Information on the processing of shareholders’ personal data by SalesUP Polska S.A.
Last updated: 2 September 2026
1. Personal data controller
The controller of shareholders’ personal data is SalesUP Polska Spółka Akcyjna, with its registered office in Warsaw at 78A Sternicza Street, 01-350 Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001098798, NIP 5223294604, REGON 528311263, hereinafter referred to as the Company or the Controller.
For matters concerning the processing of personal data, you may contact the Company:
• by post: SalesUP Polska S.A., 78A Sternicza Street, 01-350 Warsaw;
• by email: kontakt@salesup.pl.
2. Entity maintaining the shareholder register
The Company’s shareholder register is maintained by:
Dom Maklerski Navigator S.A., 18 Twarda Street, 00-105 Warsaw
Dom Maklerski Navigator S.A. processes the personal data contained in the shareholder register in accordance with applicable law and its own personal data protection obligations.
Information on the data processing rules applied by Dom Maklerski Navigator S.A. is available at:
3. Categories of personal data processed
In connection with holding shares in the Company, we may process in particular:
• full name;
• PESEL number or date of birth where the person does not have a PESEL number;
• citizenship and country of birth;
• type, series and number of the identity document;
• residential address and correspondence address;
• email address;
• telephone number;
• bank account number and SWIFT code;
• information about shares held, including their series, numbers, quantity and nominal value
as well as their type and the rights attached to them;
• information about payment for the shares;
• information about restrictions on the disposal of shares and encumbrances established over them;
• information concerning pledgees, usufructuaries, joint holders of shares and their representatives;
• information about actions and events concerning the shares, including their subscription, acquisition, disposal, encumbrance or redemption;
• information concerning the exercise of shareholder rights, participation in general meetings, powers of attorney, voting and payments made to the shareholder;
• data contained in documents and correspondence provided to the Company or to the entity maintaining the shareholder register.
Where shareholders are legal persons or organisational units, we may also process the data of their representatives, attorneys-in-fact, contact persons and beneficial owners.
4. Purposes and legal bases of processing
Personal data is processed for the following purposes:
4.1. Handling matters related to the shareholder register
We process personal data in order to:
• enter a shareholder in the shareholder register;
• report and document changes in the register;
• determine persons entitled under the shares;
• provide data and documents to the entity maintaining the register;
• maintain documentation relating to the Company’s shares and shareholding structure;
The legal basis for processing is a legal obligation imposed on the Company, in particular under the provisions of the Commercial Companies Code – Article 6(1)(c) UODO.
4.2. Exercising corporate rights and obligations
We process personal data in order to:
• organise general meetings;
• determine the persons entitled to participate in a general meeting;
• exercise voting rights;
• provide notices and information required by law or the Company’s articles of association;
• handle powers of attorney;
• prepare minutes, attendance lists and documentation of resolutions;
• exercise the remaining rights and obligations arising from share ownership.
The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO.
4.3. Settlements with shareholders
Personal data may be processed for the payment of dividends, interim dividends, remuneration for redeemed shares and the performance of other monetary obligations owed by the Company to a shareholder.
The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO and, where applicable, the necessity to perform obligations arising from the legal relationship between the shareholder and the Company – Article 6(1)(b) UODO.
4.4. Compliance with tax, accounting and reporting obligations
We process personal data to maintain accounting and tax documentation required by law and to fulfil reporting obligations. The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO.
4.5. Contact and correspondence handling
We may use contact details to correspond with a shareholder and to provide information relating to the Company and the shares held. The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO, or the Company’s legitimate interest in ensuring efficient and secure communication with shareholders – Article 6(1)(f) UODO. If disclosure of an email address in the shareholder register requires the shareholder’s consent, the legal basis for processing will be the consent granted – Article 6(1)(a) UODO.
4.6. Establishing, pursuing and defending claims
We may process personal data to establish, pursue or defend claims relating to the Company, the shares or the exercise of shareholder rights. The legal basis for processing is the Company’s legitimate interest in protecting its rights – Article 6(1)(f) UODO.
5. Sources of personal data
We may receive personal data:
• directly from the shareholder;
• from an attorney-in-fact, statutory representative or joint holder;
• from the previous or new owner of the shares;
• from the Company’s founders;
• from the deed of incorporation, articles of association, agreements concerning the shares and other corporate documentation;
• from the entity maintaining the shareholder register;
• from courts, administrative authorities, enforcement officers or other authorised entities;
• from publicly available registers, in particular the National Court Register and the
Central Register of Beneficial Owners. If the personal data was not obtained directly from the data subject, it may include the categories of data specified in section 3 of this notice.
6. Recipients of personal data
Personal data may be disclosed to:
• Dom Maklerski Navigator S.A., which maintains the Company’s shareholder register;
• shareholders and other persons entitled to access the shareholder register, to the extent provided for by law;
• courts, public administration authorities, tax authorities, law enforcement authorities, enforcement officers and other entities authorised by law;
• notaries, law firms, tax advisers, accountants, auditors and statutory auditors;
• banks and payment service providers, to the extent necessary to make payments;
• entities providing the Company with IT, hosting, archiving, postal, courier and document-storage services;
• other entities where disclosure is necessary for the Company to comply with its legal obligations or protect its rights.
Entities processing personal data on the Company’s behalf receive access only to the extent necessary to perform the services entrusted to them and on the basis of appropriate agreements.
7. Data retention period
Personal data will be retained for as long as the relevant person remains a shareholder and subsequently for the period required by law, in particular under commercial, tax, accounting and archiving regulations.
Documents relating to the exercise of rights attached to shares, general meetings, payments and changes in shareholding may also be retained until the relevant limitation periods for claims expire or proceedings relating to those claims are concluded.
Personal data contained in the shareholder register is retained in accordance with the laws governing that register and the rules applied by the entity maintaining it. Where personal data is processed on the basis of consent, it will be processed until that consent is withdrawn, unless continued retention is necessary on another legal basis.
8. Rights of the data subject
Under the rules set out in UODO, the data subject may have the right to:
• access their personal data;
• receive a copy of their personal data;
• rectify or complete their personal data;
• restrict processing;
• have their personal data erased, provided that there is no legal obligation or other basis for its continued processing;
• data portability, where applicable;
• object to processing based on the Company’s legitimate interest;
• withdraw consent at any time, where personal data is processed on that basis.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The exercise of certain rights may be restricted where the Company is legally required to continue processing personal data, in particular to maintain documentation concerning shareholders and shares. To exercise these rights, please contact the Company at kontakt@salesup.pl.
9. Right to lodge a complaint
The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they believe that their personal data is being processed unlawfully. The supervisory authority’s contact details are available at: https://uodo.gov.pl/
10. Requirement to provide personal data
Providing personal data required by law, in particular data necessary for entry in the shareholder register and for the exercise of rights attached to shares, is mandatory. Failure to provide the required personal data may prevent an entry from being made, the person entitled under the shares from being correctly identified, or certain shareholder rights from being exercised. Providing a telephone number, an additional email address and a bank account number may be voluntary, unless such data is necessary to provide a service, make a payment or use a communication method selected by the shareholder.
11. Automated decision-making
Shareholders’ personal data is not used by the Company to make decisions based solely on automated processing or for profiling that produces legal effects or similarly significantly affects those persons.
12. Transfers of personal data outside the European Economic Area
As a rule, the Company does not intend to transfer shareholders’ personal data outside the European Economic Area.
If a transfer of personal data outside the European Economic Area becomes necessary in connection with the use of specific service providers, it will take place only on the basis of mechanisms provided for under UODO, in particular a European Commission adequacy decision or standard contractual clauses. Information about the safeguards applied may be obtained by contacting the Company at: kontakt@salesup.pl.
13. Updates to this notice
This notice may be updated if the law, the method of maintaining the shareholder register or the Company’s personal data processing rules change. The current version of this notice is available on the SalesUP Polska S.A. website.
Information on the processing of shareholders’ personal data by SalesUP Polska S.A.
Last updated: 2 September 2026
1. Personal data controller
The controller of shareholders’ personal data is SalesUP Polska Spółka Akcyjna, with its registered office in Warsaw at 78A Sternicza Street, 01-350 Warsaw, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001098798, NIP 5223294604, REGON 528311263, hereinafter referred to as the Company or the Controller.
For matters concerning the processing of personal data, you may contact the Company:
• by post: SalesUP Polska S.A., 78A Sternicza Street, 01-350 Warsaw;
• by email: kontakt@salesup.pl.
2. Entity maintaining the shareholder register
The Company’s shareholder register is maintained by:
Dom Maklerski Navigator S.A., 18 Twarda Street, 00-105 Warsaw
Dom Maklerski Navigator S.A. processes the personal data contained in the shareholder register in accordance with applicable law and its own personal data protection obligations.
Information on the data processing rules applied by Dom Maklerski Navigator S.A. is available at:
3. Categories of personal data processed
In connection with holding shares in the Company, we may process in particular:
• full name;
• PESEL number or date of birth where the person does not have a PESEL number;
• citizenship and country of birth;
• type, series and number of the identity document;
• residential address and correspondence address;
• email address;
• telephone number;
• bank account number and SWIFT code;
• information about shares held, including their series, numbers, quantity and nominal value
as well as their type and the rights attached to them;
• information about payment for the shares;
• information about restrictions on the disposal of shares and encumbrances established over them;
• information concerning pledgees, usufructuaries, joint holders of shares and their representatives;
• information about actions and events concerning the shares, including their subscription, acquisition, disposal, encumbrance or redemption;
• information concerning the exercise of shareholder rights, participation in general meetings, powers of attorney, voting and payments made to the shareholder;
• data contained in documents and correspondence provided to the Company or to the entity maintaining the shareholder register.
Where shareholders are legal persons or organisational units, we may also process the data of their representatives, attorneys-in-fact, contact persons and beneficial owners.
4. Purposes and legal bases of processing
Personal data is processed for the following purposes:
4.1. Handling matters related to the shareholder register
We process personal data in order to:
• enter a shareholder in the shareholder register;
• report and document changes in the register;
• determine persons entitled under the shares;
• provide data and documents to the entity maintaining the register;
• maintain documentation relating to the Company’s shares and shareholding structure;
The legal basis for processing is a legal obligation imposed on the Company, in particular under the provisions of the Commercial Companies Code – Article 6(1)(c) UODO.
4.2. Exercising corporate rights and obligations
We process personal data in order to:
• organise general meetings;
• determine the persons entitled to participate in a general meeting;
• exercise voting rights;
• provide notices and information required by law or the Company’s articles of association;
• handle powers of attorney;
• prepare minutes, attendance lists and documentation of resolutions;
• exercise the remaining rights and obligations arising from share ownership.
The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO.
4.3. Settlements with shareholders
Personal data may be processed for the payment of dividends, interim dividends, remuneration for redeemed shares and the performance of other monetary obligations owed by the Company to a shareholder.
The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO and, where applicable, the necessity to perform obligations arising from the legal relationship between the shareholder and the Company – Article 6(1)(b) UODO.
4.4. Compliance with tax, accounting and reporting obligations
We process personal data to maintain accounting and tax documentation required by law and to fulfil reporting obligations. The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO.
4.5. Contact and correspondence handling
We may use contact details to correspond with a shareholder and to provide information relating to the Company and the shares held. The legal basis for processing is a legal obligation imposed on the Company – Article 6(1)(c) UODO, or the Company’s legitimate interest in ensuring efficient and secure communication with shareholders – Article 6(1)(f) UODO. If disclosure of an email address in the shareholder register requires the shareholder’s consent, the legal basis for processing will be the consent granted – Article 6(1)(a) UODO.
4.6. Establishing, pursuing and defending claims
We may process personal data to establish, pursue or defend claims relating to the Company, the shares or the exercise of shareholder rights. The legal basis for processing is the Company’s legitimate interest in protecting its rights – Article 6(1)(f) UODO.
5. Sources of personal data
We may receive personal data:
• directly from the shareholder;
• from an attorney-in-fact, statutory representative or joint holder;
• from the previous or new owner of the shares;
• from the Company’s founders;
• from the deed of incorporation, articles of association, agreements concerning the shares and other corporate documentation;
• from the entity maintaining the shareholder register;
• from courts, administrative authorities, enforcement officers or other authorised entities;
• from publicly available registers, in particular the National Court Register and the
Central Register of Beneficial Owners. If the personal data was not obtained directly from the data subject, it may include the categories of data specified in section 3 of this notice.
6. Recipients of personal data
Personal data may be disclosed to:
• Dom Maklerski Navigator S.A., which maintains the Company’s shareholder register;
• shareholders and other persons entitled to access the shareholder register, to the extent provided for by law;
• courts, public administration authorities, tax authorities, law enforcement authorities, enforcement officers and other entities authorised by law;
• notaries, law firms, tax advisers, accountants, auditors and statutory auditors;
• banks and payment service providers, to the extent necessary to make payments;
• entities providing the Company with IT, hosting, archiving, postal, courier and document-storage services;
• other entities where disclosure is necessary for the Company to comply with its legal obligations or protect its rights.
Entities processing personal data on the Company’s behalf receive access only to the extent necessary to perform the services entrusted to them and on the basis of appropriate agreements.
7. Data retention period
Personal data will be retained for as long as the relevant person remains a shareholder and subsequently for the period required by law, in particular under commercial, tax, accounting and archiving regulations.
Documents relating to the exercise of rights attached to shares, general meetings, payments and changes in shareholding may also be retained until the relevant limitation periods for claims expire or proceedings relating to those claims are concluded.
Personal data contained in the shareholder register is retained in accordance with the laws governing that register and the rules applied by the entity maintaining it. Where personal data is processed on the basis of consent, it will be processed until that consent is withdrawn, unless continued retention is necessary on another legal basis.
8. Rights of the data subject
Under the rules set out in UODO, the data subject may have the right to:
• access their personal data;
• receive a copy of their personal data;
• rectify or complete their personal data;
• restrict processing;
• have their personal data erased, provided that there is no legal obligation or other basis for its continued processing;
• data portability, where applicable;
• object to processing based on the Company’s legitimate interest;
• withdraw consent at any time, where personal data is processed on that basis.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
The exercise of certain rights may be restricted where the Company is legally required to continue processing personal data, in particular to maintain documentation concerning shareholders and shares. To exercise these rights, please contact the Company at kontakt@salesup.pl.
9. Right to lodge a complaint
The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if they believe that their personal data is being processed unlawfully. The supervisory authority’s contact details are available at: https://uodo.gov.pl/
10. Requirement to provide personal data
Providing personal data required by law, in particular data necessary for entry in the shareholder register and for the exercise of rights attached to shares, is mandatory. Failure to provide the required personal data may prevent an entry from being made, the person entitled under the shares from being correctly identified, or certain shareholder rights from being exercised. Providing a telephone number, an additional email address and a bank account number may be voluntary, unless such data is necessary to provide a service, make a payment or use a communication method selected by the shareholder.
11. Automated decision-making
Shareholders’ personal data is not used by the Company to make decisions based solely on automated processing or for profiling that produces legal effects or similarly significantly affects those persons.
12. Transfers of personal data outside the European Economic Area
As a rule, the Company does not intend to transfer shareholders’ personal data outside the European Economic Area.
If a transfer of personal data outside the European Economic Area becomes necessary in connection with the use of specific service providers, it will take place only on the basis of mechanisms provided for under UODO, in particular a European Commission adequacy decision or standard contractual clauses. Information about the safeguards applied may be obtained by contacting the Company at: kontakt@salesup.pl.
13. Updates to this notice
This notice may be updated if the law, the method of maintaining the shareholder register or the Company’s personal data processing rules change. The current version of this notice is available on the SalesUP Polska S.A. website.