Privacy Policy and GDPR

§ 1. Data controller

1. The controller of the personal data of the Buyer or User is the Seller:

MYZER VMT Spółka z ograniczoną odpowiedzialnością

with its registered office in Bielawa, ul. Tkacka 17, 58-260 Bielawa, Poland,

entered in the Register of Entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under KRS number: 0001130515,

Tax ID (NIP): 8822149206, REGON: 529823278,

registry court: District Court for Wrocław-Fabryczna in Wrocław (Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu), 9th Commercial Division of the National Court Register,

share capital: PLN 5,000.00

President of the Management Board: Artur Myziak,

contact e-mail: myzer@myzer.pl,

website: www.myzer.pl.

2. The Buyer or User may contact the controller:

a) by post at the registered office address stated in the Terms and Conditions;

b) by e-mail at: myzer@myzer.pl

§ 2. Purposes, scope, legal bases and period of data processing

1. The Controller processes the personal data of Buyers and Users for the purpose of providing services by electronic means via the Store, in particular for the purpose of maintaining and administering the Account, accepting Requests for Quotation and Orders, concluding and performing Agreements, processing payments and deliveries, and conducting communication relating to the performance of the Agreement.

2. For the purposes indicated in paragraph 1, the Controller may process, in particular:

a) the first name and surname or the business name of the entrepreneur;

b) the e-mail address and telephone number;

c) the residential, registered office, delivery or invoicing address;

d) the Tax ID (NIP) and other data necessary to issue accounting documents;

e) data relating to the Account, Request for Quotation, Order, payment, delivery, complaint and correspondence;

f) information on purchased Products and Order history.

3. The legal basis for processing data for the purpose of concluding and performing the Agreement and providing services by electronic means is Article 6(1)(b) of the GDPR (Regulation (EU) 2016/679).

4. The Controller also processes personal data for the purpose of fulfilling legal obligations, in particular tax, accounting and bookkeeping obligations and obligations relating to the handling of complaints. The legal basis for such processing is Article 6(1)(c) of the GDPR.

5. If the Buyer or User gives the relevant consent, the Controller processes their data for the purpose of sending a newsletter and commercial, marketing and promotional information concerning the Products, services, offering or business of the Controller, including for the purpose of sending communications tailored to their interests, activity in the Store and purchase history.

6. The Controller may process the data of Buyers and Users for analytical and statistical purposes, in particular for the purpose of:

a) measuring traffic in the Store;

b) determining how the Store is used;

c) analysing the effectiveness of advertising campaigns;

d) improving the functionality, content and security of the Store;

e) developing the offering and tailoring it to the interests of Buyers and Users.

7. The Controller may process data for marketing purposes, including for the purpose of:

a) displaying advertisements concerning the Products or services of the Controller;

b) conducting remarketing;

c) creating advertising audiences;

d) measuring the effectiveness of advertisements;

e) tailoring advertisements, content, offers and product recommendations to the anticipated interests of Buyers and Users.

8. In connection with the purposes referred to in paragraphs 6 and 7, the Controller may use, in particular:

a) Google Analytics 4;

b) Google Ads, including remarketing functions;

c) Meta Pixel - once that tool has been implemented in the Store;

d) analytical and recommendation tools available within the Shopify platform;

e) mailing tools enabling audience segmentation;

f) tools using artificial intelligence that support behavioural analysis, personalisation of content and offers, Product recommendations and customer service.

9. For analytical, marketing and personalisation purposes, the Controller may process, in particular:

a) the IP address;

b) online identifiers and cookie identifiers;

c) information about the device, operating system, browser and approximate location;

d) information about the source of entry to the Store and the advertising campaign;

e) information about the subpages visited, Products viewed, content searched for and time spent using the Store;

f) information about Products added to the basket, purchased or abandoned;

g) Order history;

h) information about the opening of marketing messages and clicking on the links contained therein;

i) assigned interests, preferences and marketing segments;

j) information provided in the course of contact with customer service - to the extent necessary to respond and to improve the quality of service.

10. The legal basis for processing data using analytical and marketing cookies, pixels and similar technologies is the consent of the Buyer or User, i.e. Article 6(1)(a) of the GDPR.

11. The legal basis for sending commercial or marketing information by e-mail or other means of electronic communication is the consent of the Buyer or User, in accordance with Article 6(1)(a) of the GDPR and the relevant provisions of the Electronic Communications Law (Prawo komunikacji elektronicznej).

12. The Controller may process data relating to Order history, use of the Account and the preferences of the Buyer or User for the purpose of conducting internal analyses, customer segmentation, recommending Products, improving the offering, preventing abuse and conducting direct marketing. The legal basis for such processing is the legitimate interest of the Controller referred to in Article 6(1)(f) of the GDPR, provided that the use of cookies or similar technologies other than strictly necessary ones requires prior consent.

13. The legitimate interest of the Controller also includes the establishment, exercise and defence of claims, ensuring the security of the Store, preventing abuse and conducting aggregated analyses concerning the operation of the Store.

14. Providing the data necessary to conclude or perform the Agreement is voluntary, but failure to provide it may make it impossible to conclude or perform the Agreement, create an Account, place an Order or use a specific functionality of the Store.

15. Giving consent to analytics, marketing, personalisation, the newsletter or commercial information is voluntary. Failure to give consent does not affect the ability to use the basic functions of the Store or to make a purchase.

16. Data processed in connection with the conclusion and performance of the Agreement are stored for the period necessary to perform the Agreement and thereafter for the period required by law or necessary to establish, exercise or defend claims.

17. Data contained in accounting, bookkeeping and tax documents are stored for the period required by the applicable provisions of law.

18. Data processed on the basis of consent are processed until such consent is withdrawn, the consent expires, the relevant cookies expire or the Controller ceases to use the given tool, whichever occurs first.

19. Data processed on the basis of the legitimate interest of the Controller are stored until the purpose of processing ceases or an objection is effectively lodged, unless further processing is permitted or required under the provisions of law.

20. Information making it possible to demonstrate that consent was given or withdrawn may be stored for the period necessary to defend against any claims or to demonstrate the Controller's compliance with the law.

§ 3. Complaints

1. For the purpose of handling complaints, the Seller processes the personal data of Buyers and Users submitting complaints, in particular the e-mail address, first name, content of the complaint, circumstances of the event giving rise to the complaint, and information obtained in the course of handling the complaint, including in the course of clarifying the event giving rise to it. In the course of handling the complaint, the Seller may process a range of other information, including the user's first name and surname, information on the use by the Buyer or User of the newsletter service, cookies or other similar technologies, and information about devices.

2. Such data are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing services by electronic means, administering the Account, Requests for Quotation and Orders, and performing the Sales Agreement, including handling complaints in accordance with the Terms and Conditions. Such data are processed for the period necessary to handle the complaint and thereafter for the period necessary to establish, exercise or defend any claims or for the period required by the provisions of law.

§ 4. Investigations and pursuit of claims

1. Where investigation proceedings are initiated concerning a possible breach of the provisions of the terms and conditions or of the law, the principles of community life or good practice, the controller may process the personal data of Buyers and Users until the conclusion of the pending proceedings and until the expiry of the limitation period for the controller's claims against Buyers and Users, which is usually 3 years but may be longer in specific cases provided for by law.

2. Such data will then be processed, including disclosed, in accordance with Article 6(1)(f) of the GDPR, i.e. in the legitimate interest of the controller consisting in the establishment, exercise or defence of claims against Buyers and Users, subject to the data subject's right to object and to an assessment of overriding interests in accordance with the GDPR.

§ 5. Recipients of the data of Buyers and Users

1. The personal data of Buyers and Users may be transferred to entities supporting the Controller in operating the Store, solely to the extent necessary to perform the tasks entrusted to them.

2. Recipients of the data may include, in particular:

a) providers of the e-commerce platform, hosting, IT infrastructure, cloud services, software and technical support;

b) Shopify International Limited, Shopify Inc. and the relevant entities of the Shopify group - in connection with operating the Store on the Shopify platform and using its analytics and recommendation functions;

c) Google Ireland Limited and the relevant entities of the Google group - in connection with the use of Google Analytics 4, Google Ads, remarketing and Google Consent Mode;

d) Meta Platforms Ireland Limited and the relevant entities of the Meta group - once the Meta Pixel tool has been launched;

e) providers of mailing and newsletter systems and systems used for audience segmentation;

f) providers of tools using artificial intelligence, used for analyses, recommendations, content personalisation, marketing automation or customer service;

g) payment operators, banks, courier, postal and logistics companies;

h) providers of accounting, tax, legal, audit, advisory, marketing and administrative services;

i) public authorities and other entities authorised to obtain data under the provisions of law.

3. Depending on the type of service provided, the recipients of the data may act as entities processing data on behalf of the Controller, separate data controllers.

4. The current list of analytical and marketing tools and tools using cookies, together with information on their providers, purposes and periods of operation, is available in the cookie consent management panel in the Store.

§ 6. Transfer of data outside the European Economic Area

1. In connection with the use of the services of providers of the Shopify platform, Google and Meta tools, mailing systems, cloud services and tools using artificial intelligence, the personal data of Buyers and Users may be transferred to countries outside the European Economic Area, in particular to the United States.

2. Data are transferred outside the European Economic Area solely on the basis of, and subject to, the safeguards required by the GDPR, in particular:

a) on the basis of a decision of the European Commission finding an adequate level of data protection, including - in the case of entities participating in the programme - the decision concerning the EU-U.S. Data Privacy Framework;

b) on the basis of standard contractual clauses approved by the European Commission;

c) on the basis of binding corporate rules;

d) using other mechanisms and additional safeguards provided for by the provisions of law.

3. Information on the transfer basis applied by a specific provider may be obtained by contacting the Controller.

§ 7. Rights of data subjects

1. Every data subject has the right:

1) of access - to obtain from the controller confirmation as to whether their personal data are being processed. Where personal data concerning the person are being processed, they are entitled to access them and to obtain the following information: the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data have been or will be disclosed, the period for which the data will be stored or the criteria used to determine that period, the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and the right to object to such processing (Article 15 of the GDPR);

2) to obtain a copy of the data - to obtain a copy of the data undergoing processing, whereby the first copy is free of charge and for any further copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) of the GDPR);

3) to rectification - to request the rectification of personal data concerning them which are inaccurate, or to have incomplete data completed (Article 16 of the GDPR);

4) to erasure - to request the erasure of their personal data where the controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 of the GDPR);

5) to restriction of processing - to request the restriction of processing of personal data (Article 18 of the GDPR) where:

a) the data subject contests the accuracy of the personal data - for a period enabling the controller to verify the accuracy of such data,

b) the processing is unlawful and the data subject opposes the erasure of the data and requests the restriction of their use instead,

c) the controller no longer needs the data, but they are required by the data subject for the establishment, exercise or defence of claims,

d) the data subject has objected to processing - pending verification of whether the legitimate grounds of the controller override the grounds of the data subject's objection;

6) to data portability - to receive the personal data concerning them which they have provided to the controller in a structured, commonly used and machine-readable format, and to request that such data be transmitted to another controller, where the data are processed on the basis of the data subject's consent or an agreement concluded with them and where the processing is carried out by automated means (Article 20 of the GDPR);

7) to 7) to object - to object, on grounds relating to the particular situation of the data subject, to the processing of their data on the basis of Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. Where data are processed for direct marketing purposes, the data subject may at any time object to the processing of their data for such marketing, including profiling to the extent that it is related to direct marketing. Following an objection, the data will no longer be processed for such purposes.

8) to withdraw consent - to withdraw consent to the processing of personal data at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) of the GDPR),

9) not to be subject to a decision based solely on automated processing - the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning that person or similarly significantly affects them, subject to the exceptions provided for in Article 22 of the GDPR.

2. In order to exercise the above rights, including the right to withdraw consent, the data subject should contact the Controller using the contact details provided, in particular by sending an e-mail to: myzer@myzer.pl, clearly indicating which right they wish to exercise and to what extent.

§ 8. President of the Personal Data Protection Office

The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) with its seat in Warsaw, ul. Stawki 2, who may be contacted as follows:

1) by post: ul. Stawki 2, 00-193 Warszawa;

2) via the electronic inbox available at: https://www.uodo.gov.pl/pl/p/kontakt;

3) by telephone: (22) 531 03 00.

§ 9. Data protection officer

The Controller has not appointed a data protection officer. In matters relating to the protection of personal data, the Controller may be contacted at: myzer@myzer.pl.

§ 10. Changes to the privacy policy

1. The privacy policy may be supplemented or updated in accordance with the current needs of the controller in order to provide Buyers and Users with up-to-date and reliable information concerning their personal data and information about them. Any changes to the privacy policy will be published on the Store website.

2. This privacy policy is effective from 20 July 2026.

§ 11. Profiling, personalisation and automated data processing

1. The Controller applies profiling of Buyers and Users for marketing and analytical purposes and for purposes relating to the personalisation of the use of the Store.

2. Profiling may consist in the automated analysis of information concerning, in particular:

a) subpages visited and Products viewed;

b) content searched for;

c) Products added to the basket, purchased or abandoned;

d) Order history;

e) the source of entry to the Store;

f) responses to advertisements and marketing messages;

g) assigned interests, preferences and audience segments;

h) the manner of using the Store.

3. On the basis of the above information, the Controller or the tools used by the Controller may predict the interests of the Buyer or User, assign them to specific audience groups and select the advertisements, content, offers, marketing messages and product recommendations displayed.

4. Profiling may be carried out using statistical algorithms, recommendation systems, marketing automation tools and solutions using artificial intelligence.

5. The effect of profiling may be the receipt or display of content, advertisements, offers, newsletters and product recommendations better tailored to the anticipated interests of the Buyer or User.

6. Profiling applied by the Controller does not lead to decisions being taken in respect of Buyers or Users based solely on automated processing which would produce legal effects concerning them or similarly significantly affect them. In particular, the Controller does not apply automated customer scoring, automated refusal of sale or automated deprivation of the possibility of taking advantage of the offering.

7. Tools using artificial intelligence may support the Controller, in particular, in:

a) analysing the manner of using the Store;

b) creating audience segments;

c) recommending Products;

d) tailoring content and offers;

e) preparing or optimising marketing communications;

f) handling enquiries addressed to the Controller.

8. Where an assistant or chatbot using artificial intelligence is made available, the User will be informed that they are communicating with an AI system.

9. The tools currently in use, including analytical, advertising, recommendation and artificial intelligence-based tools, are indicated in the cookie consent management panel or in the relevant information made available in the Store.

10. The introduction of a tool resulting in a material change in the purposes of processing, the categories of data used, the recipients of the data, the principles of profiling or the consequences for Buyers and Users may require an appropriate update of this Policy before that tool is put into use.

§ 12. Cookies and similar technologies

1. The Store uses cookies, pixels, tags, local device storage and other similar technologies, hereinafter collectively referred to as "cookies".

2. Cookies may be used in the following categories:

a) strictly necessary cookies - required for the proper operation of the Store, ensuring security, operating the basket, logging in, payments, remembering privacy choices and performing functions expressly requested by the User;

b) functional cookies - used to remember settings and for additional personalisation of the Store's functions;

c) analytical and statistical cookies - used to measure traffic, analyse the manner of using the Store and improve its operation;

d) marketing and advertising cookies - used to conduct remarketing, measure the effectiveness of advertisements, create audience groups and tailor advertisements to interests;

e) personalisation cookies - used to tailor content, offers and Product recommendations.

3. The Controller may use, in particular, the following tools:

a) Google Analytics 4 - for compiling statistics and analysing Users' traffic and behaviour;

b) Google Ads - for measuring the effectiveness of campaigns, conducting remarketing and tailoring advertisements;

c) Google Consent Mode v2 - for passing information on the User's consent choices to Google tools;

d) Meta Pixel - once implemented, for measuring the effectiveness of advertisements, creating audience groups and conducting remarketing on Meta services;

e) Shopify analytical and recommendation tools - for analysing the operation of the Store and recommending Products;

f) mailing tools - for measuring the effectiveness of messages, audience segmentation and personalisation of the newsletter;

g) other analytical, marketing or recommendation tools or tools using artificial intelligence, if implemented in accordance with this Policy.

4. Strictly necessary cookies may be used without separate consent where they are required to carry out the transmission of an electronic communication, to ensure security or to provide a service expressly requested by the Buyer or User.

5. Functional, analytical, statistical, marketing, advertising and personalisation cookies are activated only after obtaining the prior consent of the Buyer or User, given via the banner or the cookie consent management panel.

6. In the case of Google tools, the Controller applies Google Consent Mode v2 in the basic configuration, in which Google tags relating to analytics and advertising remain blocked until the relevant consent is given. Before consent is given, no data are transmitted to Google via those tags.

7. The Buyer or User may:

a) accept all categories of cookies;

b) reject all cookies other than strictly necessary ones;

c) make a separate choice for individual categories;

d) change or withdraw consent at any time using the consent management panel available in the Store.

8. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before its withdrawal.

9. Failure to consent to cookies other than strictly necessary ones does not prevent a purchase from being made or the basic functions of the Store from being used, but may limit the operation of additional functions, the personalisation of content or the relevance of the recommendations displayed.

10. A detailed and up-to-date list of cookies, their providers, purposes, categories and storage periods is available in the cookie consent management panel.

11. Web browser settings may be used as an additional means of blocking or deleting cookies. However, relying solely on browser settings may not ensure full control over all the technologies used in the Store.

12. Meta Pixel will be activated only after its technical implementation, the placement of the relevant information in the cookie panel and the obtaining of the User's consent to marketing cookies.

§ 13. Legal acts referred to in this clause

1. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (RODO).

2. Electronic Communications Law - the Act of 12 July 2024 - Electronic Communications Law (Prawo komunikacji elektronicznej).

3. Act on the Provision of Services by Electronic Means - the Act of 18 July 2002 on the Provision of Services by Electronic Means (ustawa o świadczeniu usług drogą elektroniczną).

4. Accounting Act - the Act of 29 September 1994 on Accounting (ustawa o rachunkowości).

Version of 21 July 2026