PRIVACY POLICY

XTREME4X4.PL

The xtreme4x4.pl online store places particular importance on respecting the privacy of users visiting www.xtreme4x4.pl, hereinafter also referred to as the "Website," "Store," or "Service." This Privacy Policy sets out the principles for the processing of personal data, the use of cookies, and other technologies used in connection with the use of the Website and making purchases through it.

§ 1. Personal data administrator

1. The controller of personal data is XTREME4X4.PL ŚWIERZ & ŚWIERZ SPÓŁKA JAWNA with its registered office at Aleja Lotników Polskich 1, 21-045 Świdnik, NIP 7132281896, KRS 0000048060.
2. In matters concerning personal data, you can contact the Administrator at the following e-mail address: xtreme@xtreme4x4.pl or in writing to the registered office address.

§ 2. Scope of collected data

1. In connection with the use of the Website, the Administrator may process data provided by the user when placing an order, creating an account, contacting via the contact form, contacting by e-mail or telephone, and subscribing to the newsletter, if such a service is available.
2. The scope of processed data may include, in particular: name and surname, company name, delivery address, billing address, telephone number, e-mail address, Tax Identification Number, payment details, order history and data related to complaints and returns.
3. The Administrator may also process technical data collected automatically when using the Website, such as IP address, device type, browser type, operating system, approximate location, source of access to the website, date and time of the visit, system errors and information saved in server logs and cookies.

§ 3. Purposes and basis of data processing

1. Personal data are processed for the purpose of concluding and executing a sales contract, fulfilling an order, processing payments, delivering Goods, maintaining contact with the Customer, handling complaints and returns, and maintaining a user account, if such functionality is available.
2. Data may also be processed for the purpose of fulfilling legal obligations incumbent on the Administrator, in particular those resulting from tax and accounting regulations.
3. The Administrator may also process data based on a legitimate interest, in particular for the purpose of pursuing claims, defending against claims, ensuring the security of the Website, maintaining statistics and improving the operation of the website and the store.
4. If the user has given separate consent, the data may also be processed for marketing purposes or for sending the newsletter.
5. The basis for data processing is in particular: Article 6(1)(b) of the GDPR – performance of a contract or pre-contractual activities, Article 6(1)(c) of the GDPR – compliance with legal obligations, Article 6(1)(f) of the GDPR – legitimate interest of the Controller, and Article 6(1)(a) of the GDPR – user consent, if required.

§ 4. Server logs

1. Like most websites, the Website records HTTP requests sent to the server. This means the Administrator may have access to data such as: the public IP address, the time of the request, the time of the response, the URL of the requested resource, the URL of the previously visited page, information about the browser and operating system, and information about errors occurring when connecting to the Website.
2. This data is used for technical, administrative, security, and diagnostic purposes for the Website. Generally, it is not used to identify specific users, unless necessary to ensure security, pursue claims, or fulfill legal obligations.
3. Server logs are stored for the period necessary to achieve the purpose for which they were collected and then deleted or anonymized, unless further storage is required by legal obligations or the justified need to secure claims.

§ 5. Data recipients

1. Personal data may be transferred to entities cooperating with the Administrator only to the extent necessary to achieve the purposes indicated in this Privacy Policy.
2. The recipients of data may include, in particular: payment operators, courier companies and carriers, hosting providers, IT system providers, accounting offices, entities providing technical, analytical, marketing or legal support – if it is necessary to achieve a given processing purpose.

§ 6. Payment operator – Przelewy24

1. In order to make online payments, the Administrator may use the services of the payment operator Przelewy24, which supports, among others, fast online transfers and BLIK payments.
2. In connection with the execution of payments, the Customer's data may be transferred to the payment operator to the extent necessary to process the transaction.
3. Detailed information on the rules for data processing by the payment operator is available here: Przelewy24 Privacy Policy.

§ 7. Delivery Operator

1. In order to deliver orders, the Administrator may transfer Customer data to logistics operators and carriers to the extent necessary to send, track and deliver the shipment.
2. The scope of data transferred may include, in particular, name and surname, delivery address, telephone number and e-mail address.
3. If delivery is made by DPD or another designated carrier, detailed information regarding data processing by a given operator is available in that entity's privacy policy.

§ 8. Hosting

1. The Website and Store may be hosted on the hosting infrastructure of an external provider.
2. Therefore, technical data and data sent via forms or the store system may be processed within the server infrastructure of the hosting provider.
3. If hosting is provided by LH.pl or another provider, detailed data processing rules are specified in the privacy policy of that service provider.

§ 9. Data storage period

1. Personal data is stored for the period necessary to perform the contract, process orders, complaints and returns.
2. Data related to accounting and tax documentation are stored for the period required by law.
3. Data processed on the basis of consent are stored until its withdrawal, and data processed on the basis of a legitimate interest are stored until an effective objection is raised or the purpose of processing ceases to exist.
4. Technical data and server logs are stored for the period necessary for administrative, security and diagnostic purposes.

§ 10. Rights of the data subject

1. The data subject has the right to access, rectify, delete, limit processing, transfer data and object to data processing – in cases provided for by law.
2. In the case of data processing based on consent, the person has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
3. The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office.

§ 11. Cookies and technical data

1. The website may use cookies and similar technologies for the proper operation of the website and the Store, for managing the shopping cart, maintaining the user's session, remembering selected settings, improving security, maintaining statistics and for analytical or marketing activities - if such are used.
2. Cookies necessary for the operation of the Website may be used without separate user consent if they are necessary to provide the service requested by the user. Analytical, advertising, or other non-essential cookies may be used after obtaining appropriate user consent, if required by law.
3. The User may manage cookies at any time using the settings of their web browser or using the consent management tool, if available on the Website.
4. Restricting the use of cookies may affect some website functionalities.

§ 12. Data security

1. The Administrator uses appropriate technical and organizational measures to protect personal data against loss, destruction, unauthorized access, disclosure or unlawful processing.
2. Only authorized persons and entities cooperating with the Administrator on the basis of appropriate agreements and only to the extent necessary to provide services have access to the data.
3. If you have an account in the Store, you are also responsible for maintaining the confidentiality of your login and password. We recommend using strong passwords and not sharing your login details with third parties.

§ 13. Links to other websites

1. The website may contain links to other websites. The Administrator is not responsible for the privacy policies of these websites.
2. When visiting other websites, we recommend that you review their privacy policies. This Privacy Policy applies solely to the xtreme4x4.pl website.

§ 14. Final provisions

1. This Privacy Policy is for informational purposes only and is effective from the date of its publication on the website.
2. The Administrator reserves the right to update the content of the Privacy Policy in the event of organizational, technological or legal changes.
3. The current version of the Privacy Policy is published on the website of the XTREME4X4.PL online store.