Information on personal data processing by PLL LOT S.A. For the purposes of the performance of air carriage contract entered into by and between a passenger and PLL LOT S..A

Data controller:

Polskie Linie Lotnicze LOT Spółka Akcyjna with its registered office in Warsaw, address: ul. Komitetu Obrony Robotnikow 43, 02-146 Warsaw, KRS: 0000056844, tel.: +48 22 577 77 55, (PLL LOT S.A.) is the controller of your personal data. You can contact us by using a contact form on our website www.lot.com.

Data Protection Officer:

Data Protection Officer is a person whom you can contact to discuss matters related to the processing of your personal data. Contact information:

a) email: iod@LOT.pl

b) ) in writing, to the address of our registered office provided in the “Data Controller” section.

Purposes and legal grounds for processing:

We process your personal data for the following purposes:

1) exercising rights and obligations under air carriage contract executed with PLL LOT S.A.;

2) in order to take steps prior to entering into air carriage contract;

3) sending to the provided e-mail address a newsletter containing the current offer of PLL LOT S.A., information on promotions and services launched on the market, organised events and competitions as well as special offers based on our legitimate interest which is direct marketing purposes;

4) the use of data for statistical, analytical and reporting purposes, based on our legitimate interest of the controller, i.e. the improvement of the quality of services and their adjustment to the needs of passengers and users of lot.com website);

5) for accounting, bookkeeping, tax and other purposes related to the performance of the legal obligations of PLL LOT S.A. under applicable regulations;

6) undertaking actions related to the performance of the air carriage contract, i.e. storing for archiving (evidential) purposes or establishing, exercising or defending claims, if any based on our legitimate interest, i.e. securing information in case of a need to provide evidence.

Categories of recipients:

Your personal data may be transferred to:

1) Entities related to PLL LOT S.A., i.e. companies from LOT group;

2) Regarding to exercising air carriage contract the carrier shall process the personal data and submit it to relevant state authorities and/or other foreign recipients (including, e.g., authorities that use them for preventing and combating terrorist acts or other international crimes), authorised agents, other carriers and other entities for the purpose of fulfilment of the above or other legitimate interest;

3) Business partners of PLL LOT S.A.. i.e. entities providing marketing, advertising and commercial services. The data will be transferred solely in the scope essential to provide these services. These entities operate on the basis of an agreement concluded with us and solely in accordance with our instructions.

Transferring data to non-EEA states:

The Data Controller may transfer your personal data, for the purposes of the performance of air carriage contract, under Article 45, 46(2)(c), 47 and 49(1)(b) of the GDPR, to other persons, authorities, institutions and carriers that are authorised to receive such information in connection with applicable legal provisions and international agreements, or when such transfer of data is necessary for the fulfilment of legitimate purposes pursued by the Data Controller or data recipients, including the compliance with immigration, customs and other requirements relating to the crossing of the border in destination countries.

Retention period:

Data retention period depending on the purpose

1) in order to perform the rights and obligations under air carriage contract – for the term of the agreement and after its termination;

2) in order to establish, exercise and defend claims – until the expiry of claims under air carriage contract;

3) for the purposes of sending commercial information to the provided e-mail address – no longer than by the object to processing personal data;

4) for statistical, analytical and reporting purposes – for the period of the performance of a transport agreement, and then no longer than for a period after which claims under the agreement fall under the statute of limitations;

5) for accounting purposes – until the date of approval of the financial statements for a given financial year;

6) for tax purposes – for no longer than 5 years after the end of the calendar year in which the tax obligation arose.

Your rights:

You have the following rights related to the processing of your data:

1) the right of access to your personal data by requesting access to or sending copies of all your personal data processed by PLL LOT S.A. as well as information on the processing of your data;

2) the right to withdraw your consent;

3) the right to rectification;

4) the right to be forgotten; PLL LOT S.A. has a right to refuse to erase data in cases permitted by law;

5) the right to restriction of processing

In order to exercise the above-mentioned rights, contact us using any means of communication

The right to object:

As we process your personal data based on our legitimate interests, you may object to the processing of your data due to your particular situation. You can contact us e-mail address: contact.mailing@lot.pl.

The right to lodge a complaint:

You have also the right to lodge a complaint to a supervisory authority, especially in a member state of your habitual residence, place of work or place of alleged infringement if you consider that the processing of your personal data violates the provisions of the GDPR In Poland, this function is held by the President of the Personal Data Protection Office,

Voluntary nature of data provision:

You must provide us with your personal data in order to enable PLL LOT S.A. in specific purpose:

a) to exercising rights and obligations in order to take steps prior to entering into air carriage contract and under air carriage contract;

b) sending to the provided e-mail address a newsletter containing the current offer of PLL LOT S.A., information on promotions and services launched on the market, organised events and competitions.

Profiling:

Using the data that you have provided in the newsletter subscription form as well as data sent by a browser based on your consent to sending the newsletter, we are able to prepare an automatic offer selection adjusted to your preferences. It is based on the profiling of the data that you have provided, including the location or technical parameters of the device that you use (resolution, browser size, etc.). The profiling does not have any legal effects.

Processing Passenger Name Record (PNR data):

The Passenger Name Record (PNR data) in the reservation system are transferring by the PLL LOT S.A. to the Passenger Information Unit (PIU) based on the Act of 9 May 2018 on the processing of Passenger Name Record (PNR) data. The purpose of such transfer is the prevention, detection, investigation and prosecution of terrorist offences and serious crime or fiscal offences and where relevant, to find criminals.

Air carriers shall transfer PNR data by electronic means:

a) 24 to 48 hours before the scheduled flight departure time; and

b) immediately after flight closure, that is once the passengers have boarded the aircraft in preparation for departure and it is no longer possible for passengers to board or leave

The PNR data provided by the air carriers to the PIU are retained in a database at the PIU for a period of five years after their transfer to the PIU. Upon expiry of this period, the data are deleted permanently.

The PIUs of the other Member State shall be entitled to request PNR data in individual cases on special request. List of the Passenger Information Units can be found here.

The data controller of transferred PNR data is the Commander in Chief of the Polish Border Guard. Contact information:

Commander in Chief of the Polish Border Guard - PNR data administrator

al. Niepodległości 100

02-514 Warszawa

telefon: +48 22 500 40 00 - centrala

e-mail: gabinet.kg@strazgraniczna.pl

You have the following rights related to the processing of PNR data:

a) the right of access to your personal data,

b) the right to demand completion, update, rectification or erasure, if the data are incomplete, unactual, incorrect or obtained illegally

c) the right to remuneration and exercise the claims in case of PIUs data protection breaches,

d) the right to contact Data Protection Officer in the PIU by using phone number: +48 22 513 54 87 or e-mail address: inspektor-PNR@strazgraniczna.pl,

e) the right to submit an application for information about your rights,

f) the right to lodge a complaint to the President of the Personal Data Protection Office in case relating to the processing PNR data.