Privacy and cookies policy

Controller

The controller of your personal data is NEOHUMANOIDX sp. z o.o. with its registered office in Warsaw, address: ul. Żelazna 51/53, 00-841 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0001233636, Tax ID (NIP): 5273213401, REGON: 544442082 (the “Controller”).

Contact

For any matters relating to the protection of personal data, you can contact our Data Protection Officer:

• by post at: Data Protection Officer, NEOHUMANOIDX sp. z o.o. with its registered office in Warsaw, address: ul. Żelazna 51/53, 00-841 Warsaw, Poland,

• by email at: angelina.stoklosa@sklegal.pl.

Your rights regarding personal data

1. What rights do you have?

We process your personal data, and therefore:

1.1. You have the right of access to your personal data

You have the right to request information from the Controller, above all as to whether your data is being processed by it. If so, you have the right to know for what purpose your data is processed, what data the Controller processes, to whom it discloses the data and how long it intends to keep it.

1.2. You may rectify / request rectification of your data:

You have the right to request that the Controller rectify, without undue delay, any of your personal data that is inaccurate. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

1.3. You may request erasure of your personal data where the GDPR allows it:

You may request that the Controller erase your data under Article 17 GDPR if, among other things:

• your data (or part of it) is no longer necessary for the Controller in relation to the purpose for which it was collected or otherwise processed,

• you withdraw your consent to the processing of your data (if you have given consent, you always have the right to withdraw it); the Controller must then erase the data processed on that basis (in particular where the purpose is marketing),

• you lodge a justified objection to the processing of your data by the Controller (on objections, see below and Article 21 GDPR),

• your data has been processed unlawfully (e.g. there is no legal basis for the processing, or the data is used for a different purpose),

• erasure of the data is required by applicable law.

1.4. You have the right to restriction of processing to the extent set out in the GDPR:

Restriction of processing means marking stored personal data with the aim of limiting its processing in the future. The purpose of this right is that the processing of the data subject’s personal data by the Controller is limited solely to storing the data. Other processing operations are excluded (with the exceptions set out in Article 18(2) GDPR).

1.5. You have the right to object (in particular where we process your data on the basis of our legitimate interests):

There are two types of objection:

• an objection on grounds relating to your particular situation,

• an objection to direct marketing.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing, including profiling to the extent that it is related to such direct marketing.

Once you object to processing for direct marketing purposes, your personal data may no longer be processed for such purposes.

Please remember that wherever this Policy refers to our legitimate interest (and Article 6(1)(f) GDPR), you have the right to object.

If we receive an objection based on your particular situation, the Controller may no longer process the data unless it demonstrates:

• compelling legitimate grounds for the processing which override your interests, rights and freedoms,

• grounds for the establishment, exercise or defence of legal claims,

• that the processing is necessary for the performance of a task carried out in the public interest, where the objection concerns processing for scientific or historical research purposes or for statistical purposes.

1.6. You have the right to data portability:

The right to data portability consists of two elements:

• you can receive the personal data concerning you in a structured, commonly used and machine-readable format, and then

• transmit that personal data to another controller without hindrance from the Controller to which the personal data was originally provided.

You may exercise the right to data portability if both of the following conditions are met:

• the processing is based on consent or on the performance of a contract,

• the processing is carried out by automated means.

You can therefore request not only that the data you previously provided be handed over to you, which you are entitled to under the right to a copy of your data, but also that it be transmitted directly to another controller of your choice.

You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO, Poland) – if you believe that our processing of your personal data infringes the GDPR. You can submit a complaint, among other ways, to that office’s email address: kancelaria@uodo.gov.pl.

You also have the right to withdraw your consent at any time (without affecting the lawfulness of processing based on your consent before its withdrawal). You may request erasure of your data after withdrawing your consent to its processing if there is no other legal basis for the processing.

2. How can you exercise your rights?

To exercise the rights referred to in this Policy, you can contact:

2.1. the Controller:

• by post (traditional mail) at: NEOHUMANOIDX sp. z o.o., Żelazna 51/53, 00-841 Warsaw, Poland,

• by email at: sales@neohumanoidx.pl

• by phone at: (+48) 579 320 877;

2.2. our Data Protection Officer:

• by post (traditional mail) at: Data Protection Officer, NEOHUMANOIDX sp. z o.o., Żelazna 51/53, 00-841 Warsaw, Poland,

• by email at: angelina.stoklosa@sklegal.pl.

3. What personal data do we process?

3.1. Online sales (launched on the terms set out in separate terms and conditions)

For what purpose do we process your data?

We process your personal data in order to conclude and perform a sales contract concluded in the to be completed store.

We process data that clearly identifies you, such as your first name, surname, correspondence address, phone number and email address and, if you would like to receive an invoice from us, also the name (business name) of your business and your Tax ID (NIP).

You will find more about how our store works in the relevant Online Store Terms and Conditions.

We also process your personal data for analytical and statistical purposes (to improve our services).

We may also process your data in case it is necessary to establish, exercise or defend legal claims.

We also fulfil statutory obligations, so your data may also be processed for that purpose.

Is your data subject to profiling?

Yes. Based on your activity on our website or our partner’s website (e.g. the products you view) or your purchase history, we may show you content tailored to your preferences and, on the basis of your consent (concerning cookies, given when you enter our website), we will present you with dedicated discount offers matched to your profile. As a result, you may receive advertising and promotional content addressed exclusively to you, which our other customers will not receive.

Please remember that you have the right to object to our profiling activities.

Is providing your data mandatory?

It is voluntary, but without your data we will not be able to conclude and perform the contract.

What is the legal basis for processing your data?

The basis is primarily the necessity to conclude or perform a contract (Article 6(1)(b) GDPR).

For analytical and statistical purposes, the basis is our legitimate interest (Article 6(1)(f) GDPR), namely improving and enhancing the quality of our services.

Establishment, exercise or defence of legal claims – legitimate interest (Article 6(1)(f) GDPR).

To fulfil statutory obligations (Article 6(1)(c) GDPR).

We carry out profiling on the basis of our legitimate interest (Article 6(1)(f) GDPR), namely direct marketing of our products.

Who may have access to your data?

Protecting your data is very important to us. Access to it may be obtained only by the entity that runs our website and online store for us (website hosting and online store operation), entities carrying out our marketing activities (marketing automation and those responsible for selecting, delivering and reporting on advertisements) and entities that provide us with services such as accounting, IT and legal services. We always conclude appropriate data processing agreements with them.

Your data is also accessible to entities to which we disclose it, i.e. online payment intermediaries, banks or courier companies that deliver your parcel.

How long will we process your data?

For as long as necessary to conclude and properly perform the contract. However, we may also need to keep your data until the expiry of the limitation period for claims related to the type of contract concluded and the limitation period for tax liabilities.

3.2. Complaints

For what purpose do we process your data?

The quality of our products and services is our priority, which is why we want to give you a comprehensive answer to your complaint and solve your problem. We do not ask for more data than necessary, so as a rule: your first name, surname, phone number and email address.

Is providing your data to us mandatory?

It is voluntary, but without your data we will not be able to contact you to respond to your complaint.

What is the legal basis for processing your data?

Article 6(1)(b) GDPR, i.e. the performance of a contract.

Who may have access to your data?

Your data related to the complaint procedure will not be disclosed to anyone, except for couriers to whom we hand over the parcel with the new product.

How long will we process your data?

For as long as necessary to deal with your complaint. However, we may also need to keep your data until the expiry of the limitation period for claims related to the type of matter you have raised.

3.3. Contacting us by email / phone

For what purpose do we process your data?

We want to give you a reliable and complete answer to all your questions and resolve your matter efficiently. For this reason, you can contact us:

• by sending an email to: sales@neohumanoidx.pl
• by calling our phone number (+48 579 320 877).

If you want to find out the status of your order or ask about other matters, we will need to identify you. In that case, we will process your personal data such as your first name, surname, phone number or email address and delivery address.

Is your conversation with us recorded?

No, your conversation with us is not recorded.

Is providing your data mandatory?

It is voluntary, but without your data we will not be able to contact you to give a specific answer about your order or to answer other questions.

What is the legal basis for processing your data?

Article 6(1)(b) GDPR, i.e. the performance of a contract, and Article 6(1)(f) GDPR, i.e. our legitimate interest (namely responding to you and contacting you for that purpose).

Who may have access to your data?

Your data is very valuable to us. Access to it may be obtained only by the entity that runs this website for us (website hosting and online store operation) – where you use the contact form on our website (if such a form is made available on the website).

How long will we process your data?

For as long as necessary to respond to you. However, we may also need to keep your data until

3.4. Returns

For what purpose do we process your data?

If you want to return products ordered in our Store or in our partner’s store, we will process your personal data in order to handle the return (including verifying the deadline for submitting a statement of withdrawal from the contract) and refund the money to your account.

Is providing your data mandatory?

It is voluntary, but without your data we will not be able to match the return to your order and refund the money.

What is the legal basis for processing your data?

Article 6(1)(b) GDPR, i.e. the performance of a contract.

Who may have access to your data?

Your data related to the return procedure will not be disclosed to anyone.

How long will we process your data?

For as long as necessary to handle your return. However, we may also need to keep your data until the expiry of the limitation period for claims related to the sales contract for our products.

3.5. Newsletter

For what purpose do we process your data?

We want to show you our offer and tell you about promotions, discounts and new products. We would also like to know whether you find our newsletters interesting and which content you read most often. Our purpose is therefore to market our services and products.

For this purpose, we process your email address.

Is your data subject to profiling?

Yes. Please note that the newsletter content displayed to you is tailored to your preferences and, on the basis of your consent concerning cookies and your activity on our website (e.g. the products you view) or your purchase history, we may present you with dedicated discount offers. As a result, you may receive advertising and promotional content addressed exclusively to you, which our other customers will not receive.

Please remember that you have the right to object to our marketing and profiling activities.

Is providing your data mandatory?

It is voluntary, but without your data (email address) you will not be able to subscribe to our Newsletter.

What is the legal basis for processing your data?

Article 6(1)(f) GDPR, i.e. our legitimate interest, namely direct marketing.

The legal basis for the communication itself is the so-called “consent to the communication channel” (Article 10 of the Polish Act on Providing Services by Electronic Means and Article 172 of the Polish Telecommunications Law), which you give when subscribing to our Newsletter.

How should our legitimate interest be understood?

It is informing you about our new products and offer, as well as analysing the quality of our content and tailoring (personalising) the newsletter content for you.

Who may have access to your data?

Protecting your data is very important to us. Access to it may be obtained only by the entity that runs this website for us (website hosting and online store operation) and entities carrying out our marketing activities (marketing automation and those responsible for selecting, delivering and reporting on advertisements).

How long will we process your data?

Until you object to our activities or unsubscribe from the newsletter.

How can I unsubscribe from the Newsletter?

Simply send us an email saying you would like to unsubscribe, or click the unsubscribe link in the footer of any newsletter email you have received from us.

3.6. Online account

For what purpose do we process your data?

We want to make shopping on our website or with our partner easier for you, so that you can track the history and progress of your orders.

We process your first name, surname, email address, phone number and delivery address. You may also give us your date of birth.

Is your data subject to profiling?

No.

Is providing your data mandatory?

It is voluntary, but without your data we will not be able to create an account for you.

What is the legal basis for processing your data?

Article 6(1)(b) GDPR, i.e. the performance of a contract for the provision of electronic services consisting in enabling you to use an online account.

Who may have access to your data?

Your data is very valuable to us. Access to it may be obtained only by the entity that runs this website for us (website hosting and online store operation).

How long will we process your data?

For as long as necessary to perform the contract.

How can I close my online account?

Simply send us an email stating that you wish to close it.

3.7. Posting product reviews

For what purpose do we process your data?

We want to make shopping on our website easier for you, so that you can track the history and progress of your orders.

We process your first name, surname, email address, phone number and delivery address. You may also give us your date of birth.

Is your data subject to profiling?

No.

Is providing your data mandatory?

It is voluntary, but without your data we will not be able to create an account for you, and it will not be possible to post a review.

What is the legal basis for processing your data?

Article 6(1)(b) GDPR, i.e. the performance of a contract for the provision of electronic services consisting in enabling you to use an online account.

Who may have access to your data?

Protecting your data is very important to us. Access to it may be obtained only by the entity that runs this website for us (website hosting and online store operation).

How long will we process your data?

For as long as necessary to perform the contract.

3.8. Us on social media (Facebook, Instagram, YouTube)

For what purpose do we process your data?

We want to show you our products, let you know about promotions or new offers, invite you to take part in competitions, and give you reliable and complete answers to all your questions and resolve your matter.

Who is the controller of your data?

We, NEOHUMANOIDX sp. z o.o., are the controller of your data if:

• you post entries or comments on our profiles,
• you have liked our profile and follow it,
• you correspond with us as the profile administrator,
• you sign up for events we organise,
• you take part in competitions we organise (you will find more details each time in the rules of the specific competition, which are generally published in the notes on our Facebook profile).

Is providing your data mandatory?

It is voluntary, but without your data you will not be able to use social media services and therefore contact us or find out about our products through them.

Is your data subject to profiling?

We use social media services, i.e. Facebook advertising campaigns. We define the target group to which we want to advertise and present our services by selecting parameters such as geographical reach, gender, age, interests and industry. However, we do not receive any feedback about the people to whom Facebook displayed the advertisement, only statistical data, i.e. how many people responded to our content (e.g. clicked “Like” or clicked a link to our online store). We therefore do not hold detailed information about the personal data of the recipients of our advertising campaigns.

What is the legal basis for processing your data?

Article 6(1)(f) GDPR, i.e. our legitimate interest (namely marketing our products, answering your questions or contacting you for that purpose).

Who may have access to your data?

Protecting your data is very important to us. Access to it may be obtained only by the entity that runs our social media profiles for us, which is authorised to process the data or with which we conclude a written data processing agreement.

Please remember that when you visit our profiles on social networks, the administrators of those services also gain access to your data.

You can read their privacy policies below:

Facebook

https://pl-pl.facebook.com/privacy/explanation

Instagram

https://pl-pl.facebook.com/help/instagram/155833707900388

YouTube

https://support.google.com/youtube/topic/2803240?hl=pl&ref_topic=6151248

If you use the above services, your data is also transferred outside the EU.

How long will we process your data?

For as long as necessary to achieve the purpose (e.g. contacting us, taking part in a competition). However, we may need to keep your data for a period corresponding to the limitation period for claims related to the type or nature of the matter you have raised. Please remember that the length of the retention period also depends on whether you follow our profile and whether you have an account on Facebook or another social media service.

4. Security of personal data

We process all personal data that you provide on our website, or that you give us when contacting us, as the Controller in accordance with the GDPR.

We endeavour to apply the technical measures required by current data protection laws so as to prevent the loss, destruction or modification of the personal data we hold.

5. Automated decision-making

Your personal data is not subject to automated decision-making.

6. Transfers of data to third countries

As a rule, we do not transfer your data to third countries, i.e. outside the European Union and the European Economic Area (EEA).

However, our use of functionalities such as cookies (and other tracking technologies) may involve transfers outside the European Union and the European Economic Area to third countries.

We transfer data on the basis of appropriate legal safeguards, including the standard contractual clauses for the transfer of personal data to processors established in third countries approved by the European Commission. Copies of such clauses can be obtained from the Controller by writing to: angelina.stoklosa@sklegal.pl.

7. Cookies

7.1. What information do we collect?

The information we collect about you that constitutes your personal data, such as your name or email address, is described in detail in the first part of this Policy.

In addition, however, we also collect non-personal information that does not directly reveal your identity (i.e. for example your first name and surname) when you visit our website and online store.

Using cookies and other tracking technologies – which we describe in detail below – we collect information such as:

• information about the end device you use,
• browser type,
• geographical location (e.g. country or region),
• system logs (date and duration of your visit to the website),
• data related to your activity on the website, such as the items you view and the URLs of the web pages you visit, including information on how you reached our website, which products you viewed, whether you added them to your basket and whether you made a purchase,
• information about the advertisements shown to you and statistics on your clicks on them.

7.2. What are cookies and how are they installed?

We install cookies on your end device (computer, tablet, smartphone) – these are small text files collected automatically while you use our website.

Some of these files are strictly necessary, i.e. they allow our website to work properly; for example, we remember the products you have added to your basket in different browser tabs.

Other cookies are used for purposes related to:

• providing website functionality adapted to user preferences,
• carrying out statistical analyses of how the website is used (user behaviour on the website),
• marketing our products by delivering personalised commercial content.

When you enter our website, we inform you that we use tracking technologies for the above purposes. You can allow or refuse these activities by choosing your preferences through your browser settings.

Links that let you change your browser settings, and information on how to delete cookies, can be found later in this Policy.

More information about cookies and other tracking technologies is available, for example, at: http://wszystkoociasteczkach.pl/.

7.3. Consent to cookies

The legal basis for processing personal data derived from cookies (or similar technologies) in our online store for purposes related to ensuring the functioning of the website, adapting the website to the User’s preferences and for analytical purposes is our legitimate interest (Article 6(1)(f) GDPR).

The legal basis for processing personal data for advertising purposes, on the other hand, is your consent, expressed through the settings of the software installed on the end device you use: computer, phone, smartphone (Article 173(2) of the Polish Telecommunications Law).

Users may withdraw their consent or object to the processing of their personal data at any time by changing their cookie settings through their browser settings or by using the other methods of changing cookie settings described below.

Please note that in many cases the software used to browse websites (web browser) allows cookies to be stored on the user’s end device by default. These settings can be changed, in particular so as to block the automatic handling of cookies in the web browser settings or to be notified each time cookies are placed on the device.

Detailed information on the options and methods for handling cookies is available in the software (web browser) settings:

• Firefox: https://support.mozilla.org/pl/kb/blokowanie-ciasteczek

• Opera: https://help.opera.com/pl/latest/security-and-privacy/#Blokowanie-reklam

• Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies

• Chrome: https://support.google.com/chrome/answer/95647?hl=pl

• Safari: https://support.apple.com/pl-pl/HT201265

7.4. How to delete cookies?

You can delete cookies after we have saved them. To do so, you can use the relevant functions of your web browser, e.g.:

• Firefox: http://support.mozilla.org/pl/kb/usuwanie-ciasteczek

• Opera: https://help.opera.com/pl/latest/web-preferences/#cookies

• Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies

• Chrome: https://support.google.com/chrome/answer/95647?hl=pl

• Safari: https://support.apple.com/pl-pl/HT201265

On mobile devices, you need to change the device settings.

• On iOS, select “Privacy” → “Advertising” → “Limit Ad Tracking”.

• On Android, select “User” → “Google” → “Ads” → “Opt out of Ads Personalization”.

You can also disable individual advertisers that use search history to deliver online behavioural advertising by visiting http://www.youronlinechoices.com/pl/twojewybory

You can also disable tracking by using the opt-out option, which consists of installing an opt-out cookie in your browser for individual cookie providers of your choice. Information about this option is provided in the section below, with the relevant link for most of our partners.

7.5. Types of cookies and tools

7.5.1. Google Analytics

We use Google Analytics tools, which collect anonymous information about user visits to our website, such as the subpages viewed, the time spent on the website and the time taken to move between individual pages, in order to generate anonymous statistics on how the website functions and to allow analysis of activity on the website so that we can best match our offer to users’ needs. Google Analytics also allows us to determine which browser, country and device the user used to access our website. It also shows how the user reached our store, e.g. whether they clicked one of the advertisements displayed to them, a Newsletter sent to them, etc. This allows us to monitor the effectiveness of our marketing activities and adjust our marketing strategies.

We keep the data collected by cookies for a period of to be completed months.

You can read Google’s privacy policy at:

https://policies.google.com/privacy?hl=pl

You can find out more about data security in Google Analytics here: https://support.google.com/analytics/answer/6004245?hl=pl

If you do not want us to collect information about you in this way, you can change your browser settings or install a browser add-on that blocks Google Analytics: https://tools.google.com/dlpage/gaoptout/.

Please note that in this case your data is transferred outside the EEA (European Economic Area): Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

7.5.2. Google Ads

We also use the advertising tool provided by Google, i.e. Google Ads, which allows us to present our offer (in the form of advertising banners) in Google Search and on websites that are part of Google’s advertising network. The cookies installed by Google make it possible to avoid showing the same advertisement to the same user over and over, to detect and stop fraudulent clicks, and to display better personalised advertisements (e.g. based on information about previously visited websites). A user who enters certain terms in the search engine may be shown our advertisement related to those terms. Google Ads allows us to analyse the effectiveness of our advertisements (i.e. how many people clicked the displayed advertisement and when) and thus helps us better tailor our marketing content.

Please note that in our online store we also use cookies provided by Google to display advertisements across the network. One of the main advertising cookies used on non-Google websites is called “IDE” and is stored in browsers as belonging to the doubleclick.net domain.

You can learn more about how Google uses advertising at:

https://policies.google.com/technologies/ads.

If you do not want to be shown advertisements tailored to you, you can turn off ad personalisation using the following link: to be completed .

Please note that in this case your data is transferred outside the EEA (Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).

7.5.3. Facebook

Facebook Pixel

The Facebook Pixel is an analytics tool that helps measure the effectiveness of advertisements by analysing the actions users take in our online store. Thanks to this technology, we can:

• show advertisements to the right audience (e.g. to people who have visited our online store or taken certain actions on our website),

• increase our sales by reaching people who are more likely to take the action we care about, e.g. make a purchase,

• measure the results of our advertisements.

Facebook Custom Audience

This is a tool that allows us to show you advertisements based on your interests on Facebook and on other websites that use this tool. Facebook collects information such as the date and time of access, IP address, the page the user visited and whether our advertisement was clicked. If you are a registered Facebook user, Facebook may link your visit to your account. For up-to-date and detailed information on this, it is best to read Facebook’s privacy policy, which is linked below.

Please note that we never receive information about which specific person was shown our advertisement. We only set the parameters (e.g. age, gender, region) of the people we would like our advertisement to reach, and Facebook tells us how many people it showed the advertisement to, whether users clicked on it, and whether and how they responded to it.

You can read Facebook’s privacy policy by clicking the following link: https://pl-pl.facebook.com/privacy/explanation.

If you want to change, limit or turn off advertisements, we encourage you to review the ad preferences available in your Facebook account settings or by clicking the link: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

Please note that in this case your data is transferred outside the EEA (Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA).

7.6. Changes to the Policy

We reserve the right to change this Policy at any time; any change will be announced by the Controller in advance.

Date of the last update of the Policy: to be completed