Information Obligation Pursuant to Articles 13 and 14 of the GDPR

Who Processes Your Data?

The Controller of your personal data is: Autenti Spółka Akcyjna with its registered office in Poznań, at ul. Święty Marcin 29/8, entered into the Register of Entrepreneurs maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań under KRS number: 0001254852 (hereinafter referred to as "Autenti") – the operator of the online service provided under the name "Autenti" – an online platform accessible at www.autenti.com (hereinafter referred to as the "Autenti Platform").

Where Do We Get Your Data From?

We received your data from you:

• during registration of an Account on the Autenti Platform, under which you accepted the Autenti Platform Terms and Conditions,
• during the Account confirmation process on the Autenti Platform, or
• in connection with optional actions taken by you on the Autenti Platform within your Account settings (provided that the account has been activated by you),
• during or in connection with the placement of an electronic signature by you within the eSign module.

We may also have received your data from the administrator of an organization Account who added you as a user to the given organization Account.

Personal data may also be collected from other sources or activities carried out by you within the management of your Account on the Autenti Platform or in connection with using Autenti's trust services.

What Is the Purpose and Legal Basis for Processing Your Personal Data by Autenti?

Autenti processes your data for the purpose of:

1. Executing the agreement for the provision of services specified in the Autenti Platform Terms and Conditions (pursuant to Article 6(1)(b) of the GDPR), e.g., for:
• providing services electronically and ensuring full use of the Autenti Platform, including providing relevant functionalities and executing the document signing process,
• enabling registration and management of the Account or accounts, as well as providing Account maintenance, document processing, electronic signature trust services, and resolving technical issues,
• handling inquiries you direct to us, e.g., via the contact form,
• informing you of changes to the service, terms and conditions, or policies;
2. Complying with legal obligations to which the Controller is subject (pursuant to Article 6(1)(c) and Article 6(3) of the GDPR), e.g., for:
• tax and accounting purposes,
• handling complaints,
• verifying your identity,
• archival and evidentiary purposes in connection with the services provided to you, including primarily trust services;
3. Pursuing the legitimate interests of Autenti (pursuant to Article 6(1)(f) of the GDPR): marketing of own products or services;
4. Establishing, exercising, or defending legal claims (pursuant to Article 6(1)(f) of the GDPR);
5. Based on your consent (pursuant to Article 6(1)(a) of the GDPR), e.g., for:
• the provision of the newsletter service by Autenti,
• marketing products or services through Trusted Partners with whom Autenti collaborates. By "Trusted Partners," we mean entities with which Autenti cooperates regarding the provision or promotion of services specified in the Autenti Platform Terms and Conditions. The list of Trusted Partners can be found on the autenti.pl website.

Do You Have to Provide Us with Your Personal Data?

We require you to provide the following personal data in order to be able to conclude and perform the contract concluded with you, and thus provide you with the service:

• first name, last name, email address, and telephone number (if you use the Personal Account option), or
• first name, last name, business email address, telephone number, and the name of the entity you represent (company) as well as the NIP (Tax Identification Number) (if you use the Business Account).

Providing data is voluntary, but required. If you do not provide this personal data, we will unfortunately be unable to enter into an agreement with you, and consequently, it will not be possible to register an Account on the Autenti Platform.

For the performance of trust services such as signing handling, Autenti e-Signature, or Autenti Advanced e-Signature, providing personal data is voluntary; however, failure to provide it will result in the inability to perform these trust services for your benefit.

Confirmation of the Account on the Autenti Platform and providing personal data within the identity verification and representation rights process (if applicable) is voluntary; however, it may affect the ability to use certain qualified trust services, e.g., Autenti eDelivery.

What Are Your Rights Against Autenti Regarding Processed Data?

Pursuant to legal provisions and considering the nature, purpose, and scope of personal data processing, you have the following rights:

• the right to access your data and the right to rectify it, including primarily through the available functionalities for changing data on the Autenti Platform,
• the right to erasure of your data, subject to the limitations set forth in Article 17 of the GDPR, meaning that Autenti will have the right to refuse or limit the execution of your request under the rules described in Article 17 of the GDPR,
• the right to restriction of processing, under the rules described in Article 18 of the GDPR,
• the right to data portability, pursuant to Article 20 of the GDPR,
• the right to object to the processing of data based on Autenti's legitimate interest or to processing for direct marketing purposes, pursuant to Article 21 of the GDPR,
• the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal — if processing is based on your consent,
• the right to lodge a complaint with a supervisory authority if you consider that the processing of your personal data violates the provisions of the GDPR.

The exercise of your rights is performed in accordance with the relevant provisions of the GDPR, which means that Autenti reserves the right to refuse or restrict their implementation if the law so requires or permits.

If you have questions, wish to exercise your rights, or have any other concerns, please contact our Data Protection Officer. Contact details can be found below.

To Whom Do We Disclose Your Personal Data?

How Long Do We Store Your Personal Data?

Your personal data may be processed to perform the agreement for the provision of services defined in the Autenti Platform Terms and Conditions, comply with a legal obligation incumbent upon Autenti, or in connection with a legitimate interest; therefore, the processing duration will depend on the specific database in which your data resides and the purposes for which it is processed.

To the extent that your data is necessary for the execution of services provided to you, personal data will be processed for the duration of the agreement, and thereafter for the period necessary to:

1. provide post-sales customer services (e.g., handling complaints or requests regarding personal data);
2. secure or pursue legal claims;
3. if necessary — ensure the proper provision of services in accordance with the Autenti Platform Terms and Conditions or the relevant Trust Services Policies;
4. comply with legal obligations of the Controller (e.g., resulting from tax or accounting regulations, the eIDAS Regulation, and others).

Personal data necessary to provide trust services, such as document signing handling, Autenti e-Signature, or Autenti Advanced e-Signature, will be processed for a period of 6 years from the date of collection.

Personal data processed for the marketing of our own products or services based on a legitimate legal interest will be processed until you object.

Data processed on the basis of consent is processed until it is withdrawn. Upon expiration of the processing period, data is irreversibly erased or anonymized.

In the case of loyalty programs, contests, and promotional campaigns in which you may participate — we will process your data for their duration and the settlement period for awarding prizes. For accountability purposes, i.e., to prove compliance with personal data processing regulations, we will retain data for the period during which Autenti is required to maintain data or documents containing it to document compliance with legal requirements and enable public authorities to audit such compliance.

Your personal data will be processed in an IT environment, which means that it may also be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with performing backups, testing changes in IT systems, detecting anomalies, or protecting against abuse and cyberattacks.

Do We Transfer Your Data Outside the European Economic Area?

Your personal data may be transferred outside the European Economic Area (EEA) to entities providing an adequate level of protection through:

1. cooperation with entities processing personal data in countries for which a relevant adequacy decision has been issued by the European Commission;
2. application of Standard Contractual Clauses issued by the European Commission;
3. application of Binding Corporate Rules approved by the competent supervisory authority;
4. other safeguards ensuring an adequate level of protection based on appropriate legal safeguards.

Do We Process Your Personal Data Automatically (Including Profiling) in a Manner Affecting Your Rights?

Your personal data will be processed in an automated manner (including profiling); however, as a rule, this will not produce any legal effects concerning you or similarly significantly affect your situation.

An exception may be the processing of personal data in connection with account confirmation on the Autenti Platform and the provision of the Autenti Advanced e-Signature trust service, where a condition for providing the service is successful identity verification and, where applicable, proof of authority to represent the entity. In the event of a negative result, Autenti may refuse to perform the service for your benefit.

Profiling of personal data by Autenti consists of processing your data (including by automated means) by using it to evaluate certain personal aspects, in particular to analyze or predict personal preferences and interests, as well as for internal statistics, product evaluation, and primarily product functionality.

Autenti may use automated tools, including solutions based on artificial intelligence technologies, to support the detection of fraud and abuse, ensure the security of provided services, improve service quality, and streamline user service processes (Helpline, chat, call transcriptions). The use of these tools takes place under appropriate human oversight and does not lead to decisions being made regarding data subjects based solely on automated processing that produce legal effects or similarly significantly affect them.

At the same time, we inform you that Autenti does not use artificial intelligence systems or applications to provide trust services or provide Accounts on the Autenti Platform, including within the provided functionalities.

How to Contact Us for Additional Information Regarding the Processing of Your Personal Data?

Please contact the Data Protection Officer designated by Autenti using the contact details provided below:

• Data Protection Officer: Agata Kolorz-Lentini
• Email address: dpo@autenti.com
• Postal address: Data Protection Officer Autenti S.A., ul. Leona Henryka Sternbacha 1 (Building L1), 30-394 Kraków, Poland