PRIVACY POLICY OF THE XANNA.EU ONLINE STORE

1. GENERAL PROVISIONS

1.1. This Online Store Privacy Policy is for informational purposes only, which means it does not impose any obligations on users or customers of the Online Store. The Privacy Policy primarily sets forth the rules governing the processing of personal data by the Controller in the Online Store, including the legal basis, purposes, and duration of personal data processing, as well as the rights of data subjects, and information regarding the use of cookies and analytical tools in the Online Store.
1.2. The Controller of personal data collected through the Online Store is XANNA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Warsaw (registered office address and address for service: ul. Przy Agorze 13C/1, 01-960 Warsaw); entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000545289; the registry court where the company’s records are kept: District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register; share capital: PLN 5,000.00; Tax Identification Number (NIP): 5223023667; REGON: 360881786, e-mail address: sales@xanna.eu, and contact phone number: +48 882 371 703 , hereinafter referred to as the “Controller” and acting simultaneously as the Online Store Service Provider and Seller.
1.3. Personal data in the Online Store is processed by the Controller in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — referred to as the “GDPR” or “GDPR Regulation.” Official text of the GDPR: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
1.4. Use of the Online Store, including making purchases, is voluntary. Similarly, the provision of personal data by Users, including Customers using the Online Store is voluntary, subject to two exceptions: (1) entering into contracts with the Controller – Failure to provide the personal data necessary to conclude and perform the Sales Agreement or the agreement for the provision of Electronic Services with the Controller, in the cases and to the extent specified on the Online Store’s website, in the Online Store’s Terms and Conditions, and in this Privacy Policy, will result in the inability to conclude such an agreement. In such cases, the provision of personal data is a contractual requirement, and if the data subject wishes to enter into a given agreement with the Controller, they are obligated to provide the required data. The scope of data required to conclude the agreement is always specified in advance on the Online Store’s website and in the Online Store Terms and Conditions; (2) the Controller’s statutory obligations – providing personal data is a statutory requirement arising from generally applicable laws imposing an obligation on the Controller to process personal data (e.g., processing data for the purpose of maintaining tax or accounting records), and failure to provide such data will prevent the Controller from fulfilling these obligations.
1.5. The Controller exercises due diligence to protect the interests of the data subjects whose personal data it processes, and in particular is responsible for and ensures that the data it collects is: (1) processed lawfully; (2) collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes; (3) factually accurate and relevant to the purposes for which they are processed; (4) stored in a form that allows for the identification of the data subjects for no longer than is necessary to achieve the purpose of processing; and (5) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, by means of appropriate technical or organizational measures.
1.6. Taking into account the nature, scope, context, and purposes of the processing, as well as the risk of infringement of the rights or freedoms of natural persons, with varying likelihood and severity of the threat, the Controller implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with the GDPR and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Controller implements technical measures to prevent unauthorized persons from accessing or modifying personal data transmitted electronically.
1.7. All words, phrases, and acronyms appearing in this Privacy Policy and beginning with a capital letter (e.g., Seller, Online Store, Electronic Service) shall be understood in accordance with their definitions set forth in the Online Store Terms and Conditions available on the Online Store’s website. 1.8 “User” means any natural person using the Online Store. “Customer” means a User who has entered into a Sales Agreement with the Controller.

2. LEGAL BASIS FOR DATA PROCESSING

2.1. The Controller is authorized to process personal data in cases where—and to the extent that—at least one of the following conditions is met: (1) the data subject has consented to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
2.2. The processing of personal data by the Controller requires, in each case, the existence of at least one of the grounds specified in Section 2.1 of the Privacy Policy. The specific grounds for the processing of personal data of Users and Customers of the Online Store by the Controller are specified in the following section of the Privacy Policy—in relation to the specific purpose of the processing of personal data by the Controller. 3. PURPOSE, LEGAL BASIS, AND DURATION OF DATA PROCESSING IN THE ONLINE STORE
3.1. In each case, the purpose, legal basis, duration, and recipients of personal data processed by the Controller result from actions taken by a given Service User or Customer in the Online Store or by the Controller.
3.2. The Controller may process personal data within the Online Store for the following purposes, on the grounds, and for the periods indicated in the table below:

Purpose of data processing	Legal basis	Data retention period
Performance of a Sales Agreement or an Electronic Services Agreement, or taking action at the request of the data subject prior to the conclusion of such agreements	Article 6(1)(b) of the GDPR (performance of a contract) – processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract	The data is retained for the period necessary to perform, terminate, or otherwise conclude the Sales Agreement or the Electronic Service Agreement.
Marketing of the Controller’s goods and services (e.g., sending commercial communications, including direct marketing, via telecommunications devices such as email and telephone, or automated calling systems)	Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) – processing is necessary for the purposes of the Controller’s legitimate interests, which include direct marketing – aimed at safeguarding the interests and positive image of the Controller and its Online Store, as well as promoting the sale of Products – for example, in connection with the data subject’s prior consent to the sending of commercial communications using telecommunications terminal equipment, such as email or telephone, depending on the scope of the consent granted	Data is retained for as long as the Controller has a legitimate interest in doing so, but no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business activities is three years, and in the case of a sales contract—two years). The Controller may not process data for direct marketing purposes if the data subject has effectively objected to such processing. Furthermore, where the basis for processing is consent to the sending of commercial communications, including direct marketing, using telecommunications terminal equipment or automated calling systems, the data is retained until the data subject withdraws consent for the continued processing of their data for this purpose, without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.
Customer feedback regarding the Sales Agreement	Article 6(1)(a) of the GDPR – the data subject has consented to the processing of their personal data for the purpose of expressing an opinion	The data is retained until the data subject withdraws their consent to the further processing of their data for this purpose.
Bookkeeping	Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act of January 30, 2018 (Journal of Laws of 2018, item 395, as amended) – processing is necessary for compliance with a legal obligation to which the Controller is subject	The data is retained for the period required by law, which mandates that the Controller retain accounting records (5 years, starting from the beginning of the year following the fiscal year to which the data relates).
Establishing, pursuing, or defending claims that the Controller may bring or that may be brought against the Controller	Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) – processing is necessary for the purposes of the Controller’s legitimate interests – consisting in the establishment, exercise, or defense of legal claims that the Controller may bring or that may be brought against the Controller	The data is retained for as long as the legitimate interest pursued by the Controller exists, but no longer than the limitation period for claims that may be brought against the Controller (the standard limitation period for claims against the Controller is six years).
Using the Online Store and ensuring its proper functioning	Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) – processing is necessary for the purposes of the Controller’s legitimate interests, which consist in operating and maintaining the Online Store website	The data is retained for as long as the legitimate interest pursued by the Controller exists, but no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business operations is three years, and for a Sales Agreement, two years).
Monitoring statistics and analyzing traffic on the Online Store	Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) – processing is necessary for the purposes of the Controller’s legitimate interests, which consist of maintaining statistics and analyzing traffic on the Online Store in order to improve the functioning of the Online Store and increase sales of Products	The data is retained for as long as the legitimate interest pursued by the Controller exists, but no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business operations is three years, and for a Sales Agreement, two years).

4. DATA RECIPIENTS IN THE ONLINE STORE

4.1. For the Online Store to function properly, including the fulfillment of Sales Agreements, the Controller must use the services of third parties (such as software providers, couriers, or payment processors). The Controller uses only the services of such processors who provide sufficient guarantees that appropriate technical and organizational measures will be implemented so that the processing meets the requirements of the GDPR and protects the rights of data subjects.
4.2. Personal data may be transferred by the Controller to a third country; however, the Controller ensures that, in such cases, the transfer will take place to a country providing an adequate level of protection—in accordance with the GDPR—and, in the case of other countries, that the transfer will be based on standard data protection clauses. The Controller ensures that the data subject has the opportunity to obtain a copy of their data. The Controller transfers the collected personal data only when and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.
4.3. The Controller does not transfer data in every instance, nor to all recipients or categories of recipients listed in the privacy policy—the Controller transfers data only when it is necessary to achieve a specific purpose of personal data processing and only to the extent necessary to achieve that purpose. For example, if a Customer opts for in-person pickup, their data will not be transferred to a carrier cooperating with the Controller.
4.4. The personal data of Service Users and Online Store Customers may be transferred to the following recipients or categories of recipients:
4.4.1. carriers / freight forwarders / courier brokers / entities handling the warehouse and/or shipping process – in the case of a Customer who uses the Online Store to have a Product delivered by postal or courier service, The Controller shares the collected personal data of the Customer with the selected carrier, freight forwarder, or intermediary handling shipments on behalf of the Controller, and if the shipment originates from an external warehouse—with the entity managing the warehouse and/or the shipping process—to the extent necessary to deliver the Product to the Customer.
4.4.2. Entities processing electronic or card payments – in the case of a Customer who uses electronic or card payment methods in the Online Store, the Controller shares the Customer’s collected personal data with the selected entity processing such payments in the Online Store, at the Controller’s request, to the extent necessary to process the payment made by the Customer.
4.4.3. service providers supplying the Controller with technical, IT, and organizational solutions that enable the Controller to conduct business operations, including the Online Store and the Electronic Services provided through it (in particular, providers of computer software for operating the Online Store, email and hosting providers, and providers of business management software and technical support to the Controller)—the Controller discloses the collected Customer personal data to a selected provider acting on its behalf only in cases and to the extent necessary to achieve a specific data processing purpose consistent with this privacy policy.
4.4.4. accounting, legal, and consulting service providers that provide the Controller with accounting, legal, or consulting support (in particular, an accounting firm, a law firm, or a debt collection agency) – The Controller discloses the collected personal data of the Customer to a selected provider acting on its behalf only if and to the extent necessary to achieve a specific purpose of data processing in accordance with this privacy policy.

5. PROFILING IN THE ONLINE STORE

5.1. The GDPR requires the Controller to provide information regarding automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and—at least in such cases – relevant information regarding the principles governing such decision-making, as well as the significance and anticipated consequences of such processing for the data subject. With this in mind, the Controller provides information regarding possible profiling in this section of the Privacy Policy.
5.2. The Controller may use profiling in the Online Store for direct marketing purposes, but decisions made by the Controller based on such profiling do not concern the conclusion or refusal to conclude a Sales Agreement or the ability to use Electronic Services in the Online Store. The result of using profiling in the Online Store may include, for example, granting a discount to a person, sending them a discount code, reminding them of unfinished purchases, sending a Product recommendation that may match the person’s interests or preferences, or offering better terms compared to the Online Store’s standard offer. Despite profiling, the individual is free to decide whether they wish to take advantage of the discount or better terms received in this way and make a purchase in the Online Store.
5.3. Profiling in the Online Store involves the automatic analysis or prediction of a person’s behavior on the Online Store’s website, for example, by adding a specific Product to the shopping cart, viewing a specific Product page in the Online Store, or by analyzing the person’s previous purchase history in the Online Store. A prerequisite for such profiling is that the Data Controller possesses the individual’s personal data in order to subsequently send them, for example, a discount code.
5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the data subject or similarly significantly affects the data subject.

6. RIGHTS OF THE DATA SUBJECT

6.1. Right of access, rectification, restriction, erasure, or portability – the data subject has the right to request from the Controller access to their personal data, its rectification, erasure (“right to be forgotten”), or restriction of processing, and has the right to object to processing, as well as the right to data portability. The specific conditions for exercising the above rights are set forth in Articles 15–21 of the GDPR.
6.2. Right to withdraw consent at any time – A data subject whose data is processed by the Controller on the basis of consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
6.3. Right to lodge a complaint with a supervisory authority – a person whose data is processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and under the procedure set forth in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
6.4. Right to object – the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on Article 6(1)(e) (public interest or public tasks) or (f) (legitimate interest of the controller), including profiling based on these provisions. In such a case, the controller may no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or grounds related to the establishment, exercise, or defense of legal claims.
6.5. Right to object to direct marketing – if personal data is processed for direct marketing purposes, the data subject has the right at any time to object to the processing of their personal data for such marketing purposes, including profiling, to the extent that the processing is related to such direct marketing.
6.6. To exercise the rights referred to in this section of the Privacy Policy, you may contact the Data Controller by sending a written message or an email to the Data Controller’s address provided at the beginning of the Privacy Policy, or by using the contact form available on the Online Store’s website.

7. COOKIES IN THE ONLINE STORE AND ANALYTICS

7.1. Cookies are small pieces of information in the form of text files sent by a server and stored on the device of the person visiting the Online Store (e.g., on the hard drive of a computer, laptop, or on a smartphone’s memory card—depending on the device used by the visitor to our Online Store). Detailed information about cookies, as well as the history of their development, can be found, among other places, here: https://pl.wikipedia.org/wiki/HTTP_cookie.
7.2. In the Privacy Policy, the Controller provides a range of information regarding the use of cookies on the Online Store website, their types and purposes, as well as how to manage them using, for example, web browser settings and/or the cookie management tool available on the Online Store website. The Controller encourages you to use the cookie management tool available on the Online Store’s website, which allows you to easily and actively manage cookies while using the Online Store’s website; if this tool is unavailable, please review the information below regarding, among other things, managing cookies from within your browser.
7.3. Cookies that may be sent by the Online Store’s website can be categorized into different types based on the following criteria:

Based on their source: 1) in-house (created by the Controller’s Online Store) and 2) belonging to third parties (other than the Controller)	Depending on how long they are stored on the device of a visitor to the Online Store: 1) session cookies (stored until you log out of the Online Store or close your web browser) and 2) persistent cookies (stored for a specified period of time, defined by the parameters of each file, or until manually deleted)	Based on their purpose: 1) essential (enabling the proper functioning of the Online Store website), 2) functional/preference-based (enabling the Online Store website to be tailored to the visitor’s preferences), 3) analytical and performance cookies (collecting information about how the Online Store website is used), 4) marketing, advertising, and social media (collecting information about the visitor to the Online Store website in order to display ads to that person, personalize them, measure effectiveness, and conduct other marketing activities, including on websites separate from the Online Store website, such as social media platforms or other sites belonging to the same advertising networks as the Online Store)

7.4. The controller may process the data contained in cookies when visitors use the Online Store website for the following specific purposes:

Purposes of using cookies on the Controller’s Online Store
to identify users as logged in to the Online Store and to indicate that they are logged in (strictly necessary cookies)
to remember the products added to the shopping cart for the purpose of placing an order (essential cookies)
to store data from completed Order Forms, surveys, or login credentials for the Online Store (necessary and/or functional/preference cookies)
to customize the content of the Online Store to the User’s individual preferences (e.g., regarding colors, font size, and page layout) and to optimize the User’s experience on the Online Store (functional/preference cookies)
to collect anonymous statistics on how the Online Store is used (analytical and performance cookies)
displaying advertisements, limiting the number of ad impressions, and excluding ads the User is not interested in measuring ad effectiveness and personalizing ads, i.e., analyzing the behavioral characteristics of visitors to the Online Store through anonymous analysis of their activities (e.g., repeated visits to specific pages, keywords, etc.) in order to create a profile of them and deliver ads tailored to their anticipated interests, even when they visit other websites within the advertising networks of Google Ireland Ltd. and Facebook, i.e., Meta Platforms Ireland Ltd. (marketing, advertising, and social media cookies)

7.5. You can check which cookies are currently being sent by the Online Store’s website, regardless of your web browser, using tools available at websites such as https://www.cookiemetrix.com or https://www.cookie-checker.com.
7.6. By default, most web browsers available on the market accept cookies. Users can configure cookie settings through their own web browser settings. This means that you can, for example, partially restrict (e.g., temporarily) or completely disable the ability to store cookies—in the latter case, however, this may affect certain functionalities of the Online Store (for example, it may not be possible to complete the Order process via the Order Form because the Products in the shopping cart are not saved during the subsequent steps of placing the Order).
7.7. Your web browser’s cookie settings are essential for consenting to the use of cookies by our Online Store—in accordance with applicable regulations, such consent may also be given through your web browser settings. Detailed information on changing cookie settings and deleting cookies yourself in the most popular web browsers is available in the browser’s help section and on the following pages (just click on the link):

in Chrome
in Firefox
in Opera
in Safari
in Microsoft Edge

7.8. Google Analytics, Google Tag Manager, Google Search Console
7.8.1. The Controller may use the services of Google Analytics, GA4, Google Tag Manager, and Google Search Console, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in the Online Store.
7.8.2. Google Analytics and GA4 help the Controller maintain statistics and analyze traffic on the Online Store. The collected data is processed within the scope of the above services to generate statistics that assist in the administration of the Online Store and the analysis of traffic on the Online Store. It is possible for a user to easily block the sharing of information about their activity on the Online Store website with Google Analytics—for this purpose, for example, you can install a browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=pl.
7.8.3. Google Search Console helps the Controller monitor traffic on the Online Store website, optimize its ranking in Google search results, and make informed decisions regarding the website’s presentation in search results. The Controller may use the information provided by Search Console to make technical decisions regarding the website and for advanced marketing analysis in conjunction with other Google tools. Further information regarding Google Search Console can be found at the following web address: https://support.google.com/webmasters/answer/9128668.
7.8.4. Google Tag Manager is a tag management system for other analytics and marketing tools, such as Google Analytics. For more information about Google Tag Manager, please visit https://support.google.com/tagmanager/answer/6102821.
7.9. In connection with the Controller’s use of advertising and analytics services provided by Google Ireland Ltd. in the Online Store, the Controller notes that full information regarding the rules for processing data of visitors to the Online Store (including information stored in cookies) by Google Ireland Ltd. is available in the Google Privacy Policy at the following web address: https://policies.google.com/technologies/partner-sites. The Controller may use the Meta Pixel service provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) in the Online Store. This service helps the Controller measure the effectiveness of advertisements, understand the actions taken by visitors to the Online Store, and display targeted advertisements to those visitors. Detailed information about how the Meta Pixel works can be found at the following web address: https://www.facebook.com/business/help/742478679120153?helpref=page_content.
7.10. You can manage the Meta Pixel through the ad settings in your Facebook.com account: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

8. FINAL PROVISIONS

8.1. The Online Store may contain links to other websites. The Controller urges you to review the privacy policies of those websites when visiting them. This Privacy Policy applies only to the Controller’s Online Store.

Cart 0