Privacy Policy and Cookie Policy

§ 1 GENERAL PROVISIONS

This document sets out the rules for processing personal data obtained from Customers by the Medibo Online Store, operated at www.sklep.medibo.pl by Medibo Sp. z o.o. It also contains information regarding the use of Cookies and analytical tools in the Online Store.

The controller of personal data is Medibo Sp. z o.o., entered in the National Court Register kept by the District Court in Bydgoszcz under number 0000788439, NIP: 9671427641 (hereinafter referred to as the “Controller”).

Personal data collected by Medibo Sp. z o.o. via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation – GDPR).

The Medibo Online Store informs that Customers’ personal data are processed solely for the purpose of performing and fulfilling the contract concluded with the Buyer/Customer. With additional consent, personal data may also be processed for the purpose of delivering informational materials and marketing offers in the form of a Newsletter.

The Medibo Online Store makes every effort to respect Customers’ privacy and protect personal information provided while using and making purchases in the Store. For this purpose, secure communication encryption protocols (SSL) are used, among others.

Providing personal data is voluntary; however, failure to provide data marked as necessary will prevent registration or placing an Order.

§ 2 TYPE, PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA

In the Medibo Online Store, personal data are collected in the following cases:

1. For the purpose of performing a sales contract concluded with the Customer, related to account registration and placing Orders – legal basis: Article 6(1)(b) GDPR (performance of a contract).

2. For the purpose of establishing, asserting or enforcing claims – legal basis: Article 6(1)(f) GDPR.

a) In these cases, the necessary scope of processed data includes: first name and last name; e-mail address; contact phone number; address (street, house number, apartment number, postal code, city, country); residence/business/registered office address; bank account number (in the case of refunds); and, for Customers who are not consumers, additionally the company name and tax identification number (NIP), as well as other data collected during the use of the Online Store.

3. Subscription to the Newsletter, for the purpose of performing a contract for the provision of an electronic service – legal basis: consent of the data subject pursuant to Article 6(1)(a) GDPR.

b) In this case, the necessary scope of processed data includes the e-mail address and contact phone number.

§ 3 DISCLOSURE OF PERSONAL DATA

For the proper functioning of the Online Store, the Controller uses services provided by external entities. The Controller ensures that it uses the services of data processors who process data lawfully and in accordance with applicable regulations, including the GDPR.

The Controller transfers personal data only when it is necessary to achieve the purpose of processing and only to the extent required.

Customers’ personal data may be transferred to the following entities:

a) hosting and IT service providers;
b) carriers delivering Orders (listed in the Online Store Regulations);
c) entities handling electronic payments in the Online Store;
d) entities providing accounting, legal, and advisory services.

§ 4 DATA RETENTION PERIOD

Personal data provided will be processed for the period necessary to perform the concluded sales contract, including handling complaints and pursuing or defending claims by the Controller – however, no longer than 10 years from the date of data provision.

§ 5 PROFILING

The Medibo Online Store may use profiling, which consists of automated processing of personal data to evaluate personal factors of a natural person, in particular to analyze or predict Customers’ preferences and interests.

This function allows the Controller to display advertisements tailored to the Customer’s preferences and interests and to present products best suited to their needs. It also allows the use of appropriate communication methods, including the selection of communication language.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

§ 6 RIGHTS OF THE DATA SUBJECT

1. In accordance with the GDPR, a person who provides personal data has the following rights:

a) the right to information on how personal data are processed;
b) the right of access to and rectification of data;
c) the right to withdraw consent – legal basis: Article 7(3) GDPR;
d) the right to object to the processing of personal data – legal basis: Article 21 GDPR;
i) the Customer may object at any time, for reasons related to their particular situation, to the processing of their personal data, including profiling, where processing is based on the Controller’s legitimate interest;
e) the right to erasure (“the right to be forgotten”) – legal basis: Article 17 GDPR;
f) the right to restriction of processing – legal basis: Article 18 GDPR;
g) the right to data portability – legal basis: Article 20 GDPR;
h) the right to lodge a complaint with a supervisory authority.

§ 7 COOKIES

1. The Medibo Online Store uses Cookies. Cookies are small text files sent by a web server and stored by the user’s browser software. When the browser reconnects to the website, the site recognizes the type of device used by the user. Parameters allow only the server that created them to read the information contained therein. Cookies therefore facilitate the use of previously visited websites.

2. The Controller uses its own Cookies for proper Store configuration, in particular to:

a) adapt website content to Customer preferences and optimize website usage;
b) recognize the Customer’s device and location and properly display content tailored to individual needs;
c) remember selected settings and personalize the interface, e.g. language or region;
d) match advertisements to Customer preferences;
e) remember browsing history to recommend content;
f) adjust font size, website layout, etc.

3. The Controller uses its own Cookies for user authentication and maintaining user sessions, in particular to:

a) maintain the Customer’s session after logging in, so the Customer does not need to re-enter login details on each page;
b) ensure proper configuration of selected service functions, including verification of browser session authenticity;
c) optimize and increase the efficiency of services provided by the Controller.

4. The Controller uses its own Cookies to enable processes necessary for full website functionality, in particular to:

a) adapt website content to user preferences and optimize website usage;
b) ensure proper handling of affiliate programs, including verification of traffic sources.

5. The Controller cooperates with the following external services that may place external Cookies:

a) Google Inc., USA (including Google AdSense, Google Analytics, Google Ads, Google Maps API, Google DoubleClick, Google Tag Manager, Google Search Console);
b) Facebook Inc., USA or Facebook Ireland Ltd., Ireland;
c) Benhauer Sp. z o.o., Kraków (SalesManago.pl);
d) Comperia.pl S.A., Warsaw;
e) EBROS Mariusz Rosa, Zielonka (czater.pl – online chat service);
f) CallPage Sp. z o.o., Warsaw;
g) Zendesk, Inc., USA;
h) Hotjar Ltd., Malta.

6. Users may change Cookie settings at any time via browser settings or service configuration, including blocking automatic Cookie handling or receiving notifications about Cookies being stored.

7. Users may delete Cookies at any time using browser functions.

8. Restricting the use of Cookies may affect some website functionalities.

§ 8 FINAL PROVISIONS

The Online Store Controller reserves the right to amend this Privacy Policy at any time and undertakes to immediately publish the updated version on the Store’s website and inform registered Users accordingly.

In matters not regulated by this Privacy Policy, generally applicable data protection laws shall apply.

Any questions regarding the Privacy Policy and personal data protection should be directed to kontakt@medibo.pl.

This Privacy Policy is effective as of 12 October 2023.