1. General Provisions

The personal data controller, in accordance with Article 4(7) of the Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as "GDPR"), is referred to as the "administrator".

Personal data refers to any information related to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2. Sources and Categories of Processed Personal Data

The administrator processes personal data that you have provided or that the administrator has obtained during the course of fulfilling your order. This includes your identification and contact data, as well as data necessary for the execution of the contract.

3. Legal Basis and Purpose of Personal Data Processing

The legal basis for processing personal data is:

• the performance of the contract between you and the administrator in accordance with Article 6(1)(b) of the GDPR;
• your consent for direct marketing purposes (including sending commercial information and newsletters) in accordance with Article 6(1)(a) of the GDPR and Article 10(2) of the Act of 18 July 2002 on the provision of electronic services, if no orders for goods or services have been placed;

The purposes of processing personal data are:

• to execute your order and fulfill rights and obligations arising from the contract between you and the administrator. When placing an order, personal data necessary for successful order completion (e.g., name and contact details) are required. Providing this data is necessary to conclude and execute the contract. Without it, the administrator cannot conclude or execute the contract;
• to send commercial information and conduct other marketing activities;

The administrator does not make automated individual decisions as defined in Article 22 of the GDPR without your explicit consent.

4. Data Retention Period

The administrator stores personal data:

• for the period necessary to fulfill rights and obligations arising from the contract between you and the administrator and to pursue claims under these contracts (up to 10 years from the end of the contractual relationship);
• until the withdrawal of consent to data processing for marketing purposes, for a maximum of 10 years, if personal data is processed based on consent;

After the data retention period expires, the administrator will delete the personal data.

5. Your Rights

According to the GDPR, you have the following rights:

• the right to access your personal data in accordance with Article 15 of the GDPR;
• the right to rectify personal data in accordance with Article 16 of the GDPR, or alternatively, the right to restrict processing in accordance with Article 18 of the GDPR;
• the right to erase personal data in accordance with Article 17 of the GDPR;
• the right to object to processing in accordance with Article 21 of the GDPR;
• the right to data portability in accordance with Article 20 of the GDPR;
• the right to withdraw consent to data processing in written or electronic form to the address or email of the administrator provided in Section III of these terms;

6. Conditions for Securing Personal Data

The administrator declares that appropriate technical and organizational measures have been taken to secure personal data. These include securing data storage and personal data in paper form, especially by securing cloud storage with passwords. Only authorized persons have access to personal data.

7. Final Provisions

By sending an order via the online order form, you confirm that you have read and fully accept the terms of personal data protection.

The administrator reserves the right to change these terms. The new version of the personal data protection terms will be published on the website.