Privacy Policy

The Controller of the personal data collected through the Online Shop is Marcin Błahyj trading as Błahyj Marcin MOSSA, with its registered office in Toruń, ul. Barwna 53, 87-100 Toruń, Poland, NIP (Tax ID No.): 8792402272, REGON (Statistical ID No.): 340352543, and Piotr Błahyj trading as MOSSA Piotr Błahyj, with its registered office in Toruń, ul. Barwna 53, 87-100 Toruń, Poland, NIP: 8792429319, REGON: 341215630, jointly operating a private partnership trading as MOSSA PIOTR BŁAHYJ, MARCIN BŁAHYJ SPÓŁKA CYWILNA, with its registered office in Toruń, ul. Barwna 53, 87-100 Toruń, Poland, NIP: 8792554728, REGON: 340440230, email address: contact.ie@carmager.com, hereinafter referred to as the “Controller”, at the same time being the Seller as well as the Service Provider of the Online Shop. The contact details of the Controller of the Customer’s personal data are set out below:

Marcin Błahyj, Piotr Błahyj
ul. Kociewska 24-26, Hala nr 1
87-100 Toruń, Poland
email address: dane.osobowe@carmager.com

The Customer’s personal data is processed in accordance with Regulation (EC) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data– repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”, and the relevant national legislation, i.e., among others, the Polish Personal Data Protection Act (10 May 2018) (Journal of Laws item 1000 as amended) and the Polish Provision of Electronic Services Act (18 July 2002) (Journal of Laws of 2017 item 1219 as amended).

The Controller takes particular care to protect the interests of the data subjects, in particular to ensure that the data it collects is processed lawfully, is collected for specified legitimate purposes and is not further processed contrary to those purposes. The Controller’s processing of personal data is materially correct and adequate in relation to the purposes of the processing. Personal data may be kept in a form that permits the identification of the data subjects for no longer than is necessary to achieve the purpose of the processing.

The Controller protects personal data from access or disclosure to unauthorised persons as well as from loss, destruction or unauthorised modification, by applying appropriate system and technical safeguards.

The terms used in this Privacy Policy have the following meanings:

1. Customer: a natural person, a legal entity or an organisational unit that is not a legal entity, but which has been granted legal capacity under specific provisions, who places an order in the Shop;
2. User: any person who uses the Online Shop website and to whom electronic services may be provided or with whom the Sales Contract may be entered into;
3. Online Shop (Shop): the Internet website available at ie.carmager.com through which the Customer may, in particular, place Orders;
4. Seller: Marcin Błahyj and Piotr Błahyj jointly operating a private partnership trading as MOSSA PIOTR BŁAHYJ, MARCIN BŁAHYJ SPÓŁKA CYWILNA, with its registered office in Toruń, registered in the Polish Central Register of Business Activities and Information kept by the Polish Ministry of the Economy, with the following place of business and address for service: ul. Barwna 53, 87-100 Toruń, Poland, NIP PL: 8792554728, REGON: 340440230, BDO (Waste Management Database): 000388568, email address: contact.ie@carmager.com;
5. Sales Contract: a contract for the sale of products within the meaning of the Polish Civil Code, entered into by and between Mossa Marcin Błahyj i Piotr Błahyj s.c. and the Customer through the Internet website of the Shop;
6. Order: the Customer’s declaration of intent aiming directly at entering into the Sales Contract, specifying in particular the type and number of products.

The purpose, scope and recipients of the data processed by the Controller are determined on a case-by-case by the activities carried out by the Customer in the Online Shop.

The Controller processes the personal data necessary for the performance of the Sales Contract and the Customer voluntarily provides the data when creating an account in the Online Shop in order to place an Order in the Online Shop.

The extent of the data required to enter into the Sales Contract is indicated on a case-by-case basis in advance on the Online Shop website.

Upon registration or at a later date, the Customer may consent to receiving the newsletter at the email address provided. By giving the above-mentioned consent, the Customer consents to the processing of their personal data by the Controller for the purposes of direct marketing of its products and to the sending of electronic marketing information to the Customer’s email address, in accordance with the Polish Provision of Electronic Services Act (18 July 2002). The consent given is voluntary and may be withdrawn at any time by the Customer, by selecting the “Unsubscribe” option found in the Online Shop in the section intended for the activation of the newsletter service or by informing the Controller at the following email address: dane.osobowe@carmager.com.

The Controller may process personal data in the Online Shop for the following purposes and on the following basis:

1. the performance of the Sales Contract or the contract for the provision of an Electronic Service, or in order to take steps at the request of the data subject, prior to entering into any of the above-mentioned contracts. The basis for the processing is Article 6(1)(b) GDPR (performance of a contract), i.e., the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;
2. direct marketing of the Controller’s products or services. The basis for the processing is Article 6(1)(a) GDPR, i.e., the data subject has given consent to the processing of their personal data for one or more specific purposes, and Article 6(1)(f) GDPR (the Controller’s legitimate interest), i.e., the processing is necessary for the purpose of the legitimate interest pursued by the Controller, which is to protect the interests and reputation of the Controller and of its Online Shop and to sell the Products;
3. marketing, analytical and statistical activities carried out by the Controller and/or its partners (including those listed in Section 11 hereinbelow) and other companies (the so-called third parties) with which the Controller cooperates. The basis for the processing is (Article 6(1)(f) GDPR (the Controller’s legitimate interest), i.e., the processing is necessary for the purpose of the legitimate interest pursued by the Controller, which is to protect the interests and reputation of the Controller and of its Online Shop, and to carry out statistical and analytical activities on the traffic in the Online Shop in order to improve the operation of the Online Shop and increase the sales of the Products;
4. provision of a review by the Customer about the Sales Contract made. The basis for the processing is Article 6(1)(a) GDPR, i.e., the data subject has given consent to the processing of their personal data for the purpose of providing a review, and the consent has been given knowingly by adding the review;
5. keeping tax records. The basis for the processing is Article 6(1)(c) GDPR in conjunction with Article 86(1) of the Tax Law (consolidated text of 17 January 2017) (Dz.U. (Journal of Laws) of 2017 item 201 as amended), i.e., the processing is necessary for the purpose of fulfilling a legal obligation incumbent on the Controller;
6. establishing, asserting or defending of claims that the Controller may make or that may be brought against the Controller. The basis for the processing is Article 6(1)(f) GDPR (the Controller’s legitimate interest), i.e., the processing is necessary for the purpose of the legitimate interest pursued by the Controller, which is to establish, assert or defend claims which the Controller is entitled to make or which may be brought against the Controller;
7. use of the Online Shop and ensuring its proper operation. The basis for the processing is Article 6(1)(f) GDPR (the Controller’s legitimate interest), i.e., the processing is necessary for the purpose of the legitimate interest pursued by the Controller, which is to operate and maintain the Online Shop.

For the proper operation of the Online Shop, including the performance of the Sales Contracts made, the Controller needs to use the services of external companies (e.g., a software provider, a courier company or a payment processor). The Controller only uses the services of such processors that provide sufficient guarantees for the implementation of appropriate technical and organisational measures, so that the processing complies with GDPR requirements and protects the rights of the data subjects.
The Controller does not transfer data in every case or to all the recipients or categories of recipients listed in the Privacy Policy. The Controller only transfers data when it is necessary for the fulfilment of a relevant purpose of personal data processing and only to the extent necessary for its fulfilment.
Data, including personal data of Recipients and Customers of the Online Shop, may be transferred to the following recipients or categories of recipients:

1. carriers/forwarders/courier brokers/warehousing and/or shipping companies: in the case of the Customer who choses the method of delivery of the Product from the Online Shop by post or courier, the Controller makes the collected personal data of the Customer available to the selected carrier, forwarder or broker who carries out the shipment on behalf of the Controller, and if the shipment is made from an external warehouse, to the warehousing and/or shipping company – to the extent necessary to complete the delivery of the Product to the Customer, including but not limited to:
   • DHL: DHL Parcel Polska Sp. z o.o., ul. Osmańska 2, 02-823 Warszawa, Poland
   • GLS: General Logistics Systems Poland Sp. z o.o., ul. Tęczowa 10, Głuchowo, 62-052 Komorniki, Poland
   • DPD: DPD Polska Sp. z o.o., ul. Mineralna 15, 02-274 Warszawa, Poland
2. companies processing electronic or credit card payments: in the case of the Customer who uses the electronic or credit card payment method in the Internet Shop, the Controller makes the collected personal data of the Customer available to the selected company processing the above-mentioned payments in the Online Shop on behalf of the Controller – to the extent necessary to process the payment made by the Customer, including but not limited to:
   • Paypal: PayPal (Europe) S.a r.l. & Cie, S.C.A., floor 5, 22– 24 Boulevard Royal, L-2449, Luxembourg
   • IdoPayments sp. z o.o., ul. al. Piastów 30, 71-064 Szczecin, Poland, KRS: 0000859711, NIP: 8522666251
   • Skrill: Paysafe Payment Solutions Limited, Grand Canal House, Grand Canal Street Upper, Dublin 4, Ireland , D04 Y7R5
3. purchase insurance companies: in the case of the Customer who uses purchase insurance in the Online Shop, the Controller makes the collected personal data of the Customer available to the above-mentioned purchase insurance company in the Online Shop on behalf of the Controller – to the extent necessary to process the Customer’s purchase insurance, including, but not limited to, entities such as:
   • Paypal: PayPal (Europe) S.a r.l. & Cie, S.C.A., floor 5, 22– 24 Boulevard Royal, L-2449, Luxembourg
4. providers of an opinion poll system: in the case of the Customer who has agreed to express their opinion about the Sales Contract made, the Controller makes the collected personal data of the Customer available to the selected company providing an opinion poll system for the Sales Contracts made in the Online Shop on behalf of the Controller – to the extent necessary for the Customer to express their opinion via the opinion poll system, including but not limited to:
   • Google Ireland Limited based in Ireland: Gordon House, Barrow Street, Dublin 4, Ireland
5. service providers who provide the Controller with technical, IT and organisational solutions that enable the Controller to carry out its business activity, including the Online Shop and the Electronic Services provided through it (in particular, providers of the computer software that enables to the Online Shop to operate, email and hosting providers, and providers of business management and technical support software for the Controller), including but not limited to:
   • IAI S.A., with its registered office in Szczecin, ul. Piastów 30, 71-064 Szczecin, Poland
   The Controller makes the collected personal data of the Customer available to the selected supplier acting on its behalf only if and to the extent necessary to achieve the given purpose of the data processing in accordance with this Privacy Policy.
6. providers of accounting, legal and advisory services who provide accounting, legal or advisory support to the Controller (in particular an accounting firm, a law firm or a debt collection agency): the Controller makes the Customer’s personal data available to the selected provider acting on behalf of the Controller only if and to the extent necessary to achieve the given purpose of the data processing in accordance with this Privacy Policy.
7. providers of social plug-ins, scripts and other similar tools that are placed in the Online Shop and that enable the browser of the person visiting the Online Shop to download content from the providers of the above-mentioned plug-ins (e.g., logging in using the login details of a social network) and to transfer the visitor’s personal data to these providers for this purpose.
8. providers of tools (including plug-ins) that enable the Shop to deliver advertisements based on the analysis of users’ browsing habits, which monitor online users’ activities in the Online Shop and send them to the providers of these tools in order to improve the effectiveness of advertising campaigns, including but not limited to:
   • Meta Platforms, Inc. based in the USA: 1 Hacker Way, Menlo Park, CA 94025, USA; or Meta Platforms Ireland Limited based in Ireland: Merrion Road, Dublin 4, D04 X2K5, Ireland
   • Google Ireland Limited based in Ireland: Gordon House, Barrow Street, Dublin 4, Ireland

The Controller does not use any automated decision-making systems; in particular, the data is not profiled within the meaning of Article 13(2)(f) GDPR.

The ie.carmager.com Online Shop does not automatically collect any data when the User visits the Shop’s website, except for the data contained in Cookies.

Cookies are small pieces of information in the form of text files that are sent by the Online Shop’s server and stored on the computer of the person visiting the Shop (e.g., on the hard drive of a computer, laptop or smartphone memory card, depending on the device used to visit our Online Shop). They contain certain information related to the use of the ie.carmager.com Online Shop by Customers. Temporary Cookies are deleted when the User closes the browser, while persistent Cookies are stored after the User leaves the website. Cookies make the use of the Online Shop faster and easier. Detailed information, the origin and history of Cookies can be found here: https://en.wikipedia.org/wiki/HTTP_cookie. The Controller uses Cookies primarily to provide the User with electronic services and to improve their quality. Accordingly, the Controller and other companies providing analytical and statistical services to the Controller use Cookies to store information or access information already stored in the User’s telecommunications terminal (computer, telephone, tablet, etc.). ie.carmager.com uses the following types of Cookies:

1. Session Cookies: these work only while the Customer is browsing the ie.carmager.com website, ensuring its correct operation, and are used by the Shop’s server to store information about the browsing activity, meaning that if the connection with the Customer’s server is lost, the Customer can return to the same place on the website.
2. Persistent Cookies: these remain on the Customer’s device after the visit to ie.carmager.com, which means that the website can remember the Customer’s settings during subsequent visits to the website, making navigation easier and storing the Customer’s preferences (e.g., remembering the products selected and placed in the basket, favourite product items, language version, products of interest to the Customer, etc.).
3. Third-Party Cookies: these are files that come from, e.g., advertising servers, servers of companies and service providers (e.g., search engines or maps embedded in the website) that enable the website displayed to be tailored to the preferences and habits of the Customer.

The Controller may process the data contained in Cookies for the following purposes when visitors use the Online Shop:

1. Identifying the Recipients as logged in to the Online Shop and displaying that they are logged in;
2. Storing the User’s location in order to customise the information provided to the User according to their location;
3. Analysing the audience on the basis of anonymous statistics to understand how they use the Online Shop, in order to improve the structure and functionality of the Shop;
4. Helping tailor the products offered by the Controller to the Users’ individual preferences and actual needs, including by speeding up the product search in the Shop and customising the communication and display of content;
5. Improving the Shop by making estimates about the Shop’s usage statistics;
6. Remembering the Products added to the basket for the purpose of placing an Order and keeping the User’s session in the Shop;
7. Storing data from completed Order Forms, surveys or logins to the Online Shop;
8. Customising the content of the Online Shop to the Recipient’s individual preferences (e.g., colours, font size, page layout) and optimising the use of the Shop pages;
9. Keeping anonymous statistics to see how the Online Shop is used;
10. If the Controller has obtained the User’s prior informed consent, the Controller may use Cookies, tags or other similar functionalities to obtain information that enables it to display ads, from the Shop, from third-party websites or otherwise, based on the analysis of the User’s browsing habits.

The Controller of the service uses Cookies for the above-listed purposes, among others, in cooperation with the following companies:

1. to present, on the website, the multimedia content downloaded from an external website:
   • www.youtube.com (Cookie controller: Google Inc. based in the USA: 1600 Amphitheatre Parkway Mountain View, CA 94043)
2. to collect general and anonymous statistical data through analytical tools:
   • Google Analytics (Cookie controller: Google Inc. based in the USA: 1600 Amphitheatre Parkway Mountain View, CA 94043)
   • IAI-Shop.com (Cookie controller: IAI S.A. based in Poland: Aleja Piastów 30 PL-71-064 Szczecin)
   • Microsoft Advertising (Cookie controller: Microsoft Ireland Operations Limited based in Ireland: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521)
3. to display advertising tailored to the User’s preferences using an online advertising tool:
   • Google AdSense (Cookie controller: Google Inc. based in the USA: 1600 Amphitheatre Parkway Mountain View, CA 94043)
   • Facebook.com (Cookie controller: Facebook Inc. based in the USA: 1 Hacker Way, Menlo Park, CA 94025; or Facebook Ireland based in Ireland: 4 Grand Canal Square, Grand Canal Dock, Dublin, D02 X525)
   • Microsoft Advertising (Cookie controller: Microsoft Ireland Operations Limited based in Ireland: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521)
4. to log in to the website using an account from another provider:
   • Facebook Connect (Cookie controller: Facebook Inc. based in the USA: 1 Hacker Way, Menlo Park, CA 94025; or Facebook Ireland based in Ireland: 4 Grand Canal Square, Grand Canal Dock, Dublin, D02 X525)
   • Google (Cookie controller: Google Inc. based in the USA: 1600 Amphitheatre Parkway Mountain View, CA 94043)
   • LinkedIn (Cookie controller: LinkedIn based in the USA: 1000 W Maude Sunnyvale, CA 94085)
5. to use interactive features to promote the website through social networking platforms:
   • twitter.com (Cookie controller: Twitter Inc. based in the USA: 1355 Market St #900, San Francisco, CA 94103) plus.google.com (Cookie controller: Google Inc. based in the USA: 1600 Amphitheatre Parkway Mountain View, CA 94043)
   • Facebook.com (Cookie controller: Facebook Inc. based in the USA: 1 Hacker Way, Menlo Park, CA 94025; or Facebook Ireland based in Ireland: 4 Grand Canal Square, Grand Canal Dock, Dublin, D02 X525)
   • Pinterest (Cookie controller, Pinterest Inc. based in the USA: 651 Brannan Street, San Francisco, CA 94103)
6. to present reviews on the website, downloaded from an external website, and to publish reviews of a purchased product and/or of the Online Shop and post them on the websites of the companies listed below, with the prior consent of the Customer (given by ticking the relevant checkbox during the ordering process):
   • Google (Cookies controller: Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043 USA)
   whereby such consent may be revoked by the Customer at any time by sending an email message to the following address: dane.osobowe@carmager.com.

Most browsers available in the market accept Cookies by default. The User can control the use of Cookies by setting their browser preferences. This means, e.g., that the User can partially (e.g., temporarily) limit or completely disable the storage of Cookies. In the latter case, however, this may affect some of the functionalities of the Online Shop (e.g., it might not be possible to follow the Order path through the Order Form because the products in the basket are not be stored during successive steps of the ordering process).

The User’s consent to the use of Cookies by our Online Shop is subject to their browser settings regarding Cookies; by law, such consent can also be given through the User’s browser settings. If the User does not wish to give such consent, they must change their browser’s Cookie settings accordingly.

In any case, the User can block the installation of Cookies or delete persistent Cookies by using the relevant options of their Internet browser. If the User encounters problems, we recommend that they consult the help section of their browser or contact the manufacturer of their browser.

Detailed information on how to change Cookie settings and how to delete Cookies in the most popular browsers is available in the help section of the User’s browser and on the following websites (click the relevant link):

• in Chrome
• in Firefox
• in Internet Explorer
• in Opera
• in Safari
• in Microsoft Edge

The Controller also processes anonymised data relating to the use of the Online Shop (IP address, domain) in order to generate statistics helpful in the management of the Online Shop. The data is aggregated and anonymous, i.e., it does not contain any identifying characteristics of the visitors to the Online Shop. The data is not disclosed to third parties.

The Customer has the right to request from the Controller access to their personal data, the right to request the restriction of processing, the right to request the amendment or rectification of data if it is inaccurate or incomplete, the right to portability, restriction of processing or erasure of data, and the right to object to processing.

The Customer may amend or rectify the data themselves if it is incorrect or incomplete, by using the relevant function in the Customer’s account.

If the Customer has given consent to the processing of data, such consent may be withdrawn at any time without affecting the lawfulness of processing, based on consent before its withdrawal.

In order to exercise the rights referred to hereinabove, the Customer should contact the Controller in writing by sending a relevant request to the address: Barwna 53, 87-100 Toruń, or via email to the email address: dane.osobowe@carmager.com.

In the event of a breach of the rules that govern the processing of personal data, the Customer has the right to lodge a complaint with the supervisory authority, which is the President of the Polish Personal Data Protection Office.

Data are stored for the duration of the legitimate interest pursued by the Controller, but no longer than:

• for the statute of limitations period applicable to the Controller's claims against the data subject in connection with the Controller’s business activity,
• for the limitation period applicable to claims that may be brought against the Controller,
• for the period resulting from the legal provisions requiring the Controller to keep tax records (until the expiry of the tax limitation period, unless otherwise provided for by tax provisions).

The Customer’s personal data obtained on the basis of the consent to the processing will be processed until the consent is withdrawn. The Controller must not process the data for direct marketing purposes if the data subject effectively objects to such processing.

The User agrees that the Controller may publish, in the Online Shop, the content of the questions send by the Customer to the Online Shop using the inquiry forms available in the Online Shop. Questions published in this way will not be accompanied by any information about the User asking them, in particular their email address.

The Online Shop, including its name, as well as any of its components: images, pictures, audio files, video files, presentations, graphic elements, information, software and database rights and any other materials presented on or downloadable from the Shop (hereinafter also referred to as: “Content”) are protected by law and belong to their respective owners, to the Seller or to the companies with which the Seller has entered into relevant contracts. The Seller’s Content is protected by copyrights, trademarks, commercial contracts and other rights. The User has the right to use the Content, including the Seller’s Content, in accordance with the law, solely within the limits of the User’s own permitted personal use and solely for the purpose of the proper use of the Online Shop. Any use of the Seller’s Content other than as set out above is permitted only subject to the Seller’s prior written consent (otherwise null and void). The User must not modify the Seller’s Content in any way or reproduce, print, publicly display, distribute or otherwise use the Content for any public or commercial purposes. Unauthorised use of the Content, including in particular the Seller’s Content, may violate laws relating to intellectual property rights (including the provisions of the Polish Copyright and Related Rights Act (4 February 1994)), trademarks, privacy and advertising or other applicable laws or provisions. The User must not remove any copyright or trademark notices from the Online Shop or from any of the Seller’s Content. All rights in the Content not expressly granted in this Privacy Policy or in the separate written consent referred to hereinabove are reserved by and to their respective owners and, as such, are protected by law.

The Online Shop may contain links to other websites. This Privacy Policy applies only to the ie.carmager.com Online Shop.

Any questions regarding this Privacy Policy should be sent to the following address: dane.osobowe@carmager.com

The Online Shop reserves the right to modify and update this Policy at any time in order to ensure that the Policy always complies with current legal requirements and refers to the current range of products and services. The relevant changes will be published in the form of a consolidated amended text of the Privacy Policy on the Shop’s website: ie.carmager.com. Furthermore, each purchase at ie.carmager.com Online Shop requires that the Customer read and accept the current version of the Policy.