ONSEN® PRIVACY POLICY

1. Definitions

1.1. Privacy Policy - this document containing information related to the processing of personal data and the use of cookies and similar tracking technologies within the ONSEN® online store, operated in the domain https://www.onsen.eu/ by Onsen Sp. z o.o. with its registered office in Toruń at ul. Marii Skłodowskiej-Curie 71G, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000588698, holding REGON number 363084435 and NIP number 9562314576, hereinafter referred to as the Controller.

1.2 Personal data - information about an identified or identifiable natural person, identified by one or more specific factors determining their physical, physiological, genetic, mental, economic, cultural or social identity. Such data includes, among other things, the IP address of a device (the Internet Protocol address assigned to the User’s device), location data, a unique online identifier and information collected through cookies or similar technologies.

1.3 Website - the website operated by Onsen Sp. z o.o. in the domain https://www.onsen.eu/, available through web browsers. The Website includes the online store, i.e. the part of the Website through which Onsen Sp. z o.o. sells goods remotely, as well as other functionalities such as the blog or contact forms.

1.4 User - any natural person visiting the Website or using one or more services or functionalities described in the Privacy Policy.

1.5 Device - any electronic device (computer, tablet, smartphone or other device) through which the User accesses and uses the Website.

2. General information

2.1 Use of the Website

By using our Website, you provide us with data necessary to provide the offered services and information concerning your activity within the Website. As the controller of your personal data, we attach great importance to its security and protection. We ensure that our data processing methods comply with applicable law, including in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation) and the Act of 10 May 2018 on the protection of personal data. Our priority is to provide you with comprehensive information about the processing of your personal data and to provide appropriate tools that will allow you to exercise your rights.

2.2 Data updates

We make every effort to ensure that the personal data we process is lawful, reliable and always up to date. Therefore, we may periodically send you reminders about the need to update your information - using your e-mail address or by displaying an appropriate message on the Website.

2.3 Data protection

The Controller has implemented the necessary organizational and technical measures to ensure the protection of your personal data during its processing and storage, and in particular to prevent access by unauthorized persons. We guarantee that personal data is processed by us fairly and transparently, for specific, legally justified purposes, and stored no longer than necessary to achieve the purposes for which it was collected or to meet requirements imposed by law. We apply the principle of minimization - we process only such data and only to the extent that is necessary.

2.4 Server location

Personal data processed by the Controller is stored on servers located in Poland, operated by Home.pl S.A., with which the Controller or an entity related to it has concluded an appropriate data processing agreement, and the infrastructure meets the security requirements specified in the GDPR.

3. Contact with the Controller

3.1 Questions about data

If you have questions about how we process your personal data or if you wish to exercise your data protection rights, we encourage you to contact us directly. You can contact us in the following ways:

• by e-mail by sending a message to biuro@onsen.eu;
• using the contact form available in the Contact section;
• by sending correspondence to the Controller’s registered office address (Onsen Sp. z o.o., Marii Skłodowskiej-Curie 71G, 87-100 Toruń).

We will try to respond to your inquiries as soon as possible.

3.2 Data Protection Officer

The Controller has not appointed a Data Protection Officer and is not obliged to do so.

4. Obtaining data

4.1 Sources of data

We obtain personal data primarily directly from you - you provide it to us voluntarily by using the functionalities of our Website. The most common situations in which you provide us with your data are:

• placing orders in our Online Store (order form);
• creating a User account (registration form);
• subscribing to the newsletter (subscription form);
• contacting us through the contact form or other communication channels;
• using other Website functions, including adding reviews, participating in promotions and browsing blog posts.

In each of the above situations, we inform you which data is necessary to use a given functionality - we mark it as mandatory in the form. Providing data not marked as mandatory is voluntary.

5. Optional provision of data

5.1 Voluntary provision of data

Providing personal data is voluntary, although in some cases it may be necessary to use specific services or to conclude/perform a contract. This applies in particular when required by law or by the nature of the service - for example, fulfilling a shipment order requires providing a delivery address. Failure to provide specific data may prevent us from providing a given service. Each time, we inform you which data is necessary and which data you may provide optionally at your own discretion.

6. Use of the Website

6.1 Unregistered User

When you use our Website without registering and logging in (as an unregistered user), we process basic data concerning your activity, such as the IP address of your device and data collected through cookies and similar technologies (details in section 13). This data is processed for the purposes specified below.

6.1.1 Provision of electronic services (displaying the Website)

We use your data to provide you with access to the content and functionalities of the Website, which constitutes the performance of a contract for the provision of electronic services (legal basis: Article 6(1)(b) GDPR - necessity for the performance of a contract).

6.1.2 Analytical and statistical purposes

We analyze how Users use our Website - which subpages are visited most often, how Users navigate the website and which content attracts the greatest interest. These analyses allow us to improve the structure and content of the Website and adapt it to Users’ preferences. We base the processing of data for analytical purposes on the Controller’s legitimate interest (Article 6(1)(f) GDPR), which is to improve the quality of services and optimize the functionality of the Website.

6.1.3 Establishment, pursuit or defense of claims

If necessary, we may use the collected information to establish our rights, pursue claims or defend against possible claims, which also constitutes our legitimate interest (Article 6(1)(f) GDPR).

6.1.4 Marketing (behavioral advertising)

We use data concerning your activity (e.g. products visited, clicks, browsing history) for our own marketing purposes and for the marketing purposes of our trusted partners. In particular, this concerns displaying personalized advertisements tailored to your interests (so-called behavioral advertising). Data processing for this purpose takes place on the basis of our legitimate interest (Article 6(1)(f) GDPR), which is the marketing of our products and services, subject to the condition that, to the extent the use of cookies or tracking technologies is involved, this is done in accordance with the rules described in section 13 (Cookies), based on your consent to advertising cookies.

6.2 System logs

Your activity on the Website is recorded in system logs - a special internal register of IT events. Logs include, among other things, the time of the visit to the website, the request URL, server response time, information about the browser and operating system. Data from logs is used primarily for technical purposes (supervising server operation, detecting irregularities), administrative purposes, ensuring the security of the IT system (protection against attacks), as well as for analytical and statistical purposes. In all these cases, the legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR).

7. Registration and account service

7.1 Registered User

Persons registering a User account on our Website are asked to provide data necessary to create and operate the account (such as an e-mail address or first name and surname). Providing data marked as mandatory is a condition for creating an account - failure to provide it will prevent registration. Providing other information (additional data) is voluntary and depends on your discretion. It may serve to personalize the account or facilitate service - for example by saving an additional contact phone number. This data is processed for the purposes specified below.

7.1.1. Performance of the account maintenance contract

We use your basic data (mandatory data) to create an account and provide you with the account maintenance service, and to enable you to fully use the functionalities available to a registered user (legal basis: Article 6(1)(b) GDPR - performance of the contract for the provision of account services).

7.1.2 Additional data

If you voluntarily complete your profile with additional data (non-mandatory data), we process it on the basis of your consent expressed by providing it (Article 6(1)(a) GDPR). Remember that you may delete or modify such data at any time by editing your account settings.

7.1.3 Account-related analyses and statistics

We observe the activity of users who have accounts in order to understand how they use them - for example which functions are used most often. This allows us to improve our services, interface and account functionalities. The legal basis for these analyses is our legitimate interest (Article 6(1)(f) GDPR), consisting in improving products and adapting them to users’ needs.

7.1.4 Possible claims

As in the case of users who are not logged in, we may process data related to your account in order to establish or pursue our possible claims or defend against claims brought against us (Article 6(1)(f) GDPR - the Controller’s legitimate interest in protecting its rights).

7.1.5. Marketing of own services and third-party services

If you have an account, we may - within the limits of applicable law - use your contact data and observe certain elements of your activity in order to direct marketing content to you (notifications about promotions or offers tailored to your preferences). This applies both to the marketing of the Controller’s own products and to the products or services of cooperating entities (partner campaigns). Details of such marketing activities are described in section 12. Remember that you have the right to object to direct marketing at any time (details in section 16.1.7).

7.2 Login via Facebook

We may make registration and login easier by allowing you to use your Facebook social media profile. If you decide to create an account or log in via Facebook, our Website - with your explicit consent - will download basic information from your Facebook account necessary for registration/identification on our Website (usually this will be your first name, surname and e-mail address). Before the first connection with Facebook, you will be clearly informed what data will be transferred to us and asked to confirm that you wish to continue logging in. Continuing to log in means that you consent to the transfer to us of the indicated data from your profile. Facebook may remember that you used your account to log in to our Website and, during subsequent logins using this method, may not again display prompts regarding the scope of data - until you change the settings or withdraw the integration. Details about the processing of your data by Facebook can be found in Facebook’s privacy policy.

7.3 Login via Apple ID

We offer the possibility of logging in via Apple ID. When you choose this option, the Website will receive from your Apple account only the data necessary to create/operate an account in our Store (first name and surname and verified e-mail address, while Apple gives you the option to hide your e-mail address through the private relay function, in which case we will receive only an anonymized relay address). The scope of data requested by our application will be presented to you in an Apple message together with a request for authorization. Continuing to log in means consent to transfer the indicated information to us. Remember that Apple will not provide us with any data without your consent. More information about how Apple processes your data can be found in Apple’s privacy policy.

7.4. Login via Google

We enable login using a Google account (including Gmail). The procedure is analogous to those described above - after selecting the "Log in with Google" option, you are redirected to Google for authentication. Google will display information about the scope of data to which our Website will request access. If you confirm that you wish to log in, Google will provide us with the indicated data so that we can create/connect your account on our Website. During subsequent logins, Google may not ask for consent again if you maintain an active account connection. Detailed information about Google’s data processing rules can be found in Google’s privacy policy.

7.5 Data of other persons

If, while using the Website (including in reviews, comments, forms or the referral program), you provide personal data of other persons - for example you recommend our product to someone and enter their e-mail address or provide the details of a gift recipient - you may do so only if it does not infringe the rights of those persons or applicable data protection regulations. In other words, make sure that the person whose data you provide has consented to it or that there is another appropriate legal basis. In such a case, the Controller treats you as the entity providing the data and assumes that you act lawfully. However, if it turns out that providing us with someone else’s data violates regulations or the personal rights of those persons, we may be forced to take appropriate steps, including removing such data from our Website.

8. Placing orders

8.1 Data necessary to fulfill orders

Placing an order for products or services offered on our Website involves the processing of your personal data. In the order placement process, we require you to provide data necessary to fulfill the order:

• information identifying the ordering person (first name and surname);
• contact details (delivery address, e-mail address, phone number);
• depending on the payment method - other data, such as confirmation of payment (directly by the payment operator).

Failure to provide data marked as required will prevent us from accepting and fulfilling the order. Providing additional data (not marked as mandatory), such as additional order notes, is optional.

This data is processed for the purposes specified below.

8.1.1. Performance of the sales contract (order service)

We use your data primarily to fulfill the order you placed - to confirm it, prepare the goods, issue a sales document (receipt or invoice), deliver the product to the indicated address and contact you regarding matters related to order fulfillment. This is the performance of a sales contract or service to which you are a party (legal basis: Article 6(1)(b) GDPR).

8.1.2 Performance of the sales contract (additional information)

If you provide us with any additional data not required to fulfill the order (an additional contact number for the courier, preferences regarding delivery hours and the like), we process it on the basis of your consent expressed by voluntarily providing it (Article 6(1)(a) GDPR). We use this data only to the extent that it facilitates order fulfillment or increases your satisfaction with the service.

8.1.3 Legal obligations incumbent on the Controller

After completing the sale, we are required to fulfill a number of obligations arising from the law, including storing accounting documentation (invoices, sales receipts) for tax and accounting purposes for the period required by law. In this context, we process your transaction-related data in order to fulfill our legal obligations (legal basis: Article 6(1)(c) GDPR - compliance with a legal obligation).

8.1.4 Purchase analysis and sales statistics

Data concerning placed orders (including the type of products purchased, basket value and purchase dates) may be used for analytical purposes, such as examining which products sell best, which promotions are effective and how sales trends develop. We conduct these analyses based on our legitimate interest (Article 6(1)(f) GDPR), which is the development of our business activity and adapting the offer to customers’ preferences. In such analyses, however, we use anonymized or aggregated data (not identifying specific persons) wherever possible.

8.1.5 Claims and protection of the Controller’s rights

Your data collected in connection with an order may also be stored for the purpose of establishing, pursuing or defending possible legal claims related to the sales contract (potential disputes, non-statutory complaints). This is also an action based on our legitimate interest (Article 6(1)(f) GDPR).

9. Complaints and returns

9.1. Handling complaints

When you submit a complaint concerning purchased goods or services (under the seller’s liability for lack of conformity of the goods with the contract, statutory warranty, if applicable, or guarantee), we process your personal data to the extent necessary to examine that complaint. This may include information provided in the complaint notification (contact details, description of the defect, product photos). Completing the complaint form is voluntary, but the information contained in it may speed up and facilitate the examination of the matter. This data is processed for the purposes specified below.

9.1.1 Performance of legal obligations

Consumer complaints are examined in accordance with the provisions concerning the seller’s liability for lack of conformity of the goods with the contract, statutory warranty, if applicable, or on the basis of the granted guarantee. Data processing for this purpose is necessary to fulfill a legal obligation incumbent on the Controller (Article 6(1)(c) GDPR).

9.1.2 Pursuit of claims

Data from complaints may also be processed for the purpose of establishing, defending or pursuing possible claims related to the defectiveness of goods (for example if the complaint were rejected and a dispute arose). The basis is our legitimate interest (Article 6(1)(f) GDPR).

9.2 Handling returns

If you exercise the statutory right to withdraw from the contract (return of goods within 14 days) or another return policy offered by our Store, we also process your data in order to accept the return and make settlements (refund, issuing a correction to the sales document, etc.). This data is processed for the purposes specified below.

9.2.1 Legal obligation

The basis for processing data related to withdrawal from the contract is the seller’s legal obligation arising from consumer protection regulations (Article 6(1)(c) GDPR) - for example, we must document acceptance of the return and refund the funds within a specified period.

9.2.2 Performance of the contract

If the return policy results from a contract between us and the customer or from our offer (extended return periods, satisfaction guarantee), data processing also takes place in order to perform such a contract (Article 6(1)(b) GDPR).

9.2.3 Analytical and statistical purposes

We also analyze information about returns statistically (for example which product is returned most often and for what reason), based on our legitimate interest (Article 6(1)(f) GDPR) - this allows us to improve the quality of products and service.

9.2.4 Pursuit of claims

As with complaints, return data may be stored for the purpose of possible defense of our rights, for example in the event of an allegation that funds were not refunded (Article 6(1)(f) GDPR).

9.3 100-day return

For the purposes of handling the offer allowing a 100-day return, we process Customers’ personal data (first name, surname, address, order number and other data) in order to carry out the goods return procedure. This offer constitutes an extension of the statutory right to withdraw from the contract and is granted additionally under the terms specified in the regulations. The legal basis is the performance of the sales contract (Article 6(1)(b) GDPR) and compliance with legal obligations arising from consumer law (Article 6(1)(c) GDPR). The data will be stored until the return process and transaction settlement are completed, and then in accordance with applicable document archiving regulations.

10. Contact form

10.1 Your messages to us

On the Website, we provide a contact form through which you may contact us on various matters (product questions, request for an offer, reporting a problem). If you use the contact form, you will be asked to provide contact details necessary to respond (at least an e-mail address, possibly name/company name and phone number) and the content of the message containing your inquiry. You may also voluntarily provide additional information if you consider it useful for handling your matter. This data is processed for the purposes specified below.

10.1.1 Handling inquiries and communication

We use the data provided in the form to identify the sender of the message and handle their inquiry. This means the possibility of return contact (reply to the indicated e-mail address or by phone), explaining the matter described, taking appropriate actions and conducting further correspondence if necessary. The legal basis for such processing is our legitimate interest (Article 6(1)(f) GDPR), consisting in serving persons contacting us as part of our business activity and building positive relationships with potential customers.

10.1.2 Inquiry analysis

Information from correspondence with users (including statistical data about received questions) may help us improve the Website and our offer. For example, if we frequently receive questions about the availability of a given product, this may influence decisions to increase stock levels or better display availability information on the website. Such processing also takes place on the basis of our legitimate interest (Article 6(1)(f) GDPR), which is improving customer service and our commercial offer.

11. Geolocation

11.1 User location

As part of the Website, we provide an optional geolocation function which - with your consent - allows us to determine the approximate location of your device. This function is intended to make it easier for you to use certain conveniences, find the nearest personal collection point or display personalized information (such as the estimated delivery time to your location).

11.1.2 Voluntary use

Using geolocation is fully voluntary and depends on your consent expressed in the browser window or application settings (the system will ask whether you allow our website to access your location).

11.1.3 Withdrawal of consent

If you consent to sharing location data, the legal basis for processing this data will be Article 6(1)(a) GDPR (consent of the data subject). You may withdraw this consent at any time by changing the settings of your browser or device (disabling access to location services for our website/application). Remember that withdrawing consent does not affect the lawfulness of previous processing - until consent was withdrawn, processing was lawful.

11.2 Scope of location data

Location data that we may process is approximate in nature (it concerns identifying the city or geographical coordinates that allow us to display a map with nearby collection points). We do not seek to determine your exact location unnecessarily and we do not store the history of your location. Location data is used only to indicate results once and is not stored in our system in a way that would allow the route or place of stay of the user to be recreated later.

12. Marketing and promotion

12.1 Marketing purposes

Your personal data may be processed by us for marketing purposes. In particular, this is described by the activities set out below.

12.1.1 Behavioral advertising

Presenting marketing content tailored to your interests and preferences. If you viewed a specific type of product in our store, we may display advertisements for those or similar products to you, either within our Website or on external websites (within advertising networks we use). The Controller uses remarketing and analytical tools such as Google Ads (including Enhanced Conversions and Customer Match), Meta Ads (including Meta Pixel and Custom Audiences), TikTok Pixel, Microsoft Ads, Pinterest Ads or LinkedIn Insight Tag. These tools allow personalized advertisements (behavioral advertising) to be presented based on the user’s activity on the Website. Data processing for this purpose takes place on the basis of Article 6(1)(f) GDPR (the Controller’s legitimate interest). In the scope of using cookies - in accordance with your consent (section 13).

12.1.2 Direct marketing

Conducting direct marketing activities for the Controller’s own products or services (sending an e-mail newsletter with news, SMS messages informing about promotions) and - if you give separate consent - direct marketing carried out through electronic channels on behalf of partners (such as a one-time promotional mailing from our business partner).

12.2 Profiling for marketing purposes

As part of marketing activities, we may use profiling, i.e. automatic assessment of selected factors concerning you in order to analyze your preferences and potential needs. Thanks to profiling, we are able to better tailor the offers or content displayed to you - for example, to suggest products complementary to those already purchased or remind you about products left in your basket. Profiling takes place on the basis of information we hold (purchase history or activity on the Website) and will not produce legal effects concerning you or similarly significantly affect your situation. In other words, the results of profiling are used only to better tailor marketing, not to limit your rights or opportunities.

12.3 Behavioral advertising by external partners

Our advertising activities are partly based on cooperation with trusted partners from the marketing industry. As part of marketing activities, the Controller uses tools that enable analysis of Users’ behavior and directing advertisements to them that match their interests (profiling). In practice, this means that tools (scripts, tracking pixels) originating from third parties, such as Google, Meta (Facebook/Instagram), TikTok, LinkedIn, Pinterest, Tumblr and other advertising platforms, are implemented on our Website. These tools allow data about your activity on our Website (products viewed, clicks, cookie identifiers) to be collected and transferred to our advertising partners for the purpose of adjusting advertisements that you will see outside our website. For example, we use Google Ads and Facebook Ads, within which we have implemented Meta Pixel (Facebook/Instagram) and TikTok Pixel - these are code fragments thanks to which these platforms can recognize a user of our Website and display an ONSEN® advertisement tailored to their behavior (a product viewed on our website may appear as an advertisement on the user’s Facebook). The legal basis for such processing is our legitimate interest (Article 6(1)(f) GDPR) combined with your consent to the use of relevant advertising cookies (consent expressed through the cookie banner). We do not receive from our partners data that allows you to be clearly identified - no service provides us with your profile, only aggregate reports on advertising effectiveness. Detailed information about behavioral advertising mechanisms can be found in the privacy policies of these partners.

12.4 Consent to marketing by e-mail and SMS

If you subscribed to our newsletter or otherwise consented to receiving commercial information electronically, we will use your e-mail address (or phone number in the case of consent to SMS/MMS notifications) to send you recurring messages containing primarily information about news, promotions, products and events related to the ONSEN® brand. The legal basis for such action is our legitimate interest (Article 6(1)(f) GDPR), consisting in the marketing of our own products, in connection with regulations requiring your consent to marketing communication by electronic means (consent in accordance with the Act on the provision of electronic services and the Electronic Communications Law). This means that even if we believe we have the right to send you marketing materials as our customer, we will still not do so by e-mail or SMS without your explicit consent. You may withdraw this consent at any time - by clicking the appropriate link in the footer of each newsletter or by contacting us in any convenient way. Withdrawal of consent in relation to communication channels (e-mail, phone number) does not affect the lawfulness of actions that took place before its withdrawal.

12.5 Push notifications

If you use our mobile application or consented to receiving web push notifications in your browser, we may send short push messages to your device. Such notifications may contain information about current promotions, the status of your order or other messages related to our offer. Consent to push notifications is usually expressed through appropriate device/application configuration (accepting a browser message). The legal basis for sending push notifications is our legitimate interest (Article 6(1)(f) GDPR) in keeping customers informed about the offer, in connection with your consent to receive such messages. Of course, as above, you may withdraw consent to push notifications at any time by changing the application or browser settings and disabling permission for such messages.

12.6 Google Ads Customer Match

In order to reach our existing customers with promotions on Google services (including YouTube or Gmail), we use Google Ads Customer Match. This means that we may upload to the Google system an encrypted list of e-mail addresses of our customers (persons who made a purchase or subscribed to the newsletter). Google compares these hashed addresses with its user database – if it finds matches (i.e. persons with a Google account using the same e-mail address), it places such persons in an audience group for our advertisements. Thanks to this, when you log in to your Google account, you may see our advertisements directed specifically to this group (for example advertisements for new products for existing customers). The entire address matching process takes place on Google’s side and in encrypted form. We do not learn which Google accounts correspond to which customers, but receive only aggregate campaign statistics. The legal basis for such processing is our legitimate interest (Article 6(1)(f) GDPR) in marketing directed to our own customer base, but we implement it only with respect to persons who are our customers (which means that there is a relationship and a justified expectation of receiving information about similar products/services).

12.7 Google Ads - enhanced conversions

To better measure the effectiveness of our Google advertising campaigns (to check whether you make a purchase after clicking an advertisement), we use the Enhanced Conversions feature. It consists in the fact that, when you make a conversion (for example a purchase on the website), our Website may send certain encrypted data to Google (such as your e-mail address, if provided when placing the order). Google uses this encrypted data to better link the conversion event with a specific advertising campaign, while ensuring that the data remains secure (the data is encrypted using a one-way algorithm). This allows us to better assess which campaigns are effective and optimize advertising expenditure. The data is used only to analyze advertising effectiveness and is not used by Google for any other purposes. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) - optimization of marketing activities.

12.8 Meta Custom Audience

As in the case of Google, we use an analogous feature on the Facebook/Instagram platform called Custom Audiences. As part of this functionality, we transfer encrypted identifiers of our customers (e-mail addresses, phone numbers) to the Facebook system - of course only those who are registered in our database. Meta checks whether there are accounts with matching data (an account created using the same e-mail address) and, if so, adds such a person to our custom advertising audience. Thanks to this, as a Facebook/Instagram user, you may receive dedicated ONSEN® advertisements directed to our customers (for example informing about a special campaign for regular customers). This process, as with Google, does not disclose to us any specific data about your social media profile - everything takes place within the Meta system, and we only see the total size of the audience group and campaign results. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) in reaching persons who have already used our services with marketing, assuming that we act in accordance with the terms of those platforms and with respect for your privacy.

12.9 Social media

We maintain official ONSEN® brand profiles on social media such as Facebook (fanpage), Instagram, TikTok, LinkedIn, Pinterest or Tumblr. If you visit our profiles, react to posts, leave comments or interact with us on these services, your data is processed both by us and by the controllers of those platforms under the rules specified in their terms and privacy policies. For example, if you ask a question through Messenger on Facebook, we will receive your Facebook identifier and the content of the message in order to reply. Statistical data concerning visits to our profiles (Facebook Insights) is used to better understand users visiting our fanpages (legitimate interest of the fanpage controller – Article 6(1)(f) GDPR). Remember that when using social networking services, you are also subject to the legal regulations of those service providers, which is why we encourage you to read their privacy policies. Detailed information concerning the processing of personal data within our social media profiles, including the scope of responsibility of us as the fanpage controller and of social platforms, is presented in a separate document, the transparency policy.

12.10 Referral program

Each buyer who has made a purchase in our store automatically participates in the referral program. This means that a unique identifier (order number) is assigned to them, which they may share with other persons. If the referred person makes a purchase, the buyer may receive a benefit in accordance with the program rules. Participation in the program does not require any additional action by the customer, however each participant may object to such processing at any time. As part of the “Sleep, recommend, benefit” referral program, we process participants’ personal data, primarily first name and surname, e-mail address, order number (referral code), order value and address for sending the prize. This data is used exclusively to carry out the promotion, assign benefits under the program, keep referral records, prevent abuse and analyze the effectiveness of marketing activities. The legal basis is the performance of the sales contract (Article 6(1)(b) GDPR) and the Controller’s legitimate interest in settling the promotional program (Article 6(1)(f) GDPR). The data will be stored for the period of carrying out the promotion and settlements and in accordance with applicable document storage periods.

13. Cookies and other tracking technologies

13.1 Cookies

Cookies are small text files that a website (such as ours) saves on the User’s Device while browsing the website. They are commonly used to ensure the proper functioning of websites, improve their use and provide certain information to the website owner. Within our Website, cookies perform various functions, which we describe below.

13.1.1 Required cookies (necessary)

These are cookies absolutely necessary for the proper operation of the Website and for using its basic functionalities. They enable, for example, maintaining a session after logging in (so you do not have to enter your login and password on every subpage), remembering the contents of the basket, completing the order process from start to finish, and ensuring transaction security. Without these cookies, our Website could not function properly. In the case of necessary cookies, the law allows us to use them without obtaining your prior consent. They are installed automatically on your device as soon as you enter our website or use a given functionality.

13.1.2 Analytical cookies

These cookies collect information about how users use the Website - for example which subpages are visited most often, whether errors appear on pages and how users navigate the website. Analyzing this information helps us improve the operation of the Website and adapt it to visitors’ preferences. Data collected by analytical cookies is aggregated and anonymous, which means that it does not allow direct identification of the user (for example, we receive information that a given subpage was visited 1000 times, but without data on who exactly did so and when).

13.1.3 Personalization cookies (functional)

These are files that allow us to remember settings selected by you and personalize the User interface, for example in terms of the selected Website language, region, font size or page layout. Thanks to these files, using our Website may be more tailored to your needs and more pleasant, because it remembers your choices.

13.1.4 Advertising cookies (marketing)

Cookies that are used to collect information about your activities on our Website in order to display advertisements tailored to your preferences. Thanks to advertising cookies, our partner may recognize that you have been on our website and display our advertisement to you when you visit another related website. Advertising cookies may also measure campaign effectiveness (for example count how many people clicked an advertisement and made a purchase). Most often, files of this type come from our partners such as Google (files from a Google domain), Meta Platforms (domains related to Facebook.com or Instagram.com), TikTok (e.g. TikTok Pixel files), as well as from other platforms listed in the table below. These cookies usually identify the browser and device (not the user’s first name and surname) using unique strings of characters.

13.2 Session and persistent cookies

We also divide cookies according to their validity period. Session cookies operate temporarily and are stored on your device only during the browser session, i.e. until it is closed. After the browser is closed, these files are usually deleted from the device. Persistent cookies remain on your device even after the browser is closed (for the time specified in the file parameters or until they are manually deleted). Thanks to them, our Website remembers you during your next visit, making the login process or use of the basket faster.

13.3 Managing cookies

During your first visit to our Website, we display a message (cookie banner) informing you about the use of cookies and ask for consent to analytical, personalization and advertising cookies. They are not installed without your consent. You can then manage your preferences - consent to all or selected categories of files or refuse their use (except necessary cookies, which are always active). You can change your cookie settings at any time using a special tool available on the Website. Most web browsers allow cookies to be stored by default, but also give you the possibility of independent control – from the browser level you can delete cookies, block them for all or selected websites, or set notifications about their sending. Remember, however, that blocking all cookies (including necessary ones) may make using our Website difficult or even impossible (the Store may not remember products added to the basket or logging in may not be possible). Some data may be transferred to third countries (mainly the USA) - in particular in connection with the use of tools provided by Google, Meta, TikTok or Microsoft. In such cases, the transfer of data takes place on the basis of so-called standard contractual clauses adopted by the European Commission or other mechanisms provided for in Article 46 GDPR.

13.4 Third-party cookies

On our Website, in addition to our own cookies, we also use cookies from external entities with which we cooperate within various services. The table below presents the current list of our partners using cookies on our Website, together with information about the nature of these cookies and their typical duration.

The duration indicated above is approximate and may change. Some persistent cookies may remain longer if the user does not delete them.

Each of the partners listed above has its own privacy policy and cookie policy, in which it describes in detail how it uses cookies and data derived from them. We encourage you to read these documents on the websites of the respective entities - especially if you want to understand more precisely how Google or Facebook use information about your activity. For example, if you do not want Google Analytics to collect data about your activity, you can use the official tool provided by Google (a browser add-on blocking Google Analytics).

14. Cooperating entities

14.1 Data disclosure

As part of conducting our business and providing services, it may be necessary to transfer your personal data to various categories of recipients, i.e. entities that process this data on their own behalf or on our instruction. This is always done in accordance with applicable data protection regulations, on the basis of appropriate processing agreements (when they act on our instruction as processors) or on the basis of legal requirements. Below we present the main categories of such entities.

14.1.1 Courier and logistics companies

If you choose delivery of ordered goods to your home or a collection point, we must provide your address and contact details (for example a phone number for SMS notifications) to the company carrying out the delivery. We cooperate with trusted carriers and courier brokers. We provide them only with the information necessary to deliver the shipment (recipient’s first name and surname, delivery address, contact phone number, possibly e-mail address for shipment tracking). These entities become independent controllers of this data in the scope of the parcel delivery process, and therefore are responsible for its processing in order to perform the courier service.

14.1.2 Payment operators

Depending on the chosen payment method for the order, payment processing may require transferring your data to the appropriate payment service provider. This mainly concerns the operator of the online payment system or the bank handling a traditional bank transfer. The payment provider receives from us the minimum scope of data needed to identify the transaction and assign the payment - the amount due, order number or your identifier, sometimes first name and surname or e-mail address if necessary to link the payment. These providers act as independent data controllers in the scope of payment processing. They therefore have their own legal obligations and their own privacy policies.

14.1.3 E-mail and SMS services

If you consented to receiving commercial information from us electronically (newsletter consent, consent to SMS offers), we use the assistance of external companies specializing in mailing and SMS/MMS communication to send these messages. The newsletter service provider is MailerLite, and SMS messages regarding orders or promotions are sent through the SMSAPI service operated by LINK Mobility Poland. These entities process your contact details (e-mail address, phone number) and possibly basic information about your transactions (order status, if we send an SMS notification) only on our behalf, on the basis of a processing agreement. This means that they may not use this data for their own purposes, but only perform for us the service of sending specified messages.

14.1.4 IT service providers

The Website, including the online store, operates thanks to IT infrastructure for which external providers are partly responsible. We use the services of the hosting company Home.pl, which provides us with a server and space for our databases and website files. The hosting provider may potentially have access to your personal data stored on the server (in the order database or logs), but only to the extent necessary to maintain and administer the infrastructure (technical access to the database if it is necessary to remove a failure). We have signed a data processing agreement with each such provider, guaranteeing confidentiality and appropriate protection measures.

14.1.5 Analytical and marketing partners

We cooperate with companies that provide us with analytical and advertising tools facilitating the development of our business and reaching customers. In practice, this concerns the technological partners discussed in sections 12-13, such as:

• Google (Google LLC) - provider of analytical services (Google Analytics), advertising services (Google Ads, including Customer Match and enhanced conversions) and social login (Google Sign-In).
• Meta Platforms Ireland Ltd. - owner of the Facebook and Instagram platforms; provider of advertising tools (Facebook Pixel, Custom Audiences) and social login (Facebook Login).
• TikTok (TikTok Technology Ltd.) - provider of the TikTok Ads advertising platform (including TikTok Pixel).
• Microsoft (Microsoft Corp.) - provider of advertising tools (Bing/Microsoft Ads) and analytical tools (e.g. Microsoft Clarity).
• Pinterest, LinkedIn, Tumblr - social/advertising platforms used for marketing campaigns.
• Apple (Apple Inc.) - provider of the Apple ID login service (Apple Sign-In).

Cooperation with the above entities may involve transferring to them certain information about users of our Website, primarily through cookies or plugins integrated with our website. For example, when we use Google Analytics, a code fragment from Google collects data about your activity and sends it to Google servers. Similarly, Facebook Pixel transfers information about your visit and actions on the website to Meta Platforms. This data is used by our partners mainly to provide services to us (generating statistics, targeting our advertisements), and partly also by them themselves - in accordance with their own policies. Such partners usually process data as independent controllers, which means that Meta or Google are independently responsible for the lawfulness of data processing operations in their own advertising systems. We, in turn, strive to ensure that integrations with these services are carried out lawfully (we obtain your consent to advertising cookies). Details about these integrations can be found in earlier parts of the Policy (especially sections 12 and 13).

14.1.6 Order management platform

In order to efficiently handle online orders, we use the external BaseLinker platform (BaseLinker sp. z o.o.). BaseLinker enables us to manage the sales process in an integrated way - connecting our store with courier company systems, price comparison websites or marketplaces. In practice, this means that information about your order (such as: order contents, amount, delivery address, phone number, e-mail address) is recorded in the BaseLinker system, from where it may then be automatically transferred, for example, to a courier company (to generate a waybill) or to the external platform on which you purchased our product. BaseLinker acts on our instruction as a processor - we have signed a data processing agreement with this company. Your data in BaseLinker is subject to the same protection as in our own system. BaseLinker does not use it for its own purposes, but only provides a tool to streamline sales service.

14.1.7 Review acquisition platforms

We care about learning your opinion about the purchase made and the quality of our service, which is why we use programs of external review services. After making a purchase, you may receive from us a request to leave a review of the store or product on Opineo.pl (operated by Opineo Sp. z o.o.). If you consent to this when placing the order (by ticking the appropriate box), we will provide your e-mail address and order number to the Opineo system, which will then send you a one-time post-sale survey. Opineo becomes a separate controller of your data in this scope (the e-mail address used for the survey) and will use it exclusively to confirm that a purchase was made and to collect reviews. Completing the survey is, of course, voluntary. If you do not want to receive such a survey, simply do not consent during the purchase or ignore the invitation. Similarly, we participate in the Ceneo Trusted Reviews program (Ceneo.pl sp. z o.o.). If you consent, Ceneo will receive from us information about your e-mail address and the order placed (transaction ID, purchased product) in order to send an invitation to review the transaction on the Ceneo platform. The procedure is analogous to Opineo - the data is used only to enable you to leave a verified review of the store/product on Ceneo.pl.

14.1.8 Public authorities

We reserve the right - and in certain situations we have a legal obligation - to disclose selected information concerning Users to competent public authorities (such as the police, prosecutor’s office, courts, administrative authorities) or other entities that submit an appropriate legal request based on legal provisions. This applies in particular to situations where disclosure of data is required by applicable law (for example criminal proceedings are pending and authorities request that we provide data on the basis of an appropriate order or decision), or where we must provide data in order to pursue our claims or defend against claims (providing information to a lawyer or debt collection company). In each such case, we carefully verify the legal basis of the request and provide data only to authorized entities.

14.2 Transfer of data outside the European Economic Area

In the case of transferring data to third countries outside the EEA, the Controller ensures appropriate safeguards required by the GDPR - in particular by applying standard contractual clauses.

15. Data storage period

15.1 Processing period

The period for which we store your personal data depends on the type of service and the purpose of processing. As a rule, we process data for the duration of the service (holding an active user account, fulfilling an order). If processing is based on consent (newsletter consent) - we process the data until you withdraw such consent. If we process data on the basis of our legitimate interest - until you submit an effective objection, unless we achieve the given purpose earlier. If your data is processed in connection with the performance of a contract, we store it for as long as necessary to perform the contract, and then - if necessary - for the period during which claims arising from that contract may be pursued.

15.2 Storage periods due to regulations or claims

Sometimes legal regulations require us to store data for a specific period. For example, accounting documents (containing personal data) must be stored for 5 tax years from the end of the year in which the tax obligation arose (which often effectively means a period of up to 6 calendar years). Data concerning concluded contracts and performed services may be stored until the limitation period for claims arising from the contract expires, which usually amounts to 6 years, and for claims for periodic benefits and claims related to conducting business activity, 3 years. Therefore, if necessary (for example in case of a complaint or dispute), we may store personal data for a period equal to the longest potential limitation period for claims that may arise from our legal relationship with you.

15.3 Data deletion

After the above periods expire - i.e. when the data is no longer needed by us or required by law - we delete or anonymize it (permanently deprive it of features allowing identification). Anonymization causes the information to cease being treated as personal data (we retain sales statistics without assigning them to specific customers).

16. Your rights

16.1 Rights of data subjects

Personal data protection regulations grant you specific rights that you may enforce against us. We describe your main rights below.

16.1.1 Right to information

You have the right to obtain confirmation from us as to whether we process your data, and if so, to receive information, among other things, about the purpose, type of data, to whom we disclose it, how long we plan to store it and what rights you have.

16.1.2 Right of access to data

You have the right to receive a copy of your personal data processed by us. The first copy is free of charge; for subsequent copies, in accordance with the GDPR, we may charge a reasonable fee (resulting from administrative costs).

16.1.3 Right to rectification

If you notice that your data is incorrect or incomplete, you have the right to request its correction or completion. In the case of most basic account data (first name, surname, delivery address), you may correct it yourself by logging in to your account and editing the data.

16.1.4 Right to erasure ("right to be forgotten")

At your request, we will delete personal data if there is no legal basis for us to continue storing it. This may happen, for example, when you withdraw consent to data processing (and we have no other legal basis), object to processing for marketing purposes, the data was processed unlawfully or deletion is required by a legal obligation. Remember, however, that the right to erasure is not absolute - we cannot delete data concerning a completed transaction earlier than after the expiry of legal requirements for storing financial documentation (see section 15);

16.1.5 Right to restriction of processing

You may request that we temporarily block access to your data or operations on it in the following situations:

• you dispute the accuracy of the data (for the time needed to check and correct it, if applicable);
• you believe that the processing is unlawful, but prefer us to restrict the use of the data instead of deleting it;
• we no longer need your data, but you need it to establish, defend or pursue claims;
• you have objected - until it is determined whether our legitimate grounds override the grounds of your objection.

During the restriction period, we will only store your data (possibly use it to pursue claims or protect the rights of another person or for important reasons of public interest).

16.1.6 Right to data portability

You have the right to receive from us, in a structured and commonly used format (such as CSV), the personal data that you provided to us and that we process on the basis of your consent or for the performance of a contract (Article 6(1)(a) or (b) GDPR), if this is done by automated means (in IT systems). You may also instruct us to send this data directly to another indicated controller, provided this is technically possible (however, this applies only when such a direct connection between systems exists).

16.1.7 Right to object to direct marketing

You have the right to object at any time to the processing of your data for direct marketing purposes. If you submit such an objection, we will stop using your data for this purpose. The objection does not require justification and is free of charge.

16.1.8 Right to object on grounds relating to a particular situation

If we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR) for a purpose other than marketing, you have the right to object due to your particular situation. In such a situation, we must consider whether - after taking your particular situation into account - further data processing is permissible (for example whether our interests are not excessively invasive in relation to your rights). If we find your objection justified, we will be obliged to stop processing data in this scope.

16.1.9 Right to withdraw consent

To the extent that the processing of your data is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of earlier processing (i.e. processing was lawful until consent was withdrawn). You may withdraw consent as easily as you gave it. In the case of newsletter consent - by clicking the unsubscribe link in the received message or changing settings in the user account. In the case of cookie consent - by changing cookie settings (section 13.3). In the case of other consents - by contacting us through any channel.

16.1.10 Right to lodge a complaint

If you believe that we process your data unlawfully or violate your rights under the GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, the competent authority is the President of the Personal Data Protection Office (Stawki 2, 00-193 Warsaw).

16.2 Exercising rights

You may exercise many of your rights on your own. If you have an account - log in and in the settings section find the option to correct or update data, change marketing consents or download a copy of data (if we currently provide such a function). Regardless of the above, you may at any time send us a request concerning your rights. It is enough to contact us by e-mail, using the form or in writing.

16.3 Response deadline

We will make every effort to respond to your request without undue delay - no later than within one month of receiving it. If, due to the complex nature of the request or the number of requests, we are unable to meet this deadline, we will inform you about the extension of the deadline (by no more than another 2 months) and provide the reasons for the delay.

16.4 Identity verification

To protect your data from being released to an unauthorized person, in case of doubts as to the identity of the requester, we may ask for additional verification information (for example providing certain data that we already have, for confirmation purposes). If, despite verification, we are unable to confirm the identity of the requester, we may refuse to fulfill the request - we will then inform you about the reasons for refusal.

16.5 Representatives

You may submit requests regarding your rights personally or through an authorized representative (such as a family member or lawyer). If you act through a representative, for our and your security we may ask for a power of attorney to be presented (preferably notarized or granted in a form that allows us to verify its authenticity).

16.6 Form of response

As a rule, we respond to your requests through the same channel through which you wrote to us. If you prefer to receive a response in another form, please indicate this in your request and we will try to adapt. Remember, however, that e-mail communication is the fastest. If for some reason we are unable to respond in writing on time, we may provide an emergency response electronically.

16.7 Register of requests

We inform you that we may archive submitted requests and responses given for evidentiary and administrative purposes. Such an archive is kept confidential. This means that if you ask us to delete data, the fact that such a request was submitted and our response will be stored in a separate case register to which only authorized persons bound by confidentiality have access.

17. Introducing changes

17.1 The content of this Privacy Policy may be subject to updates or modifications, primarily due to changes in legal regulations, technological changes on our Website or expansion of our service offer. We will inform you about any significant changes through messages on the website or by e-mail (in the case of very important changes and if we have your e-mail address). The latest version of the Privacy Policy is effective from 4 July 2025.

Thank you for reading the Privacy Policy. While taking care of the security of your data, we make every effort to ensure that our Website is not only convenient, but also privacy-friendly. If you have additional questions or doubts regarding our privacy practices, we remain at your disposal. Full transparency and the protection of our customers’ data are our priority.