pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC – General Data Protection Regulation – (OJEU L of 2016, No. 119, item 1) hereinafter referred to as the GDPR, and the Act of 18 July 2002 on rendering electronic services (Journal of Laws 2002, No. 144 item 1204, as amended), and the Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2018, item 1000), and the Act of 16 July 2004 Telecommunications Law (consolidated text Journal of Laws 2014, item 243, as amended), the Act of 23 April 1964 Civil Code (Journal of Laws of 2018, item 1025, 1104,1629). The Controller of the personal data of the www.rosa.golf website user is: Press Glass Holding S.A. with its registered office at ul. Golfowa19, 42-274 Konopiska, Konopiska commune, entered into the National Court Register by the District Court in Częstochowa, 17th Commercial Division of the National Court Register under number 0000131477, using Tax Identification Number NIP 574 000 74 96 and Business Statistical Number REGON 150021158, share capital of PLN 500 000 (in words: five hundred thousand zlotys 00/100), paid in full, represented by the Management Board – in accordance with a valid legal authorisation, hereinafter referred to as the "Controller" and/or "Press Glass". In all matters relating to the processing of personal data via the www.rosa.golf website by Press Glass and the use of rights related to the processing of data, the user may communicate in writing at the following email address: gdpr@pressglass.com or Press Glass Holding S.A. with its registered office at ul. Golfowa19, 42-274 Konopiska with an annotation "Personal data".
The Controller has appointed a Data Protection Officer. The Data Protection Officer can be contacted directly by electronic means at the following e-mail address: iod@pressglass.com or by phone at: +48 602 638 231 .

• first name, surname,
• e-mail address,
• data for statistical purposes processed via www.rosa.golf , (the user's IP address, domain name, browser type, type of operating system, i.e. data collected during visits to the above-mentioned website).

• in relation to personal data processed for the purpose of maintenance and operation of the www.rosa.golf , website, in the form of the user's IP address, domain name, browser type, type of operating system, i.e. data collected automatically in the course of the user's visits on the www.rosa.golf website, which, however, prevent the identification of a specific person – legal basis Article 6 sec. 1(f) in conjunction with Article 22 of the GDPR,.
• performance of legal obligations imposed on the Controller – legal basis - Article 6 sec. 1(c) of the GDPR,
• replying to questions asked in the contact form on the www.rosa.golf website – legal basis – Article 6 sec. 1(b) and f of the GDPR
• provision of services by electronic means via the www.rosa-golf – website legal basis - Article 6 sec. 1(b) of the GDPR
• contacting the user via the www.rosa.golf website for purposes related directly to the operation of the Rosa Private Golf Club golf course – legal basis Article 6 sec. 1(b) and sec. 1(f) of the GDPR,
• establishing, defending and pursuing claims – legal basis – legally justified interest pursued by the Controller consisting in conducting business activity – Article 6 sec. 1(f) of the GDPR.

Personal data of the user (natural person) shall be kept for the period necessary to perform the tasks of the Controller and comply with the archiving obligations resulting from the provisions of law. In the case of claims, personal data of the user shall be processed until they expire under legal standards contained in the Civil Code or other legal provisions, if such a requirement arises, but no longer than 6 years in the scope of civil law claims, from the date of obtaining consent for processing or performing the first activity related to the processing of personal data of a given user. After expiry of the above dates, personal data of the user shall be deleted or anonymised – i.e. subjected to the irreversible process of encrypting personal data, which prevents identification of the person to whom the personal data pertained. Personal data may be transferred to entities that process such data at the request of the Controller, including entities proving Press Glass with support of the operation of the above golf course, i.a. Rosa Private Golf Association, IT support, the Controller's commercial partners, companies providing consulting services, including marketing agencies, while such entities shall have the right to process personal data only on the basis of an agreement with Press Glass and only to the extent specified in such agreement (the so-called entrustment agreement). The user:

• has the right to access his or her personal data and the right to request its rectification, deletion and restriction of its processing. If the basis for the processing of personal data is a legitimate interest of the Controller, the user has the right to object to the processing of his or her personal data.
• to the extent to which the basis for the processing of personal data is the user's consent, he or she has the right to withdraw consent. The withdrawal of consent does not affect the lawfulness of the processing that was made on the basis of such consent before its withdrawal,
• to the extent to which personal data is processed in order to conclude and perform an agreement/provide services or processed on the basis of consent – the user has the right to transfer personal data. In this situation, the user shall receive from Press Glass his or her personal data in a structured, commonly used, machine-readable format. The user may send this data to another data controller,
• the user has also the right to lodge a complaint with the supervisory body dealing with the protection of personal data - President of the Office for Personal Data Protection.

• if the user is under 13 years of age, Press Glass, in accordance with the law, shall not process his or her personal data (Article 8 of the GDPR), for example, in order for the user to receive information about the above golf course or to obtain a card authorising the use of the above golf course, unless consent previously expressed by the user or legal action performed is confirmed by a person having legal custody over him or her or by the above persons or consent is granted to Press Glass by a statutory representative or legal guardian for and on behalf of the user who is under 13 years of age at the time of granting consent to the processing of this data or under 18 years of age in other legal actions,
• if the user's Parents or legal guardians do not confirm to the e-mail address: gdpr@pressglass.com, consent to the processing of personal data of the user who is under 13 years of age at the time of giving consent, Press Glass shall refrain from processing personal data in relation to the above user.

• personal data obtained directly from the user,
• Internet (in particular: contact form located on www.rosa.golf).
• personal data obtained from the Rosa Private Golf association.

Personal data processed by the Controller is transferred outside the EEA. In connection with the cooperation undertaken by Press Glass with affiliated entities and service providers established outside the EEA, personal data of the user may be transferred to the following states outside the EEA: USA. The European Commission adopted on 12 July 2016 a decision on the appropriate protection of personal data (EU-US Privacy Shield Program), which allows the transfer of personal data of EU citizens, while ensuring an adequate security standard of the above-mentioned procedures.