§ 1 GENERAL PROVISIONS

1. The controller of personal data collected via the online store www.grubygarage.com.pl is Hubert Figaś conducting business activity under the name GRUBYGARAGE HUBERT FIGAŚ, registered in the Central Register and Information on Economic Activity of the Republic of Poland maintained by the minister responsible for the economy. Business address and correspondence address: ul. Łanowa 35F, 32-050 Skawina, NIP: 6832102694, REGON: 381753187, email address: [email protected], phone number: +48 699 570 440, hereinafter referred to as the "Controller" and also the "Service Provider."
2. Personal data collected by the Controller via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.
3. Any words or expressions written in this Privacy Policy in capital letters should be understood in accordance with their definitions provided in the Regulations of the online store www.grubygarage.com.pl.

§ 2 TYPES OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data of Service Users of the store www.grubygarage.com.pl in cases of:
   1. Account registration in the Store to create an individual account and manage it, based on Article 6(1)(b) of the GDPR (performance of a contract for the provision of electronic services in accordance with the Store's regulations),
   2. Placing an Order in the Store to perform a Sales Agreement, based on Article 6(1)(b) of the GDPR (performance of a sales agreement),
   3. Subscribing to the Newsletter to send commercial information by electronic means. Personal data is processed upon separate consent, based on Article 6(1)(a) of the GDPR,
   4. Using the Contact Form to send messages to the Controller, based on Article 6(1)(f) of the GDPR (legitimate interest of the entrepreneur).
2. TYPES OF PERSONAL DATA PROCESSED. The Service User provides the following data:
   1. For the Account: email address,
   2. For the Order: first and last name, address, NIP (tax identification number), email address, phone number,
   3. For the Newsletter: first and last name, email address,
   4. For the Contact Form: first and last name, email address, phone number.
3. DATA RETENTION PERIOD. The personal data of Service Users is stored by the Controller:
   1. When the basis for processing is the performance of a contract, for as long as it is necessary to perform the contract, and afterward for a period corresponding to the statute of limitations for claims. If a specific provision does not state otherwise, the statute of limitations is six years, and for periodic performance claims and claims related to conducting business activity – three years.
   2. When the basis for processing is consent, until the consent is withdrawn, and after withdrawal, for a period corresponding to the statute of limitations for claims that may be raised by the Controller and against the Controller. If a specific provision does not state otherwise, the statute of limitations is six years, and for periodic performance claims and claims related to conducting business activity – three years.
4. When using the Store, additional information may be collected, including: the IP address assigned to the Service User's computer or external IP address of the Internet provider, domain name, browser type, access time, and operating system type.
5. Upon separate consent based on Article 6(1)(a) of the GDPR, data may also be processed for sending commercial information by electronic means or making phone calls for direct marketing purposes – as per Article 10(2) of the Act of 18 July 2002 on the provision of electronic services or Article 172(1) of the Act of 16 July 2004 – Telecommunications Law, including those directed as a result of profiling, if the Service User has given appropriate consent.
6. Navigation data, including information about links and references clicked or other activities undertaken in the Store, may also be collected from Service Users. The legal basis for such activities is the Controller's legitimate interest (Article 6(1)(f) of the GDPR), which involves facilitating the use of services provided electronically and improving the functionality of these services.
7. Providing personal data by the Service User is voluntary.
8. The Controller takes special care to protect the interests of the persons to whom the data relates, ensuring that the data collected is:
   • processed in accordance with the law,
   • collected for specified, lawful purposes, and not subjected to further processing incompatible with those purposes,
   • factually correct and adequate in relation to the purposes for which it is processed, and stored in a form that permits identification of the persons to whom it pertains, no longer than necessary to achieve the purpose of processing.

§ 3 DISCLOSURE OF PERSONAL DATA

1. Personal data of Service Users is provided to service providers used by the Controller to operate the Store, in particular to:
   • entities handling the delivery of Products,
   • payment system providers,
   • survey system providers,
   • accounting offices,
   • hosting providers,
   • software providers enabling the operation of the Store,
   • entities providing mailing systems,
   • software providers needed to run the online store.
2. The service providers mentioned in point 1 of this paragraph, to whom personal data is transferred, may either follow the instructions of the Controller regarding the purposes and methods of processing this data (processors) or independently define the purposes and methods of processing (controllers), depending on the contractual arrangements and circumstances.
3. Personal data of Service Users is stored only within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of this Privacy Policy.

§ 4 RIGHTS OF ACCESS, CONTROL, AND RECTIFICATION OF PERSONAL DATA

1. A person whose data is processed has the right to access their personal data, rectify it, delete it, limit its processing, transfer the data, object to its processing, and withdraw consent at any time without affecting the lawfulness of the processing carried out based on consent before its withdrawal.
2. Legal grounds for the Service User's requests:
   1. Access to data – Article 15 of the GDPR,
   2. Rectification of data – Article 16 of the GDPR,
   3. Deletion of data (the right to be forgotten) – Article 17 of the GDPR,
   4. Restriction of processing – Article 18 of the GDPR,
   5. Data portability – Article 20 of the GDPR,
   6. Objection – Article 21 of the GDPR,
   7. Withdrawal of consent – Article 7(3) of the GDPR.
3. To exercise the rights mentioned in point 2, an appropriate email can be sent to: [email protected].
4. If a Service User exercises any of the rights arising from the above points, the Controller fulfills the request or refuses to fulfill it promptly, but no later than within one month of receiving the request. If, due to the complexity of the request or the number of requests, the Controller cannot fulfill the request within one month, the Controller will fulfill it within the next two months, informing the Service User in advance, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.
5. If the processing of personal data violates GDPR regulations, the person concerned has the right to lodge a complaint with the President of the Office for Personal Data Protection.

§ 5 "COOKIES" FILES

1. The Controller's website uses "cookies."
2. The installation of "cookies" is necessary for the proper provision of services on the Store's website. "Cookies" contain information necessary for the proper functioning of the website and allow the development of general statistics of website visits.
3. Two types of "cookies" are used on the website: "session cookies" and "persistent cookies."
   1. "Session cookies" are temporary files stored on the Service User's device until logging out (leaving the website).
   2. "Persistent cookies" are stored on the Service User's device for a specified period in the "cookies" parameters or until deleted by the Service User.
4. The Controller uses its own "cookies" to better understand how Service Users interact with the website. The files collect information about the use of the website by the Service User, the type of site from which the User was redirected, the number of visits, and the time of the visit. This information does not record specific personal data of the Service User but is used to compile usage statistics.
5. The Controller also uses external "cookies" to collect general and anonymous statistical data via analytical tools such as Google Analytics (administrator of external cookies: Google LLC, based in the USA).
6. "Cookies" may also be used by advertising networks (particularly Google) to display advertisements tailored to how the Service User uses the Store. For this purpose, they may retain information about the Service User's navigation path or time spent on a given page.
7. The Service User can decide on the access of "cookies" to their computer by:
   • Selecting the types of cookies they consent to immediately upon entering the Store's website, upon the display of the cookies notification,
   • Changing the settings in their browser. Detailed information about the possibilities and ways of handling "cookies" can also be found in the settings of the software (internet browser).

§ 6 ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

1. The Store uses so-called social plugins ("plugins") from social networking sites. When displaying the www.grubygarage.com.pl website containing such a plugin, the Service User's browser will directly connect to the servers of Facebook, Instagram, and Google.
2. The content of the plugin is transmitted directly by the respective service provider to the Service User's browser and integrated into the website. Thanks to this integration, the service providers receive information that the Service User's browser displayed the www.grubygarage.com.pl website, even if the Service User does not have a profile with the respective service provider or is not logged in. This information (including the Service User's IP address) is transmitted by the browser directly to the respective service provider's server (some servers are located in the USA) and stored there.
3. If the Service User logs in to one of the above-mentioned social networking sites, the service provider can directly associate the visit to the www.grubygarage.com.pl website with the Service User's profile on the respective social networking site.
4. If the Service User uses a plugin, e.g., by clicking the "Like" button or the "Share" button, the respective information will also be transmitted directly to the service provider's server and stored there.
5. The purpose and scope of data collection and its further processing and use by service providers, as well as the possibility of contact and the Service User's rights in this respect, and the possibility of making settings to protect the Service User's privacy, are described in the privacy policies of the service providers:
   • https://www.facebook.com/policy.php
   • https://help.instagram.com/519522125107875?helpref=page_content
   • https://policies.google.com/privacy?hl=en.
6. If the Service User does not want social networking sites to assign data collected during visits to the www.grubygarage.com.pl website directly to their profile on the respective site, they must log out of the respective site before visiting www.grubygarage.com.pl. The Service User can also completely prevent the loading of plugins on the website by using appropriate browser extensions, such as script blockers like "NoScript."
7. The Controller uses remarketing tools such as Google Ads. Their use involves cookies from Google LLC related to the Google Ads service. Within the cookie management mechanism, the Service User can decide whether the Service Provider may use Google Ads (administrator of external cookies: Google LLC, based in the USA) concerning them.

§ 7 E-RECEIPTS

1. The Seller may provide the entity responsible for IT services related to the issuance, maintenance, and access to e-receipts with the Customer's phone number or email address, which may be processed for:
   1. Verifying whether the phone number or email address has been registered in the IT system of the service provider. In the case of positive verification, the Customer may be granted access to e-receipts and additional information derived from the issuance process.
   2. Sending SMS or other notifications to Customers confirming the issuance of an e-receipt into the IT system of the service provider.

§ 8 FINAL PROVISIONS

1. The Controller applies technical and organizational measures to ensure the protection of processed personal data, appropriate to the threats and category of data being protected. In particular, the Controller secures the data against unauthorized access, acquisition by unauthorized persons, processing in violation of applicable regulations, and alteration, loss, damage, or destruction.
2. The Controller provides appropriate technical measures to prevent the acquisition and modification of personal data sent electronically by unauthorized persons.
3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and other applicable Polish law provisions shall apply accordingly.