DATA PROTECTION POLICY FOR THE WEBSITE

I. INTRODUCTION

This Policy describes the types of information to be collected by Bunge Polska Sp. z o.o. in Kruszwica (hereinafter also referred to as “Bunge”, the “Company”, “we”, “our” or “us”) or that you will provide to us when visiting this website, as well as our practices concerning the collection, use, storage, protection and disclosure of such information. This Policy shall not apply to information collected by us offline or by other means, including on any other website operated by the Company or a third party, or through any application or content (including advertisements) which may be links to or be accessible from the Website.

The Company undertakes to protect your privacy. We present this Policy in order to clarify the type of information we collect, and to inform you of specific practices and guidelines that protect the security and confidentiality of your personal data. Please read this Policy carefully. If any terms and conditions of this Policy are unacceptable to you, please do not use the Website or provide any personal data of yours. This Policy may be subject to change from time to time (see “Changes to our Data Protection Policy”).

II. WHAT INFORMATION WE COLLECT ON YOU AND HOW

We collect several types of information from and about users of our Website, which include information known as personal data (“Personal Data”).

II. 1. Information that you provide to us

II. 1. 1. Visitors

Information that we collect on or through our Website includes:

Information that you provide to us as Visitors by filling out forms on our Website. This includes information provided during registration in order to subscribe to e-alerts, as well as information involved when we process and respond to your inquiries and requests. The types of data to be collected include your first name and surname, e-mail address, telephone number, country, profession, and information related to inquiries and requests.
Information that you provide as an investor by filling out forms on our Website. This includes information provided during registration in order to subscribe to e-alerts, information involved when you register to subscribe for webcasts, as well as information involved when we process and respond to your inquiries and requests. The types of data to be collected include your first name and surname, e-mail address, telephone number, country, profession, and information related to inquiries and requests.

II. 2. Information that we collect on you

II. 2. 1. Visitors

As in the case of many other websites, when you navigate through and interact with our Website, we use automated data collection technologies to collect specific information about your activities and browsing behaviours, including:

Detailed information about your visit to our Website, including the resources you have access to and which you use on our Website, traffic data, location data, logins, language, date and time of access, frequency, and other communication data.
Information on your computer and Internet connection, including your operating system, host domain, and browser type.
Details of referrals (URL).

Information that we collect automatically is statistics that help us improve our Website and provide a better and more personalised service, including by making it possible for us to:

define the traffic patterns on the Website;
count visits to the network;
identify the sources of traffic so that we can measure and improve the performance of our Website;
know which pages and contents are the most and the least popular;
observe the search patterns on the Website to provide more intuitive navigation hints;
determine the frequency of user visits and the time between the users’ visits.

II. 3. Cookies used on this Website.

Our Website uses one-session (temporary) and multiple-session (permanent) cookies. Temporary cookies remain available only for as long as the web browser is open, and are used for technical purposes, such as improving navigation on our Website.

Once the browser is closed, the cookie will disappear. Permanent cookies are stored on a computer for a longer period and are used for purposes such as tracking the number of visitors to our Website and gathering information such as the visitor traffic, the time spent on the Website and other relevant information on network statistics.

Cookies as such will not be used by the Company to disclose your identity. This information identifies your browser for our servers when you visit the Website. If you want to disable cookies or delete them from your computer at any time, you can disable or delete these files via your web browser (you should use the browser “Help” menu to find out how to delete cookies); however, you have to enable cookies to access certain information on our Website.

Our annual reports and statements of attorneys do not contain cookies, in accordance with the SEC regulations.

Below you can find a detailed list of our own cookies that we use on our Website:

OUR OWN COOKIES
Cookie type	Name	Purpose	Duration
Session (Drupal)	has_js	Specifies whether JavaScript is enabled so that Drupal could perform operations more efficiently in order to improve user experience; the Website will not operate if this cookie is not enabled	End of Session; Temporary
Google Analytics to measure user interactions on the Website	_gid	Used to differentiate between unique users. Stores and updates a unique value for each site visited. Expires automatically after 24 hours	24 hours; expires automatically
Google – as above	_ ga	Identifies the domain to be measured Differentiates between unique users Saves the number and duration of previous visits Saves traffic source information Defines the beginning and end of the session Saves the value of non-standard variables at the user level [note – it does not store any personal data of users; it randomly generates a unique customer ID for the new user; it only has a randomly generated number and no personal data are stored]	Permanent (2 years after it is set/updated)
Google – as above	_gat	Used to reduce the request speed. This reduces the collection of data on high traffic sites	10 minutes; expires automatically

III. WHY WE USE YOUR INFORMATION

Below you can find out why we process Personal Data collected about you, as well as the relevant legal basis for the processing. We process your data wherever the processing is based on:

III. 1. Consent, Legitimate Interest or Pre-contractual Obligation

III. 1. 1. Visitors

Purpose of the processing	Legal basis
Management of e-alerts and online webcasts	Consent
Answering the “Contact us” forms	Legitimate interest in pursuing the Company’s business activity

III. 2. Legal obligation

DISCLOSURE OF YOUR INFORMATION

1. Visitors

We provide aggregated information about our users and information that does not identify any data subjects, without limitations. Subject to applicable laws, we disclose the Personal Data that we collect, or which you provide in accordance with the rules described in this Policy:

to each member of our group, our subsidiaries and branches;
to contractors, service providers and other third parties whose services we use to support our business, or in connection with the management and support of the activities listed above, with such entities bound by contractual obligations to maintain the confidentiality of Personal Data and use them solely for the purposes for which we make them available (e.g. hosting providers, database providers, developers or consultants);
to purchasers or other successors in the event of a merger, sale, restructuring, reorganisation, dissolution, or other sale or transfer of some or all of the Company’s assets, both as a going concern and as part of bankruptcy, liquidation or similar proceedings in which the Personal Data held by the Company and concerning the users of our Website are among the assets transferred;
if we are obliged to disclose or share your Personal Data in order to comply with any legal obligations, or to enforce or apply our terms and conditions of use and other agreements, including for invoicing and collection purposes; or to protect the rights, ownership or security of the Company, our customers or other persons;
for any other purpose, with the consent of the user, when required by applicable laws and regulations.

IV. CROSS-BORDER TRANSFER OF PERSONAL DATA

The data we collect from you will be transferred to and will be stored in a location outside the European Economic Area (the “EEA”). They will also be processed by employees working outside the EEA who work for us, or for other entities acting as data controllers that process data on our behalf. This includes employees dealing with, inter alia, the processing of your request or order and the provision of support services.

V. STORAGE OF DATA

Unless otherwise required by law, the Company will also delete the Personal Data when they cease to be necessary in connection with the purposes for which they have been collected or otherwise processed; if you withdraw your consent (if the lawfulness of processing was based on your consent) and there is no other legal basis for processing; in the case of your objection to the processing and when there are no reasonable grounds for the processing; when your Personal Data have been unlawfully processed; and when it is necessary to comply with legal obligations.

If you are a person seeking employment, your profile will be automatically deleted after 3 years from its creation unless Bunge offers you, or intends to offer you a job.

VI. SELECTION OF A METHOD TO USE AND DISCLOSE INFORMATION

We make every effort to ensure that you have a freedom of choice as regards the Personal Data that you provide to us. We have created mechanisms to ensure that you have control over your information:

Cookie settings. You can set your browser in such a way as to reject all or some browser cookies or prompt you when sending cookies. If you disable cookies or refuse to receive cookies, please remember that some parts of this Website will become unavailable or will not work properly.

VII. YOUR RIGHTS IN RESPECT OF PERSONAL DATA

We would like to remind you that you can exercise the following rights at any time:

The right to request access to your Personal Data, including the right to obtain confirmation from us whether your Personal Data are processed and, if this is the case, the right to access the Personal Data and information about how they are processed.
The right to rectify your Personal Data or have them erased, including the right to supplement the incomplete Personal Data, including by providing a supplementary declaration, and certain rights to request us to erase your Personal Data without undue delay.
The right to request restriction of the processing of your Personal Data, including the restriction of further processing of your Personal Data in certain specific circumstances (e.g. when you challenge the accuracy of your Personal Data, the processing is unlawful, your Personal Data are no longer necessary for the purposes of the processing, or you have otherwise expressed your objection to the processing in connection with automatic individual decision-making).
The right to object to the processing of your Personal Data in the case of the processing of your Personal Data for direct marketing purposes, where the processing is necessary for the performance of a task carried out in the public interest, or where the processing is necessary for the purposes of pursuing legitimate interests of the Company or a third party, unless we present significant legitimate grounds for processing that violate such interests.
The right of data portability, which includes certain rights to transfer your Personal Data to another controller.
If the processing of data is based on your consent, the right to withdraw your consent at any time.
The right to lodge a complaint with the supervisory authority.

If you are a person seeking employment and you want to view, modify or delete any Personal Data, please log in to your account.

All requests related to the above rights can be sent by e-mail to BEU.ZTK.Dataprotection@bunge.com.

VIII. DATA SECURITY

We have implemented measures to protect your Personal Data against accidental loss, use, alteration, disclosure and unauthorised access.

VIII 1. Visitors

Identity & Access Management (IAM);
Password rotation;
Monitoring of access control through log management;
Management of threats and responding in real time, including, where necessary, through escalations; and
Implementation of leading firewall technologies and protection against harmful impact of DDoS attacks of third parties.

In addition, the Bunge Group has established a cybersecurity committee to ensure that all cybersecurity aspects are up-to-date and evolve at the same pace as the constantly changing threats.

IX. THIRD-PARTY WEBSITES

Our Website may contain links or references to other websites beyond our control (such as Facebook.com/bunge, linkedin.com/company/bunge, etc.). Please note that this Policy does not apply to these sites. The Company encourages you to read the privacy statements and the terms and conditions of related websites to which you are referred when you enter specific websites. The said third-party websites will send you their own cookies and other tracking devices, record your IP address, and otherwise collect or solicit your Personal Data. The Company does not exercise control or holds responsibility for actions of third parties in connection with their websites, nor for the manner in which they handle your Personal Data. Please be careful and read the data protection policy posted on such third-party websites in order to obtain further information.

X. CHILDREN BELOW 16 YEARS OF AGE

Our Website is not intended for children under the age of 16, and the Company does not knowingly collect or use any Personal Data from children under 16 years of age. No person under 16 years of age may provide any information to or on the Website. If we find that we have collected or received Personal Data from a child under 16 years of age, we will delete such information. If you think that we can have any information from a child under 16 years of age, please contact us at BEU.ZTK.Dataprotection@bunge.com.

XI. REVIEWS OF OUR DATA PROTECTION POLICY

We reserve the right to change this Policy at any time. Any changes introduced by us will be published on this Website. If we introduce significant changes in the treatment of your Personal Data, we will notify you by publishing relevant information on the Website, using a separate banner relating to this Data Protection Policy for the Website. The date of the last update of this Policy is indicated at the top of the page.

XII. DATA CONTROLLER AND CONTACT DETAILS

The Controller for the purposes of this website is Bunge Polska Sp. z o.o. in Kruszwica.

If you have any questions or doubts related to this Policy and our privacy practices, please contact us at: BEU.ZTK.Dataprotection@bunge.com

Srovnat