PRIVACY AND COOKIE POLICY

1. Introduction

The protection of your personal data is one of the most important aspects of our business. We ensure that you are informed about all of your rights. This
Privacy Policy sets out the principles for the processing and protection of personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR)
and the Act on the Provision of Electronic Services.

2. Personal Data Controller

The controller of your personal data is:
FMIC Performance sp. z o.o.
ul. Boczna 6/8/10, 42-202 Częstochowa
Tax ID: PL9492250893, National Business Registry Number: 520264908
Contact details for data protection matters:
- E-mail: [email protected] or [email protected]
- Telephone: +48 793 593 993
- Correspondence address: ul. Boczna 6/8/10, 42-202 Częstochowa

3. Purposes and Legal Bases for Data Processing

We process your personal data for the following purposes:
- Registration and maintenance of a User Account in order to provide electronic services – legal basis: necessity for the performance of a contract, Article 6(1)(b) GDPR.
- Processing orders and purchase transactions, including delivery handling, payments and issuing sales documents – legal basis: necessity for the performance of a contract, Article 6(1)
(b) GDPR.
- Legal obligations (tax and accounting), retention of invoices and accounting documentation – legal basis: compliance with a legal obligation under Article 6(1)(c) GDPR.
- Handling complaints, returns and contact requests: legal basis: necessity for the performance of a contract under Article 6(1)(b) GDPR or the legitimate interest
of the Controller under Article 6(1)(f) GDPR.

- Direct marketing and promotional activities, including operating a newsletter, organising loyalty programmes, competitions and promotional campaigns – legal basis: your
consent under Article 6(1)(a) GDPR or the Controller's legitimate interest in promoting its own services under Article 6(1)(f) GDPR.
- Establishing, pursuing and defending against claims, protecting the company's legal interests – legal basis: the Controller's legitimate interest under Article 6(1)(f)
GDPR.
- Statistical and analytical purposes and satisfaction surveys, improving the operation of the store and its offer – legal basis: the Controller's legitimate interest under Article 6(1)(f) GDPR.

4. Data Retention Period

Your personal data will be retained for the period necessary to fulfil the purposes:
- Account and order-processing data: for the duration of the account and for the limitation period for civil claims arising from purchases (usually up to 6 years).
- Accounting and tax data: for 5 years, calculated from the end of the calendar year in which the tax payment deadline expired.
- Data processed on the basis of consent (e.g. newsletter): until you withdraw your consent.
- Data processed on the basis of a legitimate interest: until you make an effective objection or until that interest ceases to exist.

5. Recipients of Personal Data

For the proper operation of the store and the fulfilment of orders, your data may be transferred to trusted external entities:
- Logistics and courier service providers delivering goods.
- Payment service providers handling online payments.
- Accounting and legal service providers, i.e. accounting offices, tax advisers, law firms and debt collection companies.
- IT system providers, i.e. hosting companies, providers of CRM and ERP systems and e-mail marketing tools.
- Satisfaction survey providers, external tools conducting NPS surveys.
- Public authorities, exclusively on the basis of legal provisions (e.g. Tax Office, courts).

6. Rights of the Data Subject

In connection with the processing of personal data, you have the following rights:
- The right to access your data and obtain a copy of it.
- The right to rectify (correct) your data.
- The right to erasure of data (“right to be forgotten”).
- The right to restrict data processing.
- The right to data portability to another controller.
- The right to object to data processing (including direct marketing).
- The right to withdraw consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal).

To exercise your rights, contact us at: [email protected].

7. Right to Lodge a Complaint

If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (PUODO),
ul. Stawki 2, 00-193 Warsaw.

8. Voluntary Provision of Data

Providing personal data is voluntary, however it is necessary to create a User Account, place and fulfil an order in the online store or subscribe to the newsletter. Failure
to provide the data will make it impossible to provide these services.

9. Transfers of Data to Third Countries and Profiling

- The Controller does not transfer personal data outside the European Economic Area (EEA) or to international organisations, unless required by law or
necessary when using global analytical and marketing tools (e.g. Google).

In such situations, appropriate safeguards are applied (e.g. standard contractual clauses).
- Your data is not used for automated decision-making that would produce legal effects concerning you. We may tailor the offer on the website based on
your activity (so-called behavioural profiling), however this does not affect your consumer rights or purchase conditions.

10. Cookies and Operational Data

1. The online store uses cookies. These are small text files stored on your end device (computer, tablet, smartphone) while browsing the website.
2. During the first visit to the website, a message concerning cookies is displayed. You may change cookie settings in your web browser at any time
or block them completely.
3. Restricting the use of cookies may affect some functionalities available on the store's website (e.g. difficulties in remaining logged in or saving products in
the shopping cart).
4. To a limited extent, we may automatically collect personal data through cookies and similar technologies (e.g. Local Storage) located on our
websites.
5. Cookies are small text files stored on the user's computer or other mobile device while using online services. These files are used, among other things, for
using various functions provided on a given website or confirming that a given user has seen specific content.
6. Within the online store, we use cookies divided into the following categories:

A. Essential (technical) cookies

They are necessary for the proper operation of our store. Their use does not require user consent and includes:
- Maintaining the user session and its status.
- Enabling authorisation by logging in to the User Account.
- Saving information necessary for the operation of the shopping cart.
- Monitoring the stability and availability of services.

B. Functional and preference cookies

They facilitate the use of the website by remembering the user's choices. Their operation includes:
- Restoring the most recently visited view or search result upon the next login.
- Remembering the choice regarding the display of messages (e.g. promotional banners).
- Enabling automatic login using the “Remember me” option.
- Setting the preferred language, currency, font size or sorting parameter.
- Displaying recently viewed products.

C. Analytical and marketing cookies (third parties)

We use cookies from external partners to measure traffic, analyse user behaviour and personalise advertisements. These activities include:
- Monitoring website traffic and collecting aggregated, anonymous statistics.
- Determining the number of unique users and controlling the frequency of displayed content.
- Measuring the effectiveness of newsletter subscriptions.
- Integration with messengers (chat support), payments and social media.

As of the date of this document, these entities include in particular:
- Google Analytics / Google LLC – traffic statistics analysis (the user may block this tool using the official add-on: google.com).
- Meta Platforms Ireland Limited (Facebook) – social media integration and marketing analytics.
- PayU S.A. / PayPal – processing and security of payment transactions.
- DPD Polska sp. z o.o. – logistics services and shipment tracking.

11. Cookie Management and User Consent

1. During the first visit to our website, a cookie banner is displayed (consent management platform – CMP). The user may voluntarily consent to the installation
of functional, analytical and marketing cookies.
2. Consent to non-essential cookies may be withdrawn or changed at any time through the privacy widget available on our website.
3. Without your explicit consent, we do not link personal data (such as name or address) with anonymous data stored in direct marketing cookies.
4. The user may also manage cookies directly on their device by changing web browser settings:
- Google Chrome: Settings › Privacy and security › Cookies and other site data.
- Mozilla Firefox: Options › Privacy and security › Cookies and site data.
- Apple Safari: Preferences › Privacy › Block all cookies or Manage website data.
- Microsoft Edge: Settings › Site permissions › Cookies and site data.
- Opera: Settings › Advanced › Privacy and security › Site settings › Cookies.

5. Restricting or disabling the use of cookies may affect the proper operation of certain store functionalities (e.g. inability to remain logged in or loss
of shopping cart contents).

12. Server Access Logs

1. We collect information concerning the use of our website and users' IP addresses based on the analysis of server access logs.
2. This data is used exclusively for the following purposes:
- Diagnosing technical issues related to server operation.
- Analysing and detecting possible security breaches (e.g. hacking attacks).
- Managing the technical side of the service and creating anonymous demographic analyses (e.g. the region from which the connection was made).

3. Based on this data, we may prepare general statistical reports concerning website traffic, which may be made available to cooperating entities. These reports
do not contain any data enabling the identification of your identity.
4. IP addresses may be disclosed exclusively to authorised public authorities (e.g. the Police, the Public Prosecutor's Office) on the basis of applicable laws and in connection
with proceedings conducted by them.

13. Principle of Data Minimisation and Legitimate Interest

1. When pursuing our legitimate interest (Article 6(1)(f) GDPR), we conduct a balancing test each time and consider the impact of processing on the privacy of the persons whose
data is concerned.
2. We comply with the principle of data minimisation – we never process more information than is absolutely necessary for the proper performance of a service or the achievement of a
business purpose.
3. We process extended data (e.g. e-mail address, address data) exclusively with your knowledge and for specific purposes, such as order fulfilment or sending a newsletter.

14. Changes to the Privacy Policy

This Privacy Policy is reviewed and updated on an ongoing basis. Changes to the document may occur in particular in the event of:
- Changes to generally applicable laws concerning personal data protection or telecommunications law.
- New guidelines or decisions of supervisory authorities (e.g. the President of the Personal Data Protection Office).
- Implementation on the website of new technologies, analytical tools or marketing tools affecting data-processing processes.
- Changes to the methods, purposes or legal bases for data processing by the Controller.

The current version of the document is always available on the website of our online store.