All capitalised terms used in this document shall have the meaning given to them in the Terms and Conditions, unless otherwise indicated.

This Privacy Policy describes the principles of processing Customers' personal data in connection with placing Orders in the Store and in connection with providing Services to the Customers, as well as processing the data of persons sending enquiries or requests related to exercising their rights concerning the processing of their personal data. The Privacy Policy also contains information on processing personal data in social mediaand on cookies used on the Website.

WHO IS THE CONTROLLER OF YOUR DATA?

The controller, i.e. the entity which determines the purposes and means of processing your personal data, is Suchandra Bose, conducting business activity under the nameSuchandra Bose @Mojaartshop, holding NIP (tax identification number): 9452246187 and REGON number: 389496034 (“Mojaartshop”).

Mojaartshop deeply cares about your privacy and is committed to protecting all the information you share with us. We follow stringent procedures to help protect the confidentiality, integrity and security of data stored in our systems. Our top most priority is in protecting your confidential information and privacy. Your personal data is processed by Mojaartshop in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (“GDPR”).

HOW CAN YOU CONTACT THE CONTROLLER?

You can contact Mojaartshop:

• in writing to the address:ul. Żabiniec 83/46, 31-215 Kraków
• or electronically by writing to the e-mail address: info@mojaartshop.com

FOR WHAT PURPOSES MOJAARTSHOP PROCESSES YOUR PERSONAL DATA?

Processing of Customers' personal data in connection with the provision of Services to them

In the case of conclusion of an agreement between Mojaartshop and the Customer on the electronic provision of the Services of Customer Account, Data Storage or Contact Form, personal data is processed for the following purposes and on the following legal grounds:

1. in order to provide the above-mentioned Services - on the basis of Article 6(1)(b) of the GDPR (data processing is necessary for the performance of the agreement on the provision of services by electronic means);


2. for the purpose of ongoing contact regarding the performance of the Services and the handling of potential complaints, which constitutes Mojaartshop's legitimate interest pursuant to Article 6(1)(f) of the GDPR;


3. in order to establish, assert and defend claims, which constitutes Mojaartshop's legitimate interest in accordance with Article 6(1)(f) of the GDPR.

In connection with the Newsletter Service provision to Customers, personal data is processed for the purpose of marketing the Mojaartshop's own products and sending commercial information, including information about new products and promotions in the Store,which constitutes a legitimate interest of Mojaartshop within the meaning of Article 6(1)(f) of the GDPR. In order to receive the Newsletter, it is necessary for the Customer to give consent pursuant to the Act on the provision of electronic services and the Telecommunications Law. You can withdraw this consent at any time.

Providing personal data in order to implement the above Services is voluntary, but necessary for their performance. Personal data shall be stored for the duration of the relevant Service. The Customer may resign from the above Services at any time. Mojaartshop points out that if the Customer resigns from the Customer Account and Data Storage Services, Mojaartshopwill delete the Customer's Account, which does not mean, however, that Mojaartshop will delete the personal data related to Sales Agreements concluded with the Customer. These data will continue to be stored by Mojaartshop for the period indicated in the section entitled "Processing of Customers' personal data in connection with the conclusion and performance of Sales Agreements".

Processing of Customers' personal data in connection with the conclusion and performance of Sales Agreements

In connection with placing Orders by Customers in the Store, Mojaartshop processes personal data for the following purposes and on the following legal grounds:

1. in order to conclude and perform a Sales Agreement - on the basis of Article 6(1)(b) of the GDPR (data processing is necessary for the conclusion and performance of the Sales Agreement);


2. for the purpose of ongoing contact regarding the performance of the Sales Agreement and the processing of potential complaints, which constitutes Mojaartshop’s legitimate interest in accordance with Article 6(1)(f) of the GDPR;


3. in order to fulfil Mojaartshop’s legal obligations in the field of tax and accounting, in particular: issue invoices or other accounting evidence, keep accounts, settle taxes, archive data for accounting purposes - on the basis of Article 6(1)(c) of the GDPR in relation to the provisions of tax law and the Accounting Act;


4. in order to establish, assert and defend claims, which constitutes a legitimate interest of Mojaartshop pursuant to Article 6(1)(f) of the GDPR.

The provision of personal data to the extent necessary for the fulfilment of legal obligations is mandatory and results from tax regulations and the Accounting Act. Providing personal data for the purpose of concluding an agreement is voluntary, but necessary for concluding this agreement and its performance.

Personal data is stored for the period of execution of the contract and then until the statutory obligation to store data ceases (5 years from the end of the fiscal year) and until the expiry of the period of limitation of claims.

Data processing in connection with e-mail or written contact

When you contact Mojaartshop by e-mail or post, Mojaartshop receives your personal data directly from you. Mojaartshopprocesses it in order to respond to your request, which is its legitimate interest under Article 6(1)(f) of the GDPR.

You provide your personal data voluntarily in this case, but without itMojaartshopwill not be able to respond to your enquiry.

Mojaartshop will process your personal data provided to it in connection with your enquiry for the period necessary to respond or until you lodge an effective objection to the processing of your personal data.

Processing of personal data in social media

Mojaartshopmaintainsits profile on Facebook: https://www.facebook.com/mojaartshop and on Instagram: https://www.instagram.com/mojaartshop/

In connection with the operation of the above profiles, Mojaartshop acquires your personal data in connection with your subscription to Mojaartshop’s page (clicking the “Like” or “Watch” icon etc.), your publication of a comments under any of the Mojaartshop’sposts on Facebook or Instagram, as well as in connection with sending a message via Messenger or Instagram. Mojaartshopprocesses your personal data in particular as follows:

1. your user ID / your identification data and other information to the extent published by you on your own profile on Facebook or Instagram;
2. your profile picture;
3. the content of the comments and the content of the conversation you have with Mojaartshop through Messenger or Instagram;
4. statistical data on visits to Mojaartshop’s profiles.

Mojaartshop processes your personal data for the following purposesand on the following legal grounds:

1. to maintain a profile on Facebook or Instagram, under the terms and conditions set by its operator, and to inform you through it about activities, services, products, as well as to build and maintain community and to communicate through the available functionalities of Facebook orInstagram (comments, messages etc.), which constitutes Mojaartshop’s legitimate interest in accordance with Article 6(1)(f) of the GDPR;


2. to conduct analyses of the functioning, popularity, use of Facebook or Instagram profile, which is Mojaartshop’s legitimate interest in accordance with Article 6(1)(f) of the GDPR.

When using the statistics function on Facebook, Mojaartshopand Meta Platforms Ireland Ltd act as joint controllers of the data processed for statistics purposes. The arrangements between the joint controllers, which define the responsibilities for the processing of personal data, can be found here: https://www.facebook.com/legal /terms/page_controller_addendum

According to them, Meta Platforms Ireland Ltd has assumed primary responsibility under the GDPR for processing data for statistics purposes and for complying with all relevant obligations under the GDPR.

Tracking of web activity can take place regardless of whether you are logged in or registered with the social network.

You can find detailed information on activity tracking in the privacy policy of Meta Platforms Ireland Ltd. As for the statistics Mojaartshop receives from the operator, Mojaartshop has limited influence on them and can only prevent their transmission to a limited extent. If you are a logged in/registered user of Facebook or Instagram, please verify your privacy settings to correspond to your preferences.

The provision of personal data is voluntary.

Information that is contained in private messages sent to Mojaartshop via Facebook will be stored until the fulfilment of its legitimate interest, or until you object to the processing on grounds of your particular situationor until you delete your user profile, whichever comes first.

In the case of information held by Mojaartshopas part of comments shared by you, it will be available on Mojaartshop’s profile until you delete it.

Personal data collected by Facebook or Instagram, i.e. history of posts, history of activity and sent messages, are subject to storage according to the Facebookor Instagram terms and conditions.

Statistical data regarding visitors to Mojaartshop’s Facebook or Instagram profile will be processed for the time that the data is available on each platform in accordance with its terms and conditions.

Processing personal data in connection with the use of cookies

By using cookies (as detailed below), we process your personal data for analytical, statistical and other purposes, depending on which cookies you have consented to (pursuant to Article 6(1)(a) of the GDPR).

The data is stored until you withdraw your consent.

Processing of data in connection with sending requests concerning the exercise of rights under the GDPR

You have certain rights in relation to Mojaartshop’sprocessing of your personal data (see below in Privacy Policy), and you may address correspondence to Mojaartshop regarding the exercise of these rights. In connection with such correspondence, Mojaartshopprocesses your identification data, contact data, and other data provided by you or any other person who sends a request on your behalf to exercise your rights under the GDPR. Where the application is not sent directly by you, but by a proxy or legal representative, Mojaartshop processes in addition data concerning that proxy or representative, i.e. their identification data, contact data and data concerning the type of empowerment.

Mojaartshop processes applicants’ personal data for the following purposesand on the following legal grounds:

1. contacting you regarding your request for the exercise of rights under the GDPR – on the basis of Article 6(1)(c) of the GDPR, as the processing of personal data is necessary for the fulfilment of the Mojaartshop’s legal obligation under Article 12(1)-(3) of the GDPR;


2. archiving correspondence carried out on the handling of your request for the exercise of rights under the GDPR, for the purpose of proof and demonstrating that Mojaartshop has responded to your request in a timely manner, which is Mojaartshop’s legitimate interest under Article 6(1)(f) of the GDPR.

The provision of personal data is necessary in order to fulfil the request made by you.

The personal data is processed for the duration of the correspondence and will then be archived for evidence purposes until the expiry of the period of limitation of claims.

RECIPIENTS OF PERSONAL DATA

Your personal data may be disclosed by Mojaartshopto other entities:

1. its contractors, in particular entities providing accounting services, marketing services, entity providing IT infrastructure of the Store, web hosting providers (these are entities processing personal data on behalf of Mojaartshop, with whom Mojaartshop has concluded agreements on entrusting processing of personal data );
2. banks or institutions intermediating in making payments in the Store;
3. couriers, post offices;
4. entities authorised by law,
5. if you publish content in connection with theMojaartshop’s Facebook or Instagram profile, your personal data may also be visible to visitors to this profile.

AUTOMATED DECISION-MAKING

Mojaartshop does not make decisions about you based solely on automated processing, including profiling.

TRANSFER OF DATA OUTSIDE THE EEA

In connection with the maintenance of the Facebook or Instagram profile, as well as the use of Gmail provided by Google,your personal data may be transferred to the USA or another country outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, social network operatoror Google is required to apply appropriate safeguards, in particular EU Standard Contractual Clauses. In such case, you may request a copy of these relevant safeguards. You can find more detailed information in the Facebook, Instagram or Googleprivacy policy.

In connection with the use of the Google Analytics services by Mojaartshop, your personal data may also be transferred to the USA on the basis of EU Standard Contractual Clauses.

YOUR RIGHTS

You have the following rights in relation to the Mojaartshop’s processing of your personal data:

1. access to your personal data (Article 15 GDPR), including obtaining a copy of your data (Article 15(3) GDPR),
2. to rectify (amend) or complete incomplete personal data (Article 16 GDPR),
3. to request the erasure of personal data in cases provided for by law (Article 17 GDPR),
4. to request the restriction of the processing of personal data (Article 18 GDPR),
5. to receive your data in a structured commonly used format and to have it transferred where the processing is based on your consent or contract by automated means (Article 20 GDPR),
6. to object to the processing of your personal data where the processing is carried out for Mojaartshop’s legitimate interest, on grounds related to your particular situation (Article 21 GDPR),
7. to withdraw the consents granted at any time, without affecting the lawfulness of the processing that took place on the basis of the consents before their withdrawal.

You can exercise the above rights by contacting Mojaarsthop as indicated in section How can you contact the controller?

In addition, if you consider that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint to the competent supervisory authority.

COOKIES

Depending on your settings, in addition to technically necessary cookies, Mojaartshop may use cookies for statistical and analytical purposes. Cookies are small text files containing information about your activity on the Website and storing it on the device from which you access the Website.

In accordance with applicable law, Mojaartshop may store cookies on your device if this is necessary for the functioning of the Website (these cookies are described below as necessary). For the use of any other types of cookies (in particular analytical or advertising cookies) Mojaartshop needs your permission (opt-in).

Strictly necessary cookies on the Website do NOT legally require your prior consent. They are automatically installed on your device when you access the Website or make specific choices on the Website. They are necessary for the proper functioning of the Website, including to perform certain tasks such as, for example, performing the Services you have requested through the Website. These cookies are not deleted once you have finished browsing the Website, but have a limited validity period.

If you agree to this when you first visit the Website, or later by invoking the cookie settings panel, we will also use analytical cookies.

List of cookies used by Mojaartshop on the Website:

At any time you can change your cookie settings by invoking the cookie settings panel available at the bottom of the Website under “Change cookie settings” button.

CHANGES TO THE PRIVACY POLICY

This Privacy Policy may be updated in the event of a change in legislation that affects the processing of your personal data, as well as if Mojaartshop introduces changes in processing your personal data.