Dear Sir/Madam,

By fulfilling the obligation arising from the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, referred to as the GDPR, and in particular Article 13 or 14(1) and (2) of this Regulation, we hereby provide you with information on the principles of processing your personal data by us.

Data Controller

The controller of your personal data is VMC, Ludwinowska 11, 30-331 Krakow.

Contact with the Controller is possible:

● by post: at the above address,

● through the contact form available on the store's website at https://revewalls.fr/kontakt/.

● via email: [email protected]

Categories of individuals, their data, and the purpose of processing personal data

Personal data is processed for the purpose of conducting the Controller's business activities in the following categories:

● online store customers,

The Controller collects and processes data in categories such as: first name, last name, company name, address details, telecommunication contact details, registration data. This information comes directly from the individuals concerned.

Personal data of online store customers is processed for the purpose of promoting offered products, e.g. through newsletters, order fulfillment, agreements related to the purchase of goods and services, invoicing, and delivery of purchased items.

The legal basis for processing personal data arises from:

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, namely:

● Article 6(1)(b) – necessary for the performance of a contract, orders, or their conclusion.

● Article 6(1)(a) – based on the expressed consent to receive information related to offers, promotions, and events through all electronic means of communication.

2. Act on the provision of electronic services of 18 July 2002 (Journal of Laws of 2019, item 123) Article 10 and the Telecommunications Law of 16 July 2004 (Journal of Laws of 2018, item 1954) Article 172 – consent to receive unsolicited commercial information.

Other applicable legal acts, in particular tax and accounting regulations, telecommunications law, provision of services by electronic means, civil code.

Access to personal data

Your data is accessible to employees who have been trained in the protection of personal data, have signed confidentiality statements, and have authorization to process personal data to the extent resulting from their duties. Entities carrying out orders placed by the Controller may also have access. The Controller has concluded appropriate data processing agreements with these entities to ensure the confidentiality and security of this data. Your personal data is not transferred to third countries.

Use of cookies

We use cookies on our website. Cookies are computer data (e.g. text files) that are stored on the user's device, such as a tablet, phone, or computer. They may contain the domain name of our website, storage time, and other information. Cookies do not contain any data enabling the identification of individuals. The web browser automatically sends some anonymous data to our website, such as the IP address of the device, browser version, and others. Anonymous data collected in this way facilitates your use of our website and provides us with information about the activities of its users.

Cookies are used for:

● collecting information on how our website is used (Google Analytics cookies) – we collect information on the number of visits, their average duration, or the number of visited subpages. This allows us to better tailor the site to users' expectations and needs.

● remembering user-selected settings and customizing the interface, e.g. in terms of font size, website appearance, etc.

● recognizing the user's device – to display content clearly

● improving the user experience of our website.

The Controller also uses cookies for advertising purposes. Remembered user behaviors on the site will allow us to tailor the advertising of our products to your interests (Google AdWords cookies). By browsing our site, you consent to the use of cookies by the Controller. If you do not want these files to be stored, you should change the settings of your browser on your devices, and necessary information can be found in the browser's help functions. The website contains links to social media portals, e.g. Facebook. If you use our site while logged into a particular portal, information about how you use our site may be transferred to that portal.

Data processing period

Your personal data will be stored during the execution of contracts, orders, and after their completion for a period resulting from legal provisions, in particular indicated in tax and accounting regulations, anti-money laundering and counter-terrorism regulations. In the case of processing based on consent, data will be stored until its withdrawal or the cessation of the reason for which the consent was given.

Rights of data subjects

1. the right to access their data: the right to obtain confirmation from the Controller whether they process your personal data and the right to access this data,

as well as the following information:

○ information on the purposes of processing your personal data

○ information on the categories of your personal data processed by the Controller,

○ information on recipients or categories of recipients to whom the Controller has disclosed or intends to disclose your personal data,

○ information on the possibility of exercising your rights in the field of personal data protection, as well as the way in which these rights can be exercised,

○ information about the right to lodge a complaint with a supervisory authority,

2. the right to rectify personal data: the right to request the Controller to immediately correct your personal data that is incorrect and to request the completion of incomplete personal data,

3. the right to erase personal data: the right to request the Controller to immediately erase your personal data. The Controller is obliged to delete your personal data without undue delay, provided that one of the following conditions is met:

○ personal data are no longer necessary for the purposes for which they were collected or processed,

○ you have withdrawn your consent on which the processing is based, and the Controller has no other legal basis for processing your personal data,

○ your personal data have been processed unlawfully,

○ your personal data must be deleted to comply with a legal obligation. The right to erasure of personal data cannot be exercised if the Controller is obliged under the law to further process personal data to the extent specified by the relevant legal provisions or for purposes necessary to establish, assert, or defend claims by the Controller,

4. the right to request the restriction of personal data processing: the right to request the Controller to restrict the processing of your personal data in the following cases:

○ when you question the accuracy of personal data processed by the Controller – for a period allowing the Controller to verify the accuracy of this data,

○ when the processing of your personal data is unlawful, and you oppose the erasure of your personal data, requesting instead the restriction of their use,

○ when the Controller no longer needs your personal data for processing purposes, but you need them to establish, assert, or defend claims. In the case of exercising the right to restrict the processing of personal data, the Controller may process your personal data, except for their storage, only with your consent or for the purpose of establishing, asserting, or defending claims or protecting the rights of another natural or legal person or for reasons of significant public interest of the European Union or a Member State,

5. the right to data portability: you have the right to receive your personal data provided to the data controller in a structured, commonly used, machine-readable format and to request the transmission of this personal data to another data controller, if technically feasible. The data controller is obliged to provide the data provided by you, which meet the following conditions:

○ processing is carried out in an automated manner, i.e. does not include paper collections,

○ the data is processed based on consent or in connection with a contract. The exercise of the right to data portability must not adversely affect the rights and freedoms of others,

6. the right to object to data processing: you have the right to object at any time – for reasons related to your particular situation – to the processing of data based on the legitimate interest of the data controller. The data controller cannot continue to process your personal data after you have objected, unless there are compelling legitimate grounds for processing your personal data that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims. You also have the right to object to the processing of personal data at any time for marketing purposes. The right to object to the processing of data does not apply when:

○ the processing of personal data is based on consent,

○ the processing of data is necessary for the performance of a contract to which you are a party or for taking action at your request before entering into a contract with the data controller,

○ the processing is necessary to fulfill a legal obligation incumbent on the data controller.

If personal data processing is based on consent, you have the right to withdraw your consent to the processing of personal data at any time, without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal.

You are entitled to exercise your rights as follows:

● in writing to the address: VMC, Ludwinowska 11, 30-331 Krakow

● electronically to the address through the contact form available on the store's website at https://revewalls.fr/kontakt/, or to the email address:

● +48783311851

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement, if you believe that the processing of your personal data violates the provisions of the General Data Protection Regulation of 27 April 2016. For the territory of the Republic of Poland, this is the Office for Personal Data Protection, Stawki 2, 00-193 Warsaw.

Other information

Providing personal data to the extent required to achieve the specific purposes mentioned above is mandatory; failure to provide them will prevent the completion of tasks set by the processing purpose. In other respects, it is voluntary. Your data will not be subject to automated decision-making (profiling). In the event of a change in the purpose of processing, the Controller will provide you with appropriate information.