Privacy and Cookie Policy

This is a translation of the Polish original. In case of any discrepancy, the Polish version prevails.

publication date: 24.01.2025

I treat your personal data and its protection very responsibly. This Privacy Policy applies to the personal data that I process in connection with my business activity.

The document you are reading is based on legal provisions concerning personal data, including the provisions of the GDPR (General Data Protection Regulation of 27 April 2016) and the Act of 10 May 2018 on the protection of personal data (ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych).

The content of the Privacy Policy may change at any time. I will inform you of any changes and provide the current version of the document. I cooperate with entities that ensure a high level of protection of the personal data processed.

Contact me – In any matter related to the protection of your personal data, you can contact me at kontakt@upiekszaj.pl and by phone.

Data controller – The controller of your personal data processed in connection with my business activity is Upiększaj Patrycja Korzeniowska NIP: 5361981542 REGON: 529205994 ul. Projektowana 13c 05-119 Legionowo.

What does this Privacy Policy contain? – Here you will find information, among other things, about the principles of processing your personal data, the purposes for which we process your data and the legal bases that allow me to do so, the tools I use on the website, as well as the recipients of your data and the rights you have.

Report illegal content or content that does not comply with the terms of use of my website!

For the purpose of reporting illegal content and content that does not comply with the terms of use of the website www.upiekszaj.pl, the Controller has created a Contact Point: sklep@upiekszaj.pl

The indicated e-mail address is used for contact regarding content posted within my website.

What data do I process, for what purpose and on what basis?

I process the personal data I receive from you for the following purposes and on the following legal bases:

Contact with you

Scope of data:

• e-mail address (first and last name), data contained in the content of the message

• phone number

• other data provided by you in the content of the correspondence

Legal basis: The legal basis for such processing is Art. 6(1)(a) GDPR, which allows me to process data on the basis of consent in order to respond to your message, and Art. 6(1)(f) GDPR, which allows me to pursue my legitimate interest, which is ensuring smooth and effective communication between the website controller and the user.

Placing and fulfilling an order for products/services

Scope of data:

• first and last name

• address

• e-mail address

• residential address

• phone number

additionally:

• NIP (tax identification number)

• data about the business activity conducted

Providing the data is voluntary, but necessary to fulfil the order.

Legal basis: The legal basis for such processing is Art. 6(1)(b) GDPR, which allows data to be processed in order to take steps towards concluding a contract and in order to perform the contract concluded by placing an order.

Issuing an invoice and fulfilling legal and tax obligations

Scope of data:

• data concerning the business activity

• first and last name

• address

• NIP (tax identification number)

Legal basis: The legal basis for such data processing is primarily Art. 6(1)(c) GDPR, which allows personal data to be processed if such processing is necessary for the controller to comply with obligations arising from the law.

Handling complaints and handling withdrawal from the contract

Scope of data:

• e-mail address

• first and last name

• data contained in the content of the complaint

• bank account number

• residential address

• phone number

Legal basis: The legal basis for such data processing is, firstly, Art. 6(1)(b) GDPR, which allows personal data to be processed if they are necessary for the performance of a contract or for taking steps towards concluding a contract, and secondly, Art. 6(1)(c) GDPR, which allows personal data to be processed if such processing is necessary for the controller to comply with obligations arising from the law.

Marketing purpose (newsletter)

Scope of data:

• e-mail address

• first name

Legal basis: The legal basis for such data processing is primarily Art. 6(1)(a) GDPR, i.e. your consent to receive commercial information and marketing content from me, and Art. 6(1)(f) GDPR, which allows personal data to be processed if, in this way, the controller pursues its legitimate interest (in this case, the marketing of its own services and products).

Contact with you via the Instagram platform using the ManyChat tool

Scope of data:

- identification data (first and last name, e-mail address),

- publicly available information in social media profiles,

- linked pages and accounts,

- ICT data (IP addresses, geographic location, usage data, cookie data, browser data),

- data from chat history and content,

- information on the use of the chatbot,

- other electronic and personal data, the scope of which is determined and controlled by the Controller in accordance with the functions available within the ManyChat service.

Legal basis:

For communication purposes, the Controller processes your data on the basis of Art. 6(1)(f) GDPR, i.e. the legitimate interest of the controller.

For the purpose of presenting you with commercial information about products or services, the Controller processes your data on the basis of Art. 6(1)(a) GDPR, i.e. your consent given before such information is sent via ManyChat.

For the purpose of subscribing to the Controller, i.e. receiving informational and educational content as well as commercial information about the Controller's services and products, the Controller processes your data on the basis of Art. 6(1)(a) GDPR, i.e. your consent to the subscription given before such information is sent via ManyChat.

For the purpose of performing an obligation in the case of certain content, the controller processes your data on the basis of Art. 6(1)(b) GDPR with regard to the informational content sent, depending on the content of the message sent while using the ManyChat tool.

Archival and evidentiary purpose, for securing information that may be used to demonstrate facts

Scope of data:

• all data listed in the table concerning data processing by me

Legal basis: The legal basis for such data processing is Art. 6(1)(f) GDPR, which allows personal data to be processed if, in this way, the controller pursues its legitimate interest (in this case, the controller's interest is to hold personal data that will make it possible to prove facts related to the use of the website, the performance of the contract, and the processing of data on a justified legal basis).

Establishing, pursuing or defending against claims

Scope of data:

• all of the data listed above

Legal basis: The legal basis for such data processing is Art. 6(1)(f) GDPR, which allows personal data to be processed if, in this way, the controller pursues its legitimate interest (in this case, the controller's interest is to hold personal data that will make it possible to establish claims, pursue claims or defend against claims of persons using the website, third parties or customers).

Managing the website, using tools that improve the website and analyse data related to the use of the website

Scope of data:

• IP

• behaviour on the website

Legal basis: The legal basis for such data processing is Article 6(1)(f) GDPR, which allows personal data to be processed if the controller thereby pursues its legitimate interest (in this case, the controller's interest is action aimed at optimising the website, including the content presented on the website, to the needs of users, and improving the controller's offer).

Use of cookies on the website

Scope of data:

• IP

• user behaviour on the website

Legal basis: The legal basis for such data processing is Article 6(1)(a) GDPR, which allows personal data to be processed with your consent. You give your consent during your first visit to the website.

Management of the controller's social media profiles

Scope of data:

• data related to the use of the given social media platform

Legal basis: The basis for processing is the controller's entitlement exercised pursuant to Article 6(1)(f) GDPR, i.e. the controller's legitimate interest in managing its profile on the given platform, and your consent (Article 6(1)(a) GDPR), which you express, e.g., by joining a group created by the controller on the given platform.

Fulfilment of obligations in the field of personal data protection (e.g. the obligation to keep registers and records)

Scope of data:

• the scope of data is determined by legal provisions and varies depending on the content of the given legal obligation incumbent on the controller

Legal basis: The basis for processing is Article 6(1)(c) GDPR, i.e. it takes place on the basis of legal provisions which require the processing of personal data.

Posting comments/reviews on the website

Scope of data:

• first name

• e-mail address

Legal basis: The basis for processing is Article 6(1)(a) GDPR, i.e. your consent, which you give in order to add a comment on our website.

Handling reports concerning illegal content and content inconsistent with the terms of use of the services of my website

Scope of data:

• first name

• surname

• e-mail address

• data indicated in the report

Legal basis:

The basis for processing is Article 6(1)(c) GDPR, i.e. it takes place on the basis of legal provisions which require the processing of personal data.

Please remember that your data will also be processed after the handling of the report has been completed. The legal basis for such processing is the legitimate purpose of archiving the report in order to demonstrate, in the future, the course of its handling and to defend against possible reports (Article 6(1)(f) GDPR).

Researching preferences regarding services and products and analysing business processes by conducting surveys

Scope of data:

• data indicated in the survey and in the answers to the survey questions

Legal basis:

The basis for processing the data indicated by you in the survey or in the answers to the survey questions is your consent (Article 6(1)(a) GDPR).

Participation in the survey and providing me with data is voluntary. The data provided will subsequently be processed by me for archival purposes and for possible defence against claims (Article 6(1)(f) GDPR).

Your rights related to the processing of personal data

I hereby inform you that you have the following rights related to the processing of your personal data:

If you wish to exercise your right, write to the address indicated in this document

1. Right of access to information — means that every person whose data is processed has the right to know what happens to their personal data. It is, among other things, for this purpose that the Privacy Policy you are currently reading has been created.
2. Right of access to personal data — means that if I, as the controller of your data, receive from you a request for access to your data, I am obliged to provide you with such information. I must fulfil my obligations in this respect, as the data controller, without undue delay and no later than within one month. If this is not possible within that time limit, I am obliged at least to inform you whether I process your data, and I may then extend the time limit for a complete response to your request by two months.
3. Right to rectification of personal data — means that you may request that the controller of your data rectify inaccurate data or complete incomplete data.
4. Right to erasure of personal data, right to be forgotten — means that you may demand that I, as the controller of your personal data, erase them and inform the person to whom your data has been disclosed of their erasure. You also have the right to demand that your data which I have made public also be erased by other controllers. As the controller of your data, I am also obliged, at your request, to inform you to which recipients your data subject to erasure has been disclosed.
5. Right to restriction of processing of personal data — means that you may demand restriction of the processing of your personal data. This is the case, for example, when you contest the accuracy of the processed data or when you consider that the data is no longer needed for the purposes of processing.
6. Right to object to the processing of personal data — means that you may object to your data being processed by the controller.
7. Right to data portability — means that, subject to certain conditions being met, you may request that your data be transmitted directly to another controller indicated by you.
8. Right to lodge a complaint — means that as soon as you consider that my processing of your data infringes legal provisions, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
9. Right to withdraw consent — means that, where data is processed on the basis of your consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of the processing of your personal data until the consent is withdrawn.

Recipients of data

Your personal data may be transferred to third parties whose services I use in connection with running the website www.upiekszaj.pl and my social media profiles. I assure you that I carefully select the entities with which I cooperate or whose services I use, and I am always guided by ensuring appropriate data protection.

Below you will find a list of all the entities whose services I use. They have been divided into two groups: the first group consists of entities that process data within the European Economic Area, and the second — entities that process data outside the European Economic Area (e.g. in the USA).

Where personal data is transferred outside the European Economic Area, the entities carrying out such processing maintain an appropriate level of data protection compliant with EU standards, inter alia through the use of standard contractual clauses adopted by the European Commission.

Entities processing data within the European Economic Area:

Hostinger – A service providing IT system maintenance and hosting services (storing data on a server).

Furgonetka – A service responsible for shipments.

Przelewy24 – A provider of fast online payments.

Entities processing data outside the European Economic Area:

MANYCHAT INC., 535 Mission St, San Francisco, CA 94105, USA – A tool used for efficient communication with the community and for pursuing marketing purposes, enabling automated messages to be sent on the META platform within the Instagram social networking service.

Requirement to provide personal data

As a rule, providing personal data is voluntary and depends on your decision. However, it may happen that providing certain personal data is necessary to meet your expectations regarding the conclusion of a contract or the use of my services. If you place an order for a product, providing your data is necessary to fulfil your requests related to the concluded contract.

If you contact me in any matter related to the website, the products or the services I provide, providing your contact details may be necessary to answer the question you have asked.

If the requirement to provide your data results from legal provisions, providing the data is your obligation.

Automated decision-making and profiling

I do not use your data for automated decision-making that could affect your legal situation or produce other similarly significant effects concerning you.

The tools implemented on the website may profile user behaviour in order to improve the website and to tailor the displayed content to the user's preferences, whereby in this case mainly data of an anonymous nature (location, age, interests) is analysed.

Like every website, I use cookies and analytical tools. Further on in this Privacy Policy, I explain how cookies work and how these activities affect you.

How long do I process your data?

In accordance with applicable law, I process your data only for as long as is necessary to achieve the specified purpose. After this period, your personal data will be irreversibly deleted or destroyed. The additional year related to the processing of personal data collected for the performance of a contract results from the fact that you may submit a claim just before the limitation period expires.

I process your data for the following period:

3 or 6 years + 1 year – with regard to personal data processed for the purpose of establishing, pursuing or defending claims; the choice of 3 or 6 years depends on whether both parties are entrepreneurs or not;

until an objection is effectively raised or the purpose of processing is achieved – with regard to personal data processed on the basis of the legitimate interest of the controller;

until the data becomes outdated or loses its usefulness – with regard to personal data processed mainly for the purposes of administering the website;

until consent is withdrawn or the data loses its usefulness – with regard to personal data processed on the basis of your consent, unless expressly stated otherwise at the time consent is given.

Social media

I run profiles on social media platforms, and this website contains plugins redirecting to them.

I am the administrator of my profile on a given platform, and I process your data (first name, surname, nickname, other data indicated by you on your profile) mainly for the purpose of managing my profile, building a community and interacting with followers.

The provider of a given social media platform determines the rules applicable on the platform and the rules for processing data for its own purposes, so I encourage you to read the terms and policies of each platform. I do not process data collected by social media platforms for my own purposes.

The plugins leading to my profiles allow you to connect directly to my profile by clicking on the platform icon. The social media platform may obtain information that you are using my website, in particular when you are logged in as its user.

If you do not want social media platforms to obtain information about your activity, I recommend logging out of your profiles and using your browser in incognito mode.

On my website you will find plugins redirecting you to my profiles on the platforms indicated below; I also indicate the privacy policies of these platforms so that you can read them in accordance with my recommendations:

1. Facebook: https://www.facebook.com/share/1A3ZiiYBYt/?mibextid=wwXIfr

Platform privacy policy: https://www.facebook.com/privacy/explanation

2. Instagram https://www.instagram.com/upiekszaj?igsh=bmNjbzgxMTA1YTBs&utm_source=qr

Platform privacy policy: https://help.instagram.com/519522125107875?helpref=page_content

3. TikTok: https://www.tiktok.com/@upiekszaj?_t=ZN-8tKqJdh0BYU&_r=1

Platform privacy policy: https://www.tiktok.com/legal/privacy-policy?lang=pl

4. Pinterest: https://pin.it/3qDGfzXLp

Platform privacy policy: https://policy.pinterest.com/pl/privacy-policy

Sending the newsletter

The information below is only a brief summary of how I send the newsletter. You will find more information here: Newsletter Terms and Conditions.

The data you provide in the newsletter sign-up form (first name, surname) is processed for the purpose of sending the newsletter and on the basis of your consent. Remember to confirm your newsletter subscription after receiving the first message. If you do not do this, you will not receive further messages from me.

I use the services of a newsletter provider that ensures the protection of your data, i.e. PrestaShop, with its registered office at /198 Av. de France, 75013 Paris, France (the provider's privacy policy is available at https://addons.prestashop.com/pl/content/32-personal-data-protection-policy ).

Your data will not be transferred to a third country outside the European Union for the purpose of sending the newsletter.

Providing your data in the newsletter sign-up form is voluntary, but necessary in order to send you the newsletter on the basis of your consent, as well as to send you information about the marketing of my own products or services on the basis of my legitimate interest as the controller (i.e. Article 6(1)(f) GDPR), and to pursue any claims in connection with sending the newsletter.

You will receive my newsletter until you end your subscription or until I stop sending the newsletter.

If a subscriber is inactive for 1 year, I may stop sending the newsletter, in which case I will remove you from my list of subscribers.

The mechanism for unsubscribing from the newsletter service (cancelling the newsletter subscription) is not complicated and consists of clicking an active link labelled Unsubscribe from the newsletter or another link with the same meaning.

After you exercise this right and unsubscribe from the newsletter, your data relating to the newsletter subscription will be stored for the period necessary to defend against potential claims. This is my legitimate interest as the data controller.

I may transfer the personal data provided when subscribing to the newsletter to the following entities: the service providing IT system maintenance and hosting services, the email service provider, the newsletter service provider and third parties supporting me in sending the newsletter, with whom I have concluded appropriate agreements.

As in every case in which I process your data, you have the right to access your data and to receive a copy of it, the right to rectification, erasure and restriction of its processing, the right to data portability, the right to object, and the right to withdraw consent at any time.

Please remember, however, that if you withdraw your consent to data processing, this will not affect the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) whenever you consider that the processing of your data violates the law. Your data will not be processed in an automated manner.

Surveys

I strive to improve my products and services and the procedures of my business, which is why I may send you surveys that also include questions from which I will learn about your preferences or feelings related to using my products or services, as well as the needs you have in connection with the scope of my business activity.

Participation in the survey is entirely voluntary, and not participating in it or not answering all of the questions has no negative consequences. You may withdraw your consent to participate in the survey at any time. Withdrawing consent does not affect the processing of data before its withdrawal.

Withdrawal of consent to data processing

If personal data is processed on the basis of consent, you may withdraw that consent at any time — at your own discretion.

If you would like to withdraw your consent to the processing of personal data, all you need to do is send an email directly to the Controller's address indicated at the beginning of this document.

If your personal data was processed on the basis of consent, its withdrawal does not render the processing of personal data up to that point unlawful. In other words, until consent is withdrawn I have the right to process your personal data, and its withdrawal does not affect the lawfulness of the processing carried out so far.

Handling of reports concerning content on the website and possible sanctions

If you see content on my website that is illegal or incompatible with the terms of use of my website's services, you may report it to me, e.g. via the Contact Point.

For me to be able to accept your report, it should contain:

1. the location of the content in the form of a direct link to the content;
2. a justification for considering this content illegal or incompatible with the terms of use of my website's services;
3. your contact details, including your first name, surname or name, and email address, unless the report concerns an offence related to sexual abuse or sexual exploitation, child pornography, solicitation of children for sexual purposes, or incitement, aiding and abetting, or attempt in relation to these offences – in that case you do not need to provide me with this information;
4. a statement that you have formed, in good faith, the belief that the reported content is illegal or incompatible with the terms of use of my website's services, in particular that the allegations made are true and complete.

Promptly, no later than 3 days after receiving the report, I confirm that such a report has reached me, if you have left me your contact details, e.g. an email address.

I consider a report to be valid if, without the need to carry out a detailed legal analysis, I determine that the reported content is non-compliant or illegal.

Before issuing a decision, I may ask the user who posted the reported content to provide explanations, if this is necessary to make the decision.

I do not use tools for the automated handling of reports.

You may appeal against my decision no later than 14 days from the date of its receipt. The appeal should contain, in particular:

1. precise indications of why the decision issued is incorrect;
2. the justification of your position;
3. an indication of the negative effects of the decision for you or a third party.

I will consider your appeal no later than 14 days after receiving it. I will inform you and other persons interested in the outcome of the matter of the decision issued as a result of the appeal.

The decision issued in the matter, after consideration of the appeal, is final and no further appeal to me is available against it.

Please remember that I am able to apply sanctions against a user who has posted illegal content or content incompatible with the terms of use of my website's services on my website, including as a result of issuing a decision, on the basis of a report that has been considered, that the user has committed such a violation.

Therefore, I may:

• restrict the visibility of the content, including removing it, disabling access to it or demoting it;

• suspend, terminate or otherwise restrict monetary payments to the user who posted the given content on the website;

• suspend or terminate the provision of the service in whole or in part to the user who committed the violation;

• suspend or close the account of the user who committed the violation.

If I obtain any information giving grounds to suspect that a criminal offence threatening the life or safety of a person or persons has been committed, is being committed or may be committed, I immediately inform the competent law enforcement or judicial authorities of my suspicion.

Cookies and tools implemented on the website

This website, like many others, uses cookies. Cookies are short pieces of text information stored on the device you use while browsing websites. Some of them are read by me (“first-party cookies”, needed for the proper functioning of the shop and for improving the offer), and some belong to entities whose services I use (“third-party cookies”). You may change the cookie settings in your browser or delete stored files at any time.

During your first visit to the website, I display a consent banner in which you decide which categories of cookies and tools you agree to. I distinguish four categories: necessary, functional, analytical and marketing. Necessary cookies are always active, because the shop does not work properly without them. I activate the remaining categories only if you consent to them.

I store your choice for 180 days in a first-party cookie named up_consent. Thanks to this, on subsequent visits I do not need to ask you for consent again.

You may change or withdraw your decision at any time using the “Cookie settings” link available in the footer of every page. Withdrawing consent results in the deletion of known cookies belonging to the rejected categories.

Until you give your consent, I do not transfer any data to Google — Google tools then operate in basic mode (Google Consent Mode v2).

Necessary cookies

They are necessary for the proper functioning of the shop and therefore do not require consent. They include, among others:

• PHPSESSID and PrestaShop-* — handle the session, cart and login,
• up_consent — remembers your choice regarding cookie consents (stored for 180 days).

Functional cookies

They make it possible to remember your preferences and settings so that using the shop is more convenient. I activate them only after you give your consent.

Analytical cookies

They are used to collect visit statistics, and I activate them only after you give your consent. In this category I use Google Analytics 4, which stores the cookies _ga and _ga_* (stored for up to 2 years). They help me understand how visitors use the website and improve its functioning.

Marketing cookies

I use them to run advertising activities and measure their effectiveness. I activate them only after you give your consent. In this category I use:

• Meta Pixel — stores the cookies _fbp (stored for up to 90 days), _fbc and _mc_xid (an identifier used by the Meta Conversions API). Meta Pixel helps me assess the effectiveness of ads and reach the right audiences on Meta platforms;
• Google advertising signals — used for ad measurement and targeting.
• OpenAI Ads — stores the cookies __oppref (an identifier of the visit from an ad) and __obref (a browser identifier). They help me assess which ads displayed in OpenAI services lead to a purchase in my shop.

In addition, I use the Meta Conversions API, which transmits selected events (e.g. product view, purchase) directly from the server to Meta. I send these events only after you give your marketing consent.

Similarly, I use the OpenAI Conversions API, which transmits purchase information directly from my server to OpenAI. I send it only if you have given marketing consent, and only after the payment has been confirmed.

Together with purchase events, I transmit to Meta and to OpenAI irreversibly encrypted hashes (SHA-256) of your data — never the data itself. For Meta, these are hashes of your email address, first name, last name, phone number, date of birth, gender, as well as city, postal code and country; for OpenAI, only the hash of your email address. They serve solely to match your purchase to an earlier interaction with an advertisement and do not allow the source data to be reconstructed.

The recipient of this data is OpenAI, LLC, based in the United States.

Embedded video (YouTube)

I embed YouTube videos in privacy-enhanced mode (the youtube-nocookie.com domain). Until a video is played, YouTube does not store any cookies. After you click the play button, YouTube and Google may store their own cookies in accordance with their own policies.

Tools that operate without cookies (legitimate interest)

The tools below do not store cookies and do not identify you as a person, which is why I use them on the basis of my legitimate interest (Art. 6(1)(f) GDPR):

• Umami — a privacy-friendly analytics tool that collects anonymous visit statistics (e.g. number of page views, country, device type, browser) without cookies and without creating a user profile. The IP address is used solely to create an anonymous daily identifier and is not stored in a form that allows you to be identified. The data is stored on a server in the European Union. More: https://umami.is/;
• Sentry — a tool for monitoring technical errors on the website, which helps me quickly detect and fix failures; it does not store cookies.

ManyChat

I use ManyChat, a tool that streamlines communication with you on social media (e.g. Instagram) as part of my marketing activities. ManyChat allows me to send you messages with content determined by me. Some data in connection with the use of this tool may be obtained by me from the META platform and from your public profiles existing within the META platform.

I may use the ManyChat tool in several ways.

Sending you messages and content without commercial information or direct marketing, and corresponding with you on the Instagram platform

When you send me a message or when I initiate contact with you on the Instagram platform, I may correspond with you via the ManyChat tool.

Our communication will be accessible in this tool to me and to the people I work with as part of my business. I have concluded a personal data processing agreement with the people who have access to these messages.

In addition, it is possible to send you messages of an educational or informational nature; all you need to do is use a “key word” (“keyword”) in a comment on my content published on my social media channel, including on the Instagram platform.

I may then send you messages of this nature for 24h. After this time, the conversation window will no longer be active and I will not send you automated messages.

If you do not want to receive messages from me, simply do not use the “key word”. After receiving a message from me, you may at any time object or withdraw the consent you have given, depending on the legal basis for data processing.

Sending you commercial information and direct marketing

In order for me to send you messages containing commercial information or direct marketing via ManyChat, I need your consent.

You can give such consent in the first message sent to you after you use the “key word” (“keyword”), which is sent by me to you using the ManyChat tool.

Using the key word triggers the ManyChat tool. If you do not want to receive messages of this nature from me, do not give me your consent and do not enter the “key word” indicated under each piece of my content in which I use automation.

I may send you a message containing commercial information only within 24h of the moment you enter the “key word” (“keyword”) and give your consent. You may withdraw the consent you have given at any time.

Sending you content containing commercial information and direct marketing, and enabling you to subscribe within the ManyChat tool

In order for me to send you commercial information and messages containing direct marketing concerning my products or services, I need your consent. The same applies to the use of the subscription option within the ManyChat tool.

With a subscription, I may send you messages for longer than 24h.

If you do not want to receive messages from me, simply do not use the “key word” and do not consent to receiving messages.

In each of the situations listed above, you may withdraw the consent you have given at any time.

I carry out marketing activities and activities aimed at contacting you via the ManyChat tool because it is an official Meta Inc Business Partner, i.e. an entity trusted and verified by Meta Inc.

According to its declarations, ManyChat complies with Meta's security guidelines, including Meta's data security requirements and the Meta Privacy Policy. As part of the Meta Business Partner requirements, ManyChat undergoes periodic audits of compliance with Meta's guidelines.

ManyChat, as a tool for marketing or for communicating with my community, plays two roles in data processing:

• it may act as a data controller, usually in relation to my data

and

• it is an entity processing data, a processor, usually in relation to your data.

The data that ManyChat may process as a processor are your identification data (first and last name, email address), publicly available information in your social media profiles, your linked pages and accounts, ICT data (IP addresses, geographical location, usage data, cookie data, browser data) and other data.

In addition, if I communicate with you via ManyChat or enter data into this service, your identification data, publicly available social media profile information (photo, name, date of birth, gender, geographical location), chat history and content, information about chatbot use and other electronic data transmitted, stored, sent or received by you are also processed, as well as other personal data whose scope is determined and controlled by me and in accordance with the functions available within the ManyChat service, of which I will inform you before processing such data, if this takes place.

The source of the data indicated above is the process of registering for the ManyChat service and the use of this service both by me and by you, in particular communication with you and the integration of applications (e.g. Facebook, Instagram, Telegram, Zapier) and other applications specified on the website http://www.apps.manychat.com/ .

An integral part of my agreement with ManyChat (Terms of Use: https://manychat.com/legal/tos) is a data processing addendum, which sets out the rules for the processing of data by ManyChat. You can read more here: https://manychat.com/legal/dpa.

ManyChat as a processor processes data until the termination of the agreement with me, and as a controller also until you opt out of receiving marketing communications and until the expiry of the retention period required by law, among others until claims become time-barred.

In connection with the use of ManyChat, personal data may be transferred outside the European Economic Area on the basis of Standard Contractual Clauses.

According to its declaration, ManyChat also applies appropriate security measures for data processing. You will find detailed information about the security measures applied by ManyChat at the following link: https://manychat.com/legal/dpa.

ManyChat also uses subprocessors, which means that your data may be transferred to these entities as part of the use of the ManyChat service.

ManyChat works with the following entities:

1. sub-processors for the purpose of providing the ManyChat Service

2. service providers on behalf of ManyChat (service providers act either as processors on behalf of ManyChat or as separate controllers):

3. ManyChat partners:

These entities may change, so you can check back here regularly as well as at https://manychat.com/legal/service-providers.

I have also subscribed to ManyChat notifications, available at the link www.manychat.com/legal/subscribe-subprocessor-updates , thanks to which Manychat will send me a notification about the engagement of a new Sub-processor at least ten calendar days before the new entity gains access to the data.

You can learn more about the processing of data by ManyChat and the security measures applied by clicking the links below:

• https://manychat.com/legal/dpa

• https://manychat.com/legal/privacy

• https://manychat.com/legal/service-providers

I may use the help of third parties who provide me with technical support in operating ManyChat. I use entities for which the protection of your data is important, and I conclude appropriate data processing agreements with them.

Final provisions

The materials posted on this website constitute the administrator's own intellectual work and are subject to legal protection.

Using the content made available beyond permitted personal use may result in the risk of criminal and civil liability.

If you have any doubts regarding the legal nature of the content made available (or how you may lawfully use it), write me a message (at the email address indicated at the beginning of this document), and I will give you a comprehensive answer.

Please also remember that the content made available is educational and marketing in nature and does not constitute or replace individual expert advice.

Finally, I would like to remind you that the content of this Privacy Policy may change, e.g. when I change a service provider or the scope of functionality on the website. For your convenience, the date of the Privacy Policy update is given at the beginning of the document.

Thank you for your time!

Patrycja Korzeniowska