User agreement

PRIVACY POLICY OF THE ONLINE STORE
WWW.CAPITAL-PRODUCTION.PL

§ 1

GENERAL PROVISIONS

1. The controller of personal data collected via the online store
www.capital-production.pl is CAPITAL PRODUCTION SPÓŁKA Z OGRANICZONĄ
ODPOWIEDZIALNOŚCIĄ entered in the Register of Entrepreneurs by the DISTRICT COURT FOR THE CAPITAL CITY OF
WARSAW IN WARSAW, 13TH COMMERCIAL DIVISION OF THE NATIONAL COURT REGISTER
under KRS number: 0000980391, place of business activity and address for service: Aleja
Prymasa Tysiąclecia 83A/332, 01-242 Warsaw, Wola district, NIP: 5273009178, REGON:
522479599, e-mail address: Capitalproductionspzoo@gmail.com, telephone number:
+48 452 550 428, hereinafter referred to as the “Controller” and also being the
“Service Provider”.
2. Personal data collected by the Controller via the website are processed in accordance with
Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
3. Any words or expressions written in this Privacy Policy with a capital letter shall be
understood in accordance with their definition contained in the Terms and Conditions of the online store www.capital-
production.pl

§ 2

TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION
1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data of
Service Recipients of the Store www.capital-production.pl in the case of:
1.1. registration of an Account in the Store in order to create an individual account and manage this
Account on the basis of Article 6(1)(b) GDPR (performance of an agreement for the provision of a service by
electronic means in accordance with the Store Terms and Conditions),
1.2. placing an Order in the Store in order to perform the Sales Agreement on the basis of Article 6
(1)(b) GDPR (performance of the sales agreement),
1.3. use of the Opinion System in order to enable the Customer to express their opinion on
the Product purchased in the Store and the Sales Agreement concluded with the Seller on
the basis of Article 6(1)(f) GDPR (legitimate interest of the entrepreneur),
1.4. use of the Chat, on the basis of Article 6(1)(f) GDPR (legitimate interest of the
entrepreneur),
1.5. fulfilment of legal obligations incumbent on the Controller, resulting in
particular from tax law, accounting law, consumer protection regulations and other provisions regulating the conduct of business activity,
on the basis of Article 6(1)(c) GDPR (processing necessary for compliance with a legal
obligation to which the controller is subject).
2. TYPE OF PERSONAL DATA PROCESSED. The Service Recipient provides, in the case of:

2.1. Account: e-mail address,
2.2. Order: name and surname, address, NIP, e-mail address, telephone number,
2.3. Opinion System: name and surname, e-mail address.
2.4. Chat: name.
3. PERSONAL DATA ARCHIVING PERIOD. Personal data of Service Recipients are stored
by the Controller:
3.1. where the basis for data processing is the performance of an agreement, for as long as
it is necessary to perform the agreement and, after that time, for a period corresponding to the limitation period
for claims. Unless a special provision states otherwise, the limitation period
is six years, and for claims for periodic services and claims related
to conducting business activity - three years,
3.2. where the basis for data processing is consent, for as long as the consent is not
withdrawn, and after the consent is withdrawn for a period corresponding to the limitation period
for claims that may be raised by the Controller and that may be raised against it.
Unless a special provision states otherwise, the limitation period is six years, and for
claims for periodic services and claims related to
conducting business activity - three years.
4. When using the Store, additional information may be collected, in particular: the IP address
assigned to the Service Recipient's computer or the external IP address of the Internet provider, domain
name, browser type, access time, type of operating system.
5. After expressing separate consent, on the basis of Article 6(1)(a) GDPR, data may also be
processed for the purpose of sending commercial information by electronic means or
making telephone calls for direct marketing purposes – respectively in
connection with Article 398(1) and (2) of the Act of 12 July 2024 - Electronic Communications Law, including
communications directed as a result of profiling, provided that the Service Recipient has given the relevant consent.
6. As part of the User's activity in the Store, profiling may take place, the purpose of which is
to select appropriate advertising content that will be directed to the User.
7. Profiling means any form of automated processing of personal data,
which consists in using personal data to evaluate certain personal factors of
a natural person, in particular to analyse or predict aspects concerning the performance at work of
that natural person, their economic situation, health, personal preferences, interests,
reliability, behaviour, location or movements. Profiling does not produce
legal effects with respect to the Service Recipient nor does it otherwise significantly affect their
situation. Its purpose is only to better tailor marketing content and offers.
8. Navigation data may also be collected from Service Recipients, including information about links
and references they decide to click or other actions taken in the Store.
The legal basis for this type of activity is the legitimate interest of the Controller (Article 6
(1)(f) GDPR) consisting in facilitating the use of services provided by electronic means
and improving the functionality of these services.
9. Providing personal data by the Service Recipient is voluntary.
10. The Controller exercises special care in order to protect the interests of persons whose data
concern, and in particular ensures that the data collected by it are:
10.1. processed lawfully,
10.2. collected for specified, lawful purposes and not further
processed in a manner incompatible with those purposes,

10.3. substantively correct and adequate in relation to the purposes for which they are processed
and stored in a form that permits identification of the persons to whom they relate, no longer
than is necessary to achieve the purpose of processing.
§ 3

DISCLOSURE OF PERSONAL DATA

1. Personal data of Service Recipients are transferred to service providers used by the
Controller when operating the Store, and in particular to:
1.1. entities carrying out delivery of Products,
1.2. payment system providers,
1.3. providers of opinion survey systems,
1.4. accounting office,
1.5. hosting provider,
1.6. provider of software enabling the conduct of business activity,
1.7. entities providing the mailing system,
1.8. provider of software necessary to run the online store,
1.9. public entities processing data in connection with the legal obligation of the
Controller, including the Ministry of Finance operating the KSeF system.
2. Service providers (referred to in point 1 of this paragraph) to whom personal data are transferred -
depending on contractual arrangements and circumstances - either follow the Controller's instructions
as to the purposes and methods of processing these data (processors)
or independently determine the purposes and methods of their processing (controllers).
3. Personal data of Service Recipients are stored only within the European Economic Area
(EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.
4. Personal data may be transferred outside the European Economic Area (EEA), in
particular to the United States, in connection with the Controller's use of services of
providers of analytical and marketing tools (e.g. Google LLC, Meta Platforms Inc.).
The transfer of data takes place on the basis of Standard Contractual Clauses (SCC)
approved by the European Commission, in accordance with Article 46(2)(c) GDPR.

§ 4

RIGHT OF CONTROL, ACCESS TO THE CONTENT OF ONE'S OWN DATA AND THEIR CORRECTION
1. The data subject has the right to access the content of their personal data and the right to
rectify, erase, restrict processing, the right to data portability, the right
to object, and the right to withdraw consent at any time without affecting
the lawfulness of processing carried out on the basis of consent before its withdrawal.
2. Legal bases for the Service Recipient's request:
2.1. access to data – Article 15 GDPR,
2.2. rectification of data – Article 16 GDPR,
2.3. erasure of data (the so-called right to be forgotten) – Article 17 GDPR,
2.4. restriction of processing – Article 18 GDPR,
2.5. data portability – Article 20 GDPR,
2.6. objection – Article 21 GDPR,
2.7. withdrawal of consent – Article 7(3) GDPR.

3. In order to exercise the rights referred to in point 2, an appropriate e-mail message may be sent
to: cptheseller@gmail.com
4. In the event that the Service Recipient exercises a right arising from the above rights,
the Controller shall fulfil the request or refuse to fulfil it without delay, but no later than
within one month of receiving it. However, if - due to the complex nature of the request
or the number of requests – the Controller is unable to fulfil the request within one month, it shall fulfil it
within the next two months, informing the Service Recipient in advance within one month from
receipt of the request - of the intended extension of the deadline and the reasons for it.
5. If it is found that the processing of personal data violates the provisions of the GDPR, the data
subject has the right to lodge a complaint with the President of the Personal Data Protection Office.

§ 5
"COOKIES" FILES
1. The Controller's website uses “cookies”.
2. The installation of “cookies” files is necessary for the proper provision of services on the
website of the Store. “Cookies” files contain information necessary for the proper
functioning of the website, and they also make it possible to prepare general statistics
of visits to the website.
3. The website uses two types of “cookies” files: “session” and “persistent”.
3.1. “Session” “cookies” are temporary files stored on the Service Recipient's
end device until logging out (leaving the website),
3.2. “Persistent” “cookies” files are stored on the Service Recipient's end device for the time
specified in the parameters of the “cookies” files or until they are deleted by the Service Recipient.
4. The Controller uses its own cookies in order to better understand the way
Service Recipients interact with the content of the website. The files collect information on how
the website is used by the Service Recipient, the type of website from which the Service Recipient was redirected
and the number of visits and the time of the Service Recipient's visit to the website. This information does not
record specific personal data of the Service Recipient, but is used to prepare statistics
on the use of the website.
5. The Controller also uses external cookies to collect general
and anonymous statistical data via Google Analytics analytical tools
(controller of external cookies: Google LLC. with its registered office in the USA).
6. Cookies may also be used by advertising networks (in particular the
Google network) in order to display advertisements tailored to the way in which the Service Recipient uses the
Store. For this purpose, they may store information about the Service Recipient's navigation path or the time
spent on a given page.
7. The Service Recipient has the right to decide on the access of “cookies” files to their
computer by:
7.1. choosing the types of cookies to which they consent immediately after entering
the Store website and the appearance of the message concerning cookies,
7.2. changing the settings in their browser window. Detailed information on the possibility and
methods of handling “cookies” files is also available in the settings of the software
(web browser).

§ 6

ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

1. The Store uses so-called social plugins (“plugins”) of
social networking services. When displaying the website www.capital-production.pl containing
such a plugin, the Service Recipient's browser establishes a direct connection with the servers of Facebook,
Instagram, Twitter, YouTube and Google.
2. The content of the plugin is transmitted by the given service provider directly to the browser of the
Service Recipient and integrated with the website. Thanks to this integration, the service providers receive information that
the Service Recipient's browser displayed the website www.capital-production.pl, even if
the Service Recipient does not have a profile with the given service provider or is not currently logged in there.
Such information (together with the Service Recipient's IP address) is sent by the browser
directly to the server of the given service provider (some servers are located in the USA) and stored there.
3. If the Service Recipient logs in to one of the above social networking services, then
that service provider will be able to directly assign the visit to the website www.capital-
production.pl to the Service Recipient's profile in the given social networking service.
4. If the Service Recipient uses a given plugin, e.g. by clicking the “Like” button or the
“Share” button, the relevant information will also be sent directly to the server
of the given service provider and stored there.
5. The purpose and scope of data collection and their further processing and use by
service providers, as well as the possibility of contact and the Service Recipient's rights in this regard and
the possibility of making settings ensuring the protection of the Service Recipient's privacy have been
described in the privacy policies of the service providers:
5.1. https://www.facebook.com/policy.php
5.2. https://help.instagram.com/519522125107875?helpref=page_content
5.3. https://help.twitter.com/en/rules-and-policies
5.4. https://www.youtube.com/intl/ALL_pl/howyoutubeworks/user-settings/privacy/
5.5. https://policies.google.com/privacy?hl=pl&gl=ZZ.
6. If the Service Recipient does not want social networking services to assign data collected
during visits to the website www.capital-production.pl directly to their profile in the given
service, they must log out of that service before visiting the website www.capital-production.pl.
The Service Recipient may also completely prevent the loading of plugins on the website
by using appropriate browser extensions, e.g. blocking scripts with
“NoScript”.
7. The Controller uses remarketing tools on its website, i.e. Google Ads. Their
use involves the use of Google LLC cookies concerning the
Google Ads service. As part of the mechanism for managing cookie settings, the Service Recipient
has the possibility to decide whether the Service Provider will be able to use Google Ads
(controller of external cookies: Google LLC. with its registered office in the USA) in relation to them.

§ 7

FINAL PROVISIONS

1. The Controller applies technical and organisational measures ensuring the protection of processed
personal data appropriate to the threats and categories of data under protection, and in
particular secures the data against disclosure to unauthorised persons, taking

by an unauthorised person, processing in violation of applicable regulations and
alteration, loss, damage or destruction.
2. The Controller provides appropriate technical measures preventing the acquisition and
modification by unauthorised persons of personal data transmitted by
electronic means.
3. In matters not regulated by this Privacy Policy, the provisions of the
GDPR and other relevant provisions of Polish law shall apply accordingly.
4. The Controller updates this Privacy Policy in connection with legal changes or
development of activity. Information about modification of the Privacy Policy will be posted at
least 7 days before it enters into force on the Store website or sent by
e-mail to the Service Recipient who uses Electronic Services provided on a continuous basis
(Account).