PRIVACY POLICY OF THE WESTSTATION.COM.PL WEBSITE

Effective from 15 July 2024

This Privacy Policy contains information about the processing of the personal data of the users ("Users") in connection with their use of the West Station website accessible through the following link http://www.weststation.com.pl/ (hereinafter the "West Station Website"), or the services available through this website (hereinafter the "Privacy Policy").

• "Personal data" means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• "Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The Privacy Policy contains information required by the Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the "GDPR").

1. Introduction

1.1 [Data Controller] The Controller of Users' data is Mapletree Management (Poland) sp. z o.o. with its registered office in Warsaw (02-305), address: Aleje Jerozolimskie 142A (floor 12), entered in the register of entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, under the number KRS: 0000731342, NIP: 5213826620, REGON: 380194320, with the share capital in the amount of: PLN 1 543 400.00 (hereinafter "Controller" or "we").

1.2 [Data Protection Officer] The Controller has not appointed a Data Protection Officer.

1.3 [Contact details] If Users wish to exercise their data protection rights or contact us on any

other matter, we remain at their disposal at the following e-mail address: ploffice@mapletree.com.sg, or by post to the address of the Controller indicated in section 1.1 above. with the note "for the attention of Legal Office".

2. Personal data collected by the Controller

2.1 The Controller collects and processes personal data provided by Users when they visit and use the West Station Website, as well as the services available to Users through the West Station Website. This data may include:

2.1.1 Name;

2.1.2 Email address;

2.1.3 Company name;

2.1.4 Telephone number(s);

2.1.5 Any other information that User chooses to include in the contact form or in a direct message to the Controller's representatives;

2.1.6 IP address;

2.1.7 Cookies.

The purposes and legal bases for processing personal data

3.1 Users' personal data will be processed for the following purposes and on the following legal bases:

3.1.1 To enable Users to use the West Station Website and the services available through the Website; the processing of Users' personal data for this purpose is be based on the basis of: Article 6(1)(b) of the GDPR, to provide Users with the ability to use the West Station Website without interruption, including all of its functionalities;

3.1.2 To allow the Users to contact us by means of the contact form available on the West Station Website or by means of the e-mail addresses to the Controller's representatives provided on the West Station Website; the processing of the Users' personal data for these purposes will be based on the following legal bases:

• Article 6(1)(f) GDPR, i.e. on the basis of the Controller's legitimate interests in being able to ensure the communication with Users and handling of their requests;

• Article 6(1)(a) of the GDPR, i.e. on the basis of the User's consent to the processing of data, where the personal data goes beyond what is necessary to send a request through the contact form available on the West Station Website.

3.1.3 Handling of complaints and claims; the processing of User’s personal data for this purpose is based on the: Article 6(1)(f) GDPR, i.e. on the basis of the Controller's legitimate interests in protecting our rights and interests.

4. Retention period of Users' personal data

4.1With respect to data processed on the basis of the User's consent, such data will be processed for no longer than is necessary to achieve the purposes for which it was collected, and thereafter for no longer than is permitted or required by applicable law (e.g. for the period required to comply with the statute of limitations), or in any case until the User withdraws their consent to such processing;

4.2With respect to data processed on the basis of our legitimate interest, it will be processed for no longer than is necessary to achieve the purposes for which it was collected, and thereafter for no longer than is permitted or required under applicable law (e.g. for billing purposes or for the period required to comply with the statute of limitations), or in any case until the User has objected to such processing.

4. Data recipients

5.1 Users' personal data may be made available to the following entities:

5.1.1 companies within the Mapletree Group or our business partners who may act as data processors, joint controllers or (separate) data controllers under agreements entered with us;

5.1.2 to companies that work with us, such as IT service providers, marketing agencies, advertising agencies, hosting companies;

5.1.3 to public authorities, including courts and law enforcement agencies (police and prosecutors), only to the extent necessary, required and permitted by law.

5.2 Any entity to which the Controller provides the User’s personal data will process such data on the basis of an appropriate agreement with the Controller, solely in accordance with the Controller's instructions, and will bound by the provisions of this Privacy Policy.

6. Data transfers outside the European Economic Area

6.1In certain circumstances, the Controller may transfer Users' personal data to another country, including countries outside the EEA. In the case of transfers to third countries in relation to which there is no European Commission decision establishing an adequate level of data protection, we will rely on an exception or derogation applicable to the specific situation (e.g. express consent), or implement appropriate safeguards (e.g. standard contractual clauses issued by the European Commission or binding corporate rules approved by the relevant supervisory authority, where applicable), to ensure the protection of Users' personal data.

6.2Copies of the appropriate safeguards in place may be obtained by contacting us at the e-mail address indicated in section 1.3 above.

6. Requirement to provide personal data

7.1The provision of personal data for marketing purposes, including profiling and analytical purposes, is voluntary. If Users do not consent to the processing of their personal data, including these stored in cookies – their personal data will not be processed for these purposes.

7.2The provision of personal data when using the contact form available on the West Station Website, or when contacting through the e-mail addresses provided on the West Station Website, is voluntary but necessary in order to be able to respond to the User's request. Failure to provide the User's personal data will make it impossible to respond to the request.

6. User’s rights

8.1Users have the following rights in relation to the processing of their personal data:

8.1.1 Right of access to personal data, including obtaining a copy of the data;

Users have the right to be informed about the data we hold about them and the scope of the data we process and transfer, and they may obtain a copy of the personal data we hold about them;

8.1.2 Right to request rectification of data; Users have the right to obtain, without undue delay, the rectification of inaccurate personal data relating to them, as well as the completion of incomplete personal data held by the Controller;

8.1.3 Right to request erasure in certain situations; Users have the right to request that personal data concerning them be erased without undue delay, e.g. if:

• their personal data are no longer necessary in relation to the purposes for which they were collected;

• the legal basis for processing the User's personal data was consent, which has been withdrawn;

• the User has objected to the processing on the basis of a balancing of interests for reasons relating to their particular situation and we cannot demonstrate that there are overriding legitimate grounds for further processing;

• User's personal data has been processed unlawfully; or

• User’s personal data must be deleted in order to comply with a legal obligation.

8.1.4 Right to request data portability; to the extent that we automatically process the personal data provided to us on the basis of the User’s consent, the User has the right to receive the data in a structured, commonly used and machine-readable format and to transmit such data to another controller without hindrance from us. The User also has the right to have personal data transferred directly from us to another controller, where this is technically feasible and provided that the rights and freedoms of others are not adversely affected.

8.1.5 Right to request the restriction of processing; the User has the right to request the restriction of processing under certain conditions. These conditions are:

• the accuracy of the User’s personal data is contested by the User and we need to verify its accuracy;

• processing is unlawful, but the User objects to the erasure of the personal data and instead requests the restriction of the use of the personal data;

• we no longer need the User’s personal data for the purposes of processing, but you need them to establish, exercise or defend legal claims;

• The User has objected to the processing and it is being verified whether the legitimate reasons for our processing do not override the User's rights.

If the processing is restricted, the User’s data will be marked accordingly and

– except for storage - will only be processed only with the User’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

8.1.6 Right to object to the processing of personal data; where we process User’s personal data on the basis of legitimate interests or in the public interest, the User has the right to object to the processing of personal data on grounds relating to their particular situation. If the User objects, we will no longer process the personal data unless:

• we can demonstrate compelling legitimate grounds for the processing of such data which override interests, rights and freedoms of the User;

• personal data is used for the establishment, exercise or defence of legal claims.

8.1.7 Right to withdraw the User’s consent to the processing of personal data

at any time; with respect to the User’s personal data that we process on the basis of consent, the User may withdraw their consent at any time without affecting the lawfulness of the processing carried out on the basis of the consent prior to its withdrawal.

8.1.8 The right to lodge a complaint regarding the processing of the User’s

personal data with the competent supervisory authority; if the User considers that the processing of personal data is unlawful, the User has the right to lodge a complaint with the supervisory authority. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy. The details of the competent supervisory authority are as follows:

President of the Office for the Protection of Personal Data, ul. Stawki 2, 00-193 Warsaw, kancelaria@uodo.gov.pl.

9. Changes to the Privacy Policy

9.1This Privacy Policy may be amended from time to time.

9.2In the event of material changes to this Privacy Policy, information about such changes will be prominently displayed at the beginning of the Privacy Policy with a link directing the User to the information about the changes and will be available for a reasonable period of time after the changes are made.

9.3This Privacy Policy, its subject matter and content shall be governed by Polish law. The courts in Poland shall have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Privacy Policy.