COODO.PL ONLINE SHOP PRIVACY POLICY

PRIVACY POLICY

PRIVACY POLICY OF THE ONLINE STORE COODO.PL

TABLE OF CONTENTS:

1. GENERAL PROVISIONS

2. GROUNDS FOR DATA PROCESSING

3. PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE

4. RECIPIENTS OF DATA IN THE ONLINE STORE

5. PROFILING IN THE ONLINE STORE

6. RIGHTS OF THE DATA SUBJECT

7. COOKIES IN THE ONLINE STORE AND ANALYTICS

8. FINAL PROVISIONS

1. GENERAL PROVISIONS

1.1. This Privacy Policy of the Online Store is informative, meaning it is not a source of obligations for Service Recipients or Customers of the Online Store. The Privacy Policy primarily contains rules regarding the processing of personal data by the Data Controller in the Online Store, including the legal grounds, purposes, and retention periods for personal data, as well as the rights of data subjects. It also provides information regarding the use of cookies and analytical tools in the Online Store.

1.2. The controller of personal data collected via the Online Store is Coodo prosta S.A., with its registered office in Warsaw at ul. Podleśna 71A, 05-075 Warsaw (Masovian Voivodeship), entered into the Register of Entrepreneurs of the National Court Register (KRS) under KRS number: 0001246091, NIP: 9522285704, REGON: 544939405, email address: office@coodo.pl, contact phone number: +48 698 509 606, hereinafter referred to as the "Controller", who is also the Service Provider of the Online Store and the Seller.

1.3. Personal data in the Online Store is processed by the Controller in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — hereinafter referred to as "GDPR". Official text of the GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

1.4. Using the Online Store, including making purchases, is voluntary. Similarly, providing personal data by a Service Recipient or Customer using the Online Store is voluntary, subject to two exceptions:

1. Entering into contracts with the Controller: Failure to provide personal data necessary for the conclusion and performance of a Sales Contract or an Electronic Service agreement with the Controller—in cases and to the extent specified on the Online Store website, in the Terms and Conditions, and in this Privacy Policy—results in the inability to conclude that contract. Providing personal data in this case is a contractual requirement, and if the data subject wishes to enter into a contract with the Controller, they are obliged to provide the required data. The scope of data required to conclude a contract is always indicated in advance on the Online Store website and in its Terms and Conditions.

2. Statutory duties of the Controller: Providing personal data is a statutory requirement resulting from generally applicable legal provisions that impose an obligation on the Controller to process personal data (e.g., processing data for tax or accounting record-keeping). Failure to provide such data will prevent the Controller from fulfilling these obligations.

1.5. The Controller exercises special care to protect the interests of data subjects and, in particular, ensures that collected data is:

1. Processed lawfully;

2. Collected for specified, legitimate purposes and not subjected to further processing incompatible with those purposes;

3. Factually correct and adequate for the purposes for which it is processed;

4. Stored in a form that permits identification of data subjects for no longer than is necessary to achieve the purpose of processing;

5. Processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

1.6. Taking into account the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements appropriate technical and organizational measures to ensure and to be able to demonstrate that processing is performed in accordance with GDPR. These measures are reviewed and updated as necessary. The Controller applies technical measures to prevent unauthorized persons from acquiring and modifying personal data transmitted electronically.

1.7. Any words, terms, or acronyms appearing in this Privacy Policy capitalized (e.g., Seller, Online Store, Electronic Service) should be understood according to their definitions set out in the Terms and Conditions available on the Online Store website.

2. GROUNDS FOR DATA PROCESSING

2.1. The Controller is authorized to process personal data in cases where—and to the extent that—at least one of the following conditions is met:

1. The data subject has given consent to the processing of their personal data for one or more specific purposes;

2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

3. Processing is necessary for compliance with a legal obligation to which the Controller is subject;

4. Processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2.2. Processing of personal data by the Controller requires the existence of at least one of the legal grounds specified in Section 2.1 of this Privacy Policy each time. The specific legal grounds for processing personal data of Service Recipients and Customers by the Controller are specified in the following section with respect to each given purpose.

3. PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE

3.1. In each case, the purpose, legal basis, retention period, and recipients of personal data processed by the Controller result from the actions taken by a given Service Recipient or Customer in the Online Store or by the Controller. For example, if a Customer decides to make a purchase and selects personal pickup of the purchased Product instead of courier delivery, their personal data will be processed to execute the Sales Contract, but will not be shared with the shipping carrier.

3.2. The Controller may process personal data in the Online Store for the purposes, on the legal bases, and for the periods specified below:

Purpose of Processing	Legal Basis	Retention Period
Performance of a Sales Contract or Electronic Service agreement, or taking action at the data subject's request prior to entering into such contracts	Article 6(1)(b) GDPR (Performance of a contract) — processing is necessary for the performance of a contract to which the data subject is party or prior to entering into a contract.	Data is stored for the period necessary to perform, terminate, or otherwise expire the Sales Contract or Electronic Service agreement.
Direct marketing	Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller, consisting of protecting the interests and image of the Controller and the Online Store, and striving to sell Products.	Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from the Controller's business activity (under Polish Civil Code, generally 3 years for business claims, 2 years for sales contracts). Processing stops immediately upon a valid objection.
Marketing	Article 6(1)(a) GDPR (Consent) — the data subject has consented to the processing of their personal data for marketing purposes by the Controller.	Data is stored until consent is withdrawn by the data subject.
Customer review on a completed Sales Contract	Article 6(1)(a) GDPR (Consent) — the data subject has consented to the processing of their personal data to express an opinion/review.	Data is stored until consent is withdrawn by the data subject.
Tax and accounting record-keeping	Article 6(1)(c) GDPR in conjunction with Article 86 § 1 of the Polish Tax Code — processing is necessary to comply with a legal obligation imposed on the Controller.	Data is stored for the period required by law ordering the Controller to keep tax records (until the expiration of the tax liability statute of limitations, unless tax laws state otherwise).
Establishment, exercise, or defense of claims	Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in establishing, pursuing, or defending claims.	Data is stored for the duration of the Controller's legitimate interest, not longer than the limitation period for claims that may be raised against the Controller (generally 6 years).
Use and operational functionality of the Online Store website	Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in operating and maintaining the Online Store website.	Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from business activity.
Statistics and traffic analysis in the Online Store	Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in collecting statistics and analyzing traffic to improve functionality and boost sales.	Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from business activity.

Purpose of Processing

Legal Basis

Retention Period

Performance of a Sales Contract or Electronic Service agreement, or taking action at the data subject's request prior to entering into such contracts

Article 6(1)(b) GDPR (Performance of a contract) — processing is necessary for the performance of a contract to which the data subject is party or prior to entering into a contract.

Data is stored for the period necessary to perform, terminate, or otherwise expire the Sales Contract or Electronic Service agreement.

Direct marketing

Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller, consisting of protecting the interests and image of the Controller and the Online Store, and striving to sell Products.

Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from the Controller's business activity (under Polish Civil Code, generally 3 years for business claims, 2 years for sales contracts). Processing stops immediately upon a valid objection.

Marketing

Article 6(1)(a) GDPR (Consent) — the data subject has consented to the processing of their personal data for marketing purposes by the Controller.

Data is stored until consent is withdrawn by the data subject.

Customer review on a completed Sales Contract

Article 6(1)(a) GDPR (Consent) — the data subject has consented to the processing of their personal data to express an opinion/review.

Data is stored until consent is withdrawn by the data subject.

Tax and accounting record-keeping

Article 6(1)(c) GDPR in conjunction with Article 86 § 1 of the Polish Tax Code — processing is necessary to comply with a legal obligation imposed on the Controller.

Data is stored for the period required by law ordering the Controller to keep tax records (until the expiration of the tax liability statute of limitations, unless tax laws state otherwise).

Establishment, exercise, or defense of claims

Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in establishing, pursuing, or defending claims.

Data is stored for the duration of the Controller's legitimate interest, not longer than the limitation period for claims that may be raised against the Controller (generally 6 years).

Use and operational functionality of the Online Store website

Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in operating and maintaining the Online Store website.

Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from business activity.

Statistics and traffic analysis in the Online Store

Article 6(1)(f) GDPR (Legitimate interest) — processing is necessary for the legitimate interests pursued by the Controller in collecting statistics and analyzing traffic to improve functionality and boost sales.

Data is stored for the duration of the legitimate interest, but no longer than the statute of limitations for claims against the data subject arising from business activity.

4. RECIPIENTS OF DATA IN THE ONLINE STORE

4.1. For the proper functioning of the Online Store, including the execution of Sales Contracts, it is necessary for the Controller to use services provided by external entities (such as software providers, couriers, or payment processors). The Controller uses only processors that provide sufficient guarantees to implement appropriate technical and organizational measures so that processing meets the requirements of the GDPR and protects the rights of data subjects.

4.2. Personal data may be transferred by the Controller to a third country (outside the EEA). In such cases, the Controller ensures that transfer occurs to a country ensuring an adequate level of protection in accordance with the GDPR, or based on standard data protection clauses. The Controller ensures that data subjects can obtain a copy of their data. Data is transferred only when and to the extent necessary to achieve the specific processing purpose.

4.3. Data transfer does not occur in every case or to all recipients listed in the Privacy Policy — data is transferred only when necessary and strictly within the required scope.

4.4. Personal data of Service Recipients and Customers may be transferred to the following categories of recipients:

4.4.1. Carriers / Freight Forwarders / Courier Brokers / Warehouse Fulfillment Partners: In the case of a Customer selecting postal or courier delivery, the Controller discloses data to the selected carrier/broker or fulfillment partner to complete product delivery.

4.4.2. Electronic and Card Payment Processors: In the case of electronic or card payments, the Controller discloses data to the selected payment gateway operator handling payments on behalf of the Controller.

4.4.3. Financing / Leasing Providers: In the case of installment or leasing payments, data is provided to the selected lender or leasing entity.

4.4.4. Review System Providers: In the case of a Customer consenting to provide a review, data is disclosed to the provider of the review/survey system.

4.4.5. Service Providers of Technical, IT, and Organizational Solutions: Including software vendors, hosting and email providers, business management software, and technical support services.

4.4.6. Accounting, Legal, and Advisory Service Providers: Including accounting firms, law offices, or debt collection agencies providing professional support.

4.4.7. Social Plugins, Scripts, and Similar Web Tool Providers:

- 4.4.7.1 Alphabet Inc. (YouTube): YouTube plugins on the website collect and share activity/device data with Alphabet Inc. (1600 Amphitheatre Parkway Mountain View, CA 94043, USA) according to their privacy terms: https://www.youtube.com/intl/ALL_pl/howyoutubeworks/user-settings/privacy/

- 4.4.7.2 Meta Platforms Ireland Ltd. (Facebook & Instagram): Social plugins (Like/Share buttons, Facebook Login) collect and share activity data with Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) according to Meta privacy policies: https://www.facebook.com/about/privacy/ and https://help.instagram.com/519522125107875/?helpref=hc_fnav

5. PROFILING IN THE ONLINE STORE

5.1. Under the GDPR, the Controller is obliged to inform about automated decision-making, including profiling referred to in Article 22(1) and (4) of the GDPR, and meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing.

5.2. The Controller may use profiling in the Online Store for direct marketing purposes, but decisions made on this basis do not affect the conclusion or refusal of a Sales Contract or access to Electronic Services. Effects of profiling may include granting discounts, sending promo codes, abandoned cart reminders, or product recommendations based on preferences. The Customer retains full freedom to choose whether to use these offers.

5.3. Profiling involves automated analysis or prediction of a person's behavior on the Online Store website (e.g., adding items to a cart, viewing specific product pages, or past purchase history). This requires the Controller to already hold the person's contact/personal data.

5.4. Data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

6. RIGHTS OF THE DATA SUBJECT

6.1. Right of Access, Rectification, Restriction, Erasure, and Data Portability: Data subjects have the right to request access to, rectification, deletion ("right to be forgotten"), or restriction of processing of their personal data, as well as the right to object to processing and the right to data portability (Articles 15–21 GDPR).

6.2. Right to Withdraw Consent: Where processing is based on consent (Art. 6(1)(a) or Art. 9(2)(a) GDPR), the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6.3. Right to Lodge a Complaint with a Supervisory Authority: Data subjects have the right to lodge a complaint with the relevant supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — PUODO).

6.4. Right to Object: Data subjects have the right to object at any time, on grounds relating to their particular situation, to processing based on Article 6(1)(e) (public interest) or (f) (legitimate interest), including profiling. The Controller shall cease processing unless demonstrating compelling legitimate grounds overriding the subject's rights or for establishing, exercising, or defending legal claims.

6.5. Right to Object to Direct Marketing: Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to processing for such marketing, including profiling related to direct marketing.

6.6. Exercising Rights: To exercise any of these rights, contact the Controller in writing or via email using the contact details in Section 1 or via the contact form on the website.

7. COOKIES IN THE ONLINE STORE AND ANALYTICS

7.1. Cookies are small text files sent by a web server and stored on the visitor's device (e.g., computer, laptop, smartphone memory).

7.2. Cookies used by the Online Store can be categorized as follows:

By Provider:

1. First-party cookies (created directly by the Online Store)

2. Third-party cookies (belonging to external partners/services)

By Retention Period:

1. Session cookies (stored until logging out or closing the browser)

2. Persistent cookies (stored for a defined period or until manually deleted)

By Purpose:

1. Necessary cookies (essential for basic website functionality)

2. Functional/Preference cookies (remember choices like language or layout)

3. Analytical and performance cookies (collect usage statistics)

4. Marketing, advertising, and social cookies (used for personalized ads, tracking campaign performance, and social media integration)

7.3. The Controller processes cookie data for specific operational purposes:

Identifying logged-in users (Necessary)

Remembering cart contents during checkout (Necessary)

Saving form data, surveys, or login credentials (Necessary / Functional)

Customizing page display preferences (Functional)

Compiling anonymous usage statistics (Analytical)

Displaying, tailoring, and measuring ad performance via Google and Meta advertising networks (Marketing / Social)

7.4. Cookie settings and active cookies can be inspected directly in major browsers (Chrome, Firefox, Internet Explorer, Opera, Safari, Edge) via browser security/privacy settings or online tools like cookiemetrix.com or cookie-checker.com.

7.5. Most browsers accept cookies by default. Users can modify browser settings to restrict or block cookies; however, disabling necessary cookies may disrupt store functions (e.g., maintaining cart items through checkout steps).

7.6. Expressing consent for cookies can occur via browser settings under applicable telecommunications laws.

7.7. Google Analytics: The Controller uses Google Analytics / Universal Analytics provided by Google Ireland Limited (Dublin, Ireland) to analyze website traffic and generate aggregated performance statistics (sources, visitor behavior, device types, IP/domain, general demographic/interest metrics).

7.8. Opting out of Google Analytics: Users can prevent tracking by installing the official browser add-on: https://tools.google.com/dlpage/gaoptout?hl=en

7.9. Google Privacy Information: Details regarding Google's data handling practices are available at: https://policies.google.com/technologies/partner-sites

7.10. Meta Pixel (Facebook Pixel): The Controller uses Meta Pixel provided by Meta Platforms Ireland Ltd. to measure ad conversion, track user interactions, and display targeted advertisements. Details: https://www.facebook.com/business/help/742478679120153

7.11. Managing Meta Ad Preferences: Users can manage Meta ad settings directly in their Facebook account: https://www.facebook.com/ads/preferences/

8. FINAL PROVISIONS

8.1. The Online Store may contain links to third-party websites. When navigating to other sites, users are advised to review the respective privacy policies established on those websites. This Privacy Policy applies exclusively to the Controller's Online Store.