4. DATA RECIPIENTS IN THE ONLINE SHOP

4.1. For the needs of proper Online Shop functioning, inclusive of the performance of the Contracts of Sale entered
into, it shall be necessary for the Controller to make use of external companies’ services (e.g. software provider,
courier, or payment system provider). The Controller uses solely the services of such processing entities which
ensure sufficient guarantee to implement appropriate technical and organisational measures so that the
processing meets the requirements set out in the GDPR Regulation and protects the rights of data subjects.
4.2. The Controller may provide personal data to a third country, while the Controller ensures that it shall only be a
third country which is considered to provide adequate level of protection – in accordance with the GDPR
Regulation, and in the case of other countries, the data transfer will occur on the basis of the standard
contractual clauses. The Controller ensures that the data subject has a right to get a copy of their data. The
Controller provides personal data to a third country only in case and scope necessary to execute a certain
purpose of data processing consistent with this privacy policy.
4.3. Providing data by the Controller does not take place in every case and not to all the recipients or categories of
recipients defined in the privacy policy – the Controller provides the data only in the case it proves necessary to
attain a given purpose of personal data processing and solely within the necessary scope.
4.4. Personal data of the Online Shop Service Recipients or Customers may be provided to the following recipients
or categories of recipients:
4.4.1. carriers/forwarders/couriers/entities operating warehouses and/or responsible for shipping process – in
the case of a Customer who selects the Online Shop to deliver the Product by post or courier, the Controller
makes the collected Customer’s personal data available to the selected carrier, forwarder or agent performing
shipment for the Controller, and if the delivery is to be made from the external warehouse – to the entity
operating warehouse and/or responsible for shipping process – to the extent necessary to deliver the Product to
the Customer.
4.4.2. e-payments or payment card service providers – in the case of a Customer who uses in the Online Shop the
option of e-payment or payment card, the Controller makes the collected Customer’s personal data available to
the selected payment service provider in the Online Shop for the Controller to the extent necessary to perform
the payment of the Customer.
4.4.3. service providers rendering for the Controller technical, IT or organisational solutions, making it
possible for the Controller to conduct a business, inclusive of the Online Shop and Electronic Services
provided via it (in particular computer software providers for the Online Shop, e-mail companies and hosting
providers as well as software providers for company management and technical aid for the Controller) – the
Controller makes the collected personal data of the Customer available to the selected provider operating to
their order only in the case and to the extent necessary for attaining a given purpose of data processing in
accordance herewith.
4.4.4. accounting, legal and consulting services providers rendering for the Controller accounting, legal or
consulting services (in particular an accounting agency, law firm or debt collection company) – the Controller
makes the collected personal data of the Customer available to the selected provider operating to their order
only in the case and to the extent necessary for attaining a given purpose of data processing in accordance
herewith.
4.4.5. providers of social plugins implemented in the Online Shop, of scripts and other similar tools enabling a
person using the Online Shop to download content from the providers of the said plugins (e.g. logging in
using social network login details) and for this purpose providing the providers with the personal data of the
visitor, including also:
4.4.5.1. Meta Platforms Ireland Ltd. - The Administrator uses Facebook social plugins on the Online Store website
(e.g. the Like button, Share or login using Facebook login details) and therefore collects and provides personal
data of the Service Recipient using the Store website to Meta Platforms Ireland Ltd. (4 Grand Canal Square,
Grand Canal Harbour, Dublin 2 Ireland) to the extent and in accordance with the privacy rules available - in
the case of Facebook - here: https://www.facebook.com/about/privacy/ (this data includes information about
activities on the Online Store website - including information about the device, visited websites, purchases,
displayed ads and how to use services - regardless of whether the Service Recipient has a Facebook account
and is logged in to Facebook).

5. PROFILING IN THE ONLINE SHOP

5.1. The GDPR Regulation obligates the Controller to inform about the automated decision-making process,
including profiling referred to in Article 22, par. 1 and 4 of the GDPR Regulation, and – at least in those cases –
the vital information concerning the decision-making process as well as the meaning and foreseeable
consequences of processing for the person being the data subject. Bearing in mind the above, the Controller
specifies in this point of the privacy policy the information concerning the possible profiling.
5.2. The Controller may use profiling in the Online Shop for direct marketing purposes, yet the decisions made on its
basis by the Controller do not concern the conclusion or rejection to conclude the Sales Contract, or the
possibility to make use of Electronic Services in the Online Shop. The result of profiling in the Online Shop may
be e.g. discount for a given person, sending a discount code, reminding about unfinished purchase process,
sending Product offers, which may be related to the interests or preferences of the person, or offering better
conditions as compared with the standard offer of the Online Shop. Regardless of profiling, the person makes
decisions freely, whether they want to use the discount given, or better conditions and buy a product in the
Online Shop.
5.3. Profiling in the Online Shop consists in automatic analysis or forecast of the conduct of a given person on the
website of the Online Shop, e.g. by adding a given Product to the cart, browsing the page of a given product in
the Online Shop, or the analysis of the history of purchase in the Online Shop. The condition for such profiling is
for the Controller to have the personal data of the person, so that they can later send them e.g. a discount code.
5.4. The data subject shall have the right not to depend on the decision, which is only based on automated
processing, including profiling, and has some legal effects on the person or similarly affects them.

6. THE RIGHTS OF THE DATA SUBJECT

6.1. The right to access, rectify, restrict, erase or transmit – the data subject shall have the right to demand the
Controller to have access to their personal data, rectify, erase (“the right to be forgotten”) or restrict the
processing and shall have the right to object to the processing and transmit their data. Detailed conditions of the
above rights shall be indicated in Articles 15­22 of the GDPR Regulation.
6.2. The right to withdraw the consent at any time – the person whose data are being processed by the
Controller on the basis of the consent given (pursuant to Article 6, par. 1, point a) or Article 9, par. 2, point a) of
the GDPR Regulation), they shall have the right to withdraw their consent at any time without any impact on the
compatibility with the right to process made based on the consent prior to the withdrawal.
6.3. The right to lodge a complaint with a supervisory body – the person whose data are being processed by the
Controller shall have the right to lodge a complaint with a supervisory body in a manner and mode specified in
the provisions of the GDPR Regulation and the Polish law, in particular the Personal Data Protection Act. The
supervisory body in Poland shall be the President of the Office for Personal Data Protection.
6.4. The right to object – the data subject shall have the right, at any time, to lodge a complaint – for reasons
related to their particular situation – as regards the processing of their personal data based on Article 6, par. 1,
point e) (public interest or official authority) or f) (legitimate interest of the controller) in the case of profiling
based on the provisions. The Controller in such a case must stop processing the personal data, unless they
show the existence of legally significant and justified bases for the processing, overriding the interests, rights
and freedoms of the data subject, or the bases for determining, pursuing or defending the claims.
6.5. The right to object as regards direct marketing – in the case the personal data are being processed for the
needs of direct marketing, the data subject shall have the right, at any time, to lodge a complaint as regards the
processing of their personal data for the needs of such marketing, including profiling, to the extent to which the
processing is related to direct marketing.
6.6. To perform the rights mentioned in this point of the privacy policy, one may contact the Controller by sending
them an appropriate message in writing or via e-mail to the address of the Controller indicated at the beginning
of the privacy policy or using the contact form available on the Online Shop’s website.

7. COOKIES IN THE ONLINE SHOP AND ANALYTICS

7.1. Cookies are small pieces of text files sent by the server and saved at the visitor’s of the Online Shop (e.g. on the 
hard disk of a computer, laptop, or smartphone’s memory card – depending on the type of device used by the 
Online Shop’s visitor). Detailed information on Cookies as well as the history of their origin can be found e.g. at: 
https://en.wikipedia.org/wiki/HTTP_cookie.
7.2. Cookies, which can be sent via the Online Shop website, can be divided into various types, according to the 
following criteria: