PRIVACY AND COOKIES POLICY OF THE mPTech ONLINE STORE

1. PERSONAL DATA ADMINISTRATOR​

The administrator of your personal data collected through the website www.mptech.eu (including through the use of cookies or similar technologies) or other communication channels is mPTech Sp. z o.o. based in Warsaw (00-511) at ul. Nowogrodzka 31, registered in the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, XII Economic Division of the National Court Register under the number 0000243245, NIP: 895-18-45-043, REGON 02016725600000, BDO 000010780, with a paid-up share capital of 13,712,500 PLN. You can contact us via email at: pomoc@mptech.eu, or by phone at 71 717 74 00.

2. FOR WHAT PURPOSE, ON WHAT BASIS AND FOR HOW LONG DO WE PROCESS YOUR DATA?

a. PLACING AN ORDER

a) Processing based on and for the purpose of concluding and fulfilling the order

If you place an order through our store, we process your personal data, in particular your name, email address, delivery address, billing address, and phone number, in order to enable the conclusion and subsequent fulfillment of the sales contract (based on Article 6(1)(b) of the GDPR).

If you are placing an order as a representative of an organizational unit, we process your data for the same purpose, but based on our legitimate interest in entering into and fulfilling a contract with the entity you represent (based on Article 6(1)(f) of the GDPR).

Processing your personal data for the purpose of fulfilling your order means that the data may be used in particular:

· In order to allow you to complete your order on our site, that is, to ensure that your data from the started order is not deleted,

· In order to enable you to make payments for the ordered products – for this purpose, we may also share your data with our Partners who manage payment systems, in accordance with the information contained in point 3 "Who may be the recipient of your data,"

· In order for us to contact you regarding your order, specifically to send you its confirmation and any other correspondence related to the order status, as well as to respond to any questions you may have regarding the order,

· In order to ensure the proper course of any potential complaint process for the products you have purchased.

For this purpose, we use personal data for the time necessary to process and fulfill your order or to handle your complaint.

b) Processing based on legitimate interest

· If you place an order in our store, we will retain your identification data (first and last name) and contact information (email address, phone number, address), data about your Customer Account (if you have one), as well as details of your orders based on our legitimate interest (Article 6(1)(f) of the GDPR) in order to defend against any potential claims or the possibility of making claims by us, as well as to maintain our internal records and any necessary audits. Our legitimate interests include protecting our rights and defending against claims, as well as the necessity to ensure proper order fulfillment.

In order to defend our rights and pursue claims arising from our business activities, as well as to maintain our internal records and for potential audits, we may process data for the period of limitation of claims specified by law, particularly the civil code, extended by one year after its expiration, taking into account the possibility of a claim being made against us at the end of the limitation period and the time needed for the relevant authorities to deliver a lawsuit or other documents to us. In the event of legal, administrative, or other proceedings being initiated, we will process your personal data to the extent necessary for the entire duration of such proceedings and until the end of the limitation period after the conclusion of the proceedings.

· We may also process your order history to present you with advertisements and personalized discounts tailored to your interests – if you have previously given your consent for us to process cookies for advertising purposes. Our legitimate interest in this case is the marketing of our products. We may process your order history data for this purpose for a period of 400 days.

c) Processing necessary to fulfill our legal obligations

We are also obligated to process your data under the provisions of the law. The processing of your data necessary to fulfill our obligations is based on Article 6(1)(c) of the GDPR. Our obligations arise particularly from the following regulations:

· Act of April 23, 1964, Civil Code,

· Act of May 30, 2014, on Consumer Rights,

· Act of March 11, 2004, on Goods and Services Tax,

· Act of September 29, 1994, on Accounting.

For this purpose, we process your identification and contact data, as well as order information, for a maximum of 6 years.

b. CLIENT ACCOUNT

a) Processing based on and for the purpose of fulfilling the contract

· If you create a Customer Account in our online store, we will process your personal data, i.e., your first and last name, email address, as well as your address details and information about your settings in the Customer Account and your orders (if you place any) based on Article 6(1)(b) of the GDPR (contract conclusion and performance), for the purpose of providing the service of managing and maintaining your Customer Account.

We use the data associated with your Customer Account until your account is deactivated. Remember that you can always change its settings or delete it.

· We may also process your name, surname, email address, as well as data about your orders and products added to the wishlist related to your Customer Account in order to provide you with the Newsletter service – if you express a desire to receive tailored offers and personalized proposals related to your order history and the products you have placed on your wishlist via email.

In order to inform you about our offers and current promotions, we may process your personal data until you opt out of receiving such messages from us. You can always disable this feature by unsubscribing from the Newsletter by clicking the appropriate link in one of the messages you received from us.

b) Processing based on legitimate interest

· If you create a Customer Account in our store, we will retain your name and email address based on our legitimate interest in defending against any potential claims or the possibility of pursuing claims by us, as well as for maintaining our internal records and for potential audits. Our legitimate interests include protecting our rights and defending against claims, as well as the necessity of ensuring proper order fulfillment.

In order to defend our rights and pursue claims arising from our business activities, as well as to maintain our internal records and for potential audits, we may process data for the period of limitation of claims specified by law, particularly the civil code, extended by one year after its expiration, taking into account the possibility of a claim being made against us at the end of the limitation period and the time needed for the relevant authorities to deliver a lawsuit or other documents to us. In the event of legal, administrative, or other proceedings being initiated, we will process your personal data to the extent necessary for the entire duration of such proceedings and until the end of the limitation period after the conclusion of the proceedings.

c. VISITS TO OUR ONLINE STORE (COOKIES AND SIMILAR TECHNOLOGIES)

When you visit our site, we store and then access small files called cookies on your device. A cookie is a small set of letters and numbers that we store in your web browser or on the hard drive of your computer. Additionally, we use pixel tags, which are small images that function similarly to cookies. Unlike cookies stored on your computer's hard drive, pixel tags are a permanent part of the website. For simplicity, we will refer to all of these technologies as cookies in this document.

Storing and retrieving information using cookies, except in situations where it is necessary to ensure the proper functioning of our store and the execution of its basic functions (such as providing you with a service delivered electronically at your request), is only possible based on your consent. You can give the appropriate consent primarily during your first visit to our store through the cookie banner, which allows you to select the scope of cookie usage and express your consent.

Depending on the scope of cookie technology usage you consent to, cookies collect various types of information that, in principle, do not constitute personal data – they do not allow for your identification. However, some information contained in cookies, depending on their content and how they are used, may be linked to a specific person, for example, by combining it with data provided during the registration of a Customer Account – and thus may be considered personal data. This particularly applies to cookies for which you give consent while using the store.

We can also supplement the information stored in cookies with the following data:

· The IP address of your device (the address of your device that you use to communicate with other devices on the Internet);

· The operating system of your device, its version, and language settings;

· The browser you are using on your device, its version, and language settings;

· The website address (URL) from which you are visiting our website.

To the extent that cookies and the other aforementioned data may contain personal data, the basis for their processing is:

a) Processing based on legitimate interest

Some cookies are stored by our website directly on your device based on our legitimate interest (Article 6(1)(f) GDPR) as necessary for using our site, to help us in particular:

· prevent attacks on our site and violations of its functionality and the security of your data, as well as identify you when you switch between subpages of our site and when you visit us again, for example, so that we can remember your username and password for your customer account, so we don't have to ask you for it every time – our legitimate interest is the seamless operation of our services for you and the security of your data;

·       to register, investigate, and eliminate failures and non-functional elements of our site – our legitimate interest is to improve our services for you.

The above cookies and similar technologies are essential for the functioning of our website. If you disable consent for storing and reading cookies by websites in your browser, our website may not function properly, and we may not be able to provide our services to you.

Detailed information about the necessary cookies, their providers who are the recipients of the data contained in them, and the duration of their processing:

b) Processing based on your consent

If you consent by clicking "I accept all cookies" on our cookie notification or by selecting the appropriate sliders during your first visit to the site, or if you provide the necessary consent in the privacy settings on your device based on the given consent (Article 6(1)(a) of the GDPR), we store and have access to cookies that – in accordance with the given consent:

·       If you consent to preference cookies (functional) – the cookies will allow us to remember information that changes the appearance or functionality of the site, such as the preferred language or region in which the user is located.

Detailed information about cookies regarding preferences, their providers who are recipients of the data contained in them, and the duration of their processing:

· If you consent to cookies related to statistics, the cookies will allow us to understand how different users behave on the site by creating statistics and reporting anonymous information, particularly by tracking traffic on our site, individual subpages, and measuring the effectiveness of user acquisition.

Detailed information about cookies regarding statistics, their providers who are recipients of the data contained in them, and the duration of their processing:

· If you consent to advertising cookies, these cookies will allow us and our partners (as indicated in the table below) to tailor the content displayed – on our website and beyond – to your needs and interests, present advertisements and promotions tailored to your interests, with the aim of these actions not being to produce legal effects or significantly influence your decisions. Thanks to these cookies, the advertisements and other content that will be displayed to you will be relevant and interesting to you.

Detailed information about advertising cookies regarding statistics, their providers who are recipients of the data contained in them, and the duration of their processing:

Remember that you can change any cookie settings from your web browser. When using browser settings, the method for blocking and deleting cookies varies depending on the web browser you are using. Information on how to delete cookies should be found in the "Help" section of your chosen web browser. For example, in Google Chrome, cookies can be managed through the Site Data settings on your device in the Privacy and Security tab. In Firefox, you should select the Tools tab, then Options, and Privacy. In Microsoft Edge, you need to select Settings, and then Cookies and site permissions.

d. COMPLAINT FORM

a) Processing necessary to fulfill a legal obligation incumbent upon the Administrator

The personal data provided by you in the Complaint Form in connection with submitting a complaint and collected in any further communication may be processed by us for the purpose of handling your complaint, maintaining accounting records, and settling accounts related to processed complaints. The basis for processing is Article 6(1)(c) of the GDPR, i.e., the necessity to fulfill a legal obligation imposed on the Administrator.

b) Legally justified interest

Your data provided in the complaint procedure may also be processed for the purpose of establishing, defending against any potential claims, or the possibility of pursuing claims by us, as well as for maintaining our internal records and any potential audits – based on our legitimate interests (Article 6(1)(f) of the GDPR), which include defending against claims and ensuring the possibility of pursuing them.

In order to defend our rights and pursue claims related to our business activities, as well as to maintain our internal records and for potential audits, we may process data for the period required by tax law (up to 6 years), as well as for the statute of limitations for claims specified by civil law, extended by one year after its expiration, taking into account the possibility of a claim being made against us at the end of the limitation period and the time needed for the relevant authorities to deliver a lawsuit or other documents to us. In the event of legal, administrative, or other proceedings being initiated, we will process your personal data to the extent necessary for the entire duration of such proceedings and until the end of the limitation period after the conclusion of the proceedings.

e. NEWSLETTER

a) Processing based on and for the purpose of fulfilling the contract

Your email address provided in connection with signing up for the Newsletter by filling out the Newsletter sign-up form located at the bottom of our page or by clicking the checkbox for signing up for the Newsletter during the order process will be processed for the purpose of fulfilling the contract for the provision of the Newsletter service, i.e., based on Article 6(1)(b) of the GDPR – to send you electronic messages regarding our products and promotions.

In order to inform you about our offers and current promotions, we may process your personal data until you opt out of receiving such messages from us. You can always disable this feature by unsubscribing from the Newsletter by clicking the appropriate link in one of the messages you received from us.

b) Legally justified interest

If you subscribe to our Newsletter, we will retain your email address based on our legitimate interest in defending against any potential claims or the possibility of pursuing claims by us, as well as for maintaining our internal records and for potential audits (Article 6(1)(f) of the GDPR). Our legitimate interests include protecting our rights and defending against claims, as well as the necessity of ensuring proper order fulfillment.

In order to defend our rights and pursue claims arising from our business activities, as well as to maintain our internal records and for potential audits, we may process data for the period of limitation of claims specified by law, particularly the civil code, extended by one year after its expiration, taking into account the possibility of a claim being made against us at the end of the limitation period and the time needed for the relevant authorities to deliver a lawsuit or other documents to us. In the event of legal, administrative, or other proceedings being initiated, we will process your personal data to the extent necessary for the entire duration of such proceedings and until the end of the limitation period after the conclusion of the proceedings.

f. OUR PROFILES ON SOCIAL MEDIA

Your personal data that you leave when visiting our profiles on social media, such as comments, likes, and online identifiers, may be processed based on the legitimate interest of the administrator (Article 6(1)(f) of the GDPR), which is to enable you to engage with our profile, as well as to effectively manage our profile by providing you with information about our products and services. Our legitimate interest, for which we may also process your data left on our social media profiles, is also to defend our rights and protect against claims related to our business activities.

The data may be processed for the period necessary to achieve the aforementioned purposes or until you effectively raise an objection, as well as for the time resulting from their storage in case of potential claims, for the limitation period specified by law, particularly the civil code.

g. VIRTUAL ADVISOR

Your personal data that you provide while engaging in a text conversation with us in the form of a chat (e.g., using the virtual advisor available on our Service) is or may be processed for the following purposes:

a) handling inquiries via chat – legal basis: art. 6 sec. 1 lit. f. GDPR, i.e., a legitimate interest pursued by the Administrator;

b) depending on the content of the communication, taking action at your request before entering into the relevant agreement – legal basis: Article 6(1)(b) of the GDPR, i.e., necessity to take action before entering into the agreement;

c) depending on the content of your messages, marketing, analytical, and statistical activities of the Administrator or other so-called third parties with whom we cooperate – legal basis: Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Administrator or a third party;

Our virtual advisor collects various information that does not essentially constitute Personal Data (it does not allow for your identification). However, in some cases, due to the information you provide while using this functionality, your identification may indeed be possible. The owner of this functionality and the administrator of your Personal Data in connection with its use is the Administrator and KODA Sp. z o.o. based in Wrocław, ul. Gen. Sikorskiego 26, 53-659 Wrocław (KRS: 0000549232, NIP: 7252084336 REGON: 36095119100000).

Your data will generally be processed until the communication with you is concluded, and in the case of marketing activities – until you raise an objection, unless the law requires us to process this data for a longer period or we need to retain it longer in case of potential claims, for the duration of the limitation period specified by law, particularly the civil code. In any case, the longer retention period for Personal Data will prevail.

3. WHO CAN BE THE RECIPIENT OF YOUR DATA?

As the administrator processing your personal data, we also use the services of processing entities that process personal data solely in accordance with our instructions and for the purposes described in point 2 above. Such processing entities include:

a) cloud service providers and other IT and technical service providers such as: Microsoft Ireland Operations Limited based in Dublin, Ireland (reg. no. 256796), Google Ireland Limited based in Dublin, Ireland (reg. no.: 368047) and Meta Platforms Technologies Ireland Limited based in Dublin, Ireland (reg. no.: 550858), KODA sp. z o.o. based in Wrocław (REGON: 360951191), Manychat, Inc., 8605 Santa Monica Blvd, #64372 West Hollywood, CA 90069.

We may also share your personal data with other entities that act as administrators, i.e.:

a) partners operating payment systems to process payments, especially in connection with card payments, in particular PayU S.A. based in Poznań (KRS 0000274399) – the PayU privacy policy is available here: https://poland.payu.com/nota-o-prywatnosci-payu/;

b) to courier and postal companies, according to the delivery method you have chosen for the goods ordered in our Store, in particular InPost Sp. z o.o. based in Krakow (KRS 0000543759), the InPost privacy policy is available here: https://inpost.pl/polityka-prywatnosci; DPD Polska Sp. z o.o. based in Warsaw (KRS 0000028368), the DPD privacy policy is available here: https://www.dpd.com/pl/pl/o-dpd/ochrona-danych-osobowych/DHL eCommerce (Poland) sp. z o.o. based in Warsaw (KRS: 0000631916), the DHL privacy policy is available here: https://www.dhl.com/pl-pl/ecommerce/o-dhl-ecommerce/polityka-prywatnosci.html;

c) public authorities authorized to receive personal data based on legal regulations, regarding public authorities authorized to receive personal data based on legal regulations.

Your data may also be shared with service providers in the fields of research, analysis, and statistics, entities organizing marketing campaigns, operators of marketing tools, processing your data contained in cookies and similar technologies, who help us optimize the website and personalize content and offers for you (if you give your consent) – in accordance with the description provided in point 2 letter c above. Under the same conditions, your data may also be shared with other entities from the TelForceOne Capital Group. The TelForceOne Capital Group includes: TelForceOne S.A. based in Wrocław, mPTech Sp. z o.o. based in Warsaw, Telcon Sp. z o.o. based in Łódź, Teletorium Sp. z o.o. based in Wrocław, R2 Invest Sp. z o.o. based in Wrocław, Telforceone Forcelight Sp. z o.o. based in Wrocław, TFO Distribution Sp. z o.o. based in Warsaw, FF Sp. z o.o. based in Wrocław, Moby.pl Sp. z o.o. based in Wrocław, CPA Czechy Sro based in Pardubice (Czech Republic), CPA Slovakia based in Bratislava (Slovakia).

Additionally, recipients of your data may include service providers supplying us with technical and organizational solutions, as well as legal and consulting service providers who support us in pursuing due claims and defending our rights (in particular, law firms, tax firms, and collection agencies).

We collaborate with Microsoft Clarity and Microsoft Advertising to record how our website is used and interacted with through behavioral metrics, heat maps, and session replay to improve and market our products/services. Data regarding website usage is collected using first-party and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information to optimize the website, fraud/security objectives, and advertising. More information about how Microsoft collects and uses data can be found in Oświadczeniu o ochronie prywatności firmy Microsoft.

4. CAN YOUR DATA BE TRANSFERRED OUTSIDE THE EUROPEAN ECONOMIC AREA?

As part of our use of tools that support our ongoing activities provided, for example, by Google, your personal data may be transferred to countries outside the European Economic Area, where entities collaborating with us maintain tools for processing personal data. Data may be transferred outside the European Economic Area based on appropriate legal safeguards, which are standard contractual clauses approved by the European Commission.

5. VOLUNTARINESS OF PROVIDING PERSONAL DATA

We do not require you to provide us with your personal data. You provide it voluntarily. However, please remember that it is necessary for us to fulfill your order, manage your Customer Account, respond to your complaint, and also – if you express such a desire – to send you our Newsletter or to allow you to leave comments or likes on our social media profiles.

In the case of cookies that are intended to facilitate or improve the use of our store, limiting their use on a given device may affect the functioning of the store – for example, it may result in the inability to maintain a login session, and in some cases, it may also significantly hinder the use of the store.

6. PROILING AND AUTOMATION

In an automated manner, including through profiling, we may process data from cookies for which you have given your consent. Similarly, the advertisements and discounts presented to you may be tailored to your purchase history in our store. This means that the information we show you on our website and in the displayed advertisements may be linked to how you have used our site and your order history. As a result, we will be able to better tailor the content of our electronically provided services to your preferences, needs, and interests; however, binding decisions will not be automated. This will also not have any legal effects on you or significantly impact your situation in a similar way.

The other data you provided in connection with the order fulfillment will not be processed in an automated manner, including profiling.

Additionally, if you use a Customer Account and subscribe to our Newsletter, data about your previous orders and items added to your wishlist may be processed in the form of profiling to tailor the content sent to you in the Newsletter to your preferences, needs, and interests.

7. WHAT ARE YOUR RIGHTS?

At any time, you have the right to withdraw your consent to the processing of personal data (if such processing is based on your consent), to access your personal data, and to request their rectification, deletion, restriction of processing, transfer of data to another administrator, not to be subject to a decision based solely on automated processing, including profiling, to object to their processing based on the legitimate interests of the data controller (Article 6(1)(f) GDPR) or for statistical purposes (Article 89(1) GDPR) for reasons related to your particular situation, as well as to object to processing for direct marketing purposes.

For any matters related to the processing of personal data, you can contact us by writing to pomoc@mptech.eu. We will address your request without unnecessary delay, within a maximum of 30 days. In exceptional circumstances, especially due to the complexity of your request, we have the right to extend this period by an additional two months, of which we will inform you.

You also have the right to file a complaint with the supervisory authority responsible for personal data protection – the President of the Personal Data Protection Office, if you believe that the processing of data by the Administrator is contrary to the GDPR. A complaint regarding the processing of your personal data by us can be submitted to the President of the Personal Data Protection Office, located in Warsaw at Stawki 2, 00-193 Warsaw.