User agreement

PRIVACY POLICY OF THE ONLINE STORE

WWW.CAPITAL-PRODUCTION.PL

§ 1

GENERAL PROVISIONS

1. The controller of personal data collected via the online store www.capital-production.pl is CAPITAL PRODUCTION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, entered in the Register of Entrepreneurs kept by the District Court for the Capital City of Warsaw, XIII Commercial Division of the National Court Register, KRS 0000980391, business address and address for correspondence: Aleja Prymasa Tysiąclecia 83A/332, 01‑242 Warsaw, Wola District, VAT No. 5273009178, REGON 522479599, e‑mail: Capitalproductionspzoo@gmail.com, phone: +48 452 550 428 (hereinafter “Controller” and also “Service Provider”).
2. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
3. All terms written with a capital letter in this Privacy Policy shall be understood as defined in the Terms and Conditions of the online store www.capital-production.pl.

§ 2

TYPES OF PERSONAL DATA, PURPOSE AND SCOPE OF PROCESSING

1. PURPOSE AND LEGAL BASIS. The Controller processes personal data of the Store Users in the following cases:
   1. registration of an Account to create and manage it — Art. 6 (1)(b) GDPR (performance of a contract for electronic services under the Terms);
   2. placing an Order to perform a Sales Contract — Art. 6 (1)(b) GDPR;
   3. using the Review System to enable the Client to express an opinion on the purchased Product and the concluded Sales Contract — Art. 6 (1)(f) GDPR (legitimate interest of the entrepreneur).
2. DATA TYPES. The User provides:
   1. for the Account: e‑mail address;
   2. for an Order: name and surname, address, VAT number, e‑mail address, phone number;
   3. for the Review System: name and surname, e‑mail address.
3. STORAGE PERIOD. Personal data are stored by the Controller:
   1. when processing is based on contract performance — as long as necessary to perform the contract, and thereafter for the limitation period for potential claims (generally six years, or three years for periodic claims and those related to business activity);
   2. when processing is based on consent — until consent is withdrawn, and after withdrawal for the limitation period for claims (as above).
4. During the use of the Store, additional information may be collected automatically, in particular: the User’s device IP address, external IP address of the Internet provider, domain name, browser type, access time, operating system type.
5. Upon separate consent (Art. 6 (1)(a) GDPR), data may also be processed to send commercial information by e‑mail or make marketing phone calls, including profiling, if the User has given such consent.
6. User activity in the Store may be profiled to select appropriate advertising content.
7. Profiling does not produce legal effects for the User; it only helps tailor marketing content.
8. Navigational data (e.g., clicked links) may also be collected — Art. 6 (1)(f) GDPR (legitimate interest to improve functionality).
9. Providing personal data is voluntary.
10. The Controller takes special care to ensure that collected data are:
    1. processed lawfully;
    2. collected for legitimate purposes and not further processed in a manner incompatible with those purposes;
    3. accurate, adequate and stored no longer than necessary for processing purposes.

§ 3

DISCLOSURE OF PERSONAL DATA

1. Personal data of Users are disclosed to service providers used by the Controller in operating the Store, in particular:
   1. delivery service providers;
   2. payment system providers;
   3. review survey providers;
   4. accounting firms;
   5. hosting providers;
   6. software providers for business operations;
   7. e‑mail marketing system providers;
   8. software providers for running the online store.
2. Depending on contractual arrangements, such providers either act on the Controller’s instructions (processors) or determine purposes and means of processing themselves (controllers).
3. Data are stored exclusively within the European Economic Area (EEA), except as specified in § 5 pt 5 and § 6.
4. Data may be transferred outside the EEA, in particular to the United States, due to the use of analytical and marketing tools (Google LLC, Meta Platforms Inc.). Transfers occur under Standard Contractual Clauses (SCC) approved by the European Commission (Art. 46 (2)(c) GDPR).

§ 4

CONTROL RIGHTS AND ACCESS TO DATA

1. A data subject has the right of access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent at any time without affecting legality of prior processing.
2. Legal bases for User requests:
   1. access — Art. 15 GDPR;
   2. rectification — Art. 16 GDPR;
   3. erasure (right to be forgotten) — Art. 17 GDPR;
   4. restriction — Art. 18 GDPR;
   5. portability — Art. 20 GDPR;
   6. objection — Art. 21 GDPR;
   7. withdrawal of consent — Art. 7 (3) GDPR.
3. To exercise these rights, please e‑mail: cptheseller@gmail.com
4. The Controller fulfils or refuses the request without undue delay, no later than one month from receipt. In complex cases this period may be extended by up to two months, with prior notice within one month.
5. If data processing violates GDPR, the data subject may lodge a complaint with the Polish Data Protection Authority.

§ 5

COOKIES

1. The Controller’s website uses cookies.
2. Cookies are necessary for proper service provision. They contain information required for the site to function and allow compilation of visit statistics.
3. Two types of cookies are used: “session” and “persistent”.
   1. “Session” cookies are temporary and remain on the User’s device until logging out (leaving the site).
   2. “Persistent” cookies remain for the time specified in their parameters or until manually deleted by the User.
4. First‑party cookies help analyse User interaction with site content. They do not record specific personal data but serve statistical purposes.
5. Third‑party cookies (Google Analytics, controller: Google LLC, USA) are used for anonymous statistics.
6. Cookies may also be used by advertising networks (especially Google) to display ads tailored to User behaviour.
7. The User can control cookie access to their device by:
   1. selecting cookie categories they agree to immediately after entering the Store (cookie banner);
   2. changing browser settings (details available in browser help).

§ 6

ADDITIONAL SERVICES RELATED TO USER ACTIVITY

1. The Store uses social plugins (Facebook, Instagram, Twitter, YouTube, Google). When viewing a page containing such a plugin, the User’s browser establishes a direct connection with the servers of these services.
2. If the User does not want social networks to link data collected during visits to their profiles, they must log out before visiting the Store or use browser extensions that block plugins (e.g., NoScript).
3. The Controller uses Google Ads remarketing tools (cookies from Google LLC, USA). You can manage these cookies through the cookie settings mechanism.

4. If the User uses a plugin, for example by clicking the “Like” button or the “Share” button, the corresponding information will also be sent directly to the server of the given provider and stored there.

5. The purpose and scope of data collection and their further processing and use by the service providers, as well as the User’s rights in this regard and the options for changing settings to protect privacy, are described in the privacy policies of the service providers:
   https://www.facebook.com/policy.php
   https://help.instagram.com/519522125107875?helpref=page_content
   https://help.twitter.com/en/rules-and-policies
   https://www.youtube.com/intl/ALL_pl/howyoutubeworks/user-settings/privacy/ 
   https://policies.google.com/privacy?hl=pl&gl=ZZ. 

6. If the User does not want social networking services to associate the data collected during the visit to www.capital-production.pl directly with their profile, they must log out of the service before visiting the website. The User may also completely block plugins from loading on the website by using appropriate browser extensions, e.g., script blockers like “NoScript”.

7. The Administrator uses remarketing tools on their site, such as Google Ads. Their use involves the use of Google LLC’s cookies related to Google Ads services. As part of the cookie management mechanism, the User can decide whether the service provider may use Google Ads (external cookies administrator: Google LLC, based in the USA) in relation to them.

 

§ 7

FINAL PROVISIONS

1. The Controller applies technical and organisational measures appropriate to the risks and categories of protected data, in particular safeguards against unauthorised access, loss, alteration, or destruction.
2. The Controller provides technical measures to prevent the acquisition and modification of personal data transmitted electronically by unauthorised persons.
3. In matters not regulated by this Privacy Policy, GDPR and other applicable Polish law shall apply.
4. The Controller updates this Policy in connection with legal changes or business development. Information on modifications will be posted on the Store website at least seven days before they take effect or sent by e‑mail to Users with ongoing electronic services (Account).