This Privacy Policy sets out the rules for the processing of personal data and the use of cookies and similar technologies in connection with the use of the website www.lubatex.pl (the “Website”).

This Policy applies exclusively to the website www.lubatex.pl. The online stores sklep.lubatex.pl and sen4you.pl have separate privacy policies appropriate to the services provided through them.

1. Data Controller

The controller of personal data is:

Lubatex Sp. z o.o.

ul. Mickiewicza 17

58-420 Lubawka, Poland

NIP (Tax ID): 6141554519

KRS: 0000231468

e-mail: biuro@lubatex.pl

tel.: +48 75 741 13 12

hereinafter referred to as the “Controller” or “Lubatex”.

2. Data Protection Officer

The Controller has appointed a Data Protection Officer (“DPO”).

For matters related to personal data protection and the exercise of rights under data protection laws, you may contact the DPO:

e-mail: iod@lubatex.pl

or in writing at the Controller’s registered office address indicated above.

3. What data we may process

In connection with your use of the Website, we may process in particular:

first and last name,

e-mail address,

telephone number,

data contained in a message sent via the contact form or by e-mail,

information concerning the company or organisation you represent, if you provide it in your correspondence,

IP address,

information about your device and browser,

information about how you use the Website,

data related to cookies and similar technologies.

Providing data via the contact form is voluntary. However, failure to provide data necessary to respond may make it impossible for us to contact you or handle your enquiry.

4. Purposes and legal bases for processing personal data

Personal data may be processed for the following purposes:

Contact and handling of enquiries

If you contact us via the contact form, e-mail or telephone, we process your data in order to respond and conduct further correspondence.

If the contact concerns entering into or performing a contract, the legal basis for processing is Article 6(1)(b) GDPR.

In other cases, the legal basis may be Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest in conducting communications, responding to enquiries and maintaining business relationships.

If, in a specific case, we ask you to consent to the processing of your data, the legal basis will be Article 6(1)(a) GDPR.

Compliance with legal obligations

Data may be processed to the extent necessary to comply with obligations arising from applicable law, on the basis of Article 6(1)(c) GDPR.

Establishment, exercise and defence of legal claims

Data may be stored and used for the establishment, exercise or defence of legal claims.

The legal basis for processing is Article 6(1)(f) GDPR, i.e. the Controller’s legitimate interest.

Ensuring the security of the Website

Technical data, including the IP address and server logs, may be processed to ensure the proper and secure operation of the Website, detect errors and prevent abuse.

The legal basis for processing is Article 6(1)(f) GDPR.

Analytics and statistics

If you consent to analytical cookies, information about how you use the Website may be used to compile statistics, analyse traffic and improve the operation and content of the Website.

To the extent that such information constitutes personal data, the legal basis for its processing is Article 6(1)(a) GDPR.

Marketing

If the Website uses advertising or remarketing tools that require consent, they are activated only after the user has given the appropriate consent in the cookie settings.

To the extent that personal data are processed, the legal basis is Article 6(1)(a) GDPR.

5. Contact form

The Website provides a form that allows you to contact Lubatex.

Data provided in the form are used only to the extent necessary to handle the submitted message, provide a response and, where this follows from the content of the enquiry, take steps aimed at establishing or carrying out cooperation.

Data submitted through the form are not used to send marketing information unrelated to the enquiry unless the user has separately consented to this.

6. Recipients of personal data

Personal data may be accessed by entities supporting the Controller in operating the Website and conducting business activities, in particular:

hosting and server service providers,

providers and service technicians of IT systems,

entities providing services related to the maintenance and development of the Website,

e-mail service providers,

analytics and marketing service providers – where the user has given the appropriate consent,

providers of social media and multimedia tools – where such tools are used on the Website and require consent,

providers of legal, advisory or audit services, where necessary,

public authorities and other entities authorised to obtain data under applicable law.

Entities processing personal data on behalf of Lubatex are required to protect them appropriately and to process them in accordance with the agreements concluded and applicable law.

7. Transfers of data outside the European Economic Area

In connection with the use of services provided by certain technology providers, personal data may be transferred outside the European Economic Area, in particular to the United States.

Where such a transfer takes place, it is carried out using mechanisms provided for under the GDPR, in particular on the basis of a European Commission adequacy decision, including – where applicable – the EU–US Data Privacy Framework, or on the basis of Standard Contractual Clauses approved by the European Commission.

8. Data retention period

We retain personal data only for the period necessary to fulfil the purpose for which they were collected.

Data relating to correspondence and enquiries are retained for the period necessary to maintain contact and then – where justified – for the period necessary to establish, exercise or defend legal claims.

Data processed on the basis of consent are processed until consent is withdrawn or the purpose of processing ceases to exist, whichever occurs first.

Data processed on the basis of a legal obligation are retained for the period required by the applicable laws.

Data associated with cookies are processed for the lifetime of the relevant cookie or until consent is withdrawn, where processing is based on consent.

9. Your rights

In connection with the processing of personal data, in the cases provided for by the GDPR, you have the right to:

access your data and obtain a copy of them,

rectify inaccurate data,

complete incomplete data,

erase data,

restrict processing,

data portability,

object to processing based on a legitimate interest,

withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise your rights, you may contact the Controller or the Data Protection Officer at:

iod@lubatex.pl

10. Right to lodge a complaint

If you believe that your personal data are being processed in breach of applicable law, you have the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)

ul. Stanisława Moniuszki 1A

00-014 Warsaw, Poland

Information concerning the rights of persons whose personal data are processed is also available on the website of the Polish Personal Data Protection Office (UODO).

11. Cookies

The Website uses cookies and similar technologies.

Cookies are small pieces of information stored on a user’s device while using the Website.

Depending on their purpose, the following categories of cookies may be used:

Necessary

These are required for the proper and secure operation of the Website. User consent is not required for their use to the extent permitted by applicable law.

Analytical

They make it possible to analyse how the Website is used, the number of visits, traffic sources and how users navigate the Website.

They are used only after the appropriate consent has been obtained from the user.

Marketing

They may be used to measure the effectiveness of advertising campaigns, for remarketing and to tailor advertisements.

They are activated only after the user has given the appropriate consent.

Functional and multimedia

Certain elements of the Website, such as embedded video content or functions provided by external providers, may require the use of additional cookies.

If they are not necessary for the operation of the Website, they are activated only after consent has been obtained.

Pursuant to Article 399 of the Polish Electronic Communications Law, accessing information stored on terminal equipment and storing such information requires compliance with the conditions laid down by law, subject to exceptions including solutions necessary to provide a service requested by the user.

12. Managing cookie consent

During the first visit to the Website, the user can choose whether optional cookies may be used.

Refusing analytical or marketing cookies does not prevent the use of the basic functions of the Website.

Consent may be withdrawn or changed at any time using the cookie settings available on the Website.

Withdrawing consent should be as easy as giving it.

The user may also delete stored cookies using the settings of their web browser.

13. Analytical, marketing and external tools

The Website may use tools provided by external entities to analyse traffic, improve the operation of the Website, conduct marketing activities or display external content.

If the operation of a particular tool requires optional cookies to be stored or access to information on the user’s device, the tool is activated only after the required consent has been obtained.

Up-to-date information about the categories of cookies used, their providers and the purposes for which they are used should be available in the cookie settings panel on the Website.

14. Profiling and automated decision-making

The Controller does not make decisions concerning Website users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

If the user consents to the use of marketing tools, external providers of such tools may analyse the user’s activity in order to create audience groups and tailor advertisements.

15. Data security

The Controller applies appropriate technical and organisational measures to protect processed personal data against loss, unauthorised access, disclosure, alteration or destruction.

The connection to the Website is secured using HTTPS encryption.

Access to personal data is limited to persons and entities for whom such access is necessary to perform their assigned tasks.

16. Changes to the Privacy Policy

The Privacy Policy may be updated, in particular in the event of changes in the law, technologies used on the Website or the manner in which personal data are processed.

The current version of the Privacy Policy is always published on www.lubatex.pl.