Privacy Policy

Hi there, hello!

If you have landed here, it is a sure sign that you value your privacy. We completely understand that. This document gathers in one place the rules for processing personal data and for using cookies and other tracking technologies in connection with the operation of the website https://strefa-kostek.pl/

First, the formal information: the website is operated by STREFA KOSTEK SPÓŁKA CYWILNA, ul. Zemborzycka 59F, 20-445 Lublin, Poland, NIP (Tax ID): 9462666962, REGON: 366472356.

This privacy policy is written as questions and answers. We chose this format to keep the information clear and easy to read.

If you have any questions about this privacy policy, you can contact us at any time by sending a message to sklep@strefa-kostek.pl.

# 1: Who is the controller of your personal data?

The controller of your personal data is STREFA KOSTEK SPÓŁKA CYWILNA, ul. Zemborzycka 59F, 20-445 Lublin, Poland, NIP (Tax ID): 9462666962, REGON: 366472356.

# 2: Who can you contact about the processing of your personal data?

As part of implementing personal data protection in our organisation, we decided not to appoint a data protection officer, because in our situation it is not mandatory. For matters related to personal data protection and privacy in general, you can contact us at sklep@strefa-kostek.pl.

# 3: What information do we hold about you?

The scope of personal data processed is listed separately for each processing purpose in Appendix 1 to this privacy policy.

In addition, we use tools that collect a range of information about you related to your use of our website. In particular, this includes the following information:

• information about your device, operating system and web browser
• user identifier (user-ID)
• IP address, which is shortened and anonymised
• date of your visit to the website
• subpages viewed
• time spent on the website
• navigation between subpages
• mouse clicks or screen taps
• clicks on specific links
• the source from which you came to the website
• your age range
• your gender
• your approximate location, limited to the town or city
• your interests, determined based on your online activity
• This information is referred to in the rest of this privacy policy as "Anonymous Information"

In our view, Anonymous Information is not personal data in itself, because it does not allow us to identify you and we do not combine it with the typical personal data we collect about you. However, given the strict case law of the Court of Justice of the European Union and the divided opinions among lawyers, as a precaution, in case Anonymous Information is considered personal data, we have also included detailed explanations about the processing of this information in this privacy policy.

We are not able to give you access to Anonymous Information about you, because we cannot attribute any Anonymous Information to any specific user. In the tools that collect Anonymous Information, we only see aggregated statistics and information not linked to specific people. Moreover, we have no access at all to the information collected by some of the tools, as we are only interested in the proper working of the feature a given tool provides, not in the information it collects. For example, a particular plugin may collect some information, but it is not shared with us in any way, and we are not interested in it at all, because all we care about is that the plugin's feature (e.g. submitting a newsletter form) simply works.
Processing Anonymous Information allows us to let you use the features available on the website. Anonymous Information is also used for analytical, statistical and marketing purposes, such as setting up and targeting ads.

Because Anonymous Information is collected by external tools that we use, it is also processed by the providers of these tools in accordance with their terms of service and privacy policies.
Anonymous Information is also used by the providers of these tools to provide and improve their services, manage them, develop new services, measure ad effectiveness, protect against fraud and abuse, and personalise content and ads displayed on various services, websites and apps.

The tools we use that involve the collection of Anonymous Information are listed in Appendix 2 to this privacy policy.

# 4: Where do we get your personal data from?

In most cases, you provide it to us yourself. This happens when you:

• register a user account

• place an order

• submit a complaint or withdraw from a contract

• sign up for the newsletter

• add a comment

• add a review

• log in with Google or Facebook – in that case we receive your first name, last name and email address from these services

• turn on push notifications in the app or browser

• contact us by email

• submit a notice or appeal regarding content we store

• submit a request related to the processing of personal data

In Appendix 1 to this privacy policy, we have assigned the data source to each processing purpose.

In addition, some information about you may be collected automatically by the tools we use:

• the website's mechanism collects your IP address

• the newsletter system's mechanism collects your IP address and information about your activity related to the content sent to you in the newsletter, such as opening messages, clicking links, etc.

• the external tools listed in Appendix 2 to this privacy policy collect Anonymous Information related to your actions on the website

# 5: Is your data safe?

We take care of the security of your personal data. We have analysed the risks associated with each process of processing your data and then implemented appropriate security and personal data protection measures. We continuously monitor our technical infrastructure, train our staff, review our procedures and introduce necessary improvements. If you have any questions about your personal data, we are at your disposal at sklep@strefa-kostek.pl

# 6: For what purposes do we process your personal data?

The purposes of processing your personal data are listed in Appendix 1 to this privacy policy.

# 7: How long will we keep your personal data?

We keep your personal data for as long as it is justified for a given processing purpose, so processing periods vary depending on the purpose – you will find them in the table that forms the appendix to this privacy policy.

Please note that when processing of your data for one purpose ends, this does not necessarily mean that your personal data is completely deleted or destroyed, as the data may still be processed for another purpose for the period specified for it. For example, when an exchange of correspondence ends, we stop processing personal data for the purpose of handling correspondence, but the data collected in connection with that correspondence is still stored for archiving, to establish, pursue or defend claims related to the correspondence. Data is completely deleted or destroyed once we have fulfilled all purposes, usually after the limitation period for claims or administrative liability has expired, or after the period during which we are legally required to keep certain data.

# 8: Who are the recipients of your personal data?

We would venture to say that no modern business can do without services provided by third parties. We use such services too. Some of these services involve processing your personal data. The external service providers involved in processing your personal data are:

• the hosting provider, which stores data on its server

• providers of cloud software in which data is processed

• the accounting office, which processes your data shown on invoices

• the CDN and website attack protection provider (Cloudflare), whose servers handle traffic to the website, including your IP address

• the technical support provider, which gains access to data if the technical work concerns areas containing personal data

All the entities listed above process your data under data processing agreements concluded with us and guarantee an appropriate level of personal data protection.

If necessary, your data may be disclosed to a legal adviser or attorney bound by professional secrecy. This may be needed if we require legal assistance that involves access to your personal data.

Your personal data may also be passed on to tax offices to the extent necessary to fulfil tax, settlement and accounting obligations. This applies in particular to all declarations, reports, statements and other accounting documents containing your personal data.

Your data is shared with courier companies to the extent necessary to deliver your order. These companies become independent controllers of your personal data.

If you pay online, we pass your data (first name, last name, email address, amount and order number) to the payment operator you choose (e.g. Przelewy24, Tpay, Stripe). Payment operators are independent controllers of your data. We do not receive or store your payment card details.

Moreover, as regards Anonymous Information, it is accessible to the providers of the tools or plugins that collect it. The providers of these tools are independent controllers of the data collected in them and may share this data on the terms set out in their own terms of service and privacy policies, over which we have no control.

# 9: Do we transfer your data to third countries or international organisations?

Yes. Some providers of the tools and services we use (e.g. Google, Stripe, Cloudflare, JivoChat and, when you log in with Facebook, Meta) are based or have servers outside the European Economic Area, in particular in the USA and Brazil, so your data may be transferred to these countries. Such transfers are based on a European Commission decision confirming an adequate level of data protection (e.g. the EU-US Data Privacy Framework) or on standard contractual clauses approved by the European Commission. You can get a copy of these safeguards by writing to sklep@strefa-kostek.pl.

# 10: Do we use profiling? Do we make automated decisions based on your personal data?

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

We do use tools that may take certain actions depending on information gathered through tracking mechanisms, but we believe these actions do not significantly affect you, because they do not differentiate your situation as a customer, do not affect the terms of any contract you may conclude with us, etc.

Using certain tools, we may, for example, show you personalised ads based on your previous actions on the website or suggest products that may interest you. This is known as behavioural advertising. We encourage you to learn more about behavioural advertising, especially its privacy aspects. You will find detailed information, together with options to manage your behavioural advertising settings, here.

We would like to stress that within the tools we use, we only have access to Anonymous Information. This information is stored on the servers of the respective tool providers, and these servers may be located anywhere in the world.

# 11: What rights do you have in connection with the processing of your personal data?

The GDPR gives you the following potential rights related to the processing of your personal data:

• the right to access your data and receive a copy of it,
• the right to rectification (correction) of your data,
• the right to erasure of your data (if you believe there are no grounds for us to process your data, you can ask us to delete it),
• the right to restriction of processing (you can ask us to limit processing to storing your data or carrying out actions agreed with you, if you believe the data we hold is incorrect or that we are processing it without a legal basis),
• the right to object to processing (you have the right to object to processing based on legitimate interest; you should indicate your particular situation which, in your opinion, justifies us stopping the processing you object to; we will stop processing your data for these purposes unless we demonstrate that our grounds for processing override your rights or that we need your data to establish, pursue or defend claims),
• the right to data portability (you have the right to receive from us, in a structured, commonly used and machine-readable format, the personal data you provided to us under a contract or your consent; you can ask us to send this data directly to another entity),
• the right to withdraw your consent to the processing of personal data, if you have given such consent,
• the right to lodge a complaint with a supervisory authority (if you believe we are processing data unlawfully, you can file a complaint with the President of the Personal Data Protection Office (UODO) or another competent supervisory authority).

The rules for exercising the rights listed above are described in detail in Articles 16–21 of the GDPR. We encourage you to read these provisions. For our part, we feel it is important to explain that the rights listed above are not absolute and will not apply to every processing activity involving your personal data.

We would like to stress that one of the rights listed above always applies to you: if you believe that we have breached data protection laws when processing your personal data, you can lodge a complaint with the supervisory authority (the President of the Personal Data Protection Office).

You can also always ask us to tell you what data we hold about you and for what purposes we process it. Just send a message to sklep@strefa-kostek.pl. That said, we have made every effort to present the information you may be interested in fully in this privacy policy. You can also use the email address above if you have any questions about the processing of your personal data.

# 12: Do we use cookies or other similar technologies, and what exactly are they?

Our website, like almost every other website, uses cookies and other similar technologies, such as tracking codes or pixels, conversion APIs, etc.

Cookies and other similar technologies may be used to collect certain information that is then used for various purposes, from ensuring that individual website features work properly, through analysing user behaviour on the website, to delivering targeted advertising.

If you want to learn more about cookies and other similar technologies, you can read, for example, these materials:

• an explanation of cookies,
• an explanation of tracking pixels,
• an explanation of the Conversions API.

# 13: On what basis do we use cookies or other similar technologies?

We use cookies and other similar technologies based on your consent, except where cookies or other similar technologies are necessary to properly provide you with an electronic service.

Cookies or other similar technologies that are not necessary to properly provide an electronic service remain blocked until you consent to their use. During your first visit to the website, we show you a message asking for your consent.

Please note that disabling or restricting cookies or other similar technologies may prevent you from using some features of our website and may cause difficulties in using it, as well as many other websites that use cookies or other similar technologies. For example, if you block cookies from social media plugins, the buttons, widgets and social features on the website may not be available to you.

# 14: Can you disable cookies or other similar technologies?

Yes, you can manage your cookie and similar technology settings in your web browser. You can block all cookies or only selected ones. You can also block cookies from specific websites. You can also delete previously saved cookies and other website and plugin data at any time.

Web browsers also offer an incognito mode. You can use it if you do not want information about the pages you visit and the files you download to be saved in your browsing and download history. Cookies created in incognito mode are deleted when you close all incognito windows.

There are also browser plugins that let you control cookies, such as Ghostery (https://www.ghostery.com). Cookie control may also be provided by additional software, in particular antivirus packages, etc.

In addition, there are online tools that let you control certain types of cookies, in particular manage behavioural advertising settings collectively (e.g. www.youronlinechoices.com/, www.networkadvertising.org/choices).

Please note that disabling or restricting cookies or other similar technologies may prevent you from using some features of our website and may cause difficulties in using it, as well as many other websites that use cookies. For example, if you block cookies from social media plugins, the buttons, widgets and social features on our website may not be available to you.

# 15: For what purposes do we use our own cookies?

Our own cookies are used to ensure that the website's mechanisms work properly, such as correctly submitting the forms on the website.

Our own cookies also store information about the cookie consent you have given.

# 16: What third-party cookies are used?

Our website uses third-party cookies or other similar technologies related to the tools listed in Appendix 2 to this privacy policy. Individual tools may use more than one cookie, but we have decided not to list them in detail, so as not to overwhelm you with information, assuming that a list of tools with their purposes will be clearer for you than a list of every cookie or similar technology technically used by each tool.

We have also decided not to specify the scope of information collected in cookies for each tool, given that every tool collects information related to your characteristics and behaviour on our website. This is the Anonymous Information we mentioned earlier in this privacy policy.

Although we are aware of the requirements set by the Court of Justice of the European Union, we have nevertheless decided not to specify the lifetime of the cookies used by individual tools. To accurately state the lifetime of every cookie, we would have to overwhelm you with information, which would in no way serve the principle of clear and readable information. Moreover, cookie lifetimes may change so often on the tool providers' side that we cannot reliably keep track of them. While not specifying cookie lifetimes, we remind you that the only real way to control how long information is stored in cookies is to manage cookies yourself. You can delete cookies stored on your device at any time in your web browser.

Here we would like to stress once again that through cookies or other similar technologies we do not have access to information that would allow us to identify you. This is the Anonymous Information we mentioned in this privacy policy.

Moreover, while for statistical and marketing tools we can view various reports generated from Anonymous Information, for the other tools we do not get any access at all to the information collected in cookies, as we are only interested in whether the features for which a tool was installed work properly on our website.

# 17: Do we track your behaviour on our website?

Yes, we use tools that involve collecting information about your activity on our website. These tools are listed in Appendix 2 to this privacy policy.

# 18: Do we show you targeted ads?

Yes, we use advertising tools that allow us to target ads at specific audiences defined by various criteria, such as age, gender, interests, profession, job, and previous actions on our website. These tools are listed in Appendix 2 to this privacy policy.

# 19: How can you manage your privacy?

The answer to this question can be found in many places in this privacy policy, in the descriptions of individual tools, behavioural advertising, cookie consent, etc. However, for your convenience, we have gathered this information once more in one place. Below you will find a list of ways to manage your privacy.

• cookie settings in your web browser

• browser plugins that help manage cookies, e.g. Ghostery

• additional software for managing cookies,

• incognito mode in your web browser

• behavioural advertising settings, e.g. youronlinechoices.com

• settings provided by external tool providers (links to these settings are collected in Appendix 2 to this privacy policy)

# 20: What are server logs?

Using the website involves sending requests to the server on which the website is hosted. Every request sent to the server is recorded in the server logs.

The logs include, among other things, your IP address, the server date and time, and information about the web browser and operating system you use. The logs are recorded and stored on the server.

The data recorded in the server logs is not associated with specific people using the website and is not used by us to identify you.

Server logs are only supporting material used to administer the website, and their contents are not disclosed to anyone other than persons authorised to administer the server.

# 21: Do we have a mobile app?

Yes. The Strefa Kostek app for Android (Google Play) displays our online shop https://strefa-kostek.pl/ full screen in the Chrome browser. The same rules therefore apply in the app as on the website – everything described in this privacy policy (including cookies and the tools in Appendix 2) also applies to the app. The app only asks for permission to show notifications; it has no access to your contacts, photos, files or location.

We only send push notifications (e.g. about your order being shipped) if you turn them on. In that case, we store your device's notification subscription identifier and, if you are logged in, its link to your account, as well as information on whether a notification was displayed and clicked. Notifications are delivered by a Google service (Firebase Cloud Messaging), and the app fetches their content directly from our server. You can turn off notifications at any time in the app or in your phone settings.

# 22: How do I delete my account?

At any time, even without logging in: go to https://strefa-kostek.pl/usun-konto (the "Delete account" link is also in My account, including in the app). If you are logged in, you confirm the request with a single button; if not, we will send a confirmation link to the account's email address. You can also write to sklep@strefa-kostek.pl.

We delete your account and personal data no later than 30 days after you confirm the request: account data, addresses, loyalty points, wishlist, saved carts, newsletter and notification sign-ups, push notification subscriptions, and Google and Facebook login connections. We only keep what we are required to keep by law: orders and invoice and receipt data (for the period required by tax law), and data needed to handle ongoing returns, complaints or claims. Product reviews remain in the shop without your name.

# 23: Is there anything else you should know?

As you can see, the processing of personal data, the use of cookies and privacy management in general are quite complex topics. We have made every effort to make this document as informative as possible on the issues that matter to you. If anything is unclear, you want to learn more, or you simply want to talk about your privacy, write to us at sklep@strefa-kostek.pl.

# 24: Can this privacy policy change?

Yes, we may modify this privacy policy, in particular due to technological changes on our website and changes in the law. If a change affects how we process your personal data and we have your electronic contact details, you will receive a message about every change to the privacy policy.

This version of the Privacy Policy is effective from 2026-10-20

All archived versions of the privacy policy are linked below.

• Version effective from 2024-07-08 to 2026-10-20

Appendix 1 - purposes of personal data processing

Appendix 2 - list of external tools