Personal data protection is one of the key processes implemented by Karko sp. z o.o. Majdan Stary 40A, 23-414 Majdan Stary, NIP (tax identification number): 9182184736, KRS 0001052298, REGON 526076540, (hereinafter referred to as KARKO). We will keep you informed about important changes to the law, including the rights of data subjects. In 2016, the European Parliament published Regulation 2016/679 on the protection of personal data, known as the GDPR. It is applicable in the European Union from May 25, 2018.

What is the GDPR?

It is an abbreviation of the General Data Protection Regulation. The GDPR introduces, among others new rights of natural persons. One of the obligations of administrators (including our company) who process personal data is to inform people about their personal data processing. Below we have provided information on how we process your personal data in connection with the services that are available on our website www.2karko.com

Who is the administrator of my personal data?

Karko sp. z o.o. Majdan Stary 40A, 23-414 Majdan Stary, NIP 9182184736, KRS 0001052298, REGON 526076540 is the administrator of your personal data.

In matters relating to personal data protection, you can contact KARKO via the contact form available on our website (https://www.2karko.com/en_GB/i/Contact/33). We also encourage you to contact us via e-mail: contact@2karko.com

The method, purpose, legal basis and time of processing your personal data

Provision of Services by Electronic Means Via the Online Store

The purpose of processing personal data is to enable you to take advantage of the functionalities of our online store. At this stage, we will need your basic personal data, age (to determine if you have legal capacity, i.e. to place orders and make payments) and your e-mail address.

Over time and in connection with your use of the functionalities of our online store, we will collect information about you, which will relate to information provided by you voluntarily, such as:

• Delivery addresses for placed orders;
• Records and details of implemented orders;
• Your bills (invoices, receipts and other accounting records);
• Discount/promotional vouchers that you will receive in connection with the orders being processed;
• Your wish lists (for our products).

When you register an account, we undertake to provide you with the services and functionalities of the online store. Thus, it comes to the conclusion of the so-called contracts for the provision of electronic services pursuant to the provisions of the Act on providing services by electronic means. The legal basis for the processing of your personal data will be Article 6(1)(b) of the GDPR (conclusion of the contract).

By clicking the "Register" button after providing the required personal data on the new user registration website, you conclude a contract with us for the provision of electronic services under the conditions specified in the Regulations.

We will store your data until you delete your user account. It is possible that we will delete the account earlier in the event of a breach of the rules of our online store. However, in this case, we will inform you in advance of such activities.

Providing your personal data at this stage is voluntary, but failure to provide it will prevent you from using the functionalities of our online store available to registered users.

Conclusion of contracts for the purchase and sale of goods offered by our company

The purpose of processing personal data is to enable you to place and process orders via our online store. A contract for the distance purchase and sale is concluded between us by placing and confirming the order. Thus, the legal basis for the processing of your personal data will be Article 6(1)(b) of the GDPR (conclusion of the contract).

At this stage, we will need your basic personal data, optionally your company data, address details and telephone number (for the delivery of ordered goods by courier companies cooperating with us). In addition, we will process your payment details, such as a bank account number or a payment card number or other payment service that you choose as a payment method (e.g. blik).

We will store your data for a period of 5 years from the end of the tax year in accordance with the provisions of the Tax Ordinance Act and the Value Added Tax Act.

Providing your personal data at this stage is voluntary, but failure to provide it will prevent you from concluding a contract for the purchase and sale, and thus the order implementation.

Handling of consumer rights, warranty and guarantee

The purpose of processing personal data is to enable you to exercise consumer rights, including the warranty and guarantee that we provide for the products offered. By submitting a complaint or a request for a return, you exercise your consumer rights under the contract. Thus, the legal basis for the processing of your personal data will be Article 6(1)(b) of the GDPR (handling of rights resulting from the concluded contract).

At this stage, we will need your basic personal data, optionally your company data, address details and telephone number (for the delivery of new goods - if the complaint is accepted, by courier companies cooperating with us). At this point, we will need information from you about what constitutes the basis for making a complaint or returning the purchased goods.

In addition, we will process your payment details, such as a bank account number or number of a payment card or other payment service that you choose as a payment method (e.g. blik) for the purpose of returning paid funds, if you are not interested in a new product and you decide to get a refund.

We will store your data for a period of 5 years from the end of the tax year in accordance with the provisions of the Tax Ordinance Act and the Value Added Tax Act.

Providing your personal data at this stage is voluntary, however, failure to provide it may prevent or significantly hinder the exercise of your consumer rights. As a result, it will be significantly difficult to handle your requests or they will be left unprocessed.

Contact form

The purpose of processing personal data is to enable you to contact our Customer Service Office or IT Department in any matter that relates to our business activity.

By sending us a message, we will process your personal data in the form of an e-mail address in order to respond to the received message. Thus, the legal basis for the processing of your personal data will be Article 6(1)(f) of the GDPR (legitimate interest of the administrator in the form of responding to messages from customers or other people).

It is possible that at this stage we will need other data categories that are impossible to predict at that moment but which will be necessary to process the case you refer to us.

We will store your data for the entire duration of your user account (if you register it) or for a period of 3 years (if you are not a registered user of our online store).

Providing your personal data at this stage is voluntary, but failure to provide it may make it impossible to handle the message you sent. This can result in your message being left unprocessed.

Using the loyalty programme

The purpose of processing personal data is to enable you to use shopping preferences (including promotions and discounts) resulting from your participation in the loyalty programme.

By sending us a filled application for the loyalty programme subscription, you give your consent to the processing of your personal data included in the application. Thus, the legal basis for the processing of your personal data will be Article 6(1)(a) of the GDPR (consent expressed through a clear affirmative action, i.e. by subscribing to a loyalty programme)

The personal data we will process about you is basic personal data and contact details (such as e-mail or telephone number).

We will store your data all the time when you participate in the loyalty programme.

We will store your data until you withdraw your participation in the programme. It is possible that your data will be deleted by us earlier in the event of a breach of the Programme rules. However, in this case, we will inform you in advance of such activities.

Providing your personal data at this stage is voluntary, but failure to provide it may prevent you from participating in the Programme. This will result in the inability to use the preferences available under the programme.

Can I access my data?

Yes. You can have full access to your personal data. You can also manage your consents to the processing of personal data, including marketing consents. Access is possible when you contact us via e-mail at the following address: contact@2karko.com

How can I contact the person responsible for personal data protection at KARKO?

You can contact the person responsible in KARKO for the protection of personal data at the e-mail address: contact@2karko.com

Who is the recipient of my data?

Your personal data that we process for the purposes described above may be transferred to data recipients performing services for KARKO, entities entrusted by KARKO for processing personal data on the basis of contracts and entities authorized to obtain personal data on the basis of legal regulations. In particular, they will include:

• Ceneo.pl sp. z o.o. - Ceneo.pl sp.z o.o. with headquarters in Poznań, ul. Grunwaldzka 182, 60-166 Poznań, KRS (court register number): 0000634928, NIP (tax identification number) 525-26-74-781, REGON (statistical number) 365338986 - in terms of collecting Questionnaires via e-mail (or informing about the website where they are made available), used to obtain from the Buyer opinions on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Ceneo Website;
• Google Ireland Limited ("Google") in terms of cookies related to you, which are transferred to Google in connection with the use of this company's services (Google Adwords, Google Ads, Google Analytics) by KARKO company;
• Courier companies cooperating with us in the field of deliveries of products ordered by you and possible returns.
• Law firms cooperating with us in the field of recognizing complaints or returns that you can submit to us.
• Allegro.pl Sp. z o.o. (formerly Grupa Allegro) - with headquarters in Poznań, ul. Grunwaldzka 182 KRS (court register number): 0000634928, 525-26-74-781, REGON (statistical number) 365338986 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain the Buyer's opinion on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Allegro Website,
• SHPL spółka z ograniczoną odpowiedzialnością, with headquarters in Warszawa ul. Towarowa 28, 00-839 Warszawa, KRS (court register number): 0000918384, NIP (tax identification number): 527-29-65-079, REGON (statistical number): 389450687 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain from the Buyer's opinion on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Shopee website.
• Erli.pl, spółka z ograniczoną odpowiedzialnością with headquarters in Poznań ul. Kopanina 34, 60-105 Poznań, KRS (court register number): 0000768895, NIP (tax identification number): 7851806847, REGON (statistical number): 382414961 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Erli Website,
• Empik Spółka Akcyjna, with headquarters in Warszawa ul. Marszałkowska 104/122, 00-017 Warszawa, KRS (court register number): 0000636785, NIP (tax identification number): 5260207427, REGON (statistical number): 011518197 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the subject of the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Erli Website,
• SalesManago Benhauer spółka z ograniczoną odpowiedzialnością located at ul. Grzegórzecka 21, 31-532 Kraków - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), to obtain an opinion from the Buyer on the transaction made by the Buyer in our online store.
• LINK Mobility Poland spółka z ograniczoną odpowiedzialnością located at ul. Toszecka 101, 44-100 Gliwice, NIP (tax identification number): 969-156-67-36, REGON (statistical number): 241520885 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), in order to obtain the Buyer's opinion on the transaction made by the Buyer in our online store.
• Wirtualna Polska Holding Spółka Akcyjna located at ul. Żwirki i Wigury 16, 02-092 Warszawa, NIP (tax identification number): 5213111513, REGON (statistical number): 016366823, KRS (court register number): 0000407130 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), to obtain opinions from the Buyer on the subject of the transaction made by the Buyer in our online store.
• Ringier Axel Springer Polska Limited Liability Company located at ul. Domaniewska 49, 02-672 Warszawa, NIP (tax identification number): 5272677009, REGON (statistical number): 146127300, KRS (court register number): 0000420780 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the transaction made by the Buyer in our online store.

Will my personal data be transferred to a third country or an international organization?

Yes. Your personal data may be made available to our partners who provide services that allow you to use the full functionality of our online store. They include:

• Ceneo.pl sp. z o.o. - Ceneo.pl sp.z o.o. with headquarters in Poznań, ul. Grunwaldzka 182, 60-166 Poznań, KRS (court register number): 0000634928, NIP (tax identification number) 525-26-74-781, REGON (statistical number) 365338986 - in terms of collecting Questionnaires via e-mail (or informing about the website where they are made available), used to obtain from the Buyer opinions on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Ceneo Website;
• Google Ireland Limited ("Google") in terms of cookies related to you, which are transferred to Google in connection with the use of this company's services (Google Adwords, Google Ads, Google Analytics) by KARKO company;
• Courier companies cooperating with us in the field of deliveries of products ordered by you and possible returns.
• Law firms cooperating with us in the field of recognizing complaints or returns that you can submit to us.
• Allegro.pl Sp. z o.o. (formerly Grupa Allegro) - with headquarters in Poznań, ul. Grunwaldzka 182 KRS (court register number): 0000634928, 525-26-74-781, REGON (statistical number) 365338986 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain the Buyer's opinion on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Allegro Website,
• SHPL spółka z ograniczoną odpowiedzialnością, with headquarters in Warszawa ul. Towarowa 28, 00-839 Warszawa, KRS (court register number): 0000918384, NIP (tax identification number): 527-29-65-079, REGON (statistical number): 389450687 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain from the Buyer's opinion on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Shopee website.
• Erli.pl, spółka z ograniczoną odpowiedzialnością with headquarters in Poznań ul. Kopanina 34, 60-105 Poznań, KRS (court register number): 0000768895, NIP (tax identification number):  7851806847, REGON (statistical number): 382414961 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Erli Website,
• Empik Spółka Akcyjna, with headquarters in Warszawa ul. Marszałkowska 104/122, 00-017 Warszawa, KRS (court register number): 0000636785, NIP (tax identification number): 5260207427, REGON (statistical number): 011518197 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the subject of the transaction made by the Buyer in our online store. Data from the questionnaire completed by the Buyer is posted on the Erli Website,
• SalesManago Benhauer spółka z ograniczoną odpowiedzialnością located at ul. Grzegórzecka 21, 31-532 Kraków - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), to obtain an opinion from the Buyer on the transaction made by the Buyer in our online store.
• LINK Mobility Poland spółka z ograniczoną odpowiedzialnością located at ul. Toszecka 101, 44-100 Gliwice, NIP (tax identification number): 969-156-67-36, REGON (statistical number): 241520885 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), in order to obtain the Buyer's opinion on the transaction made by the Buyer in our online store.
• Wirtualna Polska Holding Spółka Akcyjna located at ul. Żwirki i Wigury 16, 02-092 Warszawa, NIP (tax identification number): 5213111513, REGON (statistical number): 016366823, KRS (court register number): 0000407130 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), to obtain opinions from the Buyer on the subject of the transaction made by the Buyer in our online store.
• Ringier Axel Springer Polska Limited Liability Company located at ul. Domaniewska 49, 02-672 Warszawa, NIP (tax identification number): 5272677009, REGON (statistical number): 146127300, KRS (court register number): 0000420780 - in terms of collecting Questionnaires via e-mail (or informing about the website on which they are made available), used to obtain opinions from the Buyer on the transaction made by the Buyer in our online store.

In the above cases, the so-called Standard Contractual Clauses (SCC) in the variant Administrator - Processor adopted by of the European Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to data processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C (2010)593) constitute the mechanism legalizing the processing and transfer of personal data outside the European Economic Area.

What rights do I have?

With regard to the processing of personal data by KARKO, you are entitled to:

• have access to the content of your data (Article 15 of the GDPR),
• rectify data (Article 16 of the GDPR),
• delete data (Article 17 of the GDPR),
• limit data processing (Article 18 of the GDPR),
• transfer data (Article 20 of the GDPR),
• object to data processing (Article 21 of the GDPR),
• have the right not to be subject to decisions taken in the conditions of automated data processing, including profiling (Article 22 of the GDPR).

Who can I make a complaint to?

If you believe that the processing of your data violates the provisions of the GDPR, you have the right to make a complaint with the supervisory body of the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa (kancelaria@uodo.gov.pl)

Where does KARKO get my personal data from?

Application forms and contracts concluded with KARKO are the source of your personal data, while in the case of obtaining personal data in a different way than from data subjects, third parties are the source of the data. Then KARKO is obliged to inform you about the source of your data.

Will KARKO make decisions in your case by automated means?

We currently allow for the possibility that when you use our website, there is a so-called making decisions by automated means. Automated decision making is a situation in which, an automated mechanism makes decisions based on your data - without the participation of a human factor - that concern you. In the case of our website, we use your cookies in the automated decision-making process. More information on what cookies are and how to disable them can be found in our Privacy Policy.

Our website www.2karko.com uses mechanisms based on artificial intelligence and the so-called machine learning. These mechanisms work on the basis of your cookies, which we collect in connection with your presence and activity on our website.

The result of automated decision-making for you performed by the mechanisms described above, includes the following actions taken by our website which are based on the analysis of the content you browse:

• Displaying messages and content in the browser window (pop-up, exit pop-up). Example:

When you complete the shopping basket but have not completed the order, we will remind you through messages displayed on the open website that your order has not been completed.

• Displaying pop-up notifications by the operating system. Example:

Even if you do not browse our website, we accept the possibility that, based on your consent, we will show you notifications about new products on our website..

• Sending dynamic e-mails during or after visiting our website - only if you have provided us with your e-mail address and given your consent to its use for marketing purposes. Example:

On the basis of your activity on the website (your interests, likes, purchases), after analyzing cookies, we have learned that you are interested in a group of products or a specific product, but you have not decided to buy it. The tools operating on our website will be able to send you an e-mail encouraging you to make a purchase or send you more information about the product that you are interested in.

Running a live chat with product recommendations. Example:

On the basis of your activity on the website (your interests, likes, purchases), after analyzing cookies, we will want to send you messages (e.g. product recommendations) via the chat window available on our website.

• Displaying dynamic content or advertisements on our website or on other websites (so-called remarketing, i.e. displaying our advertisements on other websites) through the services of our Partners (e.g. Google). Example:

 If you browse other websites that use Google services (our Partners), in space intended for advertising, you will be presented with content that is not accidental. These will be content about our products based on your cookies.

 If you do not want to be subject to the consequences of decision-making by automated means, you must block the option of saving our cookies in your browser. More information on what cookies are and how to disable them can be found in our Privacy Policy.

Will my personal data be profiled?

At first, we want to explain what profiling is. According to the definition contained in the GDPR, profiling "means any form of automated processing of personal data, which consists in the use of personal data to assess certain personal factors of a natural person, in particular to analyze or forecast aspects related to the effects of natural person's work, their economic situation, health, personal preferences, interests, reliability, behaviour, location or movement”.

Due to the mechanisms of artificial intelligence and machine learning which function on our website, your personal data will be profiled in connection with your activity on our website.

The result of profiling (including automated decision-making, about which we informed above) will be:

• identification of your interest in products offered by KARKO;
• research of the market and your behaviour and preferences;
• identification of the orientations and actions necessary to improve the quality of our services (online store) and products.

The only consequence for you will be displaying or sending notifications, messages, e-mails or conducting other information/marketing activities by an automatic mechanism. If you abandon profiling (by blocking the possibility of saving our cookies on your device), you will not have any adverse consequences. Ads and other marketing information will continue to be posted, but will be less tailored to you.

More information on what cookies are and how to disable them you can find in our Privacy Policy

Rules for processing requests for customer rights service in the field of personal data

Our Customer (a natural person running a business, civil law partnership, professional partnership, general partnership) is entitled to submit an application regarding GDPR rights service, and KARKO is obliged to consider it according to the following rules:

The Customer may submit an application to KARKO at any time.

1. KARKO considers the application submitted by the Customer or a person acting on his/her

      behalf:

• within one month from the date of receipt of the request,
• if the request or the number of the Customer's requests is of a complex nature, the time limit for a reply may be extended by another two months; KARKO will inform the Customer by e-mail about the extension of the deadline, providing the reasons for the delay, within one month of receipt of the request.
• if no action in relation to the Customer's request is taken, KARKO shall immediately - no later than within one month of the receipt of the request, inform the Customer by e-mail about the reasons for not taking action and the possibility of lodging a complaint to the supervisory body and seeking legal redress from courts.

2. The Customer may submit a request concerning execution of their rights and freedoms. The Customer's application should contain address details as well as the type and details of the request.

3. The Customer may submit a request via e-mail to the following address: contact@2karko.com

4. The deadline for considering the request begins on the day KARKO receives the Customer's request.

5. The Customer is entitled to submit a complaint in the event of failure to meet the deadline for responding by KARKO.

6. KARKO provides the Customer with a reply to the submitted request via e-mail.

7. KARKO does not charge any fees or commissions for accepting and considering the first request. The provisions of the GDPR apply to each subsequent request.

8. The President of the Personal Data Protection Office is the competent supervisory authority for KARKO in the field of personal data.

If you have any questions regarding the request, please contact KARKO at the following e-mail address: contact@2karko.com

Legal basis: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (Journal UE L 119 of 4 May 2016)