The personal data you provide to us when placing an Order on the Website, i.e. any data relating to your business activity, which may indirectly indicate a specific natural person, are processed:

1. to the extent necessary to establish, shape the content, change, terminate and properly execute the Order;
2. in order to process submitted complaints,
3. to process other requests or inquiries that you may send to us.

In each of the above cases, the legal basis for data processing,
to a significant extent, it is necessary to perform the contract you enter into with the Company or to take steps to conclude it (Article 6, paragraph 1, letter b of the GDPR).

Furthermore, in order to fulfil the obligations imposed on us by law, e.g. the Accounting Act or tax regulations (e.g. issuing and storing invoices and accounting documents), we will also process your data relating to transactions made on the Website and information from your user account. We may also process your data in order to fulfil our obligation to apply the so-called accountability principle, i.e. the obligation to demonstrate
The Company complies with the provisions on personal data protection. In the cases listed in this paragraph, the legal basis for processing the above-mentioned data is our legal obligation (Article 6(1)(c) of the GDPR).

We will also process the following data based on the Company's legitimate interest (Article 6(1)(f) of the GDPR):

Your data, as well as the data of other users of the Website, in order to ensure the security of the services we provide electronically, including preventing possible abuse or fraud (our legitimate interest includes ensuring the security of the services, including preventing fraud and abuse).

Your data regarding orders for a specific advertisement for the purpose of establishing or pursuing our claims, as well as for the purpose of defending against such claims (our legitimate interest includes the possibility of protecting the Company's interests using legally prescribed means);

Your data provided in a question, complaint or suggestion for the purpose of responding to your questions, complaints or suggestions (our legitimate interest includes the ability to respond to questions, complaints and suggestions from customers);

Your data provided in the survey, which we may ask you to complete in order to measure the satisfaction of our customers and determine the quality of our service (our legitimate interest includes the possibility of obtaining information to improve customer service standards).

Your data, as well as the data of other users of the Website, for the purpose of conducting research and statistical analyses and for the purpose of improving the services and goods we offer (our legitimate interest includes the possibility of obtaining information in order to improve our business)

The personal data you provide to us via the Contact Form on the Website, including your name and contact details (e-mail address), are processed to the extent necessary to respond to the message received via the Form and to contact you for this purpose.

The personal data you provide to us for the purpose of receiving commercial and marketing information from the Controller, i.e., your name, surname, and email address, are processed to the extent necessary to send you the aforementioned information based on your prior consent. Such consent may be withdrawn at any time.

Virtually every website now uses cookies, files that are used to automatically collect personal data from website users ("Cookies"). The Administrator's Website is no exception. Information collected in this way is stored on the user's computer or other mobile device.

The primary purposes for using cookies are twofold: maintaining and saving a user's session, and ensuring security (e.g., for detecting abuse). In this respect, the use of cookies is necessary.

Cookies may not be strictly necessary, but they make using the website much easier. They are used for purposes such as:

• remembering specific user choices regarding the display of a specific message or displaying it a certain number of times,
• monitoring user activity on the website,
• collecting anonymous, aggregate statistics to improve the functionality of the website.

In this regard, the Administrator uses the services of external entities, the list of which evolves depending on market conditions and technical capabilities. These entities include:

• Google Analytics (Google Privacy Policy) – Through it, the Administrator verifies the user who has previously used the website, observes the traffic and behavior of users on the website.

It should be emphasized that at no stage is the user obligated to accept cookies. It is possible to configure the web browser to prevent cookies from being stored on the user's computer or other mobile device. It is also possible to delete existing cookies. However, failure to accept cookies may negatively impact the operation of the website and, in some cases, even prevent the use of certain features.

The information we collect in connection with your use of our Website may be processed by automated means (), but this will not produce any legal effects for you or significantly affect your situation in any other way. We attach particular importance to profiling and point out that:

• • we do not process any sensitive data for profiling purposes,

• • for profiling purposes, we usually process data that has been aggregated by us,

• • if we cannot achieve the goal in any other way than by profiling non-personalized or non-aggregated personal data, we use typical data for this purpose: e-mail and IP address or cookies,

• • we profile in order to analyze or forecast the personal preferences and interests of people using our Website and to tailor the content on our Website to these preferences,

• • we profile for marketing purposes, i.e. to tailor the marketing offer to the above-mentioned preferences.

The period of data storage depends on the legal basis for their processing:

• • in the case of consent (e.g. to provide commercial information), this period lasts until it is withdrawn,

• • when processing data for the purpose of performing a contract – for the duration of the contract and the limitation period for claims arising therefrom,

• • when processing data based on obligations arising from applicable legal provisions, the Administrator processes the data for as long as necessary under these provisions,

• • when processing data as part of the legitimate interest of the Controller, processing lasts as long as this interest lasts.

The data processing period may be extended if processing is necessary to establish, pursue, or defend against legal claims. After these periods, the data is immediately deleted or anonymized.

Sometimes the Administrator has the right to transfer user data if it is necessary to perform services, fulfill obligations and properly comply with applicable legal provisions.

The Administrator may use the services of external entities to perform certain tasks, such as data storage, accounting, legal, marketing, or IT services. If necessary, authorized authorities may also receive data.

When entrusting data to subcontractors to achieve the Controller's purpose, there is no change of data Controller and the Controller remains responsible for their security. User data may be transferred to the following entities:

• • other data recipients, e.g. law enforcement authorities, banks.

• • to processors whom we commission to carry out research for a specific purpose, e.g. an IT company or a law firm,

• • a processor, e.g. Google Analytics (Google Privacy Policy),

Beyond the above scope, data is not made available to third parties, except for situations where the user expressly gives his/her voluntary consent (which he/she may withdraw at any time), the provision of data is necessary for the performance of a contract or the provision of services and in special cases if an authorized entity requests the disclosure of data on the basis of generally applicable legal provisions.
(e.g. it is a law enforcement agency).

Each of the above-mentioned situations is carefully analyzed by the Administrator,
and the final transfer of data takes place only if it is confirmed that there is a valid and effective legal basis for requesting the disclosure of user data by these entities.

The Administrator may transfer the obtained data to other entities only if the legal basis allows it.

Some of the Controller's service providers are based outside the European Economic Area (EEA). When transferring data outside the EEA, the Controller exercises increased caution. It verifies whether the deliveries guarantee a high level of personal data protection, consistent with the legal requirements applicable within the EEA and adopted case law, including the ruling of the Court of Justice of the European Union of 27 July 2020, Schrems II. It minimizes the scope of data sent outside the EEA, and in the case of using SCCs (standard contractual clauses adopted by the European Commission), it verifies whether there is a risk of personal data being breached by entities outside the EEA. It examines, among other things, the data security process and whether the shared data may potentially be of interest to third countries.

The Administrator uses all available physical and technical means
and organizational measures to ensure proper protection of personal data. In particular, it protects it against destruction, accidental loss, disclosure to unauthorized persons, alteration, and verifies the scope of access. The Administrator exercises the rights of individuals affected by data processing.

The User has the following rights in connection with the processing of his/her personal data (Articles 12-21 of the GDPR):

1. 1. for information in terms of processed personal data, the so-called "information obligation" (in accordance with Articles 12 and 13 of the GDPR),

1. 1. access to the content of your personal data (in accordance with Article 15 of the GDPR),

1. 1. filing a request correctionspersonal data (in accordance with Article 16 of the GDPR), i.e. correcting incorrect data and supplementing incomplete data,

1. 1. filing a request processing restrictionspersonal data (in accordance with Article 18 of the GDPR),

1. 1. the right to make a request transfer your personal data to another Controller (in accordance with Article 20 of the GDPR),

1. 1. bringing objection to processingdata for reasons related to a particular situation (in accordance with Article 21 paragraph 1 of the GDPR), however, this right is not absolute – i.e. despite the objection, the Controller may still process personal data if it proves that there are important, legitimate grounds for processing, overriding the rights and freedoms or grounds for establishing, pursuing or defending claims,

1. 1. bringing objection to processing personal data for direct marketing purposes, to the extent that the processing is related to such direct marketing. This objection does not require justification or conditions for its effectiveness. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

1. 1. filing a request deletepersonal data (in accordance with Article 17 of the GDPR) – the so-called "right to be forgotten", this right applies when the Controller processes data unlawfully, when the user objects to the processing of data for marketing purposes and when the data must be deleted in order for the Controller to fulfill its obligation under the law.

In addition, the User has the right filing a complaint to the supervisory authority, i.e. the President of the Office for Personal Data Protection (formerly GIODO). If the user wishes to exercise any of the above rights, they may contact the Controller via the email address or at the address indicated above.