This document sets out the terms and conditions for the processing of personal data (hereinafter also referred to as 'data') and cookies in the area of the online shop. panjo.pl, conducted via a website provided at URL: panjo.plhereinafter referred to as the "Shop".

TABLE OF CONTENTS

• 1. HOW TO CONTACT THE DATA CONTROLLER.... 1
• 2. ON WHAT BASIS WE PROCESS YOUR DATA. 1
• 3. INFORMATION ON THE PROCESSING OF DATA FOR THE CONCLUSION AND PERFORMANCE OF CONTRACTS, POSSIBLE REDRESS AND DEFENCE 1
• 4. INFORMATION ON PROCESSING FOR DIRECT MARKETING AND PROFILING.... 2
• 5. INFORMATION ON DATA PROCESSING FOR SECURITY PURPOSES.... 2
• 6. INFORMATION ON DATA PROCESSING FOR NOTIFICATION OF GOODS. 3
• 7. INFORMATION ON RECIPIENTS OF DATA... 3
• 8. INFORMATION ON TRANSFERS OF DATA TO THIRD COUNTRIES.... 3
• 9. THE ABSOLUTE RIGHTS OF DATA SUBJECTS. 3
• 10. THE RELATIVE RIGHTS OF DATA SUBJECTS. 4
• 11. COOKIES - INTRODUCTION. 5
• 12. DATA CONTROLLER COOKIES. 5
• 13. THIRD-PARTY COOKIES. 5
• 14. CONSENT TO THE USE AND MANAGEMENT OF COOKIES 6
• 15. CACHE ... 6
• 16. PIXEL TAGS. 6
• 17. LINKS TO OTHER WEBSITES OR SOFTWARE.... 6
• 18. CHANGES TO THE PRIVACY AND COOKIES POLICY. 6

§1. HOW TO CONTACT THE DATA CONTROLLER

The controller of the personal data processed within the Shop is

KOZIOŁKOWA MYDLARNIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Kołątajew 25, 63-410, registered in the Central Register and Information on Business Activity kept by the Minister of Entrepreneurship and Technology, under NIP number 6342661860 and REGON number 240770255.

The Data Controller can be contacted at telephone number: +48 505 136 443 and by e-mail address: sklep@panjo.pl

§2. ON WHAT BASIS DO WE PROCESS YOUR DATA

When collecting personal data, we always inform you of the legal basis for its processing. This derives from the provisions of the RODO (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data on the free movement of such data and repealing Directive 95/46/EC - General Data Protection Regulation). When we inform you about:

• 6(1)(a) RODO - this means that we process personal data on the basis of consent received,
• 6(1)(b) RODO - this means that we process personal data because it is necessary for the performance of a contract or for taking action prior to entering into a contract, at your request,
• 6(1)(c) RODO - this means that we process personal data in order to comply with a legal obligation,
• 6(1)(f) RODO - this means that we process personal data in order to pursue legitimate interests.

§3. INFORMATION ON DATA PROCESSING FOR THE CONCLUSION AND PERFORMANCE OF CONTRACTS, POSSIBLE REDRESS AND DEFENCE OF CLAIMS

1. We may process personal data necessary for the performance of the contract concluded with you. However, even before the conclusion of the contract, we may process the personal data necessary to take action on your request. The processing of this data is based on Article 6(1)(b) of the DPA.
2. In the case of a contract for the provision of paid services, we may process your data in order to fulfil our accounting and tax obligations. The processing of this data takes place on the basis of Article 6(1)(c) of the DPA.
3. During and after the performance of the contract, we process the personal data of a party to the contract for the purpose of possible processing of claims and their assertion. Our legitimate interest is, for example, to be able to respond to a possible complaint, which we are obliged to do on the basis of separate civil law provisions. In this case, we will process personal data based on the legitimate interest of defending against or asserting possible claims. The processing of this data takes place on the basis of Article 6(1)(f) of the DPA.
4. We will store this data for the period necessary to fulfil the designated purposes, but no later than until the statute of limitations for claims arising from separate legal provisions.
5. You have the right of access to your data, rectification, erasure, restriction of processing, the right to data portability, and the right to lodge a complaint with a supervisory authority. When your data is processed for the purpose set out in point 3, you also have the right to object to the processing.
6. The provision of this data is voluntary, but failure to do so will prevent the conclusion of the contract or its execution.
7. The recipients of this data are our web host, our email service provider, our IT service provider, our telecommunications service provider, our accounting service provider, our banking and electronic payment service provider and other service providers we use for the designated purpose.

§4. INFORMATION ON DATA PROCESSING FOR DIRECT MARKETING AND PROFILING

1. We may process your personal data for direct marketing purposes. This happens, for example, when we respond to your message with details of our offer.
2. For the purpose of direct marketing, we may use profiling, which consists of an automated decision to display advertisements to you. This decision is made on the basis of the actions you take on the Store, and in particular on the basis of the contracts you enter into or the pages you view. In practice, profiling supports the usability of our Store by allowing us to present you with content that may potentially be of interest to you.
3. The processing of this data takes place on the basis of Article 6(1)(f) of the DPA.
4. We will keep your data until the time necessary for the purpose of performance.
5. You have the right of access to your data, rectification, erasure, restriction of processing, the right to data portability, the right to object to data processing, and the right to lodge a complaint with a supervisory authority.
6. You have the right not to be subject to profiling unless you have given your consent. However, in that case, the basis for the processing of your data will be the consent you have given (Article 6(1)(a) RODO), which you can withdraw at any time. In that case, too, your data will be processed until the consent given is withdrawn.
7. The provision of this data is voluntary and failure to provide this data will prevent direct marketing activities.
8. The recipients of this data are our web host, IT service provider, email service provider, telecommunications service provider, advertising service provider, and the provider of the communicator available on the Shop website.

§5. INFORMATION ON DATA PROCESSING FOR SECURITY PURPOSES

1. From the moment you launch our website, we process data such as:
   • the public IP address of the device from which the request came,
   • browser type and language,
   • date and time of enquiry,
   • number of bytes sent by the server,
   • the URL of the page previously visited, in the event that a visit was made via this link,
   • information about errors that occurred in the execution of the request.
2. Our legitimate interest in this processing is to keep server event logs and protect the Store from potential hacking attacks and other abuse. Including, the ability to determine the IP address of a person performing an unauthorised activity in the Shop area, such as attempting to breach security, or publishing prohibited content, or attempting unauthorised activities using our servers.
3. The processing of this data takes place on the basis of Article 6(1)(f) of the DPA.
4. We will store this data for the period necessary to fulfil the designated purposes, but no later than until the statute of limitations for claims arising from separate legal provisions.
5. You have the right to access, rectify, erase, restrict the processing of your data, object to its processing, as well as the right to lodge a complaint with a supervisory authority.
6. The provision of this data is a condition of using the Shop. Failure to provide this data will make it impossible to use the Shop.
7. The recipient of this data is our web host, IT service provider and telecommunications provider.

§6. INFORMATION ON DATA PROCESSING FOR NOTIFICATION OF GOODS

1. The shop has the functionality of sending a notification of the selected goods to the e-mail address entered by the user.
2. Our legitimate interest in this processing is the fulfilment of the user's request and the subsequent safeguarding of the Shop against potential abuse.
3. The processing of this data takes place on the basis of Article 6(1)(f) of the DPA.
4. We will store this data for the period necessary to fulfil the designated purposes, but no later than until the statute of limitations for claims arising from separate legal provisions.
5. The data subject has the right to access, rectification, erasure, restriction of processing, to object to the processing of his/her data, as well as the right to lodge a complaint with a supervisory authority.
6. The provision of this data is a prerequisite for sending the notification. Failure to provide this data will prevent this action.
7. The recipient of this data is our web host and IT service provider.

§7. INFORMATION ON DATA RECIPIENTS

We use external services when processing your personal data. Therefore, the recipients of your personal data may be third parties. When collecting personal data, we always inform you about these recipients, but for the primacy of the readability of the communication, we do so briefly. Therefore, we hereby clarify that when we inform you of particular categories of recipients, these are the following:

• IT service provider: Craftweb Dawid Kawalec.
• Hosting provider: PERSKIMEDIA
• Email service provider: PERSKIMEDIA
• Facebook messenger provider.
• Telecommunications service provider :
• Advertising service provider: Craftweb Dawid Kawalec, Facebook, Inc., Google LLC.
• Accounting service provider:
• Banking service provider:
• Electronic payment service provider: PayU, stripe

§8. INFORMATION ON TRANSFERS OF DATA TO THIRD COUNTRIES

1. As we use third-party providers, your personal data may be transferred outside the zone of the European Economic Area, namely to the country: United States of America (USA).
2. The European Commission has found that some countries outside the European Economic Area (EEA) adequately protect personal data.
3. As the country to which we transfer personal data is not recognised as a secure country, the transfer of data is based on a contract containing standard data protection clauses adopted by the European Commission.

§9. ABSOLUTE RIGHTS OF PERSONS WHOSE DATA ARE PROCESSED

When we write about the rights relating to the processing of your personal data, we refer to the rights described below. The possibility of exercising the rights below is independent of the legal basis for the processing of your personal data.

Right of access to data

You have the right to obtain confirmation from us as to whether we are processing personal data relating to you. If we are, you have the right to obtain access to that data, as well as to receive additional information about:

• processing purposes,
• categories of data concerned,
• the recipients or categories of recipients to whom the data have been or will be disclosed, in particular recipients in third countries or international organisations,
• where possible, the intended period of data retention and, where this is not possible, the criteria for determining that period,
• the right to request us to rectify, erase or restrict the processing of your data, to object to such processing, and the right to lodge a complaint with a supervisory authority,
• the source of the data, if your data was not collected from you,
• automated decision-making, including profiling, and the modalities of such decision-making, as well as the significance and foreseeable consequences of such processing for you.

Upon receipt of such a request, we are obliged to provide a copy of the personal data being processed. If such a request is received electronically and unless we receive another objection, we will also provide the information electronically.

Right of rectification

You have the right to request that we immediately rectify personal data concerning you that is inaccurate. Taking into account the purposes of the processing, you have the right to request the completion of incomplete personal data, including by providing an additional statement.

Right to erasure (to be forgotten)

You have the right to request that we immediately delete personal data concerning you. We are then obliged to delete your personal data without undue delay if one of the following circumstances applies:

• you have withdrawn your consent to process your personal data and we have no other basis for processing it,
• you have raised an effective objection to the processing of data concerning you,
• Your personal data was processed unlawfully,
• Your personal data must be deleted in order to comply with a legal obligation,
• Your data has been collected in connection with the offering of information society services.

Right to restrict processing

You have the right to request us to restrict processing in the following cases:

• where you question the accuracy of the data, for a period of time to allow us to check the accuracy of the data,
• the processing is unlawful and you object to the erasure of the data, requesting instead that its use be restricted,
• we no longer need your personal data for the purposes of processing, but you need them to establish, assert or defend your claims,
• you have objected to the processing of your data - until it is determined whether the legitimate grounds on our side override the grounds for your objection.

Automated decisions, including profiling

You have the right not to be subject to a decision that is based solely on automated processing, including profiling, and produces legal effects on you or similarly significantly affects you.

The law does not apply if this decision:

• is necessary for the conclusion or performance of a contract between you and us,
• is allowed by Union law or the law of the Republic of Poland and which provides for appropriate measures to protect your rights, freedoms and legitimate interests, or
• is based on your explicit consent.

Right of action

You have the right to lodge a complaint in relation to the processing of your personal data, to the supervisory authority: President of the Office for the Protection of Personal Data, ul. Stawki 2, 00-193 Warsaw, tel. 22 531 03 00, fax. 22 531 03 01, e-mail: kancelaria@uodo.gov.pl.

§10. RELATIVE RIGHTS OF PERSONS WHOSE DATA ARE PROCESSED

When we write about the rights related to the processing of your personal data, we refer to the rights described below. The possibility of exercising them depends in each case on the legal basis for the processing of your personal data.

Right to withdraw consent to processing

Where we process your personal data on the basis of your consent to do so, you have the right to withdraw your consent at any time. Naturally, the withdrawal of the consent given does not affect the lawfulness of the previous processing of your personal data.

Right to data portability

You have the right to receive the personal data you have provided to us, in a structured and commonly used machine-readable format. You also have the right to send this personal data to another controller without hindrance on our part if the processing takes place:

• on the basis of consent or on the basis of a contract, and
• in an automated manner.

When exercising your right to data portability, you have the right to request that we send your personal data directly to another controller, insofar as this is technically possible. This right must not adversely affect the rights and freedoms of others.

Right to object

Where we process your personal data on the basis of Article 6(1)(f) of the RODO, you have the right to object to the processing of that data on grounds relating to your particular situation.

We are then no longer allowed to process this personal data unless we can demonstrate the existence:

• valid, legitimate grounds for the processing, such grounds being overridden by the interests, rights and freedoms of your person, or
• grounds for the establishment, assertion or defence of claims.

Also, if you object to the processing of your personal data for direct marketing purposes, then we will not be able to process it for such purposes.

§11. COOKIES - INTRODUCTION

The Shop website uses cookies. These are commonly used, small files containing a string of characters which are sent to and stored on the end device (e.g. computer, laptop, tablet, smartphone) used when visiting the Shop. This information is sent to the memory of the browser used, which sends it back the next time you visit the website. We can categorise cookies according to three methods of division.

In terms of the purposes for which cookies are used, we distinguish between three categories:

• Necessary files - these files enable the proper functioning of the Store and its functionalities, e.g. authentication or security cookies. Without them being stored on your device, the use of the Shop will be impossible.
• Functional files - files which make it possible to remember your selected settings and adjust the Shop to your needs and preferences, e.g. with respect to the selected language, font size, appearance of the website. They allow us to improve the functionality and efficiency of the Shop. Without storing them on your device, the use of certain Shop functionalities will be limited.
• Business cookies - this category includes, for example, advertising cookies. They make it possible to adapt the advertisements displayed on or off the Shop to your preferences. Without them being stored on your device, the use of some of the Store's functionalities may be limited.

In terms of their duration of validity, we distinguish between two categories of cookies:

• session files - existing until the end of a given session,
• permanent files - existing after the session has been completed.

In terms of differentiating the entity administering the cookies, we distinguish between:

• our cookies,
• third-party cookies.

§12. DATA CONTROLLER COOKIES

The cookies we administer allow:

• access authentication,
• maintaining the session after logging in,
• securing the Shop against hacking attacks,
• "remembering" by the browser the content of the fields of forms that are completed (optional),
• "remembering" by the browser of items added to the basket,
• adapting the content of the Shop's websites to your preferences.

This makes using the Shop's functionality easier and more enjoyable.

§13.   THIRD-PARTY COOKIES

We use cookies administered by Google Inc. 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States as part of the services:

• Google Ads - these allow you to run and evaluate the quality of advertising campaigns, implemented using the Google Ads service,
• Google Analytics - these allow you to assess the quality of your advertising campaigns, carried out using the Google Ads service, as well as to study user behaviour and traffic and to compile traffic statistics,
• Google Maps - these allow us to store information about you that enables you to use the map functionality available through the Google Maps service. Google Inc. may track your location,
• YouTube - these allow us to store information about you to enable the functionality of the YouTube service. Google Inc. may track your video playback.

The data collected by Google Inc are anonymous and aggregated. In particular, they do not contain identifying characteristics (understood as personal data) of users of the Shop. When using the aforementioned services, we collect such data as the sources of acquisition of users visiting the Shop, as well as their behaviour on the Shop website, information on the devices and browsers they use, IP address, domain, demographic data (age, gender), interests and geographical data.

We use cookies used by Facebook Inc. 1 Hacker Way, Menlo Park, CA 94025, United States. These cookies may be used to link your external Facebook social media account with your Shop account (insofar as we provide this functionality and insofar as you use this account. These cookies may also be used to process on Facebook your activities performed using the "Share" or "Like" buttons. The processing of these activities may be public.

The use of third-party cookies is subject to the privacy and cookie policies of these third parties.

§14. CONSENT TO THE USE AND MANAGEMENT OF COOKIES

Consent to the processing of cookies is voluntary and can be withdrawn at any time. Please note, however, that a lack of consent to the use of certain cookies may result in restrictions on the use of the Shop and its functionality or even prevent such use.

You can give your consent to the processing of cookies:

• by means of the software settings installed on the telecommunications terminal equipment used by the user,
• by using the button containing a declaration of consent to the processing of cookies or confirming that you have read its terms and conditions.

In most cases, your browser settings will allow cookies and other information to be placed on your terminal device by default. If you do not agree to the storing of these files, it is necessary to change your browser settings accordingly. It is possible to disable their storage for all connections from a particular browser or for a specific website, or to delete them. How you manage the files depends on the software you are using.

You can find the current file management policy in the settings of the browser you are using and also here: https://www.e-regulaminy.pl/biuletyn/polityka-cookies-obsluga/.

§15. CACHE

When you use the Shop website, we may make automatic use of the cache memory installed on your device. Within the local memory, it is possible to store data inter-sessionally, i.e. between successive visits to the Shop website. The purpose of using the cache is to speed up the use of the Shop by eliminating the situation where the same data would be repeatedly downloaded from the Shop, thereby overloading your internet connection. The cache may also store data such as your login password.

§16. PIXEL TAGS

We use the pixel tag technology used by Facebook Inc. 1 Hacker Way, Menlo Park, CA 94025, USA pixel tag technology. These are elements published in digital content and enable the recording of information, e.g. about activities carried out on the website, as well as the evaluation of the effectiveness of advertisements. Management of the Facebook Inc. pixel tag is possible via Facebook, in its user panel. For more information on this, please click here: https://www.e-regulaminy.pl/biuletyn/polityki-prywatnosci-i-plikow-cookies/.

§17. LINKS TO OTHER WEBSITES OR SOFTWARE

The shop may contain links to other websites or software. We are not responsible for the privacy and cookie policy of these websites or software. We recommend that you read the privacy and cookie policies of these websites or software when you access them or before installing them.

§18. CHANGES TO THE PRIVACY AND COOKIES POLICY

1. The privacy and cookies policy comes into effect on the date of its publication on the Shop's website.
2. The Privacy and Cookies Policy is amended by publishing its new content on the Shop's website.
3. We will publish information about the change to the Privacy and Cookies Policy in the area of the Shop website prior to the effective date of its new wording.
4. The vendor shall send electronic notification of a change to its Privacy and Cookies Policy when the parties are bound by a contract of indefinite duration.