthe publication of its judgment in such a way that the data controller or any other data controller andthe violation committed by it can be identified.
You can request compensation from the data controller responsible for damages incurred inconnection with illegal data processing (including the failure to take data security measures). If thedata controller violates your right to privacy by illegally handling your data or violating data security
requirements, you can demand damages from the data controller. The data controller is exempt fromliability if it proves that the damage or the violation of the data subject's right to privacy was causedby an unavoidable cause outside the scope of data management. The damage does not have to becompensated and no compensation can be claimed if it resulted from the intentional or grossly
negligent behavior of the injured party.