Identity of the Controller

The controller of the personal data of users of thewebsite available at www.black-orange.eu (hereinafter the “Website”) is BlackOrange spółka z ograniczoną odpowiedzialnością (limited liability company),with its registered office in Węgrzce (32-086), ul. Forteczna 5, Poland, Tax ID(NIP): 6762476804 (hereinafter the “Controller”).

Contacting the Controller

You can contact the Controller:

• via the quote request form available on the Websiteat www.black-orange.eu/en/wycena;
• by post at ul. Forteczna 5, 32-086Węgrzce, Poland;
• by e-mail: legal.dpt@black-orange.pl

Purposes and legal basis ofprocessing

The personal data of Website users will beprocessed in order to:

• perform the contract, in particular to provide thetransport service, or to take steps at your request before entering into thecontract (Art. 6(1)(b) GDPR);
• contact you on matters relating to the contract,which constitutes a legitimate interest of the Controller, namely the abilityto communicate with customers in the course of its business activity (Art.6(1)(f) GDPR);
• send commercial information about the Controller'sproducts and services to Website users who have consented to receiving it (Art.6(1)(a) GDPR);
• handle enquiries submitted via the quote request form or bye-mail, including preparing and presenting an offer – on the basis of Art.6(1)(b) GDPR (steps taken at your request before entering into a contract) and,for enquiries not directly related to the conclusion of a contract, on thebasis of the Controller's legitimate interest in maintaining ongoingcommunication with interested parties (Art. 6(1)(f) GDPR);
• ensure the security, stability and proper functioning of theWebsite, including preventing abuse and attacks on our IT infrastructure, whichconstitutes a legitimate interest of the Controller (Art. 6(1)(f) GDPR);
• compile statistics and analyse how the Website is used, with thehelp of analytics cookies – on the basis of your consent given in the cookiemanagement tool (Art. 6(1)(a) GDPR);
• pursue claims arising from the contract and defendagainst claims, including handling complaints (Art. 6(1)(f) GDPR), whichconstitutes a legitimate interest of the Controller in protecting its interestsshould it become necessary to document and prove certain facts;
• comply with legal obligations, including taxregulations relating to issuing documents confirming a sale and retaining taxrecords for the period required by law (Art. 6(1)(c) GDPR in conjunction withArticle 106b of the Polish VAT Act and Article 74 of the Polish AccountingAct).

Categories of recipients

The personal data of Website users may be processedby entities such as:

• our subcontractors and business partners involvedin the performance of the contract (carriers);
• our accounting services provider (A&BS sp. zo.o., ul. Płaszowska 25/2a, 30-713 Kraków, Poland);
• our legal services provider (TH Legal JKozioł sp.k., Rondo Ignacego Daszyńskiego 1, 29th floor, 00-843 Warsaw, Poland);
• postal operators and couriers in the case oftraditional correspondence (as a rule, Poczta Polska S.A., ul. RodzinyHiszpańskich 8, 00-940 Warsaw, Poland);
• our hosting and e-mail provider(nazwa.pl sp. z o.o., ul. Pana Tadeusza 2, 30-727 Kraków, Poland);
• the provider of the tool used to sende-mail messages, e.g. as part of mailings or newsletters (Microsoft IrelandOperations Limited, One Microsoft Court, South County Business Park,Leopardstown, Dublin 18, D18 DH6k, Ireland);
• the bank receiving payments from transactions (INGBank Śląski S.A., ul. Sokolska 34, 40-086 Katowice, Poland);
• a provider supporting us in legalising theemployment of foreign nationals (Kancelaria Radcy Prawnego Paweł Tokarski, ul.Zwierzyniecka 30/5, 31-105 Kraków, Poland);
• our accounting services provider (PIK Group Sp. zo.o., ul. Wejherowska 4, 80-209 Karczemki, Poland);
• a provider supporting us in legalising theemployment of foreign nationals (Obsługa Firm w Transporcie Krajowym iMiędzynarodowym S.C. Wioletta Kostrzewa, Sylwia Rosłon-Bąk, ul. Borsucza 31,02-213 Warsaw, Poland);
• the provider and operator of the platform on which the Websiteruns, which also handles our online forms (Webflow, Inc., 398 11th Street, 2ndFloor, San Francisco, CA 94103, USA);
• the provider of content delivery network (CDN) services and ofprotection of the Website against attacks (Cloudflare, Inc., 101 Townsend St.,San Francisco, CA 94107, USA);
• the provider of the Google Analytics tool (Google Ireland Limited,Gordon House, Barrow Street, Dublin 4, Ireland) – only if you have consented toanalytics cookies.

Retention period

Your personaldata will be processed:

• for no longer than until the contract has beenperformed and, thereafter, until the limitation period for any claims relatingto the contract has expired and the obligations arising from applicable lawhave been fulfilled (including tax and accounting obligations – we are requiredto retain accounting records for 5 years, calculated from the end of thefinancial year);
• in the case of correspondence with the Controller –for a maximum of 24 months, calculated from the end of the calendar year, whichallows us to maintain continuity of correspondence. An exception applies wherekeeping the correspondence for a longer period is necessary to defend againstor pursue claims;
• where the processing of your personal data is basedon your consent – until you withdraw it or until the Controller decides thatcontinuing to send commercial information to a given recipient is no longerjustified;
• in the case of data collected through cookies – for the storageperiod of each cookie indicated in the Cookie Policy, but no longer than untilyou withdraw your consent or delete the cookies.

Your rights in connection with data processing

In connection with the processing of your personaldata, you have the right to:

• access your data (Art. 15 GDPR),
• have your data rectified (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• restrict the processing of your data (Art. 18GDPR),
• data portability (Art. 20 GDPR),
• object to the processing of your data (Art. 21GDPR),
• not be subject to decisions based on automatedprocessing, including profiling (Art. 22 GDPR);
• withdrawyour consent to the processing of your personal data where consent is the legalbasis for processing; this does not, however, affect the lawfulness ofprocessing carried out before the withdrawal.

Toexercise any of the above rights, please contact us atlegal.dpt@black-orange.pl or at the Controller's postal address.

Obligation to provide data

Providing your personal data is necessary toconclude and perform the contract. This follows from the need to provide thetransport service to a specific address and recipient, and from the need toissue a document confirming performance of the service, containing the datarequired by law, and to make it available to the Website user.

Providingpersonal data in the quote request form available on the Website is voluntary,but necessary for us to prepare and present you with an offer. The scope of thedata is limited to the information needed to prepare the quote and to contactyou in response.

Consenting to marketing communications is entirelyvoluntary and depends solely on your decision.

General enquiries not related to a specific ordermay be made anonymously; in such cases providing personal data is not mandatoryand depends on your decision.

Transfers of data outside the EEA

As a rule, your personal data is processed withinthe European Economic Area. However, because the Website uses tools andresources provided by entities based in the United States – in particular theWebflow platform (together with the content delivery networks it uses,including Amazon CloudFront and jsDelivr), Cloudflare services and GoogleAnalytics – your data may be transferred outside the European Economic Area.This also applies to your IP address and information about your device andbrowser, which are transmitted automatically when page elements such asscripts, stylesheets and fonts are downloaded from these networks. Suchtransfers take place on the basis of the European Commission's implementingdecision of 10 July 2023 finding that the EU–U.S. Data Privacy Frameworkensures an adequate level of protection of personal data, provided that therecipient holds a current certification under that programme, and otherwise onthe basis of standard contractual clauses approved by the European Commission (Art.46(2)(c) GDPR) together with additional safeguards. You can obtain a copy ofthe safeguards applied by contacting the Controller. Activating analytics andmarketing tools that rely on cookies additionally requires your consent.Detailed information is available in the Cookie Policy.

Right to lodge a complaint

If you believe that the processing of your data isunlawful, you have the right to lodge a complaint with the supervisoryauthority – the President of the Personal Data Protection Office (Prezes UrzęduOchrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

Automated decision-making andprofiling

Yourpersonal data is not used for automated decision-making that produces legaleffects concerning you or similarly significantly affects you within themeaning of Art. 22 GDPR. If you consent to analytics cookies, data on your useof the Website may be subject to profiling of a purely statistical nature,which produces no legal effects concerning you.

Changes to this Policy

TheController reserves the right to amend this Privacy Policy and the CookiePolicy, in particular in the event of changes to the law, to the scope ofservices provided or to the tools used on the Website. The current version ofthe document is always published on the Website. Last updated: 4 August 2026.

COOKIE POLICY AND WEB TAGS

I. Cookies

We use cookies on our website. Cookies are smallpieces of text that a website sends to your browser and that the browser sendsback on subsequent visits to the website. Cookies do not usually allow a userto be identified directly. There are two types of cookies:

1. Session cookies – stored temporarily inthe browser's memory until the browser is closed. These files are necessary forcertain applications and features to work properly;
2. Persistent cookies – remain in thebrowser's memory after it is closed, until they expire or until the userdeletes them. On the Website, cookies of this type are used for analyticspurposes.

Ifyou found the above information interesting and would like to learn more abouthow cookies work, we encourage you to read the article on cookies on Wikipedia.Information about cookies is also available at allaboutcookies.org. You arealso welcome to contact us about this by e-mail at legal.dpt@black-orange.pl.

The legal basis forstoring information, and for accessing information already stored, on yourtelecommunications end device is Articles 399 and 400 of the Polish ElectronicCommunications Act of 12 July 2024 and, to the extent that the use of cookiesinvolves the processing of personal data, the provisions of the GDPR. Cookiesnecessary for the proper provision of a service requested by the user are usedwithout consent, on the basis of Article 399(3) of the ElectronicCommunications Act; all other cookies are used only after your prior consenthas been obtained.

II. Purposes of storing and accessing cookies. Information about third-party tools.

‍

The above listreflects the position as at 3 August 2026 and is reviewed periodically. Iffurther tools using cookies are implemented on the Website, they will beactivated only after your prior consent has been obtained, and this Policy willbe updated accordingly.

Thescope and purposes of the cookies we use depend on your consent, which you givethrough the cookie management tool (Art. 6(1)(a) GDPR). You may withdraw thisconsent at any time; this does not, however, affect the lawfulness ofprocessing carried out before the withdrawal.

You give your consentby selecting the relevant cookie categories in the consent management tooldisplayed on your first visit to the Website. Until you give your consent, onlycookies necessary for the proper functioning of the Website are stored on yourdevice.

Withdrawing consentis as easy as giving it and is possible at any time – by reopening the cookiesettings on the Website, or by deleting the stored cookies and changing yourbrowser settings. Most browsers allow you to block cookies or to be notified eachtime a cookie is about to be stored; detailed instructions can be found in thedocumentation of the individual browsers (including Google Chrome, MozillaFirefox, Safari, Microsoft Edge and Opera). Restricting the use of cookies mayaffect some features of the Website.

III. GoogleAnalytics

‍

On our Website, weuse the analytics tool GoogleAnalytics 4, provided by Google Ireland Limited (Gordon House,Barrow Street, Dublin 4, Ireland), to analyse how our Website is used, optimiseits performance and improve the user experience. The tool is activated onlyafter you have consented to analytics cookies and collects statisticalinformation about visits, such as:

• the numberof visits to the site,
• the timespent on individual pages,
• the typeof device and browser used,
• approximatelocation based on the IP address,
• users'navigation paths within the Website,
• the sourceof the visit (e.g. a search engine, a referral from another site, a campaign).

Google Analytics usesthe cookies listed in the table above and is implemented via the Google tag(gtag.js) loaded from the googletagmanager.com domain; the ID of the serviceused on the Website is G-5YKFGM1J11. In Google Analytics 4, the user's IP addressis not stored – it is used only to determine an approximate location and isthen discarded. The data collected is analysed in aggregated form and is notused to identify any specific person. Google may transfer the collected dataoutside the European Economic Area under the rules described in the section“Transfers of data outside the EEA”. Detailed information on how Googleprocesses data is available at policies.google.com/privacy. Regardless of yoursettings on the Website, you can install a browser add-on that blocks GoogleAnalytics, available at tools.google.com/dlpage/gaoptout.

IV. Server logsand IP addresses

In addition to cookies, the website may alsocollect data customarily gathered by administrators of online systems in theform of logs or log files. The information contained in the logs may include,among other things, the IP address, the type of platform and browser, theInternet service provider and the address of the page from which the useraccessed the website.

IP addresses can be helpful indiagnosing technical problems with the server and in compiling statisticalanalyses (e.g. determining which regions generate the most visits). They canalso be useful in administering and improving the Website. IP addresses arecollected anonymously, which means they are not linked to any user data. Thedata contained in the server logs is kept for as long as necessary to ensurethe security and diagnostics of the Website, and no longer than 12 months.