OVERCEZ ONLINE STORE PRIVACY POLICY

§ 1. GENERAL PROVISIONS

1. The controller of personal data collected through the online store www.overcez.pl is Cezary Jarzyna OVERCEZ, Lisowo 22, 72-310 Płoty, email address: overcezkontakt@gmail.com, hereinafter referred to as the “Controller.”

2. Personal data collected by the Controller through the website www.overcez.pl is processed in accordance with Regulation (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR.”

3. All words or phrases capitalized in this Privacy Policy shall be understood in accordance with their definitions set forth in the Terms and Conditions of thewww.overcez.pl Online Store.

§ 2. TYPE OF PERSONAL DATA PROCESSED, PURPOSE, AND SCOPE OF DATA COLLECTION

1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes the personal data of Store users in the following cases:

a) When placing an order in the Store, for the purpose of performing the sales contract, pursuant to Article 6(1)(b) of the GDPR (performance of the sales contract);

b) Subscribing to the Newsletter to receive commercial information electronically. Personal data is processed upon the user’s separate consent, pursuant to Article 6(1)(a) of the GDPR;

c) Pursuant to Article 9(2)(f) of the GDPR, i.e., processing is necessary for the establishment, exercise, or defense of legal claims;

d) To fulfill the legal obligations incumbent upon the Data Controller pursuant to Article 6(1)(c) of the GDPR, arising from Union law or Polish law (e.g., personal data will be processed for the purpose of settlement of accounts);

e) For purposes arising from the legitimate interests pursued by the Data Controller pursuant to Article 6(1)(f) of the GDPR, which the Data Controller considers to include, in particular: the investigation, establishment, and defense against claims. When processing personal data in connection with the use of the Store, the Data Controller processes personal data (IP address and information collected via cookies) for analytical and statistical purposes. In this situation, the legal basis for processing is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Data Controller in analyzing the activity of users of the Data Controller’s website, including examining users’ interests in specific topics in order to tailor content that best matches users’ preferences;

f) To receive, review, and respond to inquiries submitted to the Data Controller via email or the contact form. Personal data is processed in this case pursuant to Article 6(1)(f) of the GDPR, for the purpose of pursuing the Data Controller’s legitimate interest;

g) Pursuant to Article 6(1)(c) of the GDPR, until the expiration of the period during which applicable laws require the retention of personal data (e.g., 5 years under tax law);

h) For the purpose of conducting other correspondence and marketing activities. Personal data is then processed pursuant to Article 6(1)(f) of the GDPR, for the purpose of pursuing the Controller’s legitimate interests.

2. TYPE OF PERSONAL DATA PROCESSED. The user provides, in the case of:

a) Orders: first and last name, address, tax identification number (NIP), email address, phone number.

b) Newsletter: email address.

c) Contact form: first and last name, email address.

3. PERIOD OF RETENTION OF PERSONAL DATA.

Users’ personal data is stored by the Controller:

a) Where the basis for data processing is the performance of a contract, for as long as necessary to perform the contract, and thereafter for a period corresponding to the statute of limitations for claims or the document retention period required by law (e.g., tax law);

b) Where the basis for data processing is consent, for as long as consent remains in effect, and after consent is revoked, for a period corresponding to the statute of limitations for claims that the Administrator may assert and that may be asserted against the Administrator;

c) While using the Store, additional information may be collected, in particular: the IP address assigned to the Service Recipient’s computer or the external IP address of the Internet service provider, domain name, browser type, access time, and operating system type.

4. Upon providing separate consent, pursuant to Article 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial communications by electronic means, including those targeted as a result of profiling, provided that the user has given the appropriate consent.

5. Navigation data may also be collected from users, including information about links and references they choose to click on or other actions taken within the Store. The legal basis for such activities is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in facilitating the use of services provided electronically and improving the functionality of those services.

6. The provision of personal data by a Store user is voluntary.

7. The Controller exercises particular diligence to protect the interests of data subjects and, in particular, ensures that the data it collects is:

a) processed lawfully,

b) collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes,

c) factually accurate and relevant to the purposes for which they are processed, and stored in a form that allows for the identification of the data subjects for no longer than is necessary to achieve the purpose of the processing.

§ 3. DISCLOSURE OF PERSONAL DATA

1. The personal data of Store users is disclosed to service providers used by the Administrator in operating the Store, and in particular to:

a) entities responsible for delivering Products,

b) payment system providers,

c) the accounting firm, as well as legal, tax, and business advisors,

d) hosting providers and suppliers of software and technological tools necessary to operate the online store.

e) entities providing the email marketing system.

2. The service providers referred to in point 1 of this paragraph, to whom personal data is transferred, depending on contractual arrangements and circumstances, either follow the Controller’s instructions regarding the purposes and methods of processing such data (processors) or independently determine the purposes and methods of processing (controllers).

3. Service Users’ personal data is stored exclusively within the European Economic Area (EEA), subject to §5, point 5, and §6 of the Privacy Policy.

§ 4. RIGHT TO CONTROL, ACCESS, AND CORRECT ONE’S OWN DATA

1. The data subject has the right to access their personal data, as well as the right to rectify, erase, or restrict the processing of such data; the right to data portability; the right to object; and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

2. Legal bases for the user’s requests:

1. Access to data – Article 15 of the GDPR.

2. Rectification of data – Article 16 of the GDPR.

3. Erasure of data (the so-called “right to be forgotten”) – Article 17 of the GDPR.

4. Restriction of processing – Article 18 of the GDPR.

5. Data portability – Article 20 of the GDPR.

6. Objection – Article 21 of the GDPR

7. Withdrawal of consent – Article 7(3) of the GDPR.

3. To exercise the rights referred to in point 2, you may send an email to the following address: overcezkontakt@gmail.com.

4. If a Store user submits a request based on the above rights, the Controller will comply with or refuse the request without delay, but no later than one month after receiving it. However, if—due to the complex nature of the request or the number of requests—the Controller is unable to comply with the request within one month, it will comply within the following two months, having first informed the user within one month of receiving the request of the intended extension of the deadline and the reasons for it.

5. If it is determined that the processing of personal data violates the provisions of the GDPR, the data subject has the right to file a complaint with the President of the Personal Data Protection Office.

§ 5. “COOKIES” AND OTHER TRACKING TECHNOLOGIES

Cookies.

1. The Administrator’s website uses “cookies.”

2. The installation of “cookies” is necessary for the proper provision of services on the Store’s website. “Cookies” contain information necessary for the proper functioning of the website and also enable the compilation of general statistics on website visits.

3. The website uses two types of “cookies”: “session” and “persistent” cookies.

1. “Session” cookies are temporary files that are stored on the user’s device until the user logs out (leaves the website).

2. “Persistent” cookies are stored on the user’s device for the duration specified in the cookie settings or until the user deletes them.

4. The website administrator uses its own cookies to better understand how users interact with the website’s content. These cookies collect information about how the user uses the website, the type of website from which the user was redirected, as well as the number of visits and the duration of the user’s visit to the website. This information does not record specific personal data of the user but is used to compile statistics on website usage.

5. You have the right to control whether “cookies” can access your computer by:

1. selecting the types of cookies you consent to upon entering the Store’s website and seeing the cookie notice,

2. changing the settings in their browser window. Detailed information about the options and methods for managing “cookies” is also available in the software (web browser) settings.

Google Analytics.

6. The Administrator uses the Google Analytics tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These activities are carried out based on a legitimate interest, which consists of compiling and analyzing statistics to optimize the Store’s website.

7. Google Analytics automatically collects information about the user’s use of the website. The information collected in this manner is typically transmitted to a Google server in the United States and stored there.

8. Due to the activation of IP address anonymization, the user’s IP address is truncated before being transmitted. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and truncated there. The anonymized IP address transmitted by the browser as part of Google Analytics is generally not combined with other Google data.

9. You can prevent Google from collecting data generated by cookies regarding your use of the Store’s website, as well as from processing this data, by installing the browser plugin available at the following address: https://tools.google.com/dlpage/gaoptout.

10. As part of Google Analytics, the Administrator also collects demographic data and data regarding user interests. Through the cookie settings directly on the website, users can decide whether or not to consent to the collection of such data.

11. Details regarding data processing through Google Analytics can be found at https://support.google.com/analytics/answer/6004245.

Google Ads.

12. The Administrator uses Google Ads marketing tools provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. With the help of Google Ads, the Controller promotes the website in search results and on third-party websites. These activities are carried out based on a legitimate interest in marketing its own products or services.

13. When visiting the Store’s website, a Google remarketing cookie is automatically stored on the user’s device; this cookie uses a pseudonymous identifier (ID) and, based on the pages visited by the user, enables the display of interest-based ads.

14. Further data processing occurs only if the user consents to Google linking their browsing and app usage history to their user account and using information from their Google account to personalize the ads displayed on websites. If, in such a case, the user is signed in to Google while visiting the Store’s website, Google will use this data in conjunction with Google Analytics data to create and define target audience lists for cross-device remarketing. To this end, Google temporarily combines the user’s personal data with Google Analytics data to create target audiences.

15. You can disable cookies used for remarketing in your Google account settings: https://adssettings.google.com. Additionally, you can disable the use of cookies for remarketing purposes in the cookie settings on the Store’s website.

16. Details regarding data processing within Google AdWords can be found at the following link: https://policies.google.com/privacy.

Google Tag Manager.

17. The Administrator uses the Google Tag Manager tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. With the help of Google Tag Manager, the Administrator manages advertising campaigns and monitors how users interact with the Store’s website. These activities are carried out based on a legitimate interest in marketing its own products or services and optimizing the Store’s website.

18. When visiting the website, a Google cookie is automatically stored on the user’s device. Using a pseudonymous identifier (ID) and based on the pages visited by the user, this cookie enables the display of interest-based ads, the monitoring of the effectiveness of these ads, and other activities related to tracking user behavior on the Store’s website.

19. Further data processing occurs only if the user consents to Google combining their browsing and app usage history with their account and using information from their Google account to personalize ads displayed on websites. If, in such a case, the user is signed in to Google while visiting the Store’s website, Google will use this data in conjunction with Google Analytics data to create and define target audience lists for cross-device remarketing. To this end, Google temporarily combines personal data with Google Analytics data to create target audiences

20. You can disable cookies used for remarketing in your Google account settings: https://adssettings.google.com. Additionally, you can disable the use of cookies for remarketing purposes in the cookie settings on the Store’s website.

21. Details regarding data processing within Google Tag Manager can be found at the following link: https://policies.google.com/privacy.

Facebook Pixel.

22. The Controller uses marketing tools available on Facebook and provided by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA. The Controller carries out these activities based on a legitimate interest in marketing its own products or services.

23. In order to provide users with personalized information based on their behavior on the Store’s website, the Administrator has implemented the Facebook Pixel, which automatically collects information about website usage, specifically regarding the pages viewed. The information collected in this manner is typically transmitted to a Facebook server in the United States and stored there.

24. The information collected via the Facebook Pixel is anonymous, meaning it does not allow us to identify you. The Administrator only knows what actions you have taken on our website. However, Facebook may combine this information with other information about the user collected through the use of the Facebook service and use it for its own purposes, including marketing. Such actions by Facebook are no longer under the control of the Administrator, and information about them can be found directly in Facebook’s privacy policy: https://www.facebook.com/privacy/explanation. You can also manage your privacy settings from your Facebook account.

25. Through the cookie settings available on the website, you can decide whether or not to consent to the Administrator’s use of the Facebook Pixel.

TikTok Pixel.

26. The Data Controller uses the TikTok Pixel—an analytics tool owned by TikTok Technology Limited (Ireland).

27. The TikTok Pixel helps measure the effectiveness of ads based on an analysis of user activity on the website. Data from the TikTok Pixel may be used to: serve ads to the appropriate audience, create ad audiences, and use other TikTok advertising tools.

28. By using the Store, you consent to the collection, processing, and transfer of the above data for the purposes listed above in accordance with TikTok’s privacy policy.

29. For more information regarding privacy and the processing of personal data by TikTok, please visit: https://www.tiktok.com/legal/privacy-policy-eea?lang=pl

Hotjar.

30. The data controller uses the Hotjar tool, provided by Hotjar Limited, Level 2, St. Julian’s Business Centre, 3 Elia Zammit Street, St. Julian’s STJ 1000, Malta. With the help of Hotjar, the Data Controller analyzes user behavior on the Store’s website, such as the time spent on individual pages, the buttons users click, the links they follow, etc. The Data Controller does this to optimize the Store’s website for the user experience. These activities are carried out based on a legitimate interest in optimizing the website.

31. Hotjar uses cookies and other technologies to collect information about behavior on the website and the devices used to access the website, such as IP address (anonymized), screen size, browser information, location, and language. Hotjar stores this information as part of a pseudonymized profile. Neither Hotjar nor the Administrator will use this information for identification purposes. More information can be found in Hotjar’s privacy policy: https://www.hotjar.com/legal/policies/privacy.

32. You may object to the creation of an anonymous profile and the storage of information about you by Hotjar by visiting this page: https://www.hotjar.com/legal/compliance/opt-out. Additionally, within the cookie settings on the Store’s website, you can decide whether the Administrator may use Hotjar.

Ecwid.

33. The Data Controller uses the Ecwid tool, provided by Lightspeed Commerce Inc. ATTN: Legal Department, IP Agent 700 St-Antoine Est, Suite 300 Montreal, Quebec H2Y1A6 Canada IP@lightspeedhq.com, which enables the integration of the Store with major payment gateways and various third-party applications, allows for the management of the Online Store, and facilitates the processing of orders and payment systems;

34. Ecwid processes the personal data of the store’s customers based on a data processing agreement concluded with the Controller, in accordance with legal requirements; the text of this agreement can be viewed at the link https://www.lightspeedhq.com/legal/data-processing-agreement/.

35. Ecwid also uses cookies and other technologies to collect information about user behavior on the website and the devices used to access the website, such as IP address (anonymized), screen size, browser information, location, and language.

36. For more information, please see the privacy policy at: https://www.lightspeedhq.com/legal/privacy-policy/.

Social Media Services.

1. The Store uses so-called social media plugins (“plugins”) from social media platforms. When you view the website www.overcez.pl containing such a plugin, your browser will establish a direct connection to the servers of Facebook, Instagram, TikTok, Google, and YouTube.

2. The content of the plugin is transmitted by the respective service provider directly to the user’s browser and integrated into the webpage. Through this integration, the service providers receive information that the user’s browser has accessed the page www.overcez.pl, even if the user does not have a profile with that service provider or is not currently logged in to it. This information (along with the user’s IP address) is transmitted by the browser directly to the respective service provider’s server (some servers are located in the U.S.) and stored there.

3. If the user logs in to one of the above social media platforms, that service provider will be able to directly associate the visit to www.overcez.pl with the user’s profile on that social media platform.

4. If a user interacts with a specific plugin—for example, by clicking the “Like” or “Share” button—the corresponding information will also be transmitted directly to the respective service provider’s server and stored there.

5. The purpose and scope of data collection, as well as the further processing and use of the data by the service providers, along with contact information, the User’s rights in this regard, and the options for configuring settings to protect the User’s privacy, are described in the service providers’ privacy policies:

1. https://www.facebook.com/policy.php

2. https://privacycenter.instagram.com/policy/?entry_point=ig_help_center_data_policy_redirect

3. https://policies.google.com/privacy?hl=pl&gl=ZZ.

4. https://www.tiktok.com/legal/page/eea/privacy-policy/pl

6. If a user does not want social media platforms to associate data collected during visits to www.overcez.pl directly with their profile on that platform, they must log out of that platform before visiting www.overcez.pl. You can also completely prevent plugins from loading on the website by using appropriate browser extensions, such as blocking scripts with “NoScript.”

§ 6. FINAL PROVISIONS

1. The Administrator implements technical and organizational measures to ensure the protection of processed personal data commensurate with the risks and the category of data being protected; in particular, the Administrator safeguards the data against disclosure to unauthorized persons, removal by an unauthorized person, processing in violation of applicable laws, and alteration, loss, damage, or destruction.

2. The Controller shall provide appropriate technical measures to prevent unauthorized persons from intercepting or modifying personal data transmitted electronically.

3. In matters not covered by this Privacy Policy, the provisions of the GDPR and other applicable provisions of Polish law shall apply accordingly.