§1. HOW TO CONTACT THE DATA CONTROLLER

The data controller for personal data processed within the Store is INSTALEX DAMIAN BORYCZEWSKI, located at ul. Polna 2, 89-430 Kamień Krajeński, Poland, NIP: 5040026161.

You can contact the Data Controller via email at info@skrzynkownia.pl or by phone at +48 666 190 949.

§2. ON WHAT BASIS DO WE PROCESS YOUR DATA

When collecting personal data, we always inform you about the legal basis for its processing. This is determined by the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC - General Data Protection Regulation).

When we refer to:

• Article 6(1)(a) of the GDPR – it means that we process personal data based on the consent given.
• Article 6(1)(b) of the GDPR – it means that we process personal data because it is necessary to perform a contract or to take action at the request of the data subject before entering into a contract.
• Article 6(1)(c) of the GDPR – it means that we process personal data to fulfill a legal obligation.
• Article 6(1)(f) of the GDPR – it means that we process personal data to pursue legitimate interests.

§3. INFORMATION ABOUT THE PROCESSING OF DATA FOR THE PURPOSE OF CONCLUDING AND PERFORMING CONTRACTS, POSSIBLE CLAIM AND DEFENSE AGAINST THEM

1. We may process personal data necessary for the performance of the contract concluded with you. However, even before the conclusion of the contract, we may process personal data necessary to take action on your request. We process this data on the basis of Article 6(1)(b) of the RODO.
2. During the performance of the contract and after its execution, we process personal data of a party to the contract for the purpose of possible processing of claims, as well as their investigation. Our legitimate interest is, for example, the possibility of responding to a possible complaint, which we are obliged to do under separate provisions of civil law. In such a case, we will process personal data based on the legitimate interest of defending against or asserting possible claims. We will process this data on the basis of Article 6(1)(f) of the RODO.
3. We will store this data for the period necessary for the fulfillment of the designated purposes, but no later than until the statute of limitations for claims under separate laws.
4. You have the right to access, rectify, erase, restrict processing of your data, the right to data portability, as well as the right to lodge a complaint with a supervisory authority. In the situation of data processing for the purpose specified in point 2, you also have the right to object to its processing.
5. Provision of this data is voluntary, but failure to provide this data will prevent the conclusion of a contract or its execution.
6. The recipients of this data are our web host, email service provider, IT service provider, shipping service provider, accounting and invoicing software service provider, electronic payment and banking service provider, legal, consulting and debt collection service provider and other service providers we use for the designated purpose.

§4. INFORMATION ON DATA PROCESSING FOR THE PURPOSE OF SENDING THE NEWSLETTER

1. We enable users to subscribe to our newsletter recipient list. If you have used this feature, we process your personal data solely for the purpose of sending the newsletter. The newsletter may contain advertising, commercial, or marketing content.
2. The processing of this data is based on your consent, in accordance with Article 6(1)(a) of the GDPR.
3. You have the right to withdraw your consent at any time. However, the withdrawal of consent does not affect the lawfulness of data processing carried out before its withdrawal.
4. We will store your data until you withdraw your consent. If you never withdraw it, we will process your data until we cease sending the newsletter.
5. You have the right to access your data, rectify it, delete it, restrict its processing, transfer it, and lodge a complaint with a supervisory authority.
6. Providing this data is voluntary, but failure to do so will prevent the newsletter from being sent.
7. The recipients of this data are our hosting provider, IT service provider, email service provider, and newsletter delivery service provider.

§5. INFORMATION ON DATA PROCESSING FOR THE PURPOSE OF SENDING NOTIFICATIONS

1. We enable users to subscribe to our notification recipient list, displayed via a web browser. If you have used this feature, we process your personal data solely for the purpose of sending notifications. Notifications may contain advertising, commercial, or marketing content.
2. The processing of this data is based on your consent, in accordance with Article 6(1)(a) of the GDPR.
3. You have the right to withdraw your consent at any time. However, the withdrawal of consent does not affect the lawfulness of data processing carried out before its withdrawal.
4. We will store your data until you withdraw your consent. If you never withdraw it, we will process your data until we cease sending notifications.
5. You can withdraw your consent for data processing in your web browser settings.
6. You have the right to access your data, rectify it, delete it, restrict its processing, transfer it, and lodge a complaint with a supervisory authority.
7. Providing this data is voluntary, but failure to do so will prevent notifications from being sent.
8. The recipients of this data are our hosting provider and the notification delivery service provider.

§6. INFORMATION ON DATA PROCESSING FOR THE PURPOSE OF DIRECT MARKETING

1. We may process your personal data for direct marketing purposes. This may occur, for example, when we respond to your message by providing details of our offer.
2. The processing of this data is based on Article 6(1)(f) of the GDPR.
3. We will store your data for as long as necessary to fulfill this purpose.
4. You have the right to access your data, rectify it, delete it, restrict its processing, transfer it, object to its processing, and lodge a complaint with a supervisory authority.
5. Providing this data is voluntary, but failure to do so will prevent the implementation of direct marketing activities.
6. The recipients of this data are our hosting provider, IT service provider, and email service provider.

§7. INFORMATION ON DATA PROCESSING FOR SECURITY PURPOSES

1. From the moment you access our website, we process the following data to ensure the security of our services:
   • The public IP address of the device from which the request was made,
   • Browser type and language,
   • Date and time of the request,
   • The number of bytes sent by the server,
   • The URL of the previously visited page if the visit occurred via a referral link,
   • Information about errors that occurred while processing the request.
2. Our legitimate interest in processing this data is to maintain server event logs and protect the Store from potential hacking attacks and other abuses. This includes the ability to determine the IP address of a person engaging in unauthorized activities within the Store, such as attempting to breach security, publishing prohibited content, or conducting unlawful actions using our servers.
3. The processing of this data is based on Article 6(1)(f) of the GDPR.
4. We will store this data for as long as necessary to achieve the specified purposes, but no longer than the limitation period for claims under applicable laws.
5. You have the right to access your data, rectify it, delete it, restrict its processing, object to its processing, and lodge a complaint with a supervisory authority.
6. Providing this data is a condition for using the Store. Failure to provide it will prevent the use of the Store.
7. The recipients of this data are our hosting provider and IT service provider.

§8. INFORMATION ON DATA PROCESSING FOR THE PURPOSE OF PRODUCT NOTIFICATION

1. The Store provides a feature that allows a notification about a selected product to be sent to an email address entered by the user.
2. Our legitimate interest in processing this data is to fulfill the user's request and subsequently protect the Store from potential abuses.
3. The processing of this data is based on Article 6(1)(f) of the GDPR.
4. We will store this data for as long as necessary to achieve the specified purposes, but no longer than the limitation period for claims under applicable laws.
5. The data subject has the right to access their data, rectify it, delete it, restrict its processing, object to its processing, and lodge a complaint with a supervisory authority.
6. Providing this data is a condition for sending the notification. Failure to provide it will prevent this action.
7. The recipients of this data are our hosting provider and IT service provider.

§9. INFORMATION ON DATA RECIPIENTS

When processing personal data, we use external services. Therefore, third parties may be recipients of your personal data. When collecting personal data, we always inform about these recipients, but for the sake of clarity, we do so in a concise manner. Thus, we hereby explain that when we refer to specific categories of recipients, these are the following entities:

• Transport service providers / couriers:

  • Furgonetka Sp. z o.o., al. Księcia Józefa Poniatowskiego 1, 03-901 Warsaw
  • DPD Polska Sp. z o.o., ul. Mineralna 15, 02-274 Warsaw
  • Centrala Poczty Polskiej S.A., ul. Rodziny Hiszpańskich 8, 00-940 Warsaw
  • InPost Sp. z o.o., ul. Pana Tadeusza 4, 30-727 Kraków
  • FedEx Express Poland Sp. z o.o., ul. Annopol 19, 03-236 Warsaw
  • UPS Polska Sp. z o.o., ul. Prądzyńskiego 1/3, 01-222 Warsaw
  • DHL Parcel Polska Sp. z o.o., ul. Osmańska 2, 02-823 Warsaw

• IT service provider:

  • InsERT S.A., ul. Jerzmanowska 2, 54-519 Wrocław

• Hosting provider:

  • Cyber_Folks S.A., ul. Roosevelta 22, 60-829 Poznań

• Email service provider:

  • Cyber_Folks S.A., ul. Roosevelta 22, 60-829 Poznań

• Accounting service provider:

  • Cech Rzemiosł Różnych, ul. Studzienna 7, 89-400 Sępólno Krajeńskie

• Invoice management software provider:

  • InsERT S.A., ul. Jerzmanowska 2, 54-519 Wrocław

• Legal / advisory / debt collection service providers – these providers are appointed individually as needed.

• Newsletter delivery service provider:

  • Shoper S.A., ul. Władysława Łokietka 79, 31-280 Kraków

• Electronic payment service provider:

  • PayPro SA, ul. Pastelowa 8, 60-198 Poznań

• Banking service provider:

  • PKO Bank Polski S.A., ul. Puławska 15, 02-515 Warsaw

§10. ABSOLUTE RIGHTS OF DATA SUBJECTS

When we refer to rights related to the processing of your personal data, we mean the rights described below. The ability to exercise these rights is independent of the legal basis for processing personal data.

Right of Access to Data

You have the right to obtain confirmation from us as to whether we process your personal data. If we do, you have the right to access those data and receive additional information regarding:

• the purposes of processing,
• the categories of personal data concerned,
• the recipients or categories of recipients to whom the data have been or will be disclosed, particularly recipients in third countries or international organizations,
• the planned data storage period, or if not possible, the criteria for determining this period,
• the right to request rectification, erasure, or restriction of data processing, to object to such processing, and to lodge a complaint with a supervisory authority,
• the source of the data, if your data were not collected from you directly,
• automated decision-making, including profiling, and the principles of such processing, as well as its significance and the anticipated consequences for you.

Upon receiving such a request, we are obligated to provide a copy of the processed personal data. If the request is submitted electronically and no other preference is indicated, we will provide the information electronically.

Right to Rectification

You have the right to request the immediate rectification of inaccurate personal data concerning you. Considering the purposes of processing, you also have the right to request the completion of incomplete personal data, including by providing an additional statement.

Right to Erasure (Right to Be Forgotten)

You have the right to request the immediate erasure of your personal data. We are then obliged to delete the personal data without undue delay if one of the following circumstances applies:

• You have withdrawn your consent to data processing, and there is no other legal basis for processing,
• You have effectively objected to the processing of your data,
• Your personal data have been processed unlawfully,
• Your personal data must be deleted to comply with a legal obligation,
• Your data were collected in connection with offering information society services.

Right to Restriction of Processing

You have the right to request the restriction of processing in the following cases:

• If you contest the accuracy of the data—for a period allowing us to verify their accuracy,
• If processing is unlawful, and you oppose the erasure of data, requesting a restriction instead,
• If we no longer need the personal data for processing purposes, but you require them for establishing, exercising, or defending legal claims,
• If you have objected to data processing—until it is determined whether our legitimate grounds override your objection.

Automated Decisions, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

This right does not apply if the decision:

• is necessary for entering into or performing a contract between you and us,
• is authorized by European Union or Polish law, which also lays down appropriate measures to protect your rights, freedoms, and legitimate interests, or
• is based on your explicit consent.

Right to Lodge a Complaint

You have the right to lodge a complaint regarding the processing of your personal data with the supervisory authority:

President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw, Poland
Tel: +48 22 531 03 00
Fax: +48 22 531 03 01
E-mail: kancelaria@uodo.gov.pl

§11. RELATIVE RIGHTS OF DATA SUBJECTS

When we refer to rights related to the processing of your personal data, we mean the rights described below. The ability to exercise these rights depends on the legal basis for processing personal data in each case.

Right to Withdraw Consent to Processing

If we process your personal data based on your given consent, you have the right to withdraw that consent at any time. Naturally, the withdrawal of consent does not affect the lawfulness of data processing carried out before the withdrawal.

Right to Data Portability

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format. You also have the right to transfer this personal data to another controller without hindrance from us, provided that the processing:

• is based on consent or a contract, and
• is carried out by automated means.

When exercising the right to data portability, you may also request that we transfer your personal data directly to another controller, if technically feasible. This right must not adversely affect the rights and freedoms of others.

Right to Object

If we process your personal data based on Article 6(1)(f) of the GDPR, you have the right to object to such processing on grounds related to your particular situation.

In such a case, we may no longer process your personal data unless we demonstrate:

• compelling, legitimate grounds for processing that override your interests, rights, and freedoms, or
• grounds for establishing, pursuing, or defending legal claims.

Additionally, if you object to the processing of your personal data for direct marketing purposes, we will no longer be able to process your data for such purposes.

§12. COOKIES – INTRODUCTION

The Store's website uses cookies. These are commonly used, small files containing a string of characters that are sent and stored on the end device (e.g., computer, laptop, tablet, smartphone) used when visiting the Store. This information is transmitted to the memory of the browser in use, which sends it back during subsequent visits to the website. We can categorize cookies based on three classification methods.

Categories of Cookies Based on Purpose:

• Essential Cookies – These cookies enable the proper functioning of the website and its features, such as authentication or security cookies. Without storing them on your device, using the website will not be possible.
• Analytical Cookies – These cookies allow for monitoring visited pages, traffic sources, and time spent on the website. Not storing them will not limit website functionality.
• Advertising Cookies – These cookies enable the display of personalized advertisements both within and outside the website. Not storing them will not limit website functionality.
• Social Media Cookies – These cookies allow for displaying the fan page within the website and liking it. Not storing them will not limit website functionality.
• Facebook Functional Cookies – These cookies allow users to create an account using login data from an external Facebook service. Without storing them, registering or logging in with a Facebook account will not be possible.

Categories of Cookies Based on Expiration Time:

• Session Cookies – Exist until the end of the given session.
• Persistent Cookies – Remain after the session ends.

Categories of Cookies Based on Administration:

• Our Cookies – Managed by our website.
• Third-Party Cookies – Managed by external entities

§13. COOKIES ADMINISTERED BY THE DATA CONTROLLER

The cookies administered by us allow for:

• Authentication of access,
• Maintaining a session after logging in,
• Protecting the Store from hacker attacks,
• "Remembering" form field contents filled in by the browser (optional),
• "Remembering" items added to the shopping cart.

Thanks to these cookies, using the Store's features becomes easier and more convenient.

§14. THIRD-PARTY COOKIES

The use of third-party cookies is subject to the privacy and cookie policies applied by these entities.

GOOGLE

We use cookies administered by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States, as part of the following services:

• Google Ads – advertising cookies used to manage and assess the quality of advertising campaigns conducted through Google Ads.
• Google Analytics – analytical cookies used to study user behavior and traffic patterns, as well as to generate traffic statistics.

The data collected by Google Inc. is anonymous and aggregated. In particular, it does not include identifying features (understood as personal data) of Store users. By using these services, we collect data such as the sources from which users access the Store, their behavior on the Store's website, information about their devices and browsers, IP addresses, domains, demographic data (age, gender), interests, and geographic data. These cookies may also be used to link your account in an external Google service with your Store account.

More information can be found here: Google Cookies Policy

FACEBOOK

We use cookies administered by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, United States:

• Functional cookies used by Facebook Inc. These cookies may be used to link your account in the external Facebook social network with your Store account. They may also be used to process your actions performed using the "Share" or "Like" buttons on Facebook. The processing of these actions may be public.
• Advertising pixel tags used by Facebook Inc. These elements are embedded in digital content and allow the recording of information such as user activity on the website, as well as the assessment of advertisement effectiveness. Facebook pixel tag management is possible via the Facebook platform in its user panel.

More information can be found here: Facebook Cookies Policy

The use of third-party cookies is subject to the privacy and cookie policies applied by these entities. The current terms of third-party providers regarding this matter can be found on the listed websites and here: Privacy and Cookie Policies.

§15. CONSENT TO THE USE OF COOKIES AND MANAGEMENT

With the exception of necessary cookies, the processing of cookies is based on the user's consent.

Consent to the processing of cookies is voluntary and can be withdrawn at any time. However, please note that refusing to use certain cookies may result in limitations when using the Store and its functionalities, or even make it impossible to use them.

Consent to the processing of cookies can be given through:

• The settings of the software installed on the user's telecommunications end device,
• Clicking a button containing a statement of consent to the processing of cookies or confirming acknowledgment of its terms,
• Settings available on the website.

§16. CACHE MEMORY

When you use the Store’s website, we may automatically utilize the cache memory installed on your device. Through local storage, it is possible to store data between sessions, i.e., between consecutive visits to the Store’s website.

The purpose of using cache memory is to speed up the browsing experience by eliminating situations where the same data would be repeatedly downloaded from the Store, thus reducing the load on the user's internet connection. Cache memory may also store data such as login passwords.

§17. LINKS TO OTHER WEBSITES OR SOFTWARE

The Store may contain links to other websites or software. We are not responsible for the privacy policies and cookie processing rules applied on those websites or in that software.

We recommend reviewing the privacy and cookie policies of those websites or software upon accessing them or before installing them.

§18. CHANGES TO THE PRIVACY AND COOKIE POLICY

The Privacy and Cookie Policy comes into effect on the date of its publication on the Store’s website.

Any changes to the Privacy and Cookie Policy will be made by publishing its new content on the Store’s website.

We will publish information about changes to the Privacy and Cookie Policy on the Store’s website no later than 3 days before the new version takes effect.