POLICY OF PRIVATENESS AND USE OF COOKIES

ON THE WEBSITE DAS COMPANY

(hereinafter ‘Privacy Policy’ or ‘Policy’)

Taking into account the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), hereinafter referred to as ‘GDPR’, the following document sets out rules on the processing of personal data in an online store at www.dascompany.com (hereinafter referred to as ‘Internet Store’ or ‘Shop’).

The terms in the text of the document below shall be read in accordance with their definitions in the Online Shop Regulations (hereinafter: ,,the Rules), unless otherwise indicated in the Privacy Policy.

1. PERSONAL DATA DIRECTOR

   1. The administrator of personal data in the Online Store is: Das Company Limited liability company based in Trzebini, ul. Przemysłowa 10, 32-540 Trzebinia, registered in the National Court Register by the District Court for Krakow-Śródmieście in Krakow XI Economic Division of the National Court Register at number: 0000451571, NIP: 6772373649, REGON: 122795114 (hereinafter: ,Administrator‘ or ‘Personal data controller’).

   2. The services available in the Shop (in particular the possibility of placing an Order in the Shop) are not those under the age of 16. The data controller does not provide for the deliberate collection of data on persons under the age of 16.

   3. The Administrator makes special efforts to protect privacy and information provided to him, concerning the Clients and users of the Store, including appropriate technical or organisational measures to ensure the protection of data processing.

   4. The controller shall protect the data from unauthorised access, disclosure, loss and destruction, unauthorised modification, and their processing in violation of applicable laws.

   5. The Online Store may use so-called plug-ins and other social tools, including, in particular, enabling the Client to register or log into an account in the Online Store using accounts on social and similar sites such as Facebook.com, Google.com as well as allowing them to share with other users of these services with the content or their command as part of an account with the provider of the respective portal. Providers of these services may also process personal data as independent administrators. In this case, the Administrator and the plugin provider are co-operators of personal data. Additional information in this respect can be found by the Customer in the rest of this document.

2. CONTACT DATA

   On personal data, the Client may contact the Data Administrator by:

   1. traditional mail at: Das Company Sp. z o.o., ul. Przemysłowa 10, 32-540 Trzebinia;

   2. e-mail at: biuro@dascompany.com ;

   3. telephone number: +48 32 50 65 880;

   4. the contact form available on the Store's website;

   5. chat available on the website of the Shop.

3. OBJECTIVES, SCOPE AND GROUNDS FOR PROCESSING PERSONAL DATA

The personal data controller shall process personal data for the following purposes and scope and on the following grounds:

1. Base: Personal data processed pursuant to Art. 6 (1) lit. b GDPR – i.e. for the purposes of the implementation of the contract, as well as actions before concluding the contract at the request of the Client.
   Objective and scope:On this basis, the Administrator processes the data for the following purpose and scope:
   - for the purpose of concluding and implementing the Contract for the Sale of Goods (e.g. the delivery of the Ordered Goods) - for this purpose the Administrator processes in particular the personal data provided by the Client in the form Contracts or other data provided for the performance of the Order, in particular: name, e-mail address, telephone number, address data, payment data;
   - in order to perform the Services or to provide functionality of the Shop – in particular the data provided by the Client in the registration form (account) in the Online Store, such as e-mail address, name, gender and password established.
   If registration or login to the Account occurs through an external authentication service (e.g. Facebook or Google) The Administrator collects, among others, the Client's name;
   - in order to provide the Services and to provide the functionality available in the Online Store - the Administrator processes in particular personal data concerning the activity of the Client in the Online Store, including regarding the content, goods or services reviewed by the Customer, data concerning the sessions of the Customer's device, browser, IP address, as well as data provided by the Customer in the Order or for the purposes of order execution, and data provided by the Customer in the forms available in the Store (including e.g. in the contact form);
   - to provide Services and provide functionality requiring assumptions Accounts such as the functionalities related to Account and provided through it, for example: keeping the history of Orders, informing about the status of performance of the Order – for this purpose the Administrator processes in particular the Customer data provided in the Account, the Order Form or for the purposes of performance of the Order, as well as other data collected within the Procurement, including data on the history of purchases;

2. Base: Where processing of data is necessary for the purposes of legitimate interests pursued by the controller or by a third party – the Administrator processes personal data on the basis of Art. 6 (1) lit. f GDPR.
   Objective and scope: On this basis, the Administrator processes the data for the following purpose and scope:
   - in order to conduct statistics on the use of individual functionalities available in the Online Store, facilitate the use of the Online Store and ensure the security of the IT Online Store – to this end the Administrator processes in particular personal data concerning the activity of the Client in the Online Store, including the amount of time spent on each of the websites in the Online Store, search history, location, IP address, device ID, data concerning the web browser and the client's operating system;
   - in order to establish, pursue and enforce claims and defence against claims in court proceedings and other enforcement bodies, for this purpose the Administrator may primarily process personal data provided by the Client in the Online Store, including when ordering Goods or using Services or functionality (including forms in the Store) and other data necessary to prove the existence of a claim or which arise from a legal requirement, court order or other legal procedure;
   The legitimate interest of the Administrator:In the case of processing of personal data for the above purposes, the legitimate interest pursued by the Administrator consists in: the possibility of establishing, enforcing and enforcing claims and defending against claims in proceedings before courts and other state bodies, increasing the level of services provided and the efficiency and security of the Online Store, as well as building positive relations with Clients;

3. Base: where the processing of data is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party, and where the consent of the Client was also needed for the processing of personal data, on the basis of this consent, i.e. on the basis of Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR. On the other hand, where personal data processed for the purposes of the performance of the contract as well as actions before concluding the contract on request of the Client - pursuant to Art. 6 section 1 lit. b GDPR.
   Objective and scope:On this basis, the Administrator processes the data for the following purpose and scope:
   - in order to market the goods and services of the Administrator and marketing of the products and services of the Clients and Partners of the Administrator, including remarketing - for this purpose the Administrator processes mainly personal data provided by the Client when creating and updating the Account and using it, including dates of login and registration, writing to the Newsletter, data concerning customer activity in the Online Store including Orders, data which are recorded and stored through Cookies, and in particular history of Orders, search history, clicks on the Online Store, history and customer activity related to communication with the Administrator.
   In the case of remarketing, the Administrator also uses data on customer activity to reach it with marketing messages, including personalized advertisements outside the Online Store. For this purpose, the Administrator shall use the services of external providers providing specific mechanisms. These services consist in displaying admin messages on websites other than the Online Store website. Details about this subject may also be found in the records on Cookies Files in the rest of this document;
   - for use by the Administrator in the Online Shop Cookies. Depending on the type (category of Cookies) the basis for processing personal data is a different basis, i.e. Cookies necessary – the basis is Art. 6 (1) lit. f GDPR and Art. 6 (1) lit. b GDPR. In the case of Cookies in the category Analytical/Functional – the basis is Art. 6(1)(a) GDPR. In the case of Cookies in the Marketing/Advertisement category – Art. 6(1)(a) GDPR. Details about this subject may be found in the records of Cookies Files in the following part of this document;
   - in order to examine the market, opinions, measure and conduct statistics by the Administrator himself or his partners or suppliers – for this purpose the Administrator uses in particular data such as information about the Order, data given in the Account or when purchasing the Goods. Detailed instructions are given in the information about the survey, form or place where the Client introduces his data.
   The legitimate interest of the Administrator:In the case of the processing of personal data for the above purposes, the legitimate interest pursued by the Administrator, in cases where it is the basis of the processing, is: the possibility of informing users about the offer of the Administrator, including in particular the offered Services and image building on the market, direct marketing Goods and services, as well as ensuring the most optimal use of the Services and functionality of the Store and its websites in general and increasing their level, efficiency and security.

4. Base: implementation of the Agreement, as well as where the processing of data is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – the legitimate interest of the administrator, i.e. on the basis and on the basis of Art. 6 (1) lit. b GDPR and Art. 6 (1) lit. f GDPR.
   Objective and scope:On this basis, the Administrator processes the data for the following purpose and scope:
   - in order to process complaints, complaints and requests and answer questions of the Clients – to this end the Administrator processes the personal data provided by the Client in contact form, hut, other forms in the Online Store, complaints and requests, and questions addressed in another form. For this purpose, the Administrator also processes certain personal data provided by the Client in the Account, data concerning the Order of Goods and other provided in the Online Service Store which are the cause of complaints, complaints or requests, questions and data contained in documents accompanying complaints, complaints, requests and questions;
   - in order to organize and operate competitions, loyalty programs or similar actions, and in particular to undertake activities such as notification of collected points, notification of winnings, promotion and advertising of the offer of the Store and the shares themselves – for this purpose the Administrator in particular processes personal data provided by the Client during registration (involvement to such shares) in the contest or loyalty program and personal data placed in the Account. In addition, details of the competition, loyalty programme or other action will be provided each time in terms of participation of the competition, loyalty programme or share;
   The legitimate interest of the Administrator:In the case of processing personal data for the above purposes, the legitimate interest pursued by the Administrator consists in the possibility of legally processing complaints, answers to comments or questions of the Clients, as well as increasing the level of Services provided and building positive relations with the Clients.

5. Base: when the processing of data is necessary to fulfil the legal obligation on the Administrator, i.e. on the basis of Art. 6 (1) lit. c GDPR - in particular by fulfilling the legal obligations imposed by the Administrator by tax law/laws concerning accounting in connection with the settlements of Orders, competitions, or loyalty programs and similar actions.
   Objective and scope:To this end, the Administrator primarily processes personal data provided by the Client to submit and settle the Order, as well as data provided by the Client when joining a loyalty program, contest or similar action – according to its rules.

6. Base: implementation of the Agreement as well as where the processing of data is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – the legitimate interest of the administrator, i.e. on the basis of Art. 6(1)(f) GDPR and on the basis of Art. 6(1)(b) GDPR (for the purposes of the implementation of the contract as well as actions before concluding the contract at the request of the Client).
   Objective and scope:For this purpose, the Administrator processes personal data (in particular: identifiers, comments, reviews) concerning persons (users) visiting profiles conducted by the Administrator as part of social media or other services (e.g. Facebook, Instagram, Google, YouTube). Personal data are processed for the purpose of conducting such profiles and information about the activities conducted by the Administrator, sharing expressed opinions on the Administrator.
   The legitimate interest of the Administrator:building the image of the Administrator, promoting the activities carried out, as well as the possibility of investigating or defending against possible claims, provided that this Policy does not constitute a regulation related to the processing of personal data by administrators of such websites or social media.

4. DATA PROCESSING TIME

   1. Personal data will be processed by the Administrator in principle for the period necessary to carry out the Orders, provide Services and provide functionality, marketing activities and other services provided to the Client. Personal data will be deleted by the Administrator in the following cases:

      1. when the data subject requests their deletion or withdraws his consent;

      2. when the data subject has not acted for more than 3 years (inactive contact);

      3. after obtaining information that the stored data is outdated or inaccurate;

      4. when the data subject objects effectively to the processing of his personal data by the Administrator, when the basis for the processing of personal data is the legitimate interest of the Administrator.

   2. For example: e-mail address, first and last name, address, telephone number may be additionally stored at which time it may be necessary to pursue any claims or to defend against claims of persons, for evidence of claims related to both the sale and Services provided in the Online Store, as well as for the purposes of handling complaints, complaints or other requests - pending the limitation of claims. This data will not be used by the Administrator for marketing purposes.

   3. Data relating to the orders of Goods and possible Paid Services, competitions and loyalty programmes to the extent necessary for the keeping of accounts and accounts will be kept for the necessary period of time, resulting from provisions of common law, including in particular accounting and accounting.

   4. Data collected as part of the Cookies and similar mechanisms shall be stored by the Administrator for a time corresponding to the life cycle recorded on the Cookies devices or until they are removed from the Customer's device. Details about the time of existence of a particular cookie can be found in the records of Cookies in the rest of this document.

5. PERSONAL DATA RESERVERS

   1. Pursuant to Article 4 of the GDPR, a natural or legal person, public authority, entity or other entity to which personal data are disclosed, whether or not it is a third party, must be understood by the recipient.

   2. Due to the need to conclude and implement Sales Contracts and the implementation of Services provided by electronic means, the personal data of the Clients may be transferred to the following categories of recipients:

      1. state authorities, e.g. prosecutor's office, the Police, the President of the Office for Personal Data Protection (PUODO), if requested by the Administrator, indicating the legal basis of their requests;

      2. Service providers with whom we cooperate, in particular in the field of delivery Orders or payment executions, as well as allowing the use of websites of the Online Store, including, in suppliers responsible for the proper operation of electronic systems, entities providing accounting services to the Administrator, Google Inc. based in the U.S. or Google Ireland Ltd. based in Ireland, as well as other external entities cooperating with the Administrator in the scope of their business. Depending on the contractual arrangements and circumstances, these entities shall act on behalf of or determine the purposes and means of processing them themselves.

      3. personal data may also be transferred to other entities – providers of tools which cookies are used. For information about these entities and for the purposes of using Cookies, see the section on Cookies, below.

   3. The detailed list of suppliers can be made available by the Administrator at the request of the Client.

   4. These suppliers are mainly located in the European Economic Area (EEA) countries. The personal data controller may commission certain activities to recognised subcontractors operating outside the EEA. Personal data transferred outside the EEA will be protected by adequate legal safeguards so that the suppliers receiving them guarantee a high degree of protection of personal data. These guarantees arise in particular from obligations to apply standard contractual clauses adopted by the Commission (EU) or binding corporate rules duly approved by the supervisory authority within the meaning of the GDPR. The method of data protection is in accordance with the principles set out in Chapter V of the GDPR. The Shop Client may request the Administrator to provide additional information on the security used in this respect, obtain a copy of these safeguards and information on the location of their disclosure. In addition to the intention to transfer personal data outside the EEA, the Administrator will inform the data subjects at the stage of collecting personal data.

6. CATEGORIES OF PERSONAL DATA

   The personal data controller shall process the following categories of personal data concerned:

   1. contact details, including those indicated in the contact form, the hut and other forms available in the Online Store;

   2. data on activities in the Online Store;

   3. Online Shop Orders data;

   4. settlement data - payments;

   5. data on complaints and requests;

   6. marketing services data.

7. ADVICE OF ADMINISTRATION OF PERSONAL DATA

   1. The Customer's provision of the required personal data is voluntary, subject to point 2.

   2. Providing some data is a condition for using individual Services and functionality of the Online Store.

   3. The system used by the Administrator automatically means mandatory data. The consequence of not providing this data is that the Administrator cannot provide certain Services and functionality of the Store. In addition to the data designated as mandatory, the provision of other personal data is voluntary.

8. RECOGNITION OF DECISIONS

   Personal data on preferences, behaviours and choice of marketing content may be used as a basis for automated decisions to determine the sales opportunities of the Online Store. For this purpose, the Administrator mainly uses mechanisms using Cookies – more information about them can be found in the section on Cookies, next to the Policy section.

9. RIGHTS OF PERSONS WHICH PERSONAL DATA ARE PROCESSED

Based on the GDPR, the data subject has the right to:

1. access to personal data (Article 15 GDPR).
   It may obtain information from the Administrator whether its data is processed and, if processed, has the right to:

• access to data;

• to obtain information on the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of such data, the planned period of storage or the criteria for determining that period, the rights conferred on it by the GDPR and the right to lodge a complaint with the supervisory authority, the source of such data, the automated decision-making, including profiling and the safeguards applied in relation to the transmission of such data outside the European Union;

• obtain copies of your personal data.

2. rectification of personal data (Article 16 GDPR).
   If the personal data of this person are incorrect, it may request the Administrator to rectify them immediately. It may also require the Administrator to supplement this data. If such a person has an Account in the Online Store, his personal data may also be corrected and supplemented by himself after logging in to the Account.

3. erasure of personal data, the so-called "right to be forgotten" (Article 17 GDPR)
   The data subject may request this if:

   1. personal data are no longer necessary for the purposes for which they have been collected or otherwise processed;

   2. withdraw specific consent to the extent that personal data were processed on the basis of its consent;

   3. personal data have been processed unlawfully;

   4. object to the processing of its personal data for the purposes of direct marketing, including profiling, to the extent that the processing of personal data is linked to direct marketing;

   5. objected to the processing of her personal data in connection with the processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of legitimate interests pursued by the Administrator or a third party.

Despite a request for the deletion of personal data, The controller may process the data further in order to establish, pursue or defend claims of which the data subject is informed.

4. request a restriction on the processing of personal data (Article 18 GDPR).

The data subject may request this if:

1. contests the accuracy of his personal data – The personal data controller will limit the processing of personal data in time to verify the correctness of these data;

2. where the processing of its data is unlawful and instead of eradicating personal data, requests a restriction on the processing of its personal data;

3. its personal data are no longer needed for processing purposes, but are needed to establish, investigate or defend against claims;

4. when she objected to the processing of her personal data – until it was established whether legitimate interests on the part of the Administrator of the personal data were superior to the grounds indicated in the objection of the person who notified it.

1. opposition to the processing of personal data (Article 21 GDPR).

The data subject may object at any time to the processing of his personal data, including profiling, in relation to:

1. processing necessary for the performance of a task of public interest or processing necessary for the purposes of legitimate interests pursued by the Administrator or a third party;

2. processing for direct marketing purposes.

1. audata transfer requirements (Article 20 GDPR).

The data subject has the right to receive his/her personal data from the Administrator in a structured, commonly used machine-readable format and to send it to another personal data controller or to request the Administrator to send his/her personal data directly to another administrator (if technically possible).

7. revoke consent to the processing of personal data.

The data subject may do so at any time. This shall not affect the legality of the processing carried out on the basis of its consent before its withdrawal.

8. complaints to the supervisory authority.

If the data subject believes that the processing of his personal data violates the GDPR, he or she shall have the right to lodge a complaint with the supervisory authority, in particular in the Member State of his or her habitual residence, his or her place of employment or the place of the alleged infringement.

In Poland, the supervisory authority responsible for the protection of personal data is the President of the Office for Personal Data Protection (PUODO).

How rights are implemented:

All rights of the data subject may be exercised by contacting the Administrator at the contact addresses indicated in this Policy.

The administrator shall, without undue delay, and in any event within one month of receiving the request, provide information on the actions taken in relation to the request made by such person. Where necessary, the monthly period may be extended by another two months due to the complexity of the request or the number of requests. In any event, the Administrator shall inform the person who has requested such extension within one month of receiving the request stating the reasons for the delay.

10. SPERSONALISED RECLAMS AND SOCIAL RELATIONS

1. The Administrator may use personal data in order to prepare and present personalized advertisements to the Clients, including using tools and third-party cookies, which is further indicated in this Cookies document.

2. Due to the possibility of using social plugins and other similar social tools in the Online Store, including enabling the Client to register or log in to the Account in the Online Store using accounts on social and similar websites such as Facebook.com, Google.com, as well as sharing with other users of these websites the content or their commands as part of their account with the provider of the respective portal, the providers of these services may also process the personal data of such Client as independent administrators. Detailed rules for the processing of personal data by social network administrators can be found on the websites of individual services/suppliers.

3. When the Client visits the Online Store, the browser he uses can directly connect to the servers of the entities providing these plugins/tools, so that the Client receives information about the use of the Store and, among others, the Client's IP address. Such information may be sent regardless of whether the Customer has an account on the service of such entity and whether it is currently logged in to it. If the Client has an account with such an entity and is logged in to it, this information may also be linked and assigned to his account on the social network.

4. If you use the plugin, including in particular the use of the Client account on the external site of the entity to register with the Online Store Account, information about this may also be sent directly to that entity. Certain content can also be published as part of the Customer's profile on social networks and visible to other users of such portals, including in particular those with whom they relate.

5. If the Client does not want the provider of plug-ins/tools/social services assigning his data collected during visits to the Online Store to his profile with the supplier, then before visiting the website our Store should take care to log out of this social website. The client may also prevent the plugins from being loaded on the page using appropriate mechanisms within the browser he uses – according to his settings.

6. The Administrator strives to maintain all care in order to select only software, including plug-ins, from reputable entities that broadly define their personal data protection rules.

7. The purposes, scope and principles of the collection and further processing of personal data by these entities can be found in their privacy policy. The Administrator encourages you to read them directly with the suppliers' data, e.g. at the following addresses:http://www.facebook.com/policy.php.

RULES FOR THE USE OF ‘COOKIES’ IN THE WEBSITE

1. GENERAL

1. The Internet Store uses cookies (hereinafter referred to as: , Cookies) or ,,Cookies). Cookies are small text files that are used by websites for specific purposes, mainly to improve the quality of their functionality.

2. Cookies are stored in the end device of the Client in connection with the use of the Website. Cookies allow you to identify the software used by the Client and adapt the Online Store individually to its needs.

3. Cookies usually contain the name of the domain they come from, the time they are stored on the device and the assigned value.

4. Various types of Cookies, including external files, are used in the Online Store.

5. Unless otherwise indicated, the following information concerns both the use of Cookies by the Administrator and other technologies of a similar nature.

6. The cookies used by the Administrator are safe for the Client's devices. In particular, it is not possible to access such devices through virus cookies or other unwanted software or malware.

2. TYPES OF FILE

   Within the Store the Administrator uses two types of cookies:

   1. Session cookies: they are stored on the Customer's device and remain there until the end of the session of the browser. The stored information is then permanently removed from the Client's device's memory after the session is completed or the browser is closed. The session cookies mechanism does not allow for downloading any personal data or any confidential information from the Customer's device.

   2. Permanent cookies: are stored on the Customer's device and remain there until they are removed (from the level of settings of the web browser). The termination of a particular browser session or the deactivation of the device does not remove them from the Customer's device. The Persistent Cookies mechanism does not allow for downloading any personal data or any confidential information from the Customer's device.

3. USE OBJECTIVES OF COOKIES

1. The Administrator also uses cookies of external entities. Cookies used by the Administrator have been divided into the main categories for the purposes of this document – according to the main purpose criterion, in which they are used: 1. Basic (necessary), 2. Analytical/Functional, 3. Marketing/Advertisement.

2. Cookies Basic (necessary) are those files without which it would not be possible to use the full functionality of the Online Store website, in particular allowing users to authenticate and to improve the overall security of the sites.

3. Analyst/Functional Cookies – are files used primarily to perform analyses and statistics by the Administrator concerning the use of the Online Store website, where their purpose is mainly to adapt these websites to the current needs of the Clients and to improve services.

4. Marketing/Advertisement – these are files that allow the Administrator to display online ads to customers in a way that is better suited to their expectations or needs.

5. The following is detailed in what purpose cookies are used and by which entities. Each of these entities also sets out its privacy rules on its own – links to these rules of individual suppliers can also be found directly with these suppliers.

The administrator uses the following cookies:

Detailed information on the possibilities and ways of handling Cookies are available in the User's software settings (web browser).

4. SPERSONALISED RECLAMS

   Cookies can be used by advertising networks, in particular the Google network, to display ads tailored to the Customer's preferences, including the presentation of personalised advertisements. For this purpose, information may be retained, including in particular the way the Client moves on the network, the passwords searched and the time of use of the website.

   Personalised advertisements (also defined by interest-based advertisements) are tools that can be used to increase the matching of ads to the preferences and interests of the individual.

5. EDITION, TURNING ON, COOKIES BLOOKED

   To view and edit information about your preferences, collected by Google’s advertising network, the client can use the tool posted at the link https://www.google.com/ads/preferences/and https://policies.google.com/technologies/partner-sites.

Using the settings of the web browser used by the Customer, or through the configuration of the service, he can change the settings for Cookies himself and at any time, specifying the conditions for storage and access by Cookies to his device. These settings can be changed to block automatic operation of Cookies in the settings of the web browser or to inform each time they are placed on the Customer's device.

At the same time, the Customer may also disable or revoke the use of cookies from external suppliers, as well as remarting pixels, using Network Advertising, at: https://optout.networkadvertising.org/?c=1.