§1 GENERAL INFORMATION

1. The Privacy Policy of the Internet Shop does not constitute a source of obligation for the individual browsing the resources of the Internet Shop (hereinafter: the Visitor) or the Customer of the Internet Shop. It has an informative character, it is not a contract or regulations.

2. All expressions and words written with a capital letter (e.g. Internet Shop, Customer, etc.) shall be understood in accordance with the content of the Rules and Regulations of the Internet Shop

3. In the event of any discrepancies between this Privacy Policy and consents for the processing of personal data given by an individual, the legal basis for determining the scope of the Administrator's actions shall be the voluntarily given consents or the provisions of law that apply to a given factual situation.

§2 ADMINISTRATOR OF PERSONAL DATA

1. The administrator of your personal data is MyBasic Sp. z o.o. with its registered office in Izabelin B, ul. Rzędziana 11, 05-080 Izabelin B, registered in the District Court for the capital city of Warsaw, XIV Commercial Department of the National Court Register. Warszawy in Warsaw, XIV Economic Department of the National Court Register under KRS number: 0000776465, NIP: 1182190916, REGON: 382808588, BDO: 000540511 (hereinafter: Administrator).

2. In all matters related to the protection of personal data, we encourage you to contact us at the above address or via e-mail: [email protected].

3. You can also send a request for information on what personal data we hold about you and for what purposes we process it to the address indicated.

4. The Administrator informs that it stores the correspondence for statistical purposes and for the improvement of the support system in the scope of RODO, as well as for the resolution of complaints and possible administrative intervention decisions based on the notifications in the indicated Customer Account. Addresses and data collected in this way will not be used for communication for purposes other than the fulfilment of the request, in particular not used for marketing purposes and not passed on to third parties.

5. When contacting the Administrator to perform a specific action (e.g. making a complaint, making a return), the Administrator may again ask the person concerned to provide data, including personal data, e.g. in the form of name, surname, home address, e-mail address, in order to confirm his/her identity and enable the person concerned to be contacted back on the matter and to perform the requested action. The provision of this data is not obligatory, but may be necessary in order to carry out an activity or obtain information of interest to the person concerned.

6. If you have given your additional consent for us to use cookies, our trusted partners may also be the controllers of the data obtained from your online activities.

§3 ACQUISITION OF DATA AND PURPOSE OF PROCESSING

1. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, (hereinafter: GDPR) and other data protection laws currently in force at the time of processing of certain data.

2. According to the wording of the indicated legislation, personal data is considered to be information about an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.

3. We ensure that the data we obtain from you is confidential, secure and only processed when necessary or when we have the appropriate consent to do so. We process data lawfully, fairly and transparently to the data subject. We process only such data and only of such content as is necessary for the legitimate purpose, i.e. the reason for processing. Personal data is collected with due care and adequately protected against access by unauthorised persons. We use appropriate and adequate security measures and state of the art technology to protect personal data against accidental loss and unauthorised access, use, alteration or disclosure. We keep personal data in a way that enables the data subject to be identified for no longer than is necessary for the purposes for which the data is processed.

4. The controller obtains information about personal data in the following ways:

   1. by making a purchase from the Shop (online shop) by the Customer;

   2. by registering a Customer Account;

   3. through voluntary subscription to a newsletter service;

   4. by voluntarily entering information in an email or in a chat;

   5. by sending a complaint, request, enquiry or letter of any other nature;

   6. by means of the information voluntarily entered in the e-mail sent in connection with the desire to cooperate;

   7. by posting a product review;

   8. by voluntarily sending a message via the contact form;

   9. via cookies, pixels or similar internet technologies.

5. We would like to inform you that the purpose and scope of the data processed by the Controller derives from the consent of the Website Visitor or the Customer or from the provisions of the law and, in selected cases, is further specified as a result of the actions taken by these persons in the Online Shop or through other communication channels.

6. The provision of personal data by the Visitor or Customer of the Online Shop is voluntary, but necessary in order to use certain functionalities of the Online Shop (e.g. placing an Order and its settlement by the Customer, registering a Customer Account or using contact forms).

7. In each case, the scope of the data required to conclude the relevant contract is indicated in advance in the Online Shop (we mark the data the provision of which is necessary to conclude a contract/use a specific functionality), in other channels of communication with the Visitor or the Customer or in the Terms and Conditions. The consequence of failing to provide personal data may be the inability to effectively use the functionality of the Website, e.g. the inability to place an order.

8. Your personal data is obtained by the Administrator for the following purpose:

9. In the case of an adult Customer or an adult Website Visitor, with his/her additional consent, Personal Data may also be processed for the purpose of presenting, creating, granting, and executing advertisements, offers or promotions (discounts) dedicated to a given Customer regarding the products or services of the Administrator and its partners, to the extent possible tailored to the Customer's preferences (profiling), as a result of automated decision-making, which may produce legal effects towards him/her or in a similar manner significantly affect him/her, e.g. by means of a short-term discount dedicated exclusively to such a person on a specific product that he/she has recently browsed in our Online Shop (option not available to persons who are not of legal age or who are of legal age but have not given their consent to such action).

10. Newsletter. If you wish to subscribe to our newsletter, it is mandatory that you provide us with your e-mail address or telephone number via the newsletter subscription form. The provision of data is voluntary, but necessary in order to use the newsletter service. Subscribing to the newsletter is also possible at the stage of creating a Customer Account or when placing an Order.The data provided to us when subscribing to the newsletter is used to send you the newsletter in which we inform you about company activities, the current collection, promotions and discounts. The legal basis for the processing in this situation is your voluntary consent given when signing up for the newsletter.Your data is processed in this case for the purpose of sending the newsletter periodically, and the basis for the processing is Article 6(1)(a) GDPR, i.e. your consent resulting from your wish to receive the service. The data will be processed for the duration of the newsletter, unless you opt out earlier, which will permanently delete your data from the database. Furthermore, you can rectify your data stored in the newsletter database at any time, as well as request its deletion by unsubscribing from the newsletter. You also have the right to data portability contained in Article 20 of the GDPR newsletter database is adequately secured by the Administrator. The newsletter as a database is handled through an external entity. The e-mails sent contain links to hidden images (so-called tracking pixel). In addition to its primary function of counting email opens, it optionally also serves to identify the customer and carry out marketing activities.

11. E-mail contact. When you contact us by e-mail, you provide us with your e-mail address as the sender address of the message. In addition, you may also include other personal data in the body of the message. The provision of data is voluntary, but necessary in order to get in touch with us. Your data is processed in this case for the purpose of contacting you, and the legal basis for the processing is Article 6(1)(a) of the GDPR, i.e. your consent resulting from your wish to contact us. The legal basis for post-contact processing is the legitimate purpose of archiving correspondence for internal purposes (Article 6(1)(c) GDPR). The content of your correspondence may be subject to archiving and we are not in a position to state explicitly when it will be deleted, however, this will be for a period of no more than 5 years. You have the right to request the history of any correspondence you have had with us (if it has been subject to archiving) as well as to request its deletion, unless its archiving is justified due to our overriding interests.

12. Reviews. If you wish to add your opinion about a product or our entry, you must fill in a form. Your data is processed in this case for the purpose of enabling you to post an Opinion, and the basis for the processing is Article 6(1)(a) of the GDPR, i.e. your consent resulting from your wish to post on our website.Your data will be processed for the duration of the Opinion on the website, unless you request the deletion of the Opinion beforehand, which will result in the deletion of your opinion-related data from the database. You can correct your data in the opinion at any time, as well as request its deletion. You also have the right to data portability contained in Article 20 of the GDPR.

13. Customer Account. When you create a Customer Account on our Website, you provide us with your e-mail address, first name and surname. This is voluntary, but necessary in order to successfully register a Customer Account. Subsequently, in the Customer Panel, you can also provide address data and e.g. VAT number. Your data is processed in this case for the purpose of maintaining a Customer Account, and the basis for the processing is Article 6(1)(b) GDPR, i.e. the need to process personal data in connection with the need to fulfil the contract for maintaining a Customer Account in our shop. Your data will be processed for the duration of your Customer Account, unless you request its deletion beforehand, which will result in the deletion of your data from the database.You can rectify your data assigned to your Customer Account at any time, as well as request its deletion. You also have the right to data portability contained in Article 20 of the GDPR. As part of setting up a Customer Account, you may - but are not required to - agree to subscribe to the newsletter service.

§4 CATEGORIES OF PERSONAL DATA

1. The controller may process the following categories of personal data:

   1. personal data provided in the form when registering a Customer Account, placing an Order in the Online Shop, in particular: e-mail address, name and surname, telephone number;

   2. the personal data completed by the user during the use of the customer account, in particular: name and surname; e-mail address; address of residence [street, house number, apartment number, postal code, town, country], and in the case of non-consumers, additionally company name and tax identification number [VAT];

   3. the personal data required to place the order, in particular: first and last name; e-mail address; contact telephone number; address of residence [street, house number, apartment number, postal code, town, country] and, in the case of non-consumers, additionally the company name and tax identification number [VAT];

   4. personal data provided for the purposes of using the newsletter; provided for the purposes of using the chat room, posting opinions and submitted via e-mail or the contact form; or provided for the purposes of lodging complaints, claims or requests, in particular: name and surname; e-mail address; contact telephone number; address [street, house number, apartment number, postal code, town, country], bank account number;

   5. personal data provided for the purpose of participating in competitions/promotions: name and surname; e-mail address; contact telephone number; address of residence [street, house number, apartment number, postal code, town, country];

   6. inne dane w szczególności uzyskane w oparciu o aktywność Klienta w Internecie, w tym uzyskane za pośrednictwem Sklepu Internetowego lub innych kanałów komunikacji z Klientem, z wykorzystaniem cookies i podobnych technologii.

§5 RECIPIENTS OF PERSONAL DATA

1. Your personal data may be processed by our partners and subcontractors, i.e. entities whose services we use to process your data and provide services to you. To the best of our knowledge, all entities to whom we entrust the processing of personal data guarantee the application of the appropriate protection and security measures for personal data required by law.

2. Your personal data may be transferred by the Administrator:

   1. to state authorities or other entities entitled under the law, in order to fulfil the obligations incumbent upon us;

   2. To a limited extent, the Administrator's partners may be involved in the processing of personal data, in particular those who technically assist in the smooth running of the Online Shop (e.g. support us in sending e-mails and, in the case of advertising activities, also in marketing campaigns), providers of hosting or ICT services, carriers or intermediaries carrying out the shipment of Orders, entities handling electronic payments or payment card payments in the Online Shop, companies that maintain the software, support the Administrator in marketing campaigns, as well as providers of legal and advisory services and external accountants;

   3. In addition, we may share fully anonymised data (data that cannot identify you) with entities with whom we work.

3. As part of its marketing (advertising) activities, the Administrator uses the services of third parties that use cookies, pixels or marketing functions similar to cookies in the Online Shop. The catalogue of these entities is indicated in detail in §8 of this Policy.

§6 ARCHIVING OF PERSONAL DATA

1. The Administrator will only retain your personal data for as long as is necessary for the purposes set out in this Privacy Policy and/or to comply with legal and regulatory requirements. After this period, the Administrator will securely delete your personal data.

2. We retain the data for the periods indicated below:

3. In any case, personal data will also be stored if legal regulations (e.g. accounting or tax regulations) oblige the Administrator to process them; we will store personal data for longer in case the Customer has any claims against the Administrator, in order for the Administrator to assert claims, or in order to assert or defend against third-party claims, for the period of limitation prescribed by law, in particular the Civil Code.

4. Depending on the scope of the personal data and the purposes for which they are processed, they may therefore be stored for different periods. In each case, the longer period of retention of personal data is decisive.

§7 RIGHTS, ACCESSING AND UPDATING PERSONAL DATA, COMPLAINTS

In accordance with Article 15 of the DPA, you have the right to obtain information from the Data Controller as to whether your personal data is being processed.

If the Administrator processes your personal data, then you have the right to:

• access to personal data;

• be informed about the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients of that data, the intended period of storage of your data or the criteria for determining that period, your rights under the GDPR and your right to lodge a complaint with a supervisory authority, the source of that data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of that data outside the European Union;

• obtain a copy of their personal data.

In addition, you may request the rectification of your personal data (Article 16 GDPR), the erasure of your personal data (Article 17 GDPR), object to the processing of your personal data (Article 21 GDPR) and, where technically feasible, request the transfer of the personal data provided to another organisation (Article 20 GDPR).

In relation to the right to be forgotten, the Controller will update or delete your data unless it has a legal obligation to retain it for business purposes or to comply with the law. In some cases, you have the right to request the restriction of the processing of your personal data (Article 18 GDPR). You may also contact the Controller if you have concerns about the collection, storage or use of your personal data.

The Administrator shall endeavour to deal promptly with all requests concerning the above-mentioned operations on your personal data, but no later than within 30 days of receiving the request. Due to the complex nature of the request, the Administrator has the right to consider your requests in a period exceeding 30 days, of which it will inform you in advance.

The controller aims to handle complaints conclusively, but if you are still dissatisfied with the response you receive, you may lodge a complaint with your local data protection supervisory authority. In Poland, the supervisory authority under the GDPR is the President of the Office for Personal Data Protection.

§8 AUTOMATED PROCESSING OF PERSONAL DATA, COOKIE POLICY

1. Our Website, like almost all other websites, makes use of cookies, i.e. cookies. This cookie policy applies to both Customers of the Online Shop and Visitors to the Online Shop, i.e. users who browse the content of the Online Shop but do not make purchases.

2. The Cookie Policy is a document which forms an integral part of this Privacy Policy. The content of the Cookie Policy can be found here.

3. The Website also uses functionalities similar to cookies. Accordingly, the individual provisions of the Cookie Policy must be referred to accordingly for these technologies as well.

4. Selected cookies process your personal data. The processing of personal data from cookies or similar technologies on our Website is carried out for the purposes of ensuring the functioning of the Website, the adaptation of the Website to the preferences of the Visitor and the Customer, or analytical purposes. The processing is carried out on the basis of our legitimate interest. The legal basis for the processing of personal data for advertising purposes will be your additional consent, expressed by making a selection and ticking the checkbox during the cookie consent process.

5. When a Visitor uses the Online Shop, cookies are used to identify his/her browser or device - cookies collect various types of information which, in principle, do not constitute personal data. However, some information, depending on its content and use, may be linked to a specific person - the attribution of certain behaviour to a specific Visitor or Customer, e.g. by linking it to the data provided when registering an Account with the Online Shop or a specific email address - and thus be considered personal data.

6. In relation to information collected by cookies that can be linked to a specific person, the provisions of the Privacy Policy of the Online Shop relating to personal data, in particular those relating to the rights of the data subject, shall apply.

7. The Website makes use of profiling. Thanks to the cookies used in the Online Shop, it is possible for the Administrator to learn about the preferences of the Visitor/Customer - e.g. by analysing how often they visit the Online Shop and whether and which products they buy. Analysing online behaviour helps to better understand the habits and expectations of Customers and Visitors and to adapt to their needs and interests. Thanks to this technology, it is possible to present Visitors with advertisements tailored to their needs and interests and to prepare better promotions and surprises for adult Visitors who have agreed to this.

§9 CHANGES TO THE PRIVACY POLICY

1. This Privacy Policy 3.0. is effective as of 07.10.2024.

2. The Administrator declares that he has the right to amend this document for important reasons, including:

   1. changes to the applicable legislation, in particular with regard to GDPR, telecommunications law, electronically provided services and regulating consumer rights, affecting the rights and obligations of the Controller or the rights and obligations of the Data Subject;

   2. developments in electronic functionality or services due to advances in Internet technology, including the implementation of new IT, technological or technical solutions on the Website, which affect the scope of this Privacy Policy.

3. The Administrator is obliged to inform Users of any changes in good time, allowing them to become acquainted with the content of the amended document, e.g. by placing the uniform text of the Privacy Policy on the homepage of the Website.

4. In the case of users using the newsletter function, if the Administrator makes substantial changes to the content of the Privacy Policy, the Administrator will inform the Users of these changes by e-mail. In the event of any objections to the change in the Policy, the user has the right to stop using the newsletter by sending a request to unsubscribe from the newsletter or by requesting the deletion of their personal data.