Taking into account the legal obligation arising from the provisions of the Act of 13 May 2016 on counteracting the threat of sexual crime and protection of minors and the content of the United Nations Guidelines on Business and Human Rights, recognising the important role of business in ensuring respect for the rights of children, Hotel Cristal Białystok**** adopts this document as a model of rules and procedures used in case of suspicion that a child who Stays at Cristal Białystok**** (hereinafter: Hotel), harm happens and in order Prevention of such threats. Standards are drawn up taking into account the necessity of understanding them by minors.

The hotel conducts its operations with the utmost respect for human rights, in particular the rights of children, as persons who are particularly vulnerable to harm.

The hotel recognizes its role in conducting socially responsible business and promoting desirable social attitudes.

In particular, the hotel emphasises the importance of the legal and social obligation to notify law enforcement agencies of any suspicion of committing a crime to the detriment of children and undertakes to train its staff in this area.

STANDARDS OF PROTECTION OF MINORS (SOM) in the Hotel are implemented on the basis of the following principles.

I. Scope of competence and responsibility of persons designated to implement SOM

1.Supervision over the application of SOM is carried out by the entrepreneur.

2.The entrepreneur appoints an SOM coordinator (hereinafter referred to as “coordinator”)

The Coordinator is responsible for training his subordinate employees with SOM content and monitoring their use in the Hotel.

4.The coordinator describes any intervention or reported incident related to child abuse on the premises in a document that is created for this purpose. It is also responsible for securing evidence, including surveillance recordings and providing them at the request of the services in the form of a copy by registered mail or personally to the prosecutor or police.

5. The coordinator is responsible for conducting the procedure when a child has been harmed by an employee of the facility or another adult who is not directly employed by the Hotel but by a third party.

The Coordinator shall be responsible for monitoring and updating SOM and their availability for both employees, guests and other entities cooperating with the facility.

The data of the coordinator is available to all employees and guests of the facility, including children. The data must contain information on how to contact the Coordinator: email address, telephone, availability: days and hours of operation)

II. General Principles

Each newly hired employee is obliged to undertake initial training in the field of SOM described in this document, which is confirmed by the statement of familiarization with these rules. The model declaration is Appendix 1.

2.The hotel undertakes to educate staff on the circumstances indicating that a child in the property may be harmed and how to respond quickly and appropriately to such situations.

One of the forms of effective prevention of child abuse is the identification of the child in the facility and his relationship with the adult with whom he is staying in the facility. Staff shall take all possible steps to identify the child and his relationship with the adult with whom he is at the property.

III. Procedure for identifying the CHILD when registering at the reception

1.Whenever possible, identify the child and his/her relationship with the adult with whom she is staying at the Hotel.

Each employee of the Hotel is obliged to pay special attention to the relationship between the minor and the person with whom he is staying in the Hotel, including special attention should be paid to the child's behavior towards the accompanying adult, the appearance of the child, the behavior of the child, such as anxious, nervous and avoiding eye contact, and the behavior of the adult towards the child.

In order to identify the child in detail and his relationship to the person with whom he is staying in the facility, you must:

a. Ask about the identity of the child and the relationship of the child in relation to the person with whom he arrived at or is staying in the facility. To do this, you can ask for a child's identity document or other document confirming that an adult has the right to custody of the child at the facility. Sample documents that can be used to identify: ID card, school ID, application M Citizen, passport, Internet Patient Account, court decision.

b. In the absence of an identity document, you can ask for the child's details (name, surname, address, PESEL number).

c. In the absence of documents indicating the relationship between the child and the adult, the adult and the child should be asked about this relationship.

A sample diagram of conversation with an adult and a child is included in Appendix No. 5.

4.If the adult is not the parent or legal guardian of the child, it is necessary to ask whether he has a document proving the parents' consent to the joint departure of the adult with the child. This may be a notarial statement, written consent of the child's parent to travel along with an indication of the child's data, address of residence, telephone contact to the parent and the identity document/PESEL number of the person to whom the parent entrusted custody of the child.

If an adult does not have any of the aforementioned documents, please ask them to fill in an appropriate statement according to the model or ask for a telephone number to the parents to call and confirm the child's stay in the facility with a foreign adult with the knowledge and consent of the parents/legal guardians.

The model form in Polish and English is represented by Annexes 2 and 3 respectively

6.In case of resistance by an adult regarding the presentation of the child's document and/or the indication of the relationship, it should be clarified that the procedure serves to ensure the safety of children using the Hotel and that in accordance with the provisions of the Act of 13 May 2016, the employees of the facility must comply with the provisions of the Children's Rights.

After explaining the matter in a positive way, thank you for the time spent making sure that the child is well cared for.

If an adult travelling with a child as described in paragraph 1 above refuses to make a declaration, as well as in case of reasonable doubts as to the safety of the child, it is imperative that the 'proceedings for suspected child abuse' described below shall be initiated.

IV. Description of the procedure for suspected child abuse

In unusual and/or suspicious situations when performing activities at the reception of the Hotel, indicating a possible risk of harming a child, detailed identification is compulsorily carried out by an employee of the Reception Department.

Examples of situations that may cause suspicion are given in Annex 4.

2.In the event that the conversation with the adult and the child does not dispel doubts about the suspicion of the adult and his intention to harm the child, the coordinator or the immediate supervisor should be discreetly notified and, in their absence, the Director General. In order not to raise suspicions, you can, for example, invoke the need to use equipment in the back room, asking an adult to wait with the child in a public space, e.g. a hotel lobby.

3. From the moment when the first doubts arose, both the child and the adult should be under constant surveillance by the staff and not be left alone.

4. The coordinator, supervisor or other person who has been notified of the situation shall decide to notify the police or, in case of doubt, take over the conversation with a suspicious adult for further clarification.

5. In the event that the interview confirms the conviction of an attempt or commission of a crime to the detriment of the child, the supervisor shall notify the police of this suspicion. In this case, the provisions of Chapter V of the procedure shall continue to be applied.

6. If the witnesses of unusual and/or suspicious situations are employees of other departments of the Hotel, e.g. cleaning service, room service, bar and restaurant staff and others, they should immediately notify the coordinator or immediate supervisor, who will decide to take appropriate action or, in the event of his absence, immediately notify the employee of the Reception Department.

7. Depending on the situation and place, the coordinator/supervisor verifies how reasonable the suspicion of harming the child is. To this end, he selects appropriate measures, leading to clarification of the situation, or decides to conduct an intervention and notifies the police.

V. Description of the procedure in case of circumstances indicating harm to the child.

If you have reasonable suspicion that a child in the property is being harmed, you should immediately notify the police by calling 112 and describing the circumstances of the incident. Depending on the dynamics of the situation and the circumstances, the call is made by a person who is a direct witness to the event (employee/supervisor). If the notifier is an employee, he shall inform the Coordinator about the event at the same time or in his absence the supervisor and the General Manager.

2.A reasonable suspicion of child abuse occurs when:

a) the child revealed to the employee of the object the fact of harm,

b) the employee observed the harm,

c) the child is wearing signs of harm (e.g. scratches, bruises), and the responder responds incoherently and/or chaotically and/or becomes embarrassed or there are other circumstances that may indicate harm, e.g. finding pornographic material involving children in an adult's room.

In this situation, all possible steps must be taken to prevent the child and the person suspected of harming the child from being removed from the property.

4.In any case, the safety of the child must be taken care of. The child should be in the care of an employee until the arrival of the police.

If there is a reasonable suspicion that an offence related to the child's contact with the offender's biological material (sperm, saliva, epidermis) has occurred, it is necessary to prevent the child from washing and eating/drinking until the arrival of the police.

After the child is collected by the police, the CCTV material and other relevant evidence (e.g. documents) of the incident must be secured and, at the request of the services, a copy of it must be provided by registered mail or personally to the prosecutor or police.

After the intervention, a work note should be drawn up detailing the event and submitted to the Coordinator and General Manager of the Hotel.

VI. Procedure if other forms of violence are found to be used by a parent or legal guardian or other adult.

If a child is harmed by a parent/legal guardian or other adult with whom the child is staying in the Hotel, any employee witnessing such harm should react strongly.

If the wishes or health of the child is threatened, the person who received the message should immediately notify the police by calling 112, providing his/her details and details of the child (if possible), the child's whereabouts and a description of the circumstances of the case, and notify the coordinator or supervisor in writing/email.

If a facility employee witnesses physical violence against a child (jerking, spanking, screaming, or other physical violence mentioned in the definition), he should react and try to stop the harm. Possible forms and ways of responding to the hurtful behaviour of a parent/legal guardian/other adult towards the child are included in Annex 7.

4.In the event of leaving a child under 7 years of age unattended, the employee who received information about such an event should notify the supervisor of this fact. The supervisor decides on further proceedings, taking into account the circumstances and taking into account the context of the provisions of the Criminal Code (art. 160 par.1 and 2; Article 210 par.1) and the Code of Offences (Art. 106). An attempt should be made to find the parents/guardians of the child and explain that the child cannot stay unattended in the hotel. If it is not possible to find the parents/guardians of the child or the parent/guardian is unable to take custody of the child, the supervisor notifies the police. In any case, it is necessary to take care of the safety of the child.

VII. Rules to ensure a safe relationship between a minor and the hotel staff.

1.Relations of staff with children:

You are required to maintain a professional relationship with your children and consider each time whether your reaction, communication, or action towards the child is appropriate, safe, reasonable and fair. Act openly and transparently to others to minimize the risk of misinterpreting your behavior.

2.Communication and cooperation with children:

a) In communication with children, be patient and respectful.

b) Listen carefully to children and give them answers appropriate to their age and situation.

c) You must not embarrass, humiliate, disrespect and insult the child, and shout at the child.

d) You must not disclose sensitive information concerning a child to unauthorised persons, including other children.

e) Respect the child's right to privacy.

f) You must not behave inappropriately in the presence of children.

g) You are not allowed to enter into any romantic or sexual relationship with your child or make an inappropriate proposition to him.

h) You are not allowed to perpetuate the image of the child (filming, voice recording, photographing) for private needs.

i) You must not offer alcohol, tobacco products or illicit substances to children, as well as use them in the presence of children.

VI. Glossary

For the purposes of this document, the meaning of the following terms has been clarified:

1.Hotel is a property of Hotel Cristal Białystok**** owned by Cristal Sp. z o.o.

2. A child is any person under 18 years of age.

A foreign adult is any person over 18 years of age who is not the child's parent or legal guardian.

Harming a child means committing a crime to his detriment.

Crime to the detriment of a child — all crimes that may be committed against adults may be committed to the detriment of children and, in addition, offences that can only be committed against children (e.g. sexual exploitation under Article 200 of the Criminal Code). Due to the peculiarities of tourist facilities, where it is easy to obtain the possibility of solitary confinement, the crimes that can most often occur on their territory will be crimes against sexual freedom and morality, in particular rape (Article 197 of the Criminal Code), sexual exploitation of insanity and helplessness (Article 198 of the Civil Code), sexual exploitation of dependency or critical location (Article 199 of the Civil Code), sexual exploitation of a person below 15 years of age (Article 200 of the Civil Code), grooming (seducing a minor by means of communication on distance - Art. 200a kk).

The above described rules shall be subject to periodic evaluation, i.e. at least once every two years, in order to adapt them to current needs and compliance with applicable regulations.

The conclusions of the assessment shall be drawn up in writing and attached to this procedure as annexes. *

VII. Final regulations.

1.Standards for the Protection of Minors shall enter into force on August 15, 2024.

2.Standards of Protection of Minors are made available to all employees by placing them on the Hotel's website and at the hotel reception.

3.Standards of Protection of Minors are made available to guests by placing on the Hotel's website and at the hotel reception.

4.Standards for the Protection of Minors are available in an understandable and abbreviated version for children staying in the Hotel, in a place accessible to them.

Appendix 2: Model of the Guest's statement about the relationship with the child EN

REGARDING STATEMENT MINORS

Guest's name:...

Check-in date:...

On the basis of the procedure for the protection of minors in force in accordance with Article 22c (3) (2). Act of 13 May 2016 on Counteracting Threats of Sexual Offences and Protection of Minors, I give the names and surnames of the minors accompanying me and the nature of the relationship between me and the minors:

Child's name

The nature of the relationship between the Guest and the child

Guest's signature:...

Providing data is necessary to check in at the Hotel. The consequence of failure to provide the data may be the need for the Hotel staff to identify the child and his/her relationship with the adult with whom he/she is staying at the Hotel and/or refuse to check in at the Hotel. If the identification of the above data is prevented, the hotel staff is entitled to notify the Police. The above actions are aimed at protecting children from harm, please respect the applicable rules.

INFORMATION CLAUSE

I. Personal Data Controller

The administrator of personal data is Cristal a limited liability company based in Bialystok at the following address: Lipowa str 3/5, 15-424 Bialystok, evidenced in the National Court Register of Entrepreneurs as entry No KRS 0000067310, NIP: 5420211143, REGON: 050214908,, tel.: + 48 85 74 95 100

II. Contact for Data Protection

Contact in matters of personal data protection is possible at the e-mail address: inspector@cristal.com.pl or at the correspondence address indicated in point I.

III. Purpose and legal basis of the processing

Your personal data The data will be processed for the following purposes:

implementation of the procedure for the protection of minors against abuse, introduced on the basis of Article 22c (3) (2). Act of 13 May 2016 on Counteracting Threats of Sexual Offences and Protection of Minors (Article 6 (1) (c) of the GDPR) •

implementation of the Administrator's legitimate interest, consisting in demonstrating compliance with the rules for the protection of minors referred to above (Article 6 (1) (f) of the GDPR).

IV. Categories of data in process

We process the following personal data: your name, the names of your children, the nature of your relationship with your children.

V. Information on the requirement/voluntariness of providing data

Providing personal data is necessary to use the hotel services. The consequences of not providing data are indicated above.

VI. Period of data processing

Personal data will be processed for a period of time equal to the processing of data contained in the registration card (vide information clause on the back of the registration card).

VIII. Date recipients

The data will not be passed on to third parties, except for the authorities authorized to intervene in the protection of minors.

IX. Rights of data subjects

You have the right to access your data and the right to request their rectification (if they are inconsistent with the facts), deletion, restriction of processing (in cases provided for by applicable law). To the extent that the basis for the processing of your personal data is the legitimate interest of the Administrator, you have the right to object to the processing of your personal data. To the extent that the basis for the processing of your personal data is consent, you have the right to withdraw your consent. The withdrawal of consent does not affect the lawfulness of the processing until the consent is withdrawn. You also have the right to transfer your personal data, i.e. to receive it from the Administrator in a structured, commonly used and machine-readable format. The right to data portability does not apply to data that constitutes a trade secret, must not adversely affect the rights and freedoms of others, including trade secrets or intellectual property, and will be exercised to the extent technically possible. The first copy of the data is free of charge. In addition, you have the right to receive a copy of the security measures referred to in section XII.

In order to exercise the above-mentioned rights, please contact the Administrator at the correspondence address indicated in point I. or at the e-mail address indicated in point II.

X. Right to lodge a complaint with a supervisory authority

You also have the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection (00-193 Warsaw, 2 Street Stawki, e-mail: kancelaria@uodo.gov.pl

XI. Automated decision-making

The data provided by you will not be used for automated decision-making (including profiling).

XII. Transfer of data to third countries or international organizations

The data will not be transferred outside the EEA.

Appendix No. 3: Model of the Guest's statement about the relationship with the child PL

STATEMENT CONCERNING MINORS

Guest name:...

Check-in date:...

On the basis of the procedure for the protection of minors in force in accordance with Article 22c (3) point 2 of the Act of 13 May 2016 on counteracting threats of sexual crime and protection of minors, I give the names and surnames of the minors accompanying me and the nature of the relationship between me and minors:

Name of the child

The nature of the relationship between the guest and the child

Guest Signature:...

Providing data is necessary for a check-in at the Hotel. The consequence of failure to provide data may be the need for the Hotel staff to identify the child and his/her relationship with the adult with whom he is staying in the Hotel and/or refusing to register at the Hotel. In the event that the above data is not identified, the Hotel staff is entitled to notify the Police. The above actions are aimed at protecting children from harm, please respect the applicable rules.

INFORMATION CLAUSE

I. Personal Data Controller

The administrator of personal data is Cristal Spółka z ograniczoną odpowiedzialnością with its registered office in Białystok at 15-424 Białystok ul. Lipowa 3/5, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000067310, NIP: 5420211143, REGON: 050214908, tel.: + 48 85 7496100 (hereinafter: “Controller” or “Company” “).

II. Contact on Data Protection

Contact in matters of personal data protection is possible at the e-mail address: inspektor@cristal.com.pl or at the correspondence address indicated in point I.

III. Purpose and legal basis processed

Your personal data will be processed in order to:

•implementation of the procedure for protecting minors from harm, introduced pursuant to Article 22c (3) point 2 of the Act of 13 May 2016 on counteracting threats of sexual crime and protection of minors (Article 6 (1) (c) of the GDPR)

•fulfillment of the Controller's legitimate interest, consisting in demonstrating compliance with the principles of protection of minors referred to above (Article 6 (1) (f) of the GDPR).

IV. Categories of data we process

We process the following personal data: your name, names and surnames of children, nature of the relationship between you and your accompanying children.

V. Information on the requirement/voluntary provision of data

Providing personal data is necessary to use hotel services. The consequences of not providing data are indicated above.

VI. Data processing period

Personal data will be for the time equal to the processing of data contained in the registration card (vide information clause on the back of the registration card).

VIII. Data recipients

The data will not be transferred to third parties, except for authorities authorized to intervene related to the protection of minors.

IX. Rights of data subjects

You have the right to access data and the right to request rectification (if they are inconsistent with the facts), deletion, restriction of processing (in cases provided for by applicable law). To the extent that the basis for processing your personal data is the legitimate interest of the Controller, you have the right to object to the processing of personal data. To the extent that the basis for processing your personal data is consent, you have the right to withdraw your consent. Withdrawal of consent does not affect the lawfulness of the processing until the consent is withdrawn. You also have the right to transfer personal data, i.e. to receive from the Controller, in a structured, commonly used machine-readable format. The right to data portability does not apply to data which constitute business secrets, must not adversely affect the rights and freedoms of others, including trade secrets or intellectual property, and will be exercised to the extent technically possible. The first copy of the data is free. In addition, you have the right to receive a copy of the security referred to in point XII.

In order to exercise the rights indicated above, contact the Administrator at the correspondence address indicated in point I. or at the e-mail address indicated in point II.

X. Right to lodge a complaint with the supervisory authority

You also have the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection (00-193 Warsaw, ul. Stawki 2, e-mail: kancelaria@uodo.gov.pl)

XI. Automated decision making

The data provided by you will not be used in automated decision-making processes (including profiling).

XII. Transfer of data to third countries or international organisations

The data will not be transferred outside the EEA.