PRIVACY POLICY OF THE ONLINE STORE
WWW.DIYOURSELF.EU

§ 1
GENERAL PROVISIONS

1. The administrator of personal data collected through the online store www.dibys.eu is DIBYS SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ registered in the Business Register by the DISTRICT COURT FOR WARSAW, XIII ECONOMIC DIVISION OF THE NATIONAL COURT REGISTER, under the KRS number: 0000751012, with the business location and address for deliveries at ul. Domaniewska 17/19 lok. 133, 02-663 Warsaw, NIP: 1231413091, REGON: 381492717, email address: hello@dibys.eu, phone number: +48 881 013 974, hereinafter referred to as the “Administrator” and also the “Service Provider.”
2. Personal data collected by the Administrator through the website are processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.
3. All terms or expressions written in uppercase in this Privacy Policy should be understood in accordance with their definition contained in the Regulations of the online store www.dibys.eu.

§ 2
TYPE OF PROCESSED PERSONAL DATA, PURPOSE, AND SCOPE OF DATA COLLECTION

1. PROCESSING PURPOSE AND LEGAL BASIS. The Administrator processes the personal data of Service Recipients of the www.dibys.eu Store for the purpose of:
   1. registering an Account in the Store to create an individual account and manage it based on art. 6(1)(b) GDPR (performance of a contract for the provision of electronic services in accordance with the Store Regulations),
   2. placing an Order in the Store to fulfill the Sales Agreement based on art. 6(1)(b) GDPR (performance of a sales contract),
   3. using the Opinion System to enable the Customer to express their opinion on the Product purchased in the Store and the Sales Agreement concluded with the Seller based on art. 6(1)(f) GDPR (legitimate interest of the entrepreneur).
2. TYPE OF PROCESSED PERSONAL DATA. The Service Recipient provides, in the case of:
   1. Account: email address, first name, and last name.
   2. Orders: first name, last name, address, tax identification number (NIP), email address, phone number.
   3. Opinion System: first name, email address.
3. PERSONAL DATA ARCHIVING PERIOD. The personal data of Service Recipients is stored by the Administrator:
   1. In the case where the basis for data processing is the performance of a contract, for as long as necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. If a specific provision does not state otherwise, the limitation period is six years, and for claims related to periodic services and business activities – three years,
   2. in the case where the basis for data processing is consent, until the consent is withdrawn, and after the withdrawal of consent for a period corresponding to the limitation period for claims that the Administrator can raise and that can be raised against him. If a specific provision does not state otherwise, the limitation period is six years, and for claims related to periodic services and business activities – three years.
4. During the use of the Store, additional information may be collected, in particular: IP address assigned to the Service Recipient’s computer or the external IP address of the Internet provider, domain name, type of browser, access time, operating system type.
5. After obtaining separate consent based on art. 6(1)(a) GDPR, data may also be processed for the purpose of sending commercial information electronically or making telephone calls for direct marketing – respectively in connection with art. 10(2) of the Act of July 18, 2002, on the provision of electronic services or art. 172(1) of the Act of July 16, 2004, Telecommunications Law, including those sent as a result of profiling, if the Service Recipient has given the relevant consent.
6. Data navigation, including information about links and references the Service Recipient decides to click or other actions taken in the Store, may also be collected. The legal basis for such activities is the legitimate interest of the Administrator (art. 6(1)(f) GDPR) consisting of facilitating the use of electronically provided services and improving the functionality of these services.
7. Providing personal data by the Service Recipient is voluntary.
8. The Administrator takes special care to protect the interests of individuals whose data is processed, in particular ensuring that the data collected by him is:
   1. processed lawfully,
   2. collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes,
   3. factually correct and adequate in relation to the purposes for which it is processed, and stored in a form enabling the identification of the persons to whom it relates, no longer than is necessary to achieve the purpose of processing.

§ 3
DISCLOSURE OF PERSONAL DATA

1. TRANSFER OF PERSONAL DATA. Personal data of Service Recipients is transferred to service providers used by the Administrator in operating the Store, in particular to:
   1. entities performing the delivery of Products,
   2. payment system providers,
   3. survey opinion system providers,
   4. accounting office,
   5. hosting providers,
   6. software providers enabling business operations,
   7. entities providing mailing systems,
   8. software providers necessary for operating the online store.
2. Service providers (referred to in point 1 of this paragraph) to whom personal data is transferred either follow the Administrator’s instructions regarding the purposes and methods of processing this data (processing entities) or independently determine the purposes and methods of their processing (administrators), depending on contractual agreements and circumstances.
3. Personal data of Service Recipients is stored exclusively within the European Economic Area (EEA), with the exception of § 5 point 5 and § 6 of the Privacy Policy.

§ 4
RIGHT TO CONTROL, ACCESS TO OWN DATA, AND THEIR CORRECTION

1. RIGHTS OF THE DATA SUBJECT. The individual whose data is concerned has the right to access their personal data, correct, delete, restrict processing, transfer data, object, and withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
2. LEGAL BASIS FOR THE RECIPIENT’S REQUESTS:
   1. access to data – Article 15 of the GDPR.
   2. correction of data – Article 16 of the GDPR.
   3. deletion of data (the right to be forgotten) – Article 17 of the GDPR.
   4. restriction of processing – Article 18 of the GDPR.
   5. data portability – Article 20 of the GDPR.
   6. objection – Article 21 of the GDPR.
   7. withdrawal of consent – Article 7(3) of the GDPR.
3. To exercise the rights mentioned in point 2, a relevant email message can be sent to: hello@dibys.eu.
4. In the event of a request from the Service Recipient based on the aforementioned rights, the Administrator fulfills or refuses to fulfill the request promptly, but no later than within one month of its receipt. If, due to the complex nature of the request or the number of requests, the Administrator cannot fulfill the request within a month, they will do so within the next two months, informing the Service Recipient in advance within one month of receiving the request about the intended extension and the reasons for it.
5. If an individual finds that the processing of personal data violates the provisions of the GDPR, they have the right to lodge a complaint with the President of the Office for Personal Data Protection.

§ 5
COOKIES

1. The Administrator’s website uses “cookies.”
2. The installation of “cookies” is necessary for the proper provision of services on the Store’s website. “Cookies” contain information necessary for the correct functioning of the site and also allow for the generation of general statistics on website visits.
3. Two types of “cookies” are used on the site: “session” and “persistent.”
   1. “Session” cookies are temporary files stored on the Service Recipient’s end device until logout (leaving the site).
   2. “Persistent” cookies are stored on the Service Recipient’s end device for the time specified in the parameters of the “cookies” or until deleted by the Service Recipient.
4. The Administrator uses their own cookies to better understand how Service Recipients interact with the content of the site. These cookies collect information about the Service Recipient’s use of the website, the type of page from which the Service Recipient was redirected, and the number of visits and the time of the Service Recipient’s visit to the website. This information does not record specific personal data of the Service Recipient but is used to compile statistics on the use of the site.
5. The Administrator also uses external cookies to collect general and anonymous statistical data through Google Analytics tools (external cookie administrator: Google LLC, USA).
6. Cookies may also be used by advertising networks (especially the Google network) to display ads tailored to the way the Service Recipient uses the Store. For this purpose, they may retain information about the Service Recipient’s navigation path or the time spent on a particular page.
7. The Service Recipient has the right to decide on the scope of access of “cookies” to their computer by:
   1. Selecting the types of cookies for which they give consent immediately after entering the Store’s website and the appearance of the cookie-related message,
   2. Changing settings in their browser window. Detailed information on the possibilities and methods of handling “cookies” is also available in the software settings (web browser).

§ 6
ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

1. In the Store, so-called social plugins (“plugins”) of social media services are used. By displaying the website www.dibys.eu containing such a plugin, the Service Recipient’s browser establishes a direct connection with the servers of Instagram and YouTube.
2. The content of the plugin is transmitted directly to the Service Recipient’s browser by the respective service provider and integrated into the site. Due to this integration, service providers receive information that the Service Recipient’s browser has displayed the www.dibys.eu site, even if the Service Recipient does not have a profile with the respective service provider or is not currently logged in. This information (along with the IP address of the Service Recipient) is transmitted directly to the server of the respective service provider (some servers are located in the USA) and stored there.
3. If the Service Recipient logs into one of the above social media services, this service provider will be able to directly associate the visit to the www.dibys.eu site with the Service Recipient’s profile on that social media platform.
4. If the Service Recipient uses a specific plugin, such as clicking the “Like” button or the “Share” button, the relevant information will also be directly transmitted to the server of the respective service provider and stored there.
5. The purpose and scope of data collection, as well as their further processing and use by service providers, along with the possibility of contact and the rights of the Service Recipient in this regard, including the option to make privacy protection settings, are described in the privacy policies of the service providers:
   • https://help.instagram.com/519522125107875?helpref=page_content
   • https://policies.google.com/privacy?hl=pl&gl=ZZ
6. If the Service Recipient does not want social media platforms to directly associate data collected during visits to the www.dibys.eu site with their profile on that platform, they must log out of that service before visiting the www.dibys.eu site. The Service Recipient can also completely prevent the loading of plugins on the site by using appropriate browser extensions, such as blocking scripts with “NoScript.”
7. The Administrator uses remarketing tools, i.e., Google Ads, on their website. The use of these tools involves the use of cookies from Google LLC. related to the Google Ads service. As part of the mechanism for managing cookie settings, the Service Recipient has the option to decide whether the Service Provider will be able to use Google Ads (external cookie administrator: Google LLC., USA) in relation to them.

§ 7
FINAL PROVISIONS

1. The Administrator implements technical and organizational measures ensuring the protection of processed personal data appropriate to the threats and categories of data covered by protection. Specifically, the Administrator secures data against unauthorized disclosure, acquisition by unauthorized persons, processing in violation of applicable regulations, as well as alteration, loss, damage, or destruction.
2. The Administrator provides appropriate technical measures to prevent unauthorized persons from acquiring and modifying personal data transmitted electronically.
3. Matters not regulated by this Privacy Policy are governed by the provisions of the GDPR (General Data Protection Regulation) and other relevant Polish legal regulations.