Privacy and Cookies Policy

The Controller has not appointed a Data Protection Officer.

Personal data is collected and processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation / GDPR) and applicable national data protection legislation.

Depending on the purpose and the user’s preferences, we may process the following personal data: first name and surname, address, e-mail address, telephone number, bank account number, IP address, and, in the case of business customers, VAT number / tax number and business address.

We may also process other personal data provided in correspondence addressed to us.

For analytics purposes, we may also process data concerning the source from which the user arrived at the Store, the operating system and web browser used to browse the Store, data concerning products viewed, time spent on the website, abandoned baskets, orders placed, activity resulting from newsletter mailings, age range, gender, approximate location and interests (based on online activity).

The above data may be provided to us as a result of the following actions:

• using the contact form;
• sending correspondence directly to our e-mail address;
• providing us with data during a telephone call;
• registering an account in the Store;
• placing an order in the Store;
• subscribing to the newsletter;
• collection of other analytics-related data by the Store software or by the tools referred to in this Privacy Policy.

We process personal data to the extent necessary for the functioning of our Store and retain it for the period permitted by law. We process data provided by users during their use of the Store

• Conclusion and performance of a contract – on the basis of Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Creation and maintenance of an account – on the basis of Article 6(1)(b) GDPR.
• Responding to contact made via the contact form, e-mail or telephone – on the basis of Article 6(1)(b) GDPR.
• Direct marketing – on the basis of Article 6(1)(a) GDPR, where the data subject has given consent, or Article 6(1)(f) GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.
• Sending the newsletter – on the basis of Article 6(1)(a) GDPR, where the data subject has given consent.
• Compliance with legal obligations, establishment and enforcement of claims – on the basis of Article 6(1)(c) GDPR and Article 6(1)(f) GDPR.
• Analytics and statistics – on the basis of Article 6(1)(f) GDPR.

We use tools that enable us to target advertising to specific audiences based on interests, gender and age. These tools are described in more detail in the Cookies Policy.

We disclose personal data to other entities only to the extent that the data subject has consented to such processing, where it is necessary for the performance of a contract, or where it follows from the legitimate interests pursued by the Controller.

These recipients include: the hosting provider, the newsletter service provider, the CRM and invoicing system provider, the accounting office, courier and transport companies, the IT service provider supporting the Store, online payment operators, banks, marketing tool providers and other subcontractors, as well as entities to whom we are required to disclose your data under applicable law.

Where analytics and statistics data do not constitute personal data, they may be transferred to providers of analytics, statistics and optimisation services, including to the United States (for example, Google LLC and Meta Platforms Inc.).

Some data processing operations may involve transfers of personal data to third countries or international organisations in connection with the use of tools that store personal data on servers located in third countries, in particular the United States.

However, the providers of these tools ensure an adequate level of protection of personal data, in particular by participating in the EU-U.S. Data Privacy Framework or by using Standard Contractual Clauses. This applies in particular to services provided by Google Ireland Limited.

What rights do you have in connection with the processing of your personal data?

You have the right to:

• request access to your personal data;
• request rectification of your personal data;
• object to the processing of your personal data;
• request erasure of your personal data;
• request restriction of processing of your personal data;
• request data portability;
• obtain information about automated decision-making, including profiling, and about safeguards applied in connection with transfers of data outside the EU;
• obtain information about the purposes of processing, the categories of personal data concerned, and the recipients or categories of recipients of such data;
• obtain information about your rights under the GDPR, your right to lodge a complaint with the supervisory authority, the envisaged storage period or the criteria used to determine that period, and the source of the data;
• obtain a copy of your personal data.

If you wish to exercise any of the above rights, please contact us:

• correspondence address at: ul. Kornela Makuszyńskiego 18, 31-752 Kraków, Poland;
• e-mail: [email protected].

We will respond to your request without undue delay and, in any event, within one month of receipt of the request. In justified cases, for example due to the complexity of the request, this period may be extended by a further two months. In such case, we will inform you of the extension and the reasons for it within one month of receiving the request.

To facilitate and speed up the handling of your request, you may include your first name and surname, e-mail address, order number (if applicable), and the scope of your request.

If you believe that your rights have not been properly respected, you have the right to lodge a complaint with a supervisory authority.

You may contact, in particular:

Polish supervisory authority:

President of the Personal Data Protection Office
(Prezes Urzędu Ochrony Danych Osobowych)
ul. Stanisława Moniuszki 1A
00-014 Warszawa
Poland
Website: https://uodo.gov.pl

Irish supervisory authority:

Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Website: https://www.dataprotection.ie

Tools and third-party cookies used on the website

Google Analytics

We use Google Analytics for analytics and statistical purposes in order to better understand how users interact with our website and to improve its performance.

Google Analytics may collect information such as:

• pages visited,
• time spent on the website,
• browser and device type,
• operating system,
• approximate location,
• traffic source.

More information can be found in Google’s Privacy Policy and service documentation.

Google Ads

We use Google Ads to display advertisements and to measure the effectiveness of our advertising campaigns.

Cookies associated with Google Ads may be used for:

• remarketing,
• measuring ad conversions,
• creating audience groups,
• displaying advertising tailored to users’ activity and interests.

You can manage personalised advertising settings through your Google account, including at: myadcenter.google.com.

Google Tag Manager

We use Google Tag Manager to manage website tags and scripts in an efficient manner.

Google Tag Manager itself does not usually collect personal data for its own purposes, but it enables the deployment of other tools, including analytics and marketing tags, which may process data in accordance with their own functions.

Google Marketing Platform

We use tools within the Google Marketing Platform to support analytics, campaign management, advertising performance measurement and audience segmentation.

These tools may collect information about user behaviour on the website and interaction with advertising content in order to improve campaign effectiveness and optimise marketing activities.

Meta Pixel (Facebook and other Meta services)

We use Meta Pixel and related Meta business tools provided by Meta Platforms Ireland Limited.

These tools allow us to:

• measure the effectiveness of advertisements,
• analyse user activity on the website,
• create custom audiences,
• deliver more relevant advertising through Facebook, Instagram and other Meta services.

Meta Pixel may record actions such as page views, visits to product pages, adding products to the basket and purchases.

More information can be found in Meta’s Privacy Policy.

YouTube

We may embed or use content and services provided by YouTube, a Google service.

When you view embedded YouTube content or interact with YouTube-related functionality on our website, YouTube may place cookies or collect information about your interaction, device and browser in order to provide video content, measure engagement and personalise content or advertising.

More information can be found in Google’s and YouTube’s privacy information.

E-mail marketing – MessageFlow (Vercom S.A.)

We use MessageFlow, a communication and marketing automation tool provided by Vercom S.A., for the purpose of sending newsletters and managing e-mail marketing communications.

This tool may process data such as:

• e-mail address,
• campaign interaction data,
• opening and click-through statistics,
• subscription and unsubscribe status.

This allows us to send newsletter communications, manage subscriptions and analyse the effectiveness of our e-mail campaigns.

Crazy Egg

We use Crazy Egg for analytics, statistics and website optimisation purposes.

Crazy Egg helps us understand how users interact with the website by providing tools such as:

• heatmaps,
• scroll maps,
• click tracking,
• session-level behavioural analysis in aggregated or pseudonymised form.

This helps us improve the layout, usability and performance of the website.

Social media plugins

If we place a plugin or embedded content from a social media platform on the website, the provider of that platform may receive information about your visit to our website, including technical data such as browser type, date and time of the visit, and certain user identifiers.

These providers may use such information to enable the functionality of the plugin, improve their services and personalise advertising.

Newsletter

For the purpose of sending the newsletter, we use MessageFlow, an external e-mail communication and marketing automation tool provided by Vercom S.A., which enables us to send newsletter communications, manage subscriptions and analyse the effectiveness of our e-mail campaigns.

Through this tool, we may inform you about:

• new products,
• promotions,
• updates relating to our Store.

The tool may also allow us to measure the effectiveness of our campaigns and better tailor newsletter content to the interests of recipients.

Server logs

Use of the website involves sending requests to the server, which are recorded in so-called server logs.

Server logs may include, in particular:

• IP address,
• date and time of the request,
• browser type,
• operating system.

Server logs are stored on the server and are used solely for website administration, technical diagnostics and security purposes. They are not used by us to identify individual users and are not disclosed to unauthorised persons.