§1 Personal data controller

1. The controller of personal data within the meaning of Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016. on the protection of natural persons in relation to the processing of personal data and on the free flow of such data, and repealing Directive 95/46/EC (RODO) is MEBLOGRÓD Spółka z ograniczoną odpowiedzialnością with its registered office in Krupin at Krupin 38, 19-335 Prostki, NIP: 1133036782, REGON: 389385961, entered in the Register of Entrepreneurs of the National Court Register under the KRS number: 0000909607, registration court: District Court for the Capital City of Warsaw in Warsaw, XIV Economic Division of the National Court Register, share capital: PLN 5,000.
2. Email address of the data controller: zzmeblogrod@gmail.com.
3. The controller shall, in accordance with Article 32(1) of the DPA, respect the principle of personal data protection and shall take appropriate technical and organisational measures to prevent accidental or unlawful destruction, loss, modification, unauthorised disclosure of or unauthorised access to personal data processed in connection with its activities.
4. The provision of personal data by the customer is voluntary, but necessary in order to conclude a contract with the data controller.
5. The controller processes personal data to the extent necessary for the performance of a contract or the provision of services to the data subject.

§2 Purpose and grounds for processing personal data

The controller processes personal data for the following purposes:

1. preparation of a commercial offer in response to a customer's interest, which is a legitimate interest of the data controller (Article 6(1)(f) RODO);
2. the conclusion and performance of sales contracts with customers, on the basis of the contract concluded (Article 6(1)(b) RODO);
3. the provision of services by electronic means through the Online Shop, on the basis of the contract concluded (Article 6(1)(b) RODO);
4. the handling of the complaints process, on the basis of an obligation incumbent on the controller in connection with the applicable legislation (Article 6(1)(c) RODO);
5. accounting related to the issuing and receipt of billing documents, on the basis of tax law (Article 6(1)(c) of the DPA);
6. archiving of data for possible establishment, investigation or defence against claims or the need to prove facts, which is a legitimate interest of the data controller (Article 6(1)(f) RODO);
7. contact by telephone or email, in particular in response to enquiries made to the controller, which is a legitimate interest of the controller (Article 6(1)(f) of the DPA);
8. to send technical information regarding the functioning of the Online Shop and the services used by the customer, which is a legitimate interest of the data controller (Article 6(1)(f) RODO);
9. marketing, which is its legitimate interest (Art. 6(1)(f) RODO) or is based on previously granted consent (Art. 6(1)(a) RODO).

§3 Recipients of data. Transfer of data to third countries

1. Recipients of personal data processed by the controller may be entities cooperating with the controller when this is necessary for the performance of a contract concluded with the data subject.
2. The recipients of personal data processed by the controller may also be subcontractors - entities whose services are used by the controller for data processing, e.g. accounting offices, law firms, IT service providers (including hosting services).
3. The controller may be obliged to make personal data available on the basis of applicable laws, in particular to make personal data available to authorised state authorities or institutions.
4. Personal data in connection with the controller's use of website analytics and tracking tools may be transferred to an entity based outside the European Economic Area, such as Google LLC. As an appropriate data protection measure, the controller has agreed to standard contractual clauses in accordance with Article 46 RODO with the providers of these services. More information is available here: https://commission.europa.eu/law/law-topic/data-protection_en.

§4 Period of retention of personal data

1. The controller shall keep the personal data for the duration of the contract concluded with the data subject and after its termination for the purposes of asserting claims related to the contract, performing the obligations arising from the applicable legislation, but for a period not exceeding the period of limitation under the provisions of the Civil Code.
2. The data controller shall keep the personal data contained in the settlement documents for the period indicated by tax law.
3. The controller shall retain personal data processed for marketing purposes for a period of 10 years, but no longer than until you withdraw your consent to the processing or object to the processing.
4. The controller shall keep personal data for purposes other than those indicated in paragraphs 1 to 3 for a period of one year, unless consent to the processing has been previously withdrawn and the processing cannot be continued on any other basis than the consent of the data subject.

§5 Rights of the data subject

1. Every data subject has the right:
2. access - to obtain confirmation from the controller as to whether or not his or her personal data are being processed. If data about a person are processed, he or she is entitled to access them and to be informed of the following: the purposes of the processing, the categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, the duration of data retention or the criteria for determining it, the data subject's right to request rectification, erasure or restriction of the processing of personal data and to object to such processing (Article 15 RODO);
3. to receive a copy of the data - obtain a copy of the data undergoing processing, with the first copy being free of charge and for subsequent copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) RODO);
4. to be corrected - request the rectification of personal data concerning him/her which is inaccurate or the completion of incomplete data (Article 16 RODO);
5. to delete data - request the erasure of her personal data where the controller no longer has a legal basis for the processing or the data are no longer necessary for the purposes of the processing (Article 17 RODO);
6. to restrict processing - request the restriction of the processing of personal data (Article 18 RODO) when:

- the data subject questions the accuracy of the personal data, for a period allowing the controller to verify the accuracy of the data,

- the processing is unlawful and the data subject objects to the erasure by requesting a restriction of use,

- the controller no longer needs the data, but they are needed by the data subject to establish, assert or defend a claim,

- the data subject has objected to the processing - until it is established whether the legitimate grounds on the part of the controller override the grounds of the data subject's objection;

1. to data portability - to receive in a structured, commonly used machine-readable format the personal data concerning him or her which he or she has provided to the controller, and to request that these data be sent to another controller if the data are processed on the basis of the data subject's consent or a contract with him or her and if the data are processed by automated means (Article 20 RODO);
2. to the objection - object to the processing of his or her personal data for the legitimate purposes of the controller on grounds relating to his or her particular situation, including profiling. The controller shall then assess the existence of valid legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of claims. If, according to the assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to cease processing for these purposes (Article 21 RODO).
3. In order to exercise the aforementioned rights, the data subject should contact, using the contact details provided, the controller and inform him/her of which right and to what extent he/she wishes to exercise it.
4. The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection in Warsaw.

§6 Profiling

1. Personal data obtained by the controller may be processed by automated means - including profiling. The profiling of personal data carried out by the controller consists of evaluating selected information about the data subject for the purpose of analysing and forecasting personal preferences and interests, in particular for the possibility of providing the data subject with a personalised offer.
2. The automated processing carried out by the controller shall not produce any legal effects for the data subject. The data subject may object to the automated processing of his or her data at any time.

§7 Google Analytics

1. The administrator uses Google Analytics, a web analytics service provided by Google Inc. based in the USA.
2. Google Analytics uses cookies to analyse your use of the website. The information generated by the cookie about your use of the website is transmitted to and stored on a Google server. At the request of the Administrator, Google will use this information to analyse your use of the website in order to compile reports on website activity and to provide other services relating to website and internet usage to the requesting party.
3. Data will not be used to identify any individual.
4. Users can prevent the storage of cookies through the appropriate settings of their browser; however, in this case they will not be able to use the full functionality of the website. In addition, users can prevent the collection by Google of the data generated by the cookie and relating to their use of the website (including their IP address) as well as the processing of this data by Google by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout?hl=pl.
5. You may object at any time to the collection and processing of data relating to your use of the Google website by downloading and installing a plug-in in your browser, which is available at the following address: https://tools.google.com/dlpage/gaoptout?hl=en.

§8 Social plug-ins

1. The administrator uses plug-ins directing to social networks on the website. The plug-ins in question are marked with the logo of the respective social network.
2. Data is only sent to the social networks if the user has actively clicked on the corresponding plug-in button. When the plug-in icon is pressed, the web browser will initiate a connection to the servers of the respective social network and the user will be redirected to the website of the external service provider, i.e. the owner of the respective social network, and the user's web browser will establish a direct connection to the servers of these social networks. The use of these functions may involve the use of external cookies. From the moment you click on the respective plug-in, your personal data is processed on the respective social network and the owner of the social network becomes the co-controllers of your personal data. The Administrator informs that from the moment the plug-in is actively clicked, the Administrator has no influence on the nature and scope of the personal data collected by the respective social network.
3. The data is transferred irrespective of whether the user has an account on the respective social network or is logged in. In the event that the user is logged in on the respective social media platform, the personal data collected will be directly attributed to the account (profile) used by the user.
4. For more information on the purpose and scope of the collection of personal data, including the terms of processing by the provider of the respective portal, please refer to the privacy policies of these providers.