This information concerns video surveillance covering the luggage locker system managed by the Administrator.

1. Personal Data Administrator

The administrator of Your personal data in the form of an image recorded by the surveillance system is:

Euro Inwest Bis Sp. z o.o. with registered office in Katowice

registered office address: ul. J. Pukowca 17, 40-847

KRS: 0000295608, NIP: 632 194 49 14

(hereinafter referred to as the "Administrator").

Important: This surveillance system is independent of the general train station/facility surveillance. The administrator of data from cameras directed at lockers is exclusively the entity indicated above, and not the station manager.

2. Contact regarding data protection

For matters regarding the processing of personal data and the exercise of Your rights, please contact:

• E-mail address: reklamacje@mylocker.online
• Correspondence address: ul. J. Pukowca 17, 40-847 Katowice

3. Purpose and legal basis for processing

Your personal data is processed on the basis of Art. 6(1)(f) GDPR (legitimate interest of the Administrator).

The legitimate interest pursued by the Administrator is:

1. Ensuring security - Protection of the Administrator's property (locker devices) and property entrusted by Clients (luggage).

2. Protection of persons - Ensuring the safety of clients and service staff in the locker area.

3. Pursuing claims - Identifying perpetrators of potential damages, thefts, vandalism, or defense against unjustified claims against the Administrator.

4. Scope of processing

Surveillance covers only visual image (without sound) in the immediate vicinity of luggage lockers. Recorded are: images of persons, clothing characteristics, behavior in the monitored area, and the time of the event.

5. Data recipients

Access to recordings may only be held by:

• Authorized employees and associates of the Administrator.
• Entities providing technical and maintenance services (e.g., IT service, security system installers) – based on appropriate data processing agreements.
• Entities providing property protection services (security agencies) – if applicable.
• Authorities authorized under legal provisions (e.g., Police, Prosecutor's Office, Courts) – only in the case of conducting appropriate proceedings.

6. Data retention period

Surveillance recordings are stored for a period not exceeding 30 days from the date of recording. After this period, data is automatically overwritten (deleted).

Exception: In the case where a recording constitutes evidence in proceedings conducted under the law or the Administrator has learned that it may constitute evidence in proceedings – this period is extended until the final conclusion of the proceedings.

7. Rights of data subjects

In connection with data processing, You have the right to:

1. Access to data - Obtain information about processing and a copy of a fragment of the recording (provided that this does not violate the rights and freedoms of third parties).

2. Deletion of data or restriction of processing - In cases specified in GDPR.

3. Objection - You have the right at any time to object to the processing of Your data for reasons related to Your particular situation.

4. Filing a complaint - To the supervisory authority – the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw), if You believe that the processing violates GDPR provisions.

8. Information on voluntary provision of data

Staying in the monitored area is voluntary, however, for technical and security reasons, entering the locker area involves automatic image registration.

Lack of consent to monitoring results in the inability to use the luggage storage service at this specific location.

9. Automated decision-making

Data from surveillance is not subject to automated decision-making, including profiling. The system does not use automatic facial recognition (biometrics) technology to identify persons.

10. Transfer of data to third countries

The Administrator does not transfer Your personal data to third countries (outside the European Economic Area) or to international organizations.

---

VIDEO SURVEILLANCE REGULATION

(concerning luggage locker locations)

§ 1. General Provisions

1. This Regulation defines the rules for the operation of the video surveillance system, rules for recording and storing camera footage, as well as the procedure for disclosing data recorded by the surveillance system.

2. The administrator of the surveillance system and the administrator of personal data originating from this system is Euro Inwest Bis Sp. z o.o. with registered office in Katowice, registered office address: ul. J. Pukowca 17., KRS: 0000295608, NIP: 632 194 49 14, (hereinafter referred to as the "Administrator").

3. Surveillance is used in locations where the Administrator conducts business activities in the field of luggage locker rental.

4. Surveillance is a system independent of the facility manager's security systems and covers only devices belonging to the Administrator.

§ 2. Purpose and Legal Basis

1. The purpose of using surveillance is:

a. Ensuring the security of the Administrator's property (locker devices) and property entrusted by clients.

b. Ensuring the safety of persons staying in the immediate vicinity of lockers (clients, service personnel).

c. Identifying perpetrators of prohibited acts (theft, vandalism) and pursuing claims and defense against claims.

2. The legal basis for data processing is Art. 6(1)(f) GDPR (legitimate interest of the administrator).

§ 3. Technical Scope and Monitored Area

1. The surveillance system consists of:

a. Industrial cameras recording color images.

b. Recording devices (hard drives/recorders) or secure cloud space.

c. Monitoring screens (available only to authorized persons).

2. The following are covered by surveillance:

a. Fronts of luggage lockers (service panels).

b. Immediate surroundings of lockers necessary for event verification.

3. Surveillance does not cover sanitary facilities, changing rooms, canteens, or other spaces where this would violate the dignity or privacy of persons, nor spaces managed exclusively by third parties, unless technically necessary.

4. Surveillance does not record sound.

§ 4. Recording and Data Storage Rules

1. Image recording takes place in continuous mode (24h/day) or motion detection mode.

2. The storage period for recordings is a maximum of 30 days.

3. After the period specified in para. 2, data is automatically overwritten with new recordings (deleted), without the possibility of recovery.

4. In the case where a recording constitutes evidence in proceedings conducted under the law or the Administrator has learned that it may constitute evidence in proceedings, the storage period is extended until the final conclusion of the proceedings.

§ 5. System Security and Data Access

1. Access to live images and archival recordings is available only to persons with individual authorization granted by the Administrator (e.g., Management, Technical Department, designated security personnel).

2. Recording devices are physically secured against access by unauthorized persons and logically secured.

3. Persons with access to recordings are obliged to maintain confidentiality and comply with personal data protection principles.

§ 6. Procedure for Disclosing Recordings

1. Disclosure to law enforcement agencies: Secured event recordings are provided upon written request from authorized authorities (e.g., Police, Prosecutor's Office, Courts) in connection with ongoing activities.

2. Disclosure to natural persons (Clients):

a. A natural person has the right to view a recording on which their image appears.

b. The Administrator may refuse to provide a copy of a recording to a natural person if other persons are visible on the recording and their anonymization (face blurring) is technically impossible or involves excessive costs, which would violate the rights and freedoms of third parties.

c. In the case of criminal events (e.g., luggage theft), the Administrator recommends reporting the matter to the Police. The Administrator will secure the recording upon request from the injured party until receiving an official request from the Police.

§ 7. Information Obligation

1. Areas covered by surveillance are visibly marked with information boards with a camera pictogram.

2. Detailed information clause (in accordance with Art. 13 GDPR) is available on the Administrator's website at www.mylocker.online and at the Customer Service Office.

§ 8. Final Provisions

1. This Regulation enters into force on 01-01-2025.

2. Every employee/collaborator with access to the surveillance system is obliged to familiarize themselves with the content of the Regulation and comply with it.

---