1. GENERAL PROVISIONS

1.1. This Privacy Policy of the Store is informational in nature, which means that it is not a source of obligations for Users or Customers of the Online Store. The Privacy Policy contains, above all, the rules concerning the processing of personal data by the Controller in the Online Store, including the grounds, purposes and scope of processing of personal data and the rights of data subjects, as well as information on the use of cookies and analytical tools in the Online Store.

1.2. The controller of personal data is Prestigelab Sp. z o.o. with its registered office in Warsaw (04-831), ul. Wilgi 50, entered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw, 14th Commercial Division of the National Court Register, under KRS number: 0001166164, NIP: 9512452709; REGON: 369075532, e-mail address: sklep@unit4men.pl, hereinafter referred to as the "Controller" and being at the same time the service provider of the Online Store and the seller. In matters relating to personal data, the Controller may be contacted in writing at the above address or by e-mail at: sklep@unit4men.pl.

1.3. Personal data in the Online Store is processed by the Controller in accordance with applicable law, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation – "GDPR"), as well as with the Polish Act of 10 May 2018 on the protection of personal data.

1.4. Use of the Online Store, including making purchases, is voluntary. Likewise, the provision of personal data by a User or Customer using the Online Store is voluntary, subject to two exceptions: (1) conclusion of contracts with the Controller – failure to provide the personal data necessary to conclude and perform a Sales Contract or a contract for the provision of an Electronic Service with the Controller results in the inability to conclude that contract. The provision of personal data is in such a case a contractual requirement (legal basis: Article 6(1)(b) GDPR); (2) statutory obligations of the Controller – the provision of personal data is a statutory requirement arising from generally applicable law (e.g. processing of data for the purpose of keeping tax or accounting books), and failure to provide it will prevent the Controller from fulfilling those obligations (Article 6(1)(c) GDPR).

1.5. The Controller takes particular care to protect the interests of the data subjects, and in particular ensures that the data it collects is: (1) processed lawfully; (2) collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes; (3) accurate and adequate in relation to the purposes for which it is processed; (4) kept in a form permitting identification of data subjects for no longer than is necessary to achieve the purpose of processing; and (5) processed in a manner ensuring appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical or organisational measures.

1.6. Taking into account the nature, scope, context and purposes of processing and the risk to the rights and freedoms of natural persons, the Controller has implemented appropriate technical and organisational measures to ensure that processing is carried out in accordance with the GDPR and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Controller applies technical measures to prevent the acquisition and modification of personal data transmitted electronically by unauthorised persons.

1.7. Words and expressions used with a capital letter have the meaning given to them in the Terms & Conditions of this Online Store.

2. GROUNDS FOR PROCESSING DATA

2.1. The Controller is entitled to process personal data where – and to the extent that – at least one of the following conditions is met:

a) the data subject has given consent to the processing of their personal data for one or more specified purposes (Article 6(1)(a) GDPR);

b) processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR);

c) processing is necessary for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR); or

d) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child (Article 6(1)(f) GDPR).

2.2. Processing of personal data by the Controller requires in each case the existence of at least one of the grounds indicated in point 2.1. The specific grounds for the Controller's processing of personal data of Users and Customers are indicated in the next section of the Privacy Policy, in relation to the given purpose of processing.

3. PURPOSE, BASIS, PERIOD AND SCOPE OF DATA PROCESSING IN THE ONLINE STORE

3.1. In each case, the purpose, basis, period and scope as well as the recipients of personal data processed by the Controller result from the actions taken by a given User or Customer in the Online Store.

3.2. The Controller may process personal data in the Online Store for the following purposes, on the following bases, periods and scope:

a) performance of a Sales Contract or a contract for the provision of an electronic service, or taking steps at the data subject's request prior to entering into such contracts; maximum scope of data: name and surname, e-mail address, address details, payment details, bank account number for bank transfers, recipient's address details where not the Customer (legal basis: Article 6(1)(b) GDPR);

b) provision of services not requiring a contract, i.e. browsing the Online Store's websites and the Goods search engine; data on the User's activity in the Online Store, device session, operating system, browser, location and unique ID, and the User's IP address are processed (legal basis: Article 6(1)(f) GDPR);

c) statistics on the use of the functionalities available in the Online Store, facilitating use of the Online Store and ensuring its IT security (legal basis: Article 6(1)(f) GDPR);

d) establishment, pursuit and enforcement of claims and defence against claims; data provided when purchasing Goods and other data necessary to prove the existence of a claim are processed; data is stored until the limitation period for claims expires or the rights lapse (legal basis: Article 6(1)(f) GDPR);

e) handling complaints, processing return and withdrawal requests (including those submitted via the electronic return form), handling complaints, requests and queries from Customers and Users; data is stored for the period necessary to exercise rights arising from the lack of conformity of goods with the contract (legal basis: Article 6(1)(c) GDPR);

f) performance of accounting and tax obligations: name and surname, business address / registered office of the Entrepreneur, business name, NIP, e-mail address, bank account number; data is stored for 5 years counting from the end of the year following the financial year to which the data relates (legal basis: Article 6(1)(c) GDPR);

g) direct marketing; scope of data: name and surname, e-mail address, purchase history with the Controller; data is stored for the period of the Controller's legitimate interest, no longer than until an effective objection is raised (legal basis: Article 6(1)(f) GDPR);

h) marketing of the Controller's services and products: name and surname, e-mail address; data is stored until consent is withdrawn (legal basis: Article 6(1)(a) GDPR).

4. RECIPIENTS OF DATA IN THE ONLINE STORE

4.1. For the proper functioning of the Online Store, including the performance of Sales Contracts, it is necessary for the Controller to use the services of external entities (such as software and server providers, couriers, or payment service providers). The Controller uses only the services of processors that provide sufficient guarantees of implementing appropriate technical and organisational measures.

4.2. The transfer of data by the Controller does not take place in every case and not to all recipients indicated – the Controller transfers data only where it is necessary to achieve a given processing purpose and only to the extent necessary.

4.3. Personal data may be transferred to the following recipients or categories of recipients:

a) carriers / forwarders / courier brokers – the Controller shares data with the selected carrier, forwarder or intermediary carrying out shipments on the Controller's behalf, to the extent necessary to complete the delivery;

b) entities handling electronic or card payments – to the extent necessary to handle the payment made by the Customer;

c) providers of technical, IT and organisational solutions (in particular the provider of the store platform together with its returns and withdrawal handling system, e-mail and hosting providers, and providers of company-management software and technical support) – to the extent necessary to achieve a given processing purpose;

d) providers of marketing, accounting, legal and advisory services (in particular an accounting office, a law firm or a debt collection company) – to the extent necessary to achieve a given processing purpose.

4.4. As a rule, the Controller does not transfer personal data to third countries (outside the European Economic Area). An exception is the use of analytical and marketing tools of providers based in the USA (e.g. Google, Meta) – to that extent, data may be transferred to the USA on the basis of an adequacy decision of the European Commission (the EU–US Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission.

5. PROFILING IN THE ONLINE STORE

5.1. The GDPR imposes on the Controller an obligation to provide information on automated decision-making, including profiling, referred to in Article 22(1) and (4) GDPR. With this in mind, the Controller provides in this section information on possible profiling.

5.2. The Controller may use profiling in the Online Store for direct marketing purposes, but decisions taken on its basis do not concern the conclusion or refusal to conclude a Sales Contract, nor the possibility of using Electronic Services. The effect of profiling may be, for example, granting a discount, sending a discount code, reminding about an abandoned cart, or presenting a Product proposal matching the person's interests.

5.3. Profiling consists in the automated analysis or prediction of a person's behaviour on the Online Store's website (e.g. adding a Product to the cart, viewing a Product page, analysing purchase history). A condition of profiling is that the Controller holds the person's personal data.

5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal effects concerning them or similarly significantly affects them; for this purpose they may object to the Controller at the address indicated in point 1.2 of this Privacy Policy.

6. RIGHTS OF THE DATA SUBJECT

Right of access – the right to request a copy of the information held by Prestigelab concerning the data subject;

Right to rectification – the right to correct inaccurate or incomplete data held by Prestigelab;

Right to be forgotten – in certain circumstances a request may be made to delete data stored by Prestigelab, provided that its processing is not justified by the purpose of performing a contract or a legal obligation, and is carried out solely on the basis of consent;

Right to restriction of processing – where specified conditions are met;

Right to data portability – the right to receive, in a structured, commonly used and machine-readable format, the personal data provided to the Controller, and to request its transmission to another controller, where processing is based on consent or a contract and is carried out by automated means;

Right to object – the right to object to certain types of processing, such as direct marketing;

Right to withdraw consent – where processing is based on consent, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal;

Right to lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, telephone: 22 860 70 86.

7. COOKIES IN THE ONLINE STORE, OPERATIONAL DATA AND ANALYTICS

7.1. Cookies are small text files sent by the server and stored on the device of the person visiting the Online Store's website (e.g. on the hard drive of a computer or laptop, or on a smartphone's memory card).

7.2. The Controller may process data contained in Cookies for the following purposes:

a) remembering Products added to the cart in order to place an Order;

b) remembering data from completed Order Forms, surveys or login data;

c) adapting the content of the Online Store's website to the User's individual preferences and optimising the use of the website;

d) keeping anonymous statistics on how the website is used;

e) remarketing, i.e. studying the behaviour of visitors through anonymous analysis of their actions in order to create their profile and deliver advertisements tailored to their interests, including on other websites within the advertising networks of Google and Facebook/Instagram.

7.3. As a standard, most web browsers accept the storage of Cookies by default. Everyone can specify the conditions for the use of Cookies through their own browser settings, including partial restriction or complete disabling – which, however, may affect some functionalities of the Online Store.

7.4. Cookies other than those necessary for the proper functioning of the Online Store (in particular analytical and marketing cookies) are used only after the User has given consent via the consent window (cookie banner) displayed on the first visit to the Online Store, in which the User may accept all cookies, accept only the necessary ones, or customise their consents. Cookies necessary for the functioning of the Online Store are used on the basis of the Controller's legitimate interest and do not require consent. Consent may be changed or withdrawn at any time in the cookie settings in the Online Store or through the web browser settings.

7.5. The Controller may use in the Online Store the Google Analytics 4 (GA4) service provided by Google Ireland Limited / Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The service helps the Controller analyse traffic in the Online Store; the data collected is processed in an anonymised manner (operational data which does not allow identification of a person) to generate statistics. The Controller collects data such as the source and medium of acquiring visitors, their behaviour on the website, information about devices and browsers, IP address and domain, geographical and demographic data (age, gender) and interests. To the extent that the use of these services involves the transfer of data to the USA, the transfer takes place on the basis of the EU–US Data Privacy Framework or standard contractual clauses.

7.6. It is possible to easily block Google Analytics from receiving information about a person's activity on the website by installing the browser add-on available here: https://tools.google.com/dlpage/gaoptout?hl=pl.

8. FINAL PROVISIONS

The Online Store may contain links to other websites. The Controller recommends that, after going to other sites, you read the privacy policy established there. This Privacy Policy applies only to the Controller's Online Store.