PRIVACY POLICY AND COOKIES

Effective date: 01.10.2026

§ 1. General Provisions

This Privacy Policy and Cookies sets out the rules for processing personal data of persons using the Polaya online store available at https://polaya.pl, as well as the rules for the use of cookies and similar technologies.

The data controller is Polaya sp. z o.o., with its registered office at ul. Chmielna 69, 00-801 Warsaw, Poland.

Controller identification details:

• NIP: XXX
• KRS: XXX
• REGON: XXX

Contact with the Controller:

• Address: Chmielna 69, 00-801 Warsaw, Poland,
• E-mail: contact@polaya.pl,
• Phone: +48 574 034 080.

The Controller has not appointed a Data Protection Officer unless the obligation to appoint one arises under applicable law.

This Privacy Policy applies to persons using the Store, including Customers, Account holders, persons placing Orders, persons contacting the Seller, newsletter subscribers and persons visiting the Store.

§ 2. Principles of Personal Data Processing

The Controller processes personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council ("GDPR") and relevant Polish legislation.

The Controller follows the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.

The Controller implements appropriate technical and organisational measures designed to protect personal data against loss, destruction, unauthorised access, alteration or disclosure.

§ 3. What Personal Data May Be Processed

Depending on how the Store is used, the Controller may process, in particular:

• first and last name,
• company name,
• residential or business address,
• delivery address,
• e-mail address,
• telephone number,
• Order details,
• payment and settlement details, whereby payment card details may be processed directly by the relevant payment provider,
• Customer Account details,
• information provided in messages, contact forms, complaints and returns,
• information concerning reviews submitted by the Customer,
• data related to newsletter subscriptions,
• data concerning activity in the Store and use of its functionalities,
• IP address, information concerning the device, browser, operating system and connection parameters,
• online identifiers and information obtained through cookies and similar technologies, in accordance with the user's consent settings.

§ 4. Purposes and Legal Bases for Processing Personal Data

Personal data may be processed for the following purposes:

1. Store Operations and Order Fulfilment

Data is processed for the purpose of accepting and fulfilling Orders, entering into and performing the Agreement, communicating with the Customer, delivering Goods or Digital Content and processing payments.

The legal basis is Article 6(1)(b) GDPR – processing necessary for the performance of a contract or for taking steps at the request of the data subject prior to entering into a contract.

2. Customer Account

Data may be processed for the purpose of creating and maintaining a Customer Account, providing access to Order history and enabling the use of functionalities available after logging in.

The legal basis is Article 6(1)(b) GDPR.

3. Customer Communication

Data may be processed for the purpose of responding to questions, handling correspondence and resolving problems related to the use of the Store.

The legal basis may be Article 6(1)(b) or (f) GDPR, depending on the nature of the communication.

4. Returns and Complaints

Data may be processed for the purpose of receiving and handling complaints, exercising the right of withdrawal, processing returns and fulfilling obligations arising from applicable law.

The legal basis is, in particular, Article 6(1)(b), (c) and (f) GDPR.

5. Accounting and Tax Obligations

Data may be processed for the purpose of maintaining accounting records, issuing sales documents, settling taxes and fulfilling other obligations arising from applicable law.

The legal basis is Article 6(1)(c) GDPR.

6. Establishing, Pursuing and Defending Claims

Data may be processed for the purpose of establishing, pursuing or defending claims related to the Store's activities.

The legal basis is Article 6(1)(f) GDPR – the legitimate interest of the Controller.

7. Newsletter

Data may be processed for the purpose of sending newsletters where the person has subscribed to the newsletter and provided the required consent.

The legal basis for processing based on consent is Article 6(1)(a) GDPR.

8. Direct Marketing

The Controller may process data for the purpose of conducting direct marketing of its own products and services, to the extent permitted by applicable law.

Depending on the specific activity, the legal basis may be Article 6(1)(f) GDPR or consent where consent is required.

9. Analytics and Statistics

The Controller may use analytics tools to analyse how the Store is used, create statistics, improve functionality and optimise its offer.

Where the use of a particular tool requires prior consent to cookies or similar technologies, the tool is activated in accordance with the user's consent settings.

10. Marketing and Advertising

The Controller may use advertising and marketing tools to conduct advertising campaigns, measure their effectiveness, create audience groups and tailor marketing communications.

To the extent that prior user consent is required for the use of specific technologies, the Controller uses such technologies only after obtaining the appropriate consent.

§ 5. Shopify and Service Providers

The Store operates using the Shopify platform.

Shopify may process data to the extent necessary to provide the Store's infrastructure, security, technical support and e-commerce functionalities.

The Controller may also use services provided by external providers supporting the operation of the Store, including:

• hosting and IT infrastructure providers,
• payment service providers,
• courier companies and parcel locker operators,
• accounting, legal and administrative service providers,
• analytics providers,
• advertising and marketing tool providers,
• mailing and marketing automation providers.

The Controller uses or may use, in particular, the following tools and services:

• Google Analytics,
• Google Ads,
• Google Tag Manager,
• Meta Pixel / Meta tools,
• TikTok Pixel / TikTok tools,
• Edrone,
• Klaviyo,
• Shopify.

The scope of services actually used may change as the Store develops and its configuration changes.

§ 6. Payments

The Store enables payments through external payment providers, including Przelewy24, PayU, Tpay, Stripe, Shopify Payments and PayNow – a service provided by mBank S.A., as well as through methods such as BLIK, payment cards, instant bank transfers, Apple Pay, Google Pay and traditional bank transfer, depending on the availability of a particular payment method.

When using an external payment provider, data may be processed directly by that provider in accordance with its privacy and security policies.

The Controller receives from the payment provider the information necessary to confirm and settle the transaction.

§ 7. Delivery and Data Provided to Carriers

For the purpose of delivering an Order, the Controller may provide the entity responsible for delivery with the data necessary to complete the delivery.

Depending on the selected delivery method, this may include in particular the first and last name, delivery address, telephone number, e-mail address and Order details.

Data is provided only to the extent necessary to fulfil the delivery and handle the Order.

§ 8. Digital Content

When Digital Content is purchased, the Controller processes data necessary to confirm the purchase, process the payment and deliver a file or link enabling access to the purchased Digital Content.

Digital Content may be delivered using Shopify infrastructure or other service providers used by the Controller.

The Customer's e-mail address may be used to send a message containing a file, a link to the file or information necessary to access the purchased Digital Content.

§ 9. Newsletter and Marketing Communications

Subscribing to the newsletter is voluntary.

As part of the newsletter, the Controller may send information concerning products, new materials, promotions, offers and other content related to Polaya's activities.

The Controller may use, in particular, Edrone and Klaviyo to manage marketing communications.

A person subscribed to the newsletter may unsubscribe at any time by using the unsubscribe link included in the message or by contacting the Controller.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

§ 10. Product Reviews

If the Store allows users to publish reviews, data related to a review may be processed for the purpose of publishing and managing the review and ensuring the proper functioning of the review system.

Depending on the functionality used by the Store, a first name, username or other information selected by the person submitting the review may be visible alongside the review.

§ 11. Cookies – General Information

The Store uses cookies and similar technologies.

Cookies are small files stored on the user's device or information read from the user's device that enable the Store to function properly, remember certain settings, analyse traffic or perform marketing functions, depending on the type of technology.

Some cookies are necessary for the proper operation of the Store and for providing functions expected by the user, such as shopping cart, session, login or security functions.

Other cookies, in particular analytics and marketing cookies, may require the user's prior consent in accordance with applicable law.

§ 12. Types of Cookies and Similar Technologies Used

1. Necessary Cookies

Necessary cookies are used to ensure the proper operation and security of the Store, manage sessions, the shopping cart, the checkout process, login functionality and the basic functionalities of the Shopify platform.

Their use may be necessary to provide services requested by the user.

2. Functional Cookies

Functional cookies may be used to remember user preferences and provide additional Store functionalities.

3. Analytics Cookies

Analytics cookies may be used to analyse website traffic, how the Store is used, the number of visits, traffic sources and the effectiveness of individual elements of the Store.

For this purpose, the Controller may use, in particular, Google Analytics.

4. Marketing Cookies

Marketing cookies and similar technologies may be used to conduct advertising campaigns, measure their effectiveness, create audience groups, limit the number of times an advertisement is displayed and tailor advertisements to users' interests.

For this purpose, the Controller may use, in particular, Google Ads, Meta Pixel and TikTok Pixel.

5. Marketing Automation Technologies

The Controller may use Edrone and Klaviyo technologies to manage marketing communications, analyse the effectiveness of messages and manage relationships with Customers.

§ 13. Google Tag Manager

The Store may use Google Tag Manager to manage technologies and scripts used within the Store.

The use of Google Tag Manager itself does not constitute automatic consent to all technologies activated through it.

Technologies requiring consent should be activated in accordance with the user's consent settings.

§ 14. Cookie Consent Management

During the user's first visit to the Store, the user may receive information about the use of cookies and similar technologies and may be given the opportunity to choose which technologies requiring consent may be used.

The user may consent to selected categories of technologies or refuse consent to technologies that are not necessary for the operation of the Store.

The user may subsequently change or withdraw consent using the consent management mechanism available in the Store, where such a mechanism is provided.

Withdrawal of consent does not affect the lawfulness of the use of technologies before consent was withdrawn.

Restricting or disabling certain technologies may affect the operation of selected Store functionalities.

§ 15. List of Technologies and Storage Periods

Due to the dynamic nature of the Store, the use of the Shopify platform and the possibility of installing, updating and removing third-party applications, the exact list of cookie names, their providers and storage periods may change.

The current list of cookies should be determined based on the actual configuration of the Store, active applications and the consent management mechanism used.

In particular, technologies associated with the following services may be used:

• Shopify,
• Google Analytics,
• Google Ads,
• Google Tag Manager,
• Meta,
• TikTok,
• Edrone,
• Klaviyo,
• payment processing,
• security and operation of the Store.

The storage period of individual cookies may depend on the type of technology and its configuration. Cookies may be deleted after the end of a session or may remain on the device for a period determined by the relevant technology.

§ 16. Third-Party Cookies

Some cookies and similar technologies may be stored or accessed by third parties whose services are used by the Controller.

These third parties may include, in particular, Shopify, Google, Meta, TikTok, Edrone, Klaviyo, as well as payment providers and other service providers supporting the operation of the Store.

Third parties may process information in accordance with their own privacy policies.

The scope of third-party technologies may change as the Store's configuration changes.

§ 17. Technical Data and Logs

When using the Store, technical information related to the connection with the server may be automatically recorded, including the IP address, browser information, device information, operating system, access time and address of the page visited.

This information may be used in particular to ensure security, detect errors, prevent abuse and ensure the proper operation of the Store.

§ 18. Recipients of Personal Data

Personal data may be transferred or made available to entities that support the Controller in conducting its business activities, including:

• Shopify and technical infrastructure providers,
• payment providers,
• courier companies and delivery providers,
• IT and hosting service providers,
• analytics tool providers,
• advertising and marketing tool providers,
• Edrone and Klaviyo,
• accounting firms and advisors,
• legal service providers,
• public authorities where the obligation to provide data arises from applicable law.

§ 19. Transfers of Data Outside the European Economic Area

In connection with the use of technology providers' services, personal data or information related to the use of the Store may be transferred to countries located outside the European Economic Area.

Where personal data is transferred to a third country, the Controller applies the appropriate mechanisms provided for by the GDPR, where required, including an adequacy decision or appropriate safeguards provided for in Article 46 GDPR.

Where a provider uses a mechanism ensuring an appropriate level of data protection, the Controller may also rely on such mechanism if it meets the requirements of applicable law.

§ 20. Retention Periods for Personal Data

The Controller retains personal data for no longer than necessary to fulfil the purpose for which it was collected, unless applicable law requires a longer retention period.

Data related to Orders may be retained for the period necessary to perform the Agreement, handle returns and complaints, fulfil accounting and tax obligations and potentially establish, pursue or defend claims.

Data processed on the basis of consent is processed until consent is withdrawn, unless another legal basis exists for further processing.

Data processed for direct marketing purposes may be retained for the period necessary to fulfil that purpose or until an effective objection is made, taking into account other legal obligations of the Controller.

After the applicable retention period has expired, data is deleted, anonymised or retained only to the extent permitted by law.

§ 21. Rights of the Data Subject

To the extent provided for by the GDPR, the data subject has, in particular, the right to:

• access their personal data,
• obtain a copy of their data,
• rectify their data,
• erase their data,
• restrict processing,
• data portability,
• object to processing,
• withdraw consent at any time where processing is based on consent,
• lodge a complaint with the President of the Personal Data Protection Office (UODO).

§ 22. Right to Object

Where data is processed on the basis of the legitimate interest of the Controller, the data subject may object to such processing for reasons relating to their particular situation, in accordance with the rules set out in the GDPR.

Where data is processed for direct marketing purposes, the data subject may object to such processing.

§ 23. Profiling and Automated Decision-Making

In connection with the use of analytics and marketing tools, the Controller may use profiling, for example to analyse interest in products, create audience groups or tailor marketing communications.

Profiling may also be carried out using third-party tools, in accordance with their functionalities and settings.

The Controller does not make decisions concerning Customers that produce legal effects or similarly significantly affect them based solely on automated processing, unless an exception provided for by law applies.

§ 24. Voluntary Provision of Data

Providing personal data is generally voluntary; however, in certain cases it may be necessary to enter into or perform an Agreement.

Failure to provide data required to process an Order may make it impossible to accept or fulfil the Order.

Providing data for the purpose of subscribing to the newsletter is voluntary.

Consent to optional cookies and similar technologies is voluntary to the extent required by applicable law.

§ 25. Data of Contact Persons Representing Businesses

If the Customer is a business, the Controller may process data of individuals representing the business or designated as contact persons, to the extent necessary to handle the business relationship, fulfil Orders, communicate and comply with legal obligations.

§ 26. Children's Data

The Store is not intended to knowingly collect personal data from children to the extent that this would require specific measures under applicable law. If the Controller receives information that data has been provided by a person who should not have provided it without the required consent of a legal representative, the Controller will take appropriate action in accordance with applicable law.

§ 27. Security

The Controller applies appropriate technical and organisational measures to ensure the security of processed data.

The Controller uses technology providers that apply security measures appropriate to the services they provide.

The Customer should also take measures to protect their data, in particular by protecting their Account password and not sharing login details with third parties.

§ 28. Contact Regarding Personal Data and Cookies

For matters concerning the processing of personal data, exercising rights under the GDPR and managing privacy settings, the Controller may be contacted at:

Polaya sp. z o.o.
ul. Chmielna 69
00-801 Warsaw
Poland
E-mail: contact@polaya.pl
Phone: +48 574 034 080

§ 29. Complaint to the President of the Personal Data Protection Office

If a data subject considers that the processing of their personal data infringes data protection regulations, they may lodge a complaint with the competent supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

§ 30. Amendments to the Privacy Policy and Cookies

The Controller may update this Privacy Policy, in particular in the event of changes in applicable law, changes in the scope of business activities, changes in the technologies used, service providers or Store functionalities.

The current version of the Privacy Policy is published in the Store on the relevant information page.

Changes shall take effect from the date indicated in the updated version of the document.

§ 31. Final Provisions

This Privacy Policy provides information about the rules for processing personal data and using cookies in the Polaya Store.

In matters not regulated by this Privacy Policy, applicable law shall apply, in particular the GDPR and relevant Polish legislation.

This Privacy Policy is effective from 01.10.2026.

§ 32. Controller's Details

Polaya sp. z o.o.
ul. Chmielna 69
00-801 Warsaw
Poland
NIP: XXX
KRS: XXX
REGON: XXX
E-mail: contact@polaya.pl
Phone: +48 574 034 080

Document effective from: 01.10.2026