§1. Data Administrator

• The administrator of the personal data of Users and Customers of the Store is:
  • Katarzyna Mirek Bio-Group, located at: Małopolska 1 lok. 63, 35-620 Rzeszów, Podkarpackie Voivodeship, NIP: 7941828769, REGON: 385922540, email address: biuro@puffmuff.pl, phone: +48 509040259,– hereinafter referred to as “Administrator” or “Seller.”
• For matters related to the protection of personal data, you can contact the Administrator:
  • via email: biuro@puffmuff.pl,
  • in writing: Małopolska 1 lok. 63, 35-620 Rzeszów.

§2. Purposes and grounds for data processing

• Personal data is processed for the following purposes:
  • acceptance and execution of the Order (ski hoods/buffs, winter accessories) and conclusion and performance of the Sales Agreement – art. 6 sec. 1 lit. b GDPR,
  • handling returns, withdrawals, and complaints – art. 6 sec. 1 lit. b and c GDPR,
  • fulfillment of legal obligations imposed on the Administrator (e.g., tax, accounting) – art. 6 sec. 1 lit. c GDPR,
  • conducting direct marketing of Store products (including newsletters – if used) – art. 6 sec. 1 lit. a or lit. f GDPR,
  • pursuing claims or defending against claims – art. 6 sec. 1 lit. f GDPR,
  • ensuring security and proper functioning of the website (server logs, necessary cookies) – art. 6 sec. 1 lit. f GDPR.
• The scope of processed data may include:
  • identifying data: first name, last name, company name (if applicable), NIP (if applicable),
  • contact data: email address, phone number, delivery address, billing address,
  • data concerning Orders: ordered Goods, amounts, payment methods, purchase history,
  • technical data: IP address, device and browser information, cookies.

§3. Data source

• Data is primarily obtained from the Customer:
  • when placing an Order (order form),
  • when contacting via the contact form or email,
  • when signing up for a newsletter (if used).

• Data may also partially come from payment operators and courier companies – solely in relation to the execution of the Order.

§4. Data recipients

• Personal data may be transferred to:
  • IT and hosting service providers
  • payment operators:Przelewy24,
  • courier/logistics companies: inPost,

• Recipients process data based on entrustment agreements or as separate administrators – in accordance with GDPR.

§5. Data retention period

• Personal data will be retained:
  • for the duration of the Order execution and the validity of the Sales Agreement,
  • for the period required by accounting and tax regulations (generally 5 years from the end of the year in which the tax obligation arose),
  • in the case of data processed based on consent (e.g., newsletter) – until it is revoked,
  • to the extent necessary to pursue or defend against claims – until the relevant limitation periods expire.

§6. Cookies

• The Store uses cookies, which are stored on the User's device.

• Cookies are used for the following purposes:
  • ensuring the proper functioning of the website (necessary cookies),
  • creating statistics and analyzing traffic (analytical/statistical cookies – Google Analytics),
  • conducting marketing activities (marketing cookies – Meta/Facebook).

• Upon the User's first visit to the site, a cookie banner is displayed with the option to choose the categories of files.

• The User can change cookie settings in the browser or delete saved cookies at any time.

• Detailed information about the tools used is provided here:

§7. Rights of data subjects

• The data subject has the right to:
  • access their data,
  • rectify their data,
  • delete their data (“the right to be forgotten”),
  • restrict processing,
  • data portability,
  • object to the processing of data based on art. 6 sec. 1 lit. f GDPR,
  • withdraw consent at any time (if the basis for processing is consent).

• To exercise these rights, you can contact the Administrator using the data provided in §1.

• The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office.

§8. Voluntariness of data provision

• Providing personal data is voluntary, but necessary for:
  • placing and executing the Order,
  • providing a response to an inquiry,
  • receiving the newsletter (if used).

• Failure to provide data may prevent the fulfillment of the above purposes.

§9. Profiling

• Personal data may be used for marketing profiling (e.g., content matching of advertisements), but no automated decisions are made that produce legal effects concerning the individuals whose data is involved.

• The legal basis for profiling is:
  • the legitimate interest of the Administrator (marketing their own products), or
  • consent – depending on the tools used.

§10. Changes to the Privacy Policy

• The Administrator reserves the right to change the Privacy Policy for important reasons.

• Users will be informed of changes through the publication of a new version on the Store's website.

• The amended Policy is effective from the date of publication.