Privacy Policy - Regnis

I. General Provisions

1. This Privacy Policy sets out the rules for the collection, processing, and protection of Users' personal data, necessary for the provision of electronic services via the website available at www.regnis.store (hereinafter referred to as the "Service").

2. The Service collects only such personal data as are necessary for the proper provision of the offered services, their development, including the fulfillment of orders for standard and personalized products.

3. Personal data collected via the Service are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – hereinafter "GDPR"), and the Polish Act on Personal Data Protection of May 10, 2018.

II. Personal Data Administrator

1. The Administrator of personal data collected via the Service is WYTWÓRNIA WYROBÓW DZIEWIARSKICH REGNIS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (REGNIS KNITWEAR MANUFACTURING COMPANY LIMITED LIABILITY COMPANY), with its registered office at ul. Polna 15, 62-090 Kiekrz, Poland, entered into the National Court Register under KRS number: 0001000628, NIP: 7812042423, REGON: 523569867, e-mail address for personal data matters: sklep@regnis.pl (hereinafter referred to as the "Administrator").

III. Purpose and Legal Basis for Processing Personal Data

1. Users' personal data are processed for the following purposes:

• a. registration of an account on the Service and verification of the User's identity (legal basis: Art. 6(1)(b) GDPR – performance of a contract);
• b. enabling logging in to the Service (legal basis: Art. 6(1)(b) GDPR – performance of a contract);
• c. conclusion and performance of the sales contract for products, including personalized products, and provision of electronic services offered on the Service (legal basis: Art. 6(1)(b) GDPR – performance of a contract);
• d. communication with the User on matters related to the services provided, order fulfillment, handling inquiries (e.g., via contact form, e-mail, phone) (legal basis: Art. 6(1)(b) and (f) GDPR – performance of a contract and legitimate interest of the Administrator);
• e. sending commercial and marketing information electronically (newsletter), only after the User has given separate consent (legal basis: Art. 6(1)(a) GDPR – consent);
• f. operating a system of comments or product reviews (if such functionality is available on the Service) (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Administrator);
• g. direct marketing of the Administrator's own products and services (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Administrator);
• h. personalization of Service content and offers for Users, after they have given consent to profiling (legal basis: Art. 6(1)(a) GDPR – consent);
• i. conducting statistical analyses and analytical activities aimed at improving the functioning of the Service and the quality of services offered (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Administrator);
• j. establishing, pursuing, or defending against potential claims (legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Administrator);
• k. fulfilling legal obligations incumbent on the Administrator, e.g., arising from tax or accounting regulations (legal basis: Art. 6(1)(c) GDPR – legal obligation).

2. The provision of personal data is voluntary; however, failure to provide them may make it impossible to conclude a contract, use certain functionalities of the Service, or receive marketing information.

IV. Scope of Processed Personal Data

1. The Administrator may process the following personal data of the User:

• a. First and last name;
• b. Residence/delivery address;
• c. E-mail address;
• d. Phone number;
• e. NIP number (Tax Identification Number) (in the case of entrepreneurs);
• f. Data related to orders and contract fulfillment (e.g., order history, product personalization details).
• g. Data collected automatically when using the Service (e.g., IP address, browser data, cookies).

V. Period of Personal Data Storage

1. Users' personal data will be processed for the period necessary to achieve the purposes for which they were collected:

• a. in the case of data processed on the basis of a contract – for the duration of the contract, and after its termination, for the period of limitation of potential claims;
• b. in the case of data processed on the basis of consent – until the consent is withdrawn, and after its withdrawal, for the period of limitation of potential claims;
• c. in the case of data processed on the basis of the Administrator's legitimate interest – for the duration of that interest or until the User effectively objects;
• d. in the case of data processed to fulfill legal obligations – for the period required by law.

2. As a rule, the limitation period for claims is 6 years, and for claims for periodic benefits and claims related to conducting business activities – 3 years. These periods may change in the event of changes in specific regulations. Data processed for accounting purposes are stored for 5 years, counting from the end of the calendar year in which the financial operation took place.

VI. Recipients of Personal Data

1. Users' personal data may be transferred to the following categories of recipients:

• a. entities related to the Administrator by capital or personally;
• b. subcontractors and service providers with whom the Administrator cooperates to provide services (e.g., courier and postal companies, electronic payment operators, hosting and IT service providers, accounting firms, law firms);
• c. other entities, if necessary to achieve the processing purposes and in accordance with applicable law (e.g., at the request of authorized state authorities).

2. Users' personal data will not be transferred outside the European Economic Area (EEA).

VII. Users' Rights

1. The User of the Service has the following rights related to the processing of their personal data:

• a. the right to access the content of their personal data;
• b. the right to rectification (correction) of their data;
• c. the right to erasure (the so-called "right to be forgotten");
• d. the right to restriction of processing;
• e. the right to data portability;
• f. the right to object to the processing of data (in particular to processing for direct marketing purposes or profiling);
• g. the right to withdraw consent to data processing at any time, if processing is based on consent; withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

2. To exercise the aforementioned rights, the User should contact the Administrator via e-mail at: sklep@regnis.pl or in writing to the Administrator's registered office address.

3. The Administrator will respond to the User's request promptly, but no later than one month after its receipt. In complicated cases or with a large number of requests, this period may be extended by another two months, of which the User will be informed.

4. The User has the right to lodge a complaint with the supervisory authority, i.e., the President of the Personal Data Protection Office, if they believe that the processing of their personal data violates the provisions of the GDPR.

VIII. Cookies and Tracking Technologies

1. The Service uses cookies, which are small text files stored on the User's end device (e.g., computer, tablet, smartphone). The Service may use session cookies (temporary, deleted after closing the browser) and persistent cookies (stored for a specified period).

2. Cookies are used to:

• a. ensure the proper functioning of the Service and its basic features;
• b. adapt the Service to the User's individual preferences (e.g., remembering language settings);
• c. collect anonymous statistical data regarding the use of the Service (e.g., using analytical tools);
• d. for marketing purposes, including remarketing (after obtaining appropriate consent).

3. The User has the ability to independently change cookie settings in their internet browser. They can block or restrict the saving of cookies on their device. Failure to change these settings means acceptance of the cookies used on the Service. Detailed information about the possibilities and methods of handling cookies is available in the software settings (web browser).

4. Blocking cookies may affect the functionality of some elements of the Service.

IX. Automated Decision-Making and Profiling

1. Users' personal data will not be subject to automated decision-making that would produce legal effects concerning them or similarly significantly affect them, without their express consent.

2. Users' personal data may be used for profiling for marketing purposes, i.e., to analyze Users' preferences and behaviors on the Service in order to customize the displayed content and personalize marketing offers. Profiling takes place only after obtaining the User's prior consent to such actions. The User has the right to withdraw consent to profiling at any time or object to such processing.

X. Final Provisions

1. The Administrator reserves the right to introduce changes to this Privacy Policy. All changes will be published on the Service and will come into force on the date of their publication. Changes will not limit the rights of Users acquired before their introduction.

2. Users may be additionally informed about significant changes to the Privacy Policy through a notice on the Service or via e-mail (in the case of Users who have provided their e-mail address).

3. In matters not regulated by this Privacy Policy, the relevant provisions of Polish law and the GDPR shall apply.