PRIVACY POLICY AND USE OF COOKIES

I. GENERAL INFORMATION

1. This Privacy and Cookie Use Policy is a set of rules for the processing of personal data and the collection of
   cookies by „!Fest Coffee Mission” Ltd with its registered office at Lviv, Ukraine, address; 24-26,
   Staroznesenska street (hereinafter: "Administrator"), inter alia on (hereinafter: "Website"), and sets out what personal
   data we collect, how we use it and with whom we share it. This notice also describes the measures we take to protect personal data.
2. This document is addressed to all persons who visit the website , contact the Administrator of personal data (by telephone, e-mail, letter), including if they are employees, co-workers or representatives of the Administrator’s contractors (hereinafter: "Users").
3. Users can contact the Administrator in the following ways:
4. Personal data is any information relating to an identified or identifiable natural person. This type of data includes, but is not limited to, name, address, telephone number and e-mail address. Information that cannot be linked to a specific or identifiable person (such as statistical data) is not considered personal data.
5. Before using the Website and the services of the Administrator, the User should read this privacy and cookie use policy. The purpose of the document is, inter alia, to fulfil the information obligation referred to in Articles 13(1) and (2) and 14(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), (hereinafter:
   "GDPR").

ㅤ

II. PROTECTION OF DATA

1. The Administrator, through the use of appropriate technical and organisational measures, shall make every effort to protect personal data against loss or misuse.
2. All data protection notifications are recorded and thoroughly explained and analysed based on the applicable legislation.

ㅤ

III. DATA SUBJECTS' RIGHTS

1. The data subject has the right to:

ㅤ

IV. WITHDRAWAL OF CONSENT TO THE PROCESSING OF PERSONAL DATA AND THE MECHANISM OF WITHDRAWAL OF CONSENT

1. Where processing is based on the person’s consent, we would like to inform you that the person has the right to withdraw consent at any time. The declaration of withdrawal of consent shall be made by submitting a statement to the Administrator by email or via post.
2. The receipt of such a statement does not affect the lawfulness of prior processing of personal data.
3. The withdrawal of consent for the processing of personal data shall be ineffective to the extent necessary for the proper provision of the services or the provisions of the ongoing contract, including the complaint process. In such a case, the withdrawal of the aforementioned consent shall become effective upon cancellation of the
   services, termination of the ongoing contract or the complaint process.
4. Despite the effective withdrawal of consent to process the data, the Administrator is entitled to process the data to the extent necessary for:
5. In connection with a declaration of withdrawal of consent to data processing, for the purposes of identifying the person making the declaration and in order to protect against unauthorised access to the data, the Administrator shall be entitled to obtain additional confirmation of the identity of the person making such declaration.

ㅤ

V. CATEGORIES OF PERSONAL DATA PURPOSES OF PROCESSING AND LEGAL BASIS

1. In order to provide the Services and to fulfil the Contract with its Customers [Pursuant to Article 6(1)(b) GDPR], the Administrator may process necessary data, such as registration data, data of contact persons on the Customer's side, i.e. name, surname, official position, telephone, signature, e-mail address, work position,
   delivery address.
2. The provision of personal data is voluntary, but is necessary for the performance of the Services, provided by the Administrator.
3. The Administrator also processes data in connection with the performance of its Services:
4. For the purpose of defending against and pursuing claims [Pursuant to Article 6(1)(f) GDPR].
5. The use of the Website may involve the processing of personal data by the Administrator for the following purposes:

ㅤ

VI. DATA SHARING

1. The Administrator may share personal data:

ㅤ

VII. RETENTION PERIOD AND DELETION OF DATA

1. The Administrator processes personal data only for as long as is necessary to fulfil the purpose for which they were collected.
2. Where personal data is processed in connection with the performance of a contract concluded with the Client, we will retain it for the period of performance of the contract and, to the extent necessary, for 5 years counting from the end of the calendar year in which the deadline for payment of tax due in connection with the conclusion and performance of the contract has expired, or longer if required by law;
3. The User has contacted the Administrator - their data will be processed for the period necessary for the purposes of contacting the User and for a period of 2 years after the end of the contact.
4. If personal data is processed based on the User's consent, it will be processed until the consent is withdrawn.
5. If the User's personal data are no longer necessary for the purposes for which they were processed, the Administrator will keep them for the purpose of establishing, investigating or defending against possible claims on the part of both the Administrator and the User only for the periods of limitation of claims, as defined by
   law.
6. After the expiry of the entitlement period for storing personal data, it is permanently deleted.

ㅤ

VIII. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN ECONOMIC AREA

1. Personal data may be transferred to third countries in the event that the services that the Administrator provides are also to be performed in the territory of a third country. Personal data may also be transferred to the Administrator's subcontractors (e.g. entities that deliver a consignment in the territory of a third country) and entities that provide tax, legal, audit and billing advice to the Administrator, if they carry out their activities in the territory of a third country.
2. The Administrator does not transfer personal data to international organisations.
3. The Administrator does not transfer personal data to third countries where this is impossible or would be incompatible with generally applicable law.
4. The level of protection of Personal Data outside the European Economic Area ("EEA") is not the same as that provided by European law. Accordingly, the Administrator transfers Personal Data outside the EEA only when necessary, while ensuring an adequate level of data protection in accordance with applicable regulations.

ㅤ

IX. SOURCE OF PERSONAL DATA

1. Personal data of Users that is not collected from them directly may be obtained from their employers, colleagues or entities that the User represents. The Administrator may also process personal data from publicly available sources.

ㅤ

X. COOKIES

1. Cookies are web data, in particular text files, which are stored on the User's terminal device (computer, mobile phone, tablet). First of all, they contain the name of the website of their origin, their unique number, the time they are stored on the end device. Cookies provide the Administrator with statistical information about User traffic, User activity and the use of the Website. They make it possible to adapt the content and services to the User's preferences.
2. In connection with our use of cookies, we provide the most important information on their use:
3. There are two main types of cookies used on the Website:
4. "Session" cookies are temporary files that are stored on the User's terminal equipment until the User logs out, leaves the website or switches off the software (web browser). "Permanent" cookies are stored on the User's terminal equipment for the time specified in the parameters of the cookies or until they are deleted by the User.
5. The following types of cookies are used within the Service:

ㅤ

XI. BLOCKING COOKIES

1. In many cases, web browsers allow cookies to be stored on the User's terminal equipment by default. Users of the Website may at any time make changes to their settings concerning cookies, e.g. in such a way as to block the automatic handling of cookies or inform on their each placing in the equipment of a User of the Website.
   Detailed information on the possibility and methods of using cookies is available in the settings of browsers or on the following websites:
2. However, the Administrator informs that restricting the use of cookies may affect some of the functionalitiesavailable on the Website.