Privacy and Cookies Policy of the Nika Online Store

I. General Information

1. The Privacy and Cookies Policy is intended to inform visitors to the NIKA Online Store website about the rules for collecting and using their information while using the website available at: www.sklepnika.dobrafabryka.pl (hereinafter the “Service”), as well as when placing orders for the electronic service consisting of the purchase of Products offered in the Service. Any person who uses the Service in any way is considered a User.
2. Our primary objective is to ensure that Users of the Service are provided with protection of their personal data and privacy at a level no lower than that required by applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
3. The controller of Users’ personal data is Fundacja Dobra Fabryka, with its registered office in Warsaw (04-694), ul. Pomiechowska 47/14, entered into the National Court Register (KRS) under number 0000519542, NIP: 9522131059, REGON: 147361669 (hereinafter referred to as the “Controller”).
4. The Controller has appointed a Data Protection Officer, who can be contacted at: [email protected].

II. Legal Basis, Scope and Purpose of Data Collection

1. The Service limits the collection and use of information to the necessary minimum. Data is collected either actively (voluntarily provided by the User) or passively (automatically recorded by the server).
2. Providing personal data is voluntary, but necessary for the fulfillment of orders.
3. Data is processed for the following purposes:
   • order fulfillment,
   • handling complaints,
   • provision of electronic services,
   • marketing (with separate consent).
4. Scope of data:

• first and last name,
• residential and delivery address,
• email address,
• phone number,
• Tax Identification Number (for VAT invoices issued to businesses).

Legal basis:

• a) consent (Article 6(1)(a) GDPR),
• b) performance of a contract (Article 6(1)(b) GDPR),
• c) legal obligation (Article 6(1)(c) GDPR),
• d) legitimate interest of the Controller (Article 6(1)(f) GDPR).

The Service automatically collects the IP address.

Data is not transferred to third countries or international organizations.

Data may be transferred to entities supporting the Controller’s operations (e.g., courier services, accounting firms, IT providers, payment operators).

Data is stored for a maximum of 10 years from the date on which claims become enforceable.

III. Users’ Rights

1. The User has the right to:
   • access their data,
   • rectification of their data,
   • erasure of their data,
   • data portability
   • restriction of processing,
   • the right to object,
   • the right to withdraw consent,
   • the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).
2. Contact with the Controller or the Data Protection Officer to exercise your rights.

IV. Cookies

1. The Service uses cookies stored on the User’s device. Cookies are not used to identify the User.
2. Types of cookies:
   • First-party cookies (session and persistent)
   • Third-party cookies (Google Analytics) – statistical data
3. The User can manage cookies in their browser settings.

V. Data Security

1. Data is processed lawfully, for specified purposes, appropriately, and for the necessary period of time.
2. Data is not shared with third parties, except in the cases described above.
3. The Controller applies appropriate technical and organizational measures, including SSL encryption.
   
4. Links to external websites (e.g., PayU, Facebook) are not covered by this Policy.

VII. Final Provisions

1. Use of the Service constitutes acceptance of this Policy.
2. The Controller reserves the right to amend this Policy, providing notice on the homepage for a period of 14 days.
3. The Controller is not liable for technical interruptions in the operation of the Service.
4. The Controller is not liable for any damages resulting from the use of the Service.
5. For any questions, please contact the Controller or the Data Protection Officer.