PRIVACY POLICY

§1 Data Administration

1. The administrator of personal data is Taras Lisniewski, conducting business under the name Taras Lisniewski, Wardzyńskich 21, 54-530 Wrocław. The business is registered in the Central Register and Information on Business Activity under the NIP number: 7543053665, REGON 362894913.
2. Contact with the person overseeing the processing of personal data in the organization can be made electronically via e-mail: sklep@endurodka.com, in writing to the Administrator’s address or by phone at 726492581.
3. This Privacy Policy contains the principles regarding the processing of personal data by the Administrator on the Website, including the grounds, purposes, and scope of personal data processing as well as the rights of data subjects.
4. Personal data is processed by the Administrator in accordance with applicable law, particularly with the European Parliament and Council Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
5. User rights are not absolute and do not apply to all processing activities of personal data.

§2 Definitions

1. Administrator – Taras Lisniewski, conducting business under the name Taras Lisniewski, Wardzyńskich 21, 54-530 Wrocław. The business is registered in the Central Register and Information on Business Activity under the NIP number: 7543053665, REGON 362894913.
2. Personal data – information about a natural person who is identified or can be identified by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, internet identifier, and information collected via cookies or other similar technologies.
3. Policy – this Privacy Policy.
4. GDPR / General Data Protection Regulation – Regulation of the European Parliament and Council (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
5. Website – the website operated by the Administrator under the address polyforma.pl.
6. User – any natural person visiting the Website or using one or more services or functionalities described in the Policy.

§3 Security

1. The Administrator has implemented appropriate technical and organizational measures to ensure the security of personal data processing and is responsible for ensuring that the collected data is:
   • processed lawfully;
   • collected for specified, legitimate purposes and not processed further in a way incompatible with those purposes;
   • accurate and relevant to the purposes for which it is processed;
   • stored in a form which allows identification of data subjects for no longer than necessary for the purposes of processing;
   • processed in a manner ensuring appropriate security of personal data, including protection against unauthorized or unlawful processing, and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

§4 Purposes and Legal Grounds for Processing Data

1. Based on Article 6, paragraph 1, letter a) of the GDPR (consent), personal data will be processed for the following purposes:
   • marketing of products and services of the Administrator and the Administrator’s partners,
   • sending the Newsletter,
   • moderating content on the Website,
   • storing data in cookies, as well as using cookies for the proper functioning of the Website,
   • issuing product or service reviews,
   • participating in webinars or online training,
   • contacting via distance communication tools, particularly: telephone, email, or applications.
2. Based on Article 6, paragraph 1, letter b) of the GDPR (contract performance), personal data will be processed for the following purposes:
   • Performing the sales agreement or service agreement or taking actions on the request of the data subject before concluding or after concluding the indicated agreement, in particular: the right to warranty, processing complaints, or withdrawal from the distance agreement.
3. Based on Article 6, paragraph 1, letter c) of the GDPR (legal obligation of the Administrator), personal data will be processed for the following purposes:
   • Issuing and storing invoices, receipts, or fulfilling other obligations arising from tax and accounting regulations (archival obligation for accounting documents).
   • Creating registers and other documentation required by the GDPR regulations.
4. Based on Article 6, paragraph 1, letter f) of the GDPR (legitimate interest of the Administrator), personal data will be processed for the following purposes:
   • Proper execution of the contract, processed during the contract’s execution and rights arising from it, e.g., the right to complaints. Providing data is voluntary but necessary.
   • Ensuring the security of the Website, managing the Website, and ensuring its proper functioning.
   • Conducting statistics and analyzing traffic on the Website.
   • Direct marketing.
   • Determining claims raised by or against the Administrator.
   • Contact with the User.
   • Service of the Website polyforma.pl.
   • Managing accounts on Facebook, YouTube, Instagram, Twitter, LinkedIn, TikTok and interacting with Users on the mentioned portals.
   • Data may be shared with recipients or categories of recipients such as courier companies, postal operators, law offices, accounting firms, IT service providers, and others.

§5 Profiling

1. The GDPR imposes an obligation on the Administrator to inform about automated decision-making, including profiling, as referred to in Article 22, paragraphs 1 and 4 of the GDPR, and at least in these cases, provide significant information on the principles of making such decisions, as well as the significance and anticipated consequences of such processing for the person concerned. In light of this, the Administrator provides information about possible profiling in this privacy policy.
2. The Administrator may use profiling on the Website for marketing purposes using personal data provided by the User.
3. The person concerned has the right not to be subject to a decision based solely on automated processing, including profiling, that significantly affects them.

§6 Data Processing Period

1. The period for processing data by the Administrator depends on the type of service provided and the purpose of processing. In general, data is processed for the duration of the service, until the consent is withdrawn or a valid objection to processing data is raised in cases where the legal basis for processing is the legitimate interest of the Administrator.
2. The period for processing data may be extended if processing is necessary to determine and pursue possible claims or defend against claims, and after that, only if required by law. After the processing period ends, the data will be irreversibly deleted or anonymized.

§7 User Rights

1. The User has the following rights regarding their personal data:
   • access to their personal data,
   • rectification of personal data at any time,
   • erasure of personal data at any time,
   • receiving a copy of their data,
   • restriction of personal data processing,
   • objection to personal data processing,
   • data portability,
   • withdrawal of consent; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal,
   • objection to processing personal data based on the legitimate interest of the Administrator for marketing purposes, direct marketing, and purposes other than marketing,
   • to file a complaint with a supervisory authority.

§8 Recipients of Personal Data

1. The Administrator transfers personal data to external entities for the proper operation of the Website, particularly: hosting companies, courier firms, postal operators, legal and collection offices, payment operators, insurance companies, banks, marketing firms, price comparison websites.
2. The Administrator reserves the right to disclose personal data when required by law, including the obligation to provide information to appropriate administrative bodies or law enforcement agencies.

§9 Transfer of Personal Data Outside the EEA

1. The level of protection of personal data outside the European Economic Area (EEA) differs from that guaranteed by European law. Therefore, the Administrator transfers personal data outside the EEA only when necessary, particularly when using the services of an international entity. However, appropriate protection is always ensured, primarily through:
   • cooperation with entities processing personal data in countries where the European Commission has issued a relevant decision regarding the adequacy of personal data protection;
   • using binding corporate rules approved by international certification standards and the relevant supervisory authority;
   • using standard contractual clauses issued by the European Commission based on Article 46 of the GDPR.
   • Personal data may also be transferred outside the EEA based on the User’s consent. The User will be informed of this beforehand.

§10 Security of Personal Data

1. The Administrator continuously conducts risk analysis to ensure that personal data is processed securely. Through its actions, it ensures that only authorized individuals have access to the data and only to the extent necessary for the tasks they perform.
2. The Administrator is obliged to take all actions allowed by law to ensure that all operations on personal data are recorded and carried out solely by an authorized entity.
3. The Administrator is also obliged to ensure that other entities cooperating with the Administrator provide guarantees of applying appropriate security measures whenever processing personal data on the Administrator’s behalf.

§11 Changes to the Privacy Policy

1. The Policy is regularly reviewed and updated.
2. The current version of the Policy was adopted and is effective from 2024-12-15.