Privacy Policy

concerning the protection of personal data processed within the website https://fabryka4x4.pl/

Respecting your right to privacy and out of concern for the security of your personal data, Fabryka 4x4 Sp. z o.o. with its registered office in Szczepańcowa, ul. Polna 24, 38-457 Szczepańcowa, whose registration files are kept by the District Court in Rzeszów, 12th Commercial Division of the National Court Register, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0001141004, holding tax identification number NIP: 6842646355, REGON: 367477545, BDO: 000060160, share capital: PLN 100,000.00 (hereinafter also referred to as the "Seller", the "Company" or the "Controller"), as the owner and administrator of the website and online shop located under the domain: https://fabryka4x4.pl/ and its subpages (hereinafter referred to as the "Website" or the "Online Shop"), and as the controller of the data collected and processed in connection with the operation of the aforementioned Website and Online Shop, applies appropriate organisational and technical solutions ensuring the protection of the personal data processed.

This Privacy Policy constitutes the fulfilment of the Controller's information obligation arising from Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "GDPR"). The Policy explains how we use your personal data, how we collect, store and protect it.

We collect your personal data provided while using the Website and the Online Shop and their subpages with the utmost care and in accordance with the applicable legal provisions, in particular with the GDPR, the Act of 10 May 2018 on the Protection of Personal Data, the Act of 18 July 2002 on Providing Services by Electronic Means (hereinafter referred to as the "PSEM Act") and the Act of 12 July 2024 – Electronic Communications Law (hereinafter referred to as the "ECL"), respecting the right to privacy protection and guaranteeing to all persons using the Website and the Online Shop that the data made available will be duly protected.

We exercise particular care in order to protect your interests, and in particular we ensure that we collect your data for specified, lawful purposes and do not subject it to further processing incompatible with those purposes. We ensure that your data is factually correct and adequate in relation to the purposes for which it is processed, and that it is stored no longer than is necessary to achieve the purpose of the processing.

1. Who administers your personal data?

The controller of your personal data is Fabryka 4x4 Sp. z o.o. with its registered office in Szczepańcowa, ul. Polna 24, 38-457 Szczepańcowa, whose registration files are kept by the District Court in Rzeszów, 12th Commercial Division of the National Court Register, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0001141004, holding tax identification number NIP: 6842646355, REGON: 367477545, BDO: 000060160, share capital: PLN 100,000.00.

In all matters concerning the processing of personal data, you may contact us in writing at the Company's registered office address indicated above, as well as by telephone at (+48) 887 082 272 or by e-mail at: biuro@fabryka4x4.com.pl.

2. What data of yours do we collect and for what purpose?

While using the Website and the Online Shop and their subpages, you may be asked to provide certain personal data, in particular by completing:

a) the registration form in the Online Shop;
b) the Order form;
c) the contact form,
d) the Newsletter subscription form.

The data collected by means of the above forms may include: first name, surname, correspondence or delivery address, company name, company registered office address, company NIP (tax ID), e-mail address, telephone number, login, transaction history and details.

Purposes of processing and information on the requirement to provide data

Below we indicate the purposes of data processing and information as to whether the provision of data is a contractual or statutory requirement or a condition for concluding a contract, as well as the consequences of failing to provide it:

a) Setting up and maintaining an Account in the Online Shop, including viewing the offer and price lists – the provision of data (first name, surname, e-mail address) constitutes a condition for concluding the contract for the provision of the Account maintenance service. Failure to provide the data will make it impossible to set up an Account.

b) Placing orders for goods and making purchases – the provision of data (first name, surname, buyer's address, delivery address, e-mail address, telephone number, and in the case of entrepreneurs also the company name, registered office address, NIP) constitutes a condition for concluding and performing the sales contract. Failure to provide the data will make it impossible to place and process an order.

c) Sending a Newsletter containing information about the Controller's offer – Providing an e-mail address constitutes a condition for concluding the contract for the provision of the Newsletter service by electronic means. Failure to provide an e-mail address will make it impossible to provide the Newsletter service.

d) Replying to correspondence sent via the contact form – the provision of data (at least an e-mail address) is voluntary but necessary in order to reply to your enquiry. Failure to provide the data will make return contact impossible.

e) Fulfilment of legal obligations incumbent on the Controller – Providing the data necessary to fulfil obligations arising from legal provisions (in particular tax and accounting regulations) is a statutory requirement. Failure to provide such data may make it impossible to carry out the transaction.

Furthermore, we may also record your data when you contact us by telephone, by e-mail or by traditional mail, writing or calling the numbers and addresses indicated on the Website.

Social media plug-ins

Our Website may contain plug-ins to certain social media platforms. Social media plug-ins are special tools that make it possible to embed the functions of social media platforms directly into the Website. Plug-ins of this type are marked with the relevant logo of each social media platform. When you visit our Website and use a plug-in, information is transmitted by the browser directly to the social media platform, which stores and processes it. In order to obtain more detailed information on the purposes, type and methods of collecting, processing and storing personal data by social media, as well as information on how to exercise the rights available to you, please refer to the privacy policy of the relevant social media platform.

System logs

Your activity on the Website and its subpages, including your data, is recorded in system logs (a special computer program used to store a chronological record containing information about events and activities relating to the IT system used to provide services by the Controller). The information collected in the logs may include data concerning access to the website, the volume of data transmitted, the browser you use, the operating system used, the IP address and the internet service provider. The Controller processes this data on the basis of its legitimate interest (Article 6(1)(f) GDPR), primarily for purposes related to the provision of services, the correct display of website content, for technical purposes, for the purposes of ensuring the security of the IT system and managing it, as well as for performance purposes.

Cookies

In addition, the Website also uses cookies. They are used in order to provide services at the highest level, to optimise the content available on the Website and the Online Shop and their subpages, to adapt them to the individual needs of each user, as well as for advertising and performance purposes. The rules for the use of cookies are described in detail in point 9 of this document.

Profiling

In connection with your use of the Website, your personal data may be processed in an automated manner (including in the form of profiling). This profiling will not produce any legal effects concerning you or similarly significantly affect your situation. Profiling is carried out using IT tools, in particular:

• Google Analytics – provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA); Detailed information on data processing is available in Google's Privacy Policy at: https://policies.google.com/privacy

• Cookiebot – provided by Usercentrics A/S (Havnegade 39, 1058 Copenhagen, Denmark); Detailed information on data processing is available in the Privacy Policy at: https://www.cookiebot.com/en/privacy-policy/.

Profiling by means of the tools of Google LLC or Usercentrics A/S requires the installation of tracking and advertising cookies on your terminal device, which takes place solely on the basis of your prior consent expressed via the consent management platform (cookie banner).

Google LLC and Usercentrics A/S act as separate controllers or joint controllers with respect to the data collected by means of their tools. Detailed information on data processing is available in the Privacy Policy of each of these entities, available under the links indicated above.

3. On what legal basis do we process the collected data?

a) Performance of a contract (Article 6(1)(b) GDPR) – Where data is processed for the purpose of maintaining an Account in the Online Shop, placing and processing orders submitted in the Online Shop, as well as for the purpose of providing the Newsletter service (understood as a separate service provided by electronic means) – the legal basis for the processing is the necessity of the processing for the performance of a contract for the provision of services by electronic means or a sales contract to which the data subject is a party, or in order to take steps at the request of that person prior to entering into a contract.

b) Direct marketing – your consent (Article 6(1)(a) GDPR) – Where your data is processed for marketing purposes – in connection with the use of marketing cookies.

c) Statistical and preference purposes – your consent (Article 6(1)(a) GDPR) – Where your data is processed for statistical and preference purposes, including in connection with the use of statistical and preference cookies, the legal basis for the processing is your consent.

d) Replying to correspondence – legitimate interest (Article 6(1)(f) GDPR) – Where data is processed for the purpose of replying to correspondence sent by you, the legal basis for the processing is our legitimate interest consisting in providing our customers and users with complete information and ensuring that they have a positive experience with our Shop.

e) Pursuing and defending against claims – legitimate interest (Article 6(1)(f) GDPR) – In the event of any claims raised by you against us or claims raised by us against you, the legal basis for processing your data is our legitimate interest consisting in pursuing claims or defending against claims.

f) Legal obligation (Article 6(1)(c) GDPR) – Your data will also be processed for the purpose of our fulfilment of obligations arising from legal provisions, e.g. the obligations set out in tax and accounting regulations.

4. How long do we process your data?

The period for which we may process your personal data depends on the legal basis constituting the ground for the processing of personal data. Accordingly:

1) where we process personal data on the basis of your consent – the processing period lasts until you withdraw that consent. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal;

2) where we process personal data on the basis of our legitimate interest – the processing period lasts until that interest ceases to exist or until you object to further such processing on grounds relating to your particular situation. Where data is processed for the purpose of pursuing or defending against claims, the data will be stored for the limitation period for claims arising from the provisions of the Civil Code (as a rule 6 years, and for claims for periodic performances and claims related to the conduct of business activity – 3 years, calculated until the end of the calendar year);

3) where we process personal data because it is necessary in view of the applicable legal provisions – the periods of data processing for this purpose are determined by those provisions. In particular, data necessary for accounting purposes is stored for a period of 5 years from the end of the financial year in which the economic event occurred, and data required by tax law – for the period indicated in the tax regulations;

4) where the legal basis for the processing of data is the performance of a contract for the provision of services by electronic means or a sales contract – your personal data is processed and stored for the period necessary to perform the contract, and after its termination for the limitation period for claims that may arise from the contract (as indicated in point 2 above) or for the period arising from the legal obligations incumbent on the Controller (as indicated in point 3 above) – whichever of these periods is longer.

After the processing period has elapsed, your personal data is deleted, whereby it may also be archived – e.g. for the purposes of legal obligations, in particular tax and accounting regulations – for the period required by those regulations, and after it has elapsed, permanently deleted. The deletion of personal data takes place in a manner ensuring its permanent and secure destruction, making it impossible to restore. In the case of data processed in IT systems, deletion takes place by permanently erasing the data from the system. In the case of data processed in paper form, deletion takes place by destroying the documents in a manner making it impossible to read their content.

5. What are your rights in relation to personal data?

In connection with the processing of personal data, you have the following rights:

• the right of access to data (Article 15 GDPR) – the right to obtain information about the processing of your data and a copy of the data;
• the right to rectification of data (Article 16 GDPR) – the right to request the correction of inaccurate data or the completion of incomplete data;
• the right to erasure of data (Article 17 GDPR) – the right to request the deletion of data in the cases provided for in the GDPR;
• the right to restriction of processing (Article 18 GDPR) – the right to request the restriction of processing in the cases provided for in the GDPR;
• the right to data portability (Article 20 GDPR) – the right to receive data in a structured, commonly used, machine-readable format, where the processing is based on consent or a contract and is carried out by automated means;
• the right to object (Article 21 GDPR) – the right to object to processing based on the Controller's legitimate interest, including to profiling; in the event of an objection to processing for direct marketing purposes, the data will no longer be processed for that purpose;
• the right to withdraw consent (Article 7(3) GDPR) – the right to withdraw consent at any time where the basis for the processing is consent; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal);
• the right not to be subject to a decision based solely on automated processing (Article 22 GDPR) – the right not to be subject to a decision which is based solely on automated processing (including profiling) and which produces legal effects concerning you or similarly significantly affects you, subject to the exceptions provided for in the GDPR.

The exercise of these rights depends on the conditions set out in the GDPR. If a request is refused, you will receive a reply stating the reasons for the refusal.

Please note that:

• the right to erasure of data and the right to request the restriction of its processing are available only in the cases listed in the provisions of the GDPR;
• the right to data portability is available only where the legal basis for the processing is consent or the performance of a contract and the processing is carried out by automated means;
• we may refuse to delete your data despite such a request being made, provided that one of the exceptions listed in the GDPR applies, e.g. where the processing of data is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
• in certain cases we may refuse to uphold your objection to the processing of data on the basis of our legitimate interest, where there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where there are grounds for the establishment, exercise or defence of legal claims.

You are further entitled to lodge a complaint with the competent supervisory authority if you believe that we infringe legal provisions when processing your personal data. In Poland, the supervisory authority is the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw, www.uodo.gov.pl).

6. To whom do we transfer your data?

Data recipients

In connection with the provision of the services available on the Website and in the Online Shop, we transfer your personal data to the following categories of recipients:

• companies providing us with ICT services (hosting, IT system maintenance) – to the extent of the data necessary to ensure the correct functioning of the Website and the Online Shop, including in particular: e-mail address, login, IP address, data concerning activity on the Website, data contained in cookies;
• companies providing legal and debt collection services – to the extent of the data necessary for the establishment, exercise or defence of legal claims, including in particular: first name and surname, correspondence address, e-mail address, telephone number, data concerning contracts and transactions concluded, order history, data concerning complaints and correspondence;
• courier and postal companies delivering orders – to the extent of the data necessary to deliver the ordered goods, including in particular: the first name and surname of the recipient of the parcel, delivery address, telephone number (for the purpose of contact regarding delivery), order number;
• entities providing online payment services, banks and other payment operators – to the extent of the data necessary to handle payments for orders placed in the Online Shop, including in particular: first name and surname, e-mail address, transaction amount, order number, and in the case of payment by bank transfer – also the bank account number;
• entities carrying out marketing and statistical activities for us – to the extent of the data necessary to carry out such activities, including in particular: e-mail address, data concerning activity on the Website, data contained in cookies, online identifiers (e.g. cookie identifiers, IP addresses), information about preferences and interests resulting from activity on the Website. The transfer of data for marketing purposes takes place solely where you have given the relevant consent;
• providers of tools for operating the Website and communicating with customers – to the extent of the data necessary to ensure communication with users, including in particular: first name, surname, e-mail address, content of correspondence, data concerning orders and requests submitted.

The transfer of your personal data to the above entities takes place on the basis of data processing agreements concluded with them (Article 28 GDPR) or on the basis of another appropriate legal ground (e.g. where the entity acts as a separate controller). In each case, the scope of the data transferred is limited to the minimum necessary to achieve the given purpose, in accordance with the data minimisation principle (Article 5(1)(c) GDPR).

Irrespective of the above, your personal data may also be made available to entities entitled to receive it under applicable legal provisions, in particular law enforcement authorities, courts, public administration bodies and supervisory authorities.

Transfer of data outside the European Economic Area

In particular situations connected with cooperation with global technology corporations, your personal data may be transferred outside the European Economic Area (EEA), in particular to the USA, to the following entities: Google LLC (in connection with the use of Google Analytics, Google Ads). In such cases, the transfer of data takes place with the assurance of an adequate level of data protection, in particular on the basis of:

a) a European Commission decision finding an adequate level of protection (Article 45 GDPR) – in the case of entities certified under the EU-US Data Privacy Framework, pursuant to the European Commission implementing decision of 10 July 2023, or

b) standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) GDPR – where the data recipient is not covered by an adequacy decision.

A copy of the standard contractual clauses or information about the European Commission decision finding an adequate level of protection may be obtained by contacting the Controller using the contact details indicated in section 1 of this Policy.

7. Security and confidentiality

We use all technical and organisational means to ensure the security of your personal data and to protect it against accidental or intentional destruction, accidental loss, modification, unauthorised disclosure or access. Information is stored and processed on servers with a high level of security, with appropriate security measures in place that meet the requirements of applicable law.

We carry out ongoing risk analysis in order to ensure that personal data is processed by us in a secure manner, ensuring above all that only authorised persons have access to the data and only to the extent necessary in view of the tasks they perform. We ensure that all operations on personal data are recorded and carried out only by authorised employees and associates.

We also take all necessary measures to ensure that our subcontractors and other cooperating entities likewise guarantee the application of appropriate security measures in every case where they process personal data on our instructions.

8. Changes to the privacy policy

The Controller reserves the right to introduce changes to this Privacy Policy, in particular in order to adapt it to changes in the applicable legal provisions or changes in the manner of processing personal data. You will be informed of any changes with appropriate advance notice – by means of a notice displayed on the Website, an e-mail message or another appropriate method.

Where a change to the Privacy Policy concerns the processing of data based on your consent and requires new consent to be obtained, you will be asked for it separately. Continued use of the Website after the introduction of changes that do not require separate consent means that you have familiarised yourself with the new content of the Privacy Policy.

9. Information on cookies

What are cookies?

Cookies are small text files saved on the user's telecommunications terminal device (computer, telephone, tablet, etc.) while using the Website, allowing information to be saved and read, which the Website Controller and other entities providing services to it use for the purposes described below. The information collected by means of cookies and similar technologies may include the date and time of the visit, session identifiers and the manner in which the user uses the Website.

Legal basis for the use of cookies

The storage of information or access to information already stored on the user's telecommunications terminal device takes place in accordance with the ECL:

a) Required cookies – do not require the user's consent under the ECL, as their sole purpose is to enable the transmission of electronic communications or they are necessary for the provision of a service expressly requested by the user.

b) Other cookies (preference, marketing, statistical) – require the user's prior consent in accordance with the ECL. Such consent must meet the requirements set out in Article 4(11) GDPR, i.e. it must be freely given, specific, informed and unambiguous. Consent is obtained via the consent management platform (cookie banner) displayed on the first visit to the Website.

Types of cookies according to storage time

We use two types of cookies according to their lifetime:

• session cookies – files stored on the user's device until the user logs out of the Website or leaves the Website;
• persistent cookies – files stored on the user's device until they are deleted by the user or until the cookie expires within the period specified in the file specification.

Categories of cookies according to purpose

The Website Controller and other entities providing services to it (e.g. statistical and marketing services) use cookies for various purposes, which can be divided into the following categories:

a) Necessary cookies – Necessary cookies contribute to the usability of the website by enabling basic functions such as navigation on the site and access to secure areas of the website. The website cannot function properly without these cookies. The Controller uses necessary cookies primarily for the correct functioning of the Website, for providing users with the services and functionalities of the Website, for the purposes of remembering login sessions or completing forms, as well as for purposes related to setting privacy options. Necessary cookies do not require the user's consent, as their use is covered by the exception set out in the ECL. However, these files may contain identifiers (e.g. a session identifier) which, combined with other data, may enable the identification of the user – in such a case they constitute personal data processed by the Controller on the basis of its legitimate interest (Article 6(1)(f) GDPR) consisting in ensuring the correct operation of the Website. Necessary cookies may be installed by the Website Controller and by third parties which are trusted partners of the Controller with whom the Controller cooperates on an ongoing basis. Necessary cookies installed by the Controller and by third parties are indicated on the cookie management banner. Detailed information on the processing of data by our partners can be found on their websites.

b) Preference cookies – Preference cookies enable the website to remember information that changes the appearance or functioning of the site, e.g. the preferred language or the region in which the user is located. Preference cookies may be installed by the Controller and by third parties which are our trusted partners with whom we cooperate on an ongoing basis, indicated on the cookie management banner. Detailed information on the processing of data by our partners can be found on their websites. The installation of preference cookies and the processing of personal data in connection with their use is conditional upon obtaining the user's prior consent expressed via the consent management platform (cookie banner). This consent may be withdrawn at any time via that platform, in a manner as easy as giving it. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

c) Statistical cookies – Statistical cookies help website owners understand how different users behave on the site by collecting and reporting anonymous information. Statistical cookies may be installed by the Controller and by third parties which are our trusted partners with whom we cooperate on an ongoing basis, indicated on the cookie management banner. Detailed information on the processing of data by our partners can be found on their websites. The installation of statistical cookies and the processing of personal data in connection with their use is conditional upon obtaining the user's prior consent expressed via the consent management platform (cookie banner). This consent may be withdrawn at any time via that platform, in a manner as easy as giving it. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

d) Marketing cookies – Marketing cookies are used to track users across websites. The aim is to display advertisements that are relevant and interesting to individual users and thus more valuable for third-party publishers and advertisers. Marketing cookies may be installed by the Website Controller and by third parties which are our trusted partners with whom we cooperate on an ongoing basis, indicated on the cookie management banner. Detailed information on the processing of data by our partners can be found on their websites. The installation of marketing cookies and the processing of personal data in connection with their use is conditional upon obtaining the user's prior consent expressed via the consent management platform (cookie banner). This consent may be withdrawn at any time via that platform, in a manner as easy as giving it. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

e) Unclassified cookies – Unclassified cookies are files whose function and purpose are currently being verified and assigned to the appropriate category. The Controller exercises due care in order to identify and classify cookies of this type on an ongoing basis in cooperation with their providers. Until the classification process is completed, unclassified cookies are not installed on the user's device or used, if their use requires the user's prior consent. Once the classification process has been completed, these files will be assigned to the appropriate category of cookies and will be used in accordance with the rules applicable to that category, including – in cases required by law – solely after obtaining the user's prior consent expressed via the consent management platform (cookie banner). The user may withdraw the consent given at any time via that platform, in a manner as easy as giving it. Withdrawal of consent does not affect the lawfulness of the processing of data carried out before its withdrawal.

Cookie management

A precise description of the cookies (including in particular their names, provider details and validity period) is provided on the cookie consent management platform which is displayed to the user upon their first entry to the Website's web page.

The user may, independently and at any time:

• change the cookie settings via the consent management platform available on the Website (link/icon visible on the page);
• change the web browser settings – specifying the conditions for the storage of and access by cookies to the terminal device, including blocking the automatic handling of cookies or setting a notification each time a cookie is placed on the terminal device.

Withdrawal of consent to cookies does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Limiting the use of cookies may affect certain functionalities available on the Website.