INFORMATION OBLIGATION

GDPR CLAUSES

HOW TO USE THESE CLAUSES

1.Layered model. At every point where data is collected, a short layer is displayed, with a link underneath that expands the full layer. The full layer must be available before the form is submitted, not only afterwards.

2.Consent and the information obligation are two different things. An information clause is never a checkbox and never requires ticking. Checkboxes are used only where the basis is consent — in practice, for the newsletter and marketing communications (§ 4 below).

3.No consent field may be pre-ticked by default, and consents for different purposes must be separate (Article 7(2) GDPR). Consent to the communication channel under Article 398 PKE is required independently of the GDPR basis.

1. Every clause refers to the Privacy Policy. The link must lead to the full document, not to a section of the page.

1. ENQUIRY FORM — BUYER (ARTICLE 13)

SHORT LAYER — NEXT TO THE FIELD / BUTTON

The controller of your data is Trucklo Sp. z o.o., based in Poznań. We will use the data provided in the form to route your enquiry to manufacturers capable of fulfilling it. A Manufacturer that receives the enquiry becomes a separate controller of your data. The service is free of charge, and your data is not passed to advertising networks. Expand the data notice

FULL LAYER — EXPANDABLE “EXPAND THE DATA NOTICE”

Controller: Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland, KRS 0001234469. Contact for data matters: legal@trucklo.eu.

Purposes and legal bases: routing the enquiry to matched Manufacturers and following up to clarify the enquiry — Article 6(1)(b) GDPR (performance of a service at your request) and Article 18(1) of the Act on the Provision of Electronic Services; measuring the effectiveness of enquiry routing — Article 6(1)(f) GDPR.

Recipients: the Manufacturers to whom the enquiry is routed (as separate controllers), and the IT providers acting on our behalf, listed in the Privacy Policy.

Retention period: 3 years from completion of handling the enquiry (the statute-of-limitations period for claims).

Rights: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and a complaint to the President of the Personal Data Protection Office.

Voluntary nature: providing the data is voluntary, but necessary to forward the enquiry — without contact details, the Manufacturer has no way to respond.

Automated decisions: matching is carried out partly automatically and is subject to human review; we do not make decisions that produce legal effects concerning you. Details: Privacy Policy.

2. CONTACT FORM (ARTICLE 13)

SHORT LAYER — NEXT TO THE FIELD / BUTTON

The controller of your data is Trucklo Sp. z o.o. We will use the data from the form solely to respond to your message. Expand the data notice

FULL LAYER — EXPANDABLE “EXPAND THE DATA NOTICE”

Controller: Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland. Contact: legal@trucklo.eu.

Purpose and legal basis: responding to the message submitted — Article 6(1)(f) GDPR (conducting correspondence), or, where the message concerns the conclusion or performance of a contract, Article 6(1)(b) GDPR.

Retention period: until the correspondence is concluded, and then for 12 months; longer only where necessary to pursue or defend claims.

Recipients: the mail and hosting providers acting on our behalf.

Rights: access, rectification, erasure, restriction, objection, and a complaint to the President of the Personal Data Protection Office.

Voluntary nature: providing the data is voluntary, but necessary to respond.

3. MANUFACTURER ONBOARDING FORM (ARTICLE 13)

SHORT LAYER — NEXT TO THE FIELD / BUTTON

The controller of the data of the individuals representing your company is Trucklo Sp. z o.o. We will use the data to conclude and perform the Participation Agreement, maintain your profile, and route enquiries. Expand the data notice

FULL LAYER — EXPANDABLE “EXPAND THE DATA NOTICE”

Controller: Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland, KRS 0001234469. Contact: legal@trucklo.eu.

Purposes and legal bases: concluding and performing the Participation Agreement, maintaining the profile and the Manufacturer Panel, and routing enquiries — Article 6(1)(b) GDPR; billing and tax documentation — Article 6(1)(c) GDPR in conjunction with the Accounting Act and the Tax Ordinance; analysing the quality of cooperation and pursuing or defending claims — Article 6(1)(f) GDPR.

Recipients: IT, hosting, and automation-tool providers, the accounting firm, and the SMS notification provider — listed in the Privacy Policy.

Retention period: the term of the agreement plus 3 years; billing documentation — 5 years from the end of the tax year.

Rights: access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and a complaint to the President of the Personal Data Protection Office.

Voluntary nature: providing the data is voluntary, but necessary to conclude and perform the agreement.

Note regarding Buyers' data: upon receiving an enquiry, you become a separate controller of the Buyer's contact person's data and independently fulfil the obligations arising from the GDPR, in particular the information obligation under Article 14 GDPR.

4. NEWSLETTER AND MARKETING COMMUNICATIONS — CONSENTS AND CLAUSE

The consents below are separate and optional. None may be pre-ticked by default or made a condition for submitting an enquiry.

CHECKBOX 1 — TEXT

☐ I would like to receive the Trucklo newsletter and market report at the e-mail address provided. I can withdraw my consent at any time by clicking the link in the footer of the message.

CHECKBOX 2 — TEXT

☐ I consent to being contacted by Trucklo for marketing purposes by phone or SMS message at the number provided.

FULL LAYER — EXPANDABLE “EXPAND THE DATA NOTICE”

Controller: Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland. Contact: legal@trucklo.eu.

Purpose and legal basis: sending the newsletter, market report, and marketing communications — Article 6(1)(a) GDPR (consent) and Article 398 of the Electronic Communications Law (consent to the communication channel). Consent to the channel is required separately from the GDPR basis and also applies in B2B relationships.

Retention period: until consent is withdrawn or the subscription is cancelled; we retain proof of consent for 3 years after its withdrawal in order to demonstrate compliance with Article 7(1) GDPR.

Recipients: the messaging tool provider and the SMS notification provider, listed in the Privacy Policy.

Rights: withdrawal of consent at any time without affecting the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR), as well as access, rectification, erasure, restriction, data portability, and a complaint to the President of the Personal Data Protection Office.

Voluntary nature: giving consent is entirely voluntary and is not a condition for using the Platform.

5. FIRST CONTACT WITH A MANUFACTURER FROM THE LIST — ARTICLE 14 GDPR

The clause is placed in the first message sent to a Manufacturer whose data was obtained from public sources, no later than one month after the data was obtained (Article 14(3) GDPR). Until contact is made, the obligation is fulfilled by § 5 of the Privacy Policy.

TEXT FOR THE FOOTER OF THE FIRST MESSAGE

Where we obtained your data. Your company's profile was added to the Trucklo Manufacturer List based on information from public business registers and publicly available websites and industry directories. The controller of the data is Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland, KRS 0001234469, legal@trucklo.eu.

Scope of data: the company's name and registration details, address and area of operation, business contact details, the publicly disclosed name and position of the contact person, and information on the product range and production capabilities.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in building a map of market supply and establishing B2B business contact.

What this means in practice: a profile added without your confirmation does not receive routed enquiries until participation is confirmed. We do not send unsolicited commercial offers and do not share this data with third parties for marketing purposes.

Retention period: until an objection is raised, or, in the absence of any interaction, no longer than 24 months from when the data was obtained.

Your rights: access, rectification, erasure, restriction of processing, data portability, and objection to processing (Article 21(1) GDPR). At your request, we will remove the profile from the list without delay, with no need to justify the request — an e-mail to legal@trucklo.eu is enough. You are also entitled to lodge a complaint with the President of the Personal Data Protection Office.

6. RECRUITMENT (ARTICLE 13)

FULL LAYER — EXPANDABLE “EXPAND THE DATA NOTICE”

Controller: Trucklo Sp. z o.o., ul. Stanisława Barańczaka 1B/4, 60-537 Poznań, Poland. Contact: legal@trucklo.eu.

Purpose and legal basis: conducting the recruitment process — Article 6(1)(b) GDPR (steps taken prior to entering into a contract) and Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Labour Code, as regards the data an employer may require; data beyond that scope, including a photograph in the CV — Article 6(1)(a) GDPR (consent).

Retention period: until the recruitment process ends, or, where consent is given for future recruitment, 12 months.

Rights: access, rectification, erasure, restriction, data portability, withdrawal of consent at any time, and a complaint to the President of the Personal Data Protection Office.

Voluntary nature: providing the data required under the Labour Code is a condition for taking part in the recruitment process; providing additional data is voluntary.

SUMMARY — WHERE TO PLACE EACH CLAUSE

Consent register. For every consent, the following must be retained: the wording of the clause as it stood at the time consent was given, the date and time, the channel, and the session identifier. Without this, compliance with Article 7(1) GDPR cannot be demonstrated in the event of an audit.