‍4. DATA RECIPIENTS ON THE WEBSITE

1. For the needs of proper Website functioning, inclusive of the performance of the Contracts of Sale entered into, it shall be necessary for the Controller to make use of external companies’ services (e.g. software provider, courier, or payment system provider). The Controller uses solely the services of such processing entities which ensure sufficient guarantee to implement appropriate technical and organisational measures so that the processing meets the requirements set out in the GDPR Regulation and protects the rights of data subjects. 
2. The Controller may provide personal data to a third country, while the Controller ensures that it shall only be a third country which is considered to provide adequate level of protection – in accordance with the GDPR Regulation, and in the case of other countries, the data transfer will occur on the basis of the standard contractual clauses. The Controller ensures that the data subject has a right to get a copy of their data. The Controller provides personal data to a third country only in case and scope necessary to execute a certain purpose of data processing consistent with this privacy policy.
3. Providing data by the Controller does not take place in every case and not to all the recipients or categories of recipients defined in the privacy policy – the Controller provides the data only in the case it proves necessary to attain a given purpose of personal data processing and solely within the necessary scope. 
4. Personal data of the Website Service Recipients or Customers may be provided to the following recipients or categories of recipients: 
   
   1. carriers/forwarders/couriers/entities operating warehouses and/or responsible for shipping process – in the case of a Customer who selects the Website to deliver the Product by post or courier, the Controller makes the collected Customer’s personal data available to the selected carrier, forwarder or agent performing shipment for the Controller, and if the delivery is to be made from the external warehouse – to the entity operating warehouse and/or responsible for shipping process – to the extent necessary to deliver the Product to the Customer.
   2. e-payments or payment card service providers – in the case of a Customer who uses on the Website the option of e-payment or payment card, the Controller makes the collected Customer’s personal data available to the selected payment service provider on the Website for the Controller to the extent necessary to perform the payment of the Customer.
   3. service providers rendering for the Controller technical, IT or organisational solutions, making it possible for the Controller to conduct a business, inclusive of the Website and Electronic Services provided via it (in particular computer software providers for the Website, e-mail companies and hosting providers as well as software providers for company management and technical aid for the Controller) – the Controller makes the collected personal data of the Customer available to the selected provider operating to their order only in the case and to the extent necessary for attaining a given purpose of data processing in accordance herewith.
   4. accounting, legal and consulting services providers rendering for the Controller accounting, legal or consulting services (in particular an accounting agency, law firm or debt collection company) – the Controller makes the collected personal data of the Customer available to the selected provider operating to their order only in the case and to the extent necessary for attaining a given purpose of data processing in accordance herewith.
   5. providers of social plugins implemented on the Website, of scripts and other similar tools enabling a person using the Website to download content from the providers of the said plugins (e.g. logging in using social network login details) and for this purpose providing the providers with the personal data of the visitor, including also:
      
      1. Disqus, Inc. - the Controller uses Twitter social plugins on the Website (e.g. commenting on blog posts using Disqus login) and therefore collects and discloses personal data of the Service Recipient using the Website to Disqus, Inc. (717 Market Street, Suite 700, San Francisco, CA 94105, US) to the extent and in accordance with the privacy principles available here: https://help.disqus.com/en/articles/1717103-disqus-privacy-policy – including information about the device, visited websites, purchases, displayed advertisements and the way of using services - regardless of whether the Service Recipient has a Disqus account and is logged in to this account).
      2. Twitter International Company - the Controller uses Twitter social plugins on the Website (e.g. sharing content from the Website on your Twitter profile) and therefore collects and discloses personal data of the Service Recipient using the Website to Twitter International Company (1 Cumberland Place, Fenian Street, Dublin 2, Ireland) to the extent and in accordance with the privacy principles available here: https://twitter.com/privacy.
5. PROFILING ON THE WEBSITE 
   
   1. The GDPR Regulation obligates the Controller to inform about the automated decision-making process, including profiling referred to in Article 22, par. 1 and 4 of the GDPR Regulation, and – at least in those cases – the vital information concerning the decision-making process as well as the meaning and foreseeable consequences of processing for the person being the data subject. Bearing in mind the above, the Controller specifies in this point of the privacy policy the information concerning the possible profiling.
   2. The Controller may use profiling on the Website for direct marketing purposes, yet the decisions made on its basis by the Controller do not concern the conclusion or rejection to conclude the Sales Contract, or the possibility to make use of Electronic Services on the Website. The result of profiling on the Website may be e.g. discount for a given person, sending a discount code, reminding about unfinished purchase process, sending Product offers, which may be related to the interests or preferences of the person, or offering better conditions as compared with the standard offer of the Website. Regardless of profiling, the person makes decisions freely, whether they want to use the discount given, or better conditions and buy a product on the Website.
   3. Profiling on the Website consists in automatic analysis or forecast of the conduct of a given person on the website of the Website, e.g. by adding a given Product to the cart, browsing the page of a given product on the Website, or the analysis of the history of purchase on the Website. The condition for such profiling is for the Controller to have the personal data of the person, so that they can later send them e.g. a discount code.
   4. The data subject shall have the right not to depend on the decision, which is only based on automated processing, including profiling, and has some legal effects on the person or similarly affects them.
6. THE RIGHTS OF THE DATA SUBJECT
   
   1. The right to access, rectify, restrict, erase or transmit – the data subject shall have the right to demand the Controller to have access to their personal data, rectify, erase (“the right to be forgotten”) or restrict the processing and shall have the right to object to the processing and transmit their data. Detailed conditions of the above rights shall be indicated in Articles 15­22 of the GDPR Regulation.
   2. The right to withdraw the consent at any time – the person whose data are being processed by the Controller on the basis of the consent given (pursuant to Article 6, par. 1, point a) or Article 9, par. 2, point a) of the GDPR Regulation), they shall have the right to withdraw their consent at any time without any impact on the compatibility with the right to process made based on the consent prior to the withdrawal.
   3. The right to lodge a complaint with a supervisory body – the person whose data are being processed by the Controller shall have the right to lodge a complaint with a supervisory body in a manner and mode specified in the provisions of the GDPR Regulation and the Polish law, in particular the Personal Data Protection Act. The supervisory body in Poland shall be the President of the Office for Personal Data Protection.
   4. The right to object – the data subject shall have the right, at any time, to lodge a complaint – for reasons related to their particular situation – as regards the processing of their personal data based on Article 6, par.  1, point e) (public interest or official authority) or f) (legitimate interest of the controller) in the case of profiling based on the provisions. The Controller in such a case must stop processing the personal data, unless they show the existence of legally significant and justified bases for the processing, overriding the interests, rights and freedoms of the data subject, or the bases for determining, pursuing or defending the claims.
   5. The right to object as regards direct marketing – in the case the personal data are being processed for the needs of direct marketing, the data subject shall have the right, at any time, to lodge a complaint as regards the processing of their personal data for the needs of such marketing, including profiling, to the extent to which the processing is related to direct marketing.
   6. To perform the rights mentioned in this point of the privacy policy, one may contact the Controller by sending them an appropriate message in writing or via e-mail to the address of the Controller indicated at the beginning of the privacy policy or using the contact form available on the Website’s website.
7. COOKIES ON THE WEBSITE AND ANALYTICS
   
   1. Cookies are small pieces of text files sent by the server and saved at the visitor’s of the Website (e.g. on the hard disk of a computer, laptop, or smartphone’s memory card – depending on the type of device used by the Website’s visitor). Detailed information on Cookies as well as the history of their origin can be found e.g. at: https://en.wikipedia.org/wiki/HTTP_cookie.
   2. Cookies, which can be sent via the Website, can be divided into various types, according to the following criteria:
      
      
      1. With regard to the provider: 
         
         1. own (created by the Controller’s Website) and
         2. belonging to other persons/third parties (other than the Controller
      2. With regard to the period of their retention on the appliance of the Website’s visitor:
         
         1. session cookies (stored till the moment of closing of the Website or a browser) and
         2. persistent cookies (having some expiration period, defined by parameters of each file or until they are removed by hand)
      3. With regard to the purpose of their usage:
         
         1. strictly necessary cookies (enabling proper functioning of the Website), 
         2. functional/preferential cookies (enabling adjustment of the Website to the visitor’s preferences),
         3. analytical and performance cookies (collecting information on the use of the Website),
         4. Targeting, advertising or social cookies (collecting information on a visitor of the Website in order to display personalised advertisements to such a person and for other marketing activities, including those performed on sites different from the Website, such as social networks or other websites belonging to the same advertising networks as the Online Store).
   3. The Controller may process information contained in Cookies during visiting of the Website for the following specific purposes:
      
      1. Identification of the Service Recipients as logged in to the Website and showing them that they are actually logged in (strictly necessary Cookies)
      2. Saving Products added to the cart to place an Order (strictly necessary Cookies)
      3. Saving data from the filled-in forms, questionnaires, or login data for the Website (strictly necessary Cookies and/or functional/preferential Cookies)
      4. Adjustment of the Website contents to individual preferences of the Service Recipient (e.g. colours, font size, layout) and optimisation of the use of the website (functional/preferential Cookies)
   4. It is possible to check which Cookie files are being sent in a given moment by the Website (including the expiry period of Cookies and their provider). In the most popular web browsers, it can be done in the following ways:
      
      1. In Chrome browser: (1) in the address bar, click the ’locked’ icon on the left, (2) go to the benchmark „Cookie files”.
      2. In Firefox browser: (1) in the address bar, click the ’shield’ icon on the left, (2) go to the benchmark „Allowed” or „Blocked”, (3) click the button „Tracking cookies between websites”, „Tracing elements of social networks or „Content with tracing elements”
      3. In Internet Explorer browser:
         (1) Click „Tools” menu, (2) go to „Internet options” benchmark, (3) go to „General” benchmark, (4) then go to „Settings”, (5) click the button „Display files”
      4. In Opera browser:
         (1) in the address bar, click the ’locked’ icon on the left, (2) go to the benchmark „Cookie files”.
      5. In Safari browser:
         (1) click menu „Preferences”, (2) go to „Privacy” benchmark, (3) click the button „Manage website data”
      6. Independent of the browser used, you can apply tools available e.g. at: https://www.cookiemetrix.com/ or: https://www.cookie-checker.com/
   5. As a standard, most internet browsers on the market accept saving Cookies by default. Every person has the possibility to specify the conditions of using Cookies in the browser settings. It means that one may, e.g. partially restrict (e.g. temporarily) or fully disable saving Cookies – in the latter case it may have an impact on some functionalities of the Website (for instance it may prove impossible to go through the Order using the Order Form owing to failure to save the Products in the cart in the course of subsequent stages of Order placement).
   6. The browser settings concerning Cookies are essential as regards the consent to use Cookies by our Website – in accordance with the law, such consent may also be expressed in the browser settings. In view of lack of such consent, change the browser setting accordingly as regards Cookies. Detailed information concerning the change in Cookies settings and their individual removal in the most common browsers is available in the help section of the browser and the following websites (click the link):
      • Chrome 
      • Firefox
      • Internet Explorer 
      • Opera
      • Safari
      • Microsoft Edge
      
      
   7. The Controller may use Google Analytics (GA4 i UA) services on the Website, which are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The services help the Controller to analyse the frequency of visits on the Website. The data collected are processed under the above services to generate statistics helpful while administering the Website. The data are of collective nature. Using the above services on the Website, the Controller collects such data as the sources and medium of acquiring visitors of the Website and the manner of their conduct on the website of the Website, information concerning their devices and browsers used to visit the website, IP and domain, geographical data and demographic data (age, sex) and interests.
   8. It is possible to easily block sharing information with Google Analytics as regards the activity on the website of the Website – install to that end an opt-out add-on made available by Google Ireland Ltd. available at: https://tools.google.com/dlpage/gaoptout?hl=pl.
   9. Due to the possibility that the Administrator uses advertising and analytical services provided by Google Ireland Ltd. on the Website, the Administrator points out that full information on the principles of processing of data of visitors to the Website (including information saved in cookies) by Google Ireland Ltd. can be found in the privacy policy of Google services available at: https://policies.google.com/technologies/partner-sites.
   10. The Controller may use Meta Pixel service, which is provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). The service helps the Controller to measure an effectiveness of adverts and to find out what actions the users of the Online Store undertake in order to show them matching adverts. You can find detailed information on the Meta Pixel at the following internet address: https://www.facebook.com/business/help/742478679120153?helpref=page_content.
   11. Managing Meta Pixel is possible through ads settings on a Facebook user’s account: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.
8. Final Provisions
   
   1. The Website may contain links to other websites. The Controller encourages that at the time of being transferred to other websites, become familiar with the privacy policy. This privacy policy shall apply only to the Website of the Controller.