PRIVACY POLICY

1. The Controller processes personal data of Customers of the www.bellywelly.eu Store, in the case of: 1.1. registering an Account in the Store for the purpose of creating an individual account and managing this Account pursuant to Art 6 Sec 1 Letter b GDPR performance of an electronic service agreement under the Store Terms and Conditions. 1.2. placing an Order in the Store for the performance of the Sales Agreement pursuant to Art 6 Sec 1 Letter b GDPR - performance of a sales agreement. 1.3. using the Feedback System to enable the Customer to express their opinion about the Product purchased in the Store and the Sales Agreement concluded with the Seller pursuant to Art 6 Sec 1 Letter f GDPR - legitimate business interest.

2. The Customer provides in the case of: 2.1. Account: email address, first and last name, residential address, Tax ID, phone number. 2.2. Order: email address, first and last name, residential address, Tax ID, phone number. 2.3. Feedback System first and last name email address.

3. Personal data of Customers are stored by the Controller. 3.1. When the basis for data processing is contract performance as long as necessary to perform the contract and after that for the period corresponding to the limitation period for claims. Unless a special provision states otherwise the limitation period is 6 years and for claims for periodic benefits and claims related to business activity 3 years. 3.2. When the basis for data processing is consent as long as the consent is not withdrawn and after withdrawal for the period corresponding to the limitation period for claims that may be made by or against the Controller.

4. When using the Store additional information may be collected in particular IP address assigned to the Customer’s computer or external IP address of the Internet provider, domain name, browser type, access time operating system type.

5. Upon separate consent under Art 6 Sec 1 Letter a GDPR data may also be processed to send commercial information electronically or to make telephone calls for direct marketing in accordance with Art 10 Sec 2 of the Act of 18 July 2002 on the provision of electronic services or Art 172 Sec 1 of the Act of 16 July 2004 Telecommunications Law including those directed as a result of profiling if the Customer has given appropriate consent.

6. Navigation data may also be collected from Customers including information about links and references they decide to click or other actions taken in the Store The legal basis for this is the legitimate interest of the Controller Art 6 Sec 1 Letter f GDPR aimed at facilitating the use of electronic services and improving their functionality.

7. Providing personal data by the Customer is voluntary.

8. The Controller takes special care to protect the interests of data subjects and in particular ensures that data collected are: 8.1. processed lawfully, 8.2. collected for specified lawful purposes and not further processed in a way incompatible with those purposes, 8.3. factually correct and adequate for the purposes for which they are processed and stored in a form allowing identification of data subjects no longer than necessary to achieve the purpose of processing.

1. Personal data of Customers are transferred to service providers used by the Controller in running the Store in particular to: 1.1. entities performing delivery of Products, 1.2. payment system providers, 1.3. survey and feedback system providers, 1.4. accounting office, 1.5. hosting provider, 1.6. software provider enabling business operations, 1.7. entities providing mailing system, 1.8. software provider necessary to run the online store.

2. Service providers referred to in point 1 of this paragraph to whom personal data is transferred depending on contractual arrangements and circumstances either follow the Controller’s instructions regarding the purposes and methods of processing those data (processors) or independently determine the purposes and methods of processing (controllers).

3. Personal data of Customers are stored exclusively within the European Economic Area EEA subject to §5 point 5 and §6 of the Privacy Policy.

1. The data subject has the right to access the content of their personal data and the right to rectify, erase, restrict processing, the right to data portability, the right to object, as well as the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. 2. Legal bases for the Customer’s requests are: 2.1. access to data – Art 15 GDPR, 2.2. rectification of data – Art 16 GDPR, 2.3. erasure of data (the so-called right to be forgotten) – Art 17 GDPR, 2.4. restriction of processing – Art 18 GDPR, 2.5. data portability – Art 20 GDPR, 2.6. objection – Art 21 GDPR, 2.7. withdrawal of consent – Art 7 Sec 3 GDPR. 3. To exercise the rights referred to in point 2 a relevant email may be sent to office@bellywelly.eu. 4. In case of a request from the Customer based on the above rights the Controller shall comply with the request or refuse it without undue delay and no later than within one month of receipt However if due to the complexity or number of requests the Controller is unable to comply within one month it shall comply within the next two months informing the Customer beforehand within the one-month period about the intended extension and its reasons. 5. If it is found that the processing of personal data violates the GDPR the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office.

1. The Controller’s website uses cookies. 2. Installing cookies is necessary for proper service delivery on the Store’s website Cookies contain information essential for the proper functioning of the site and also allow the development of general statistics regarding website visits. 2.1. The Customer may consent to the installation of cookies other than technical ones by using the consent management tool that appears upon the first visit to the website (the so-called cookie banner) Lack of consent prevents the installation of marketing and analytical cookies. 3. Two types of cookies are used on the website session cookies and persistent cookies. 3.1. Session cookies are temporary files stored on the Customer’s end device until logout (leaving the website). 3.2. Persistent cookies are stored on the Customer’s end device for the time specified in the cookie parameters or until deleted by the Customer. 4. The Controller uses own cookies to better understand how Customers interact with the website content These cookies collect information about how the Customer uses the website the type of site from which the Customer was redirected as well as the number of visits and duration of the Customer’s visit These data do not record specific personal data of the Customer but are used to develop site usage statistics. 5. The Controller also uses external cookies to collect general and anonymous statistical data through Google Analytics analytical tools (external cookie controller Google LLC based in the USA). 6. Cookies may also be used by advertising networks (in particular Google’s network) to display ads tailored to how the Customer uses the Store For this purpose they may record information about the Customer’s navigation path or time spent on a given page. 7. The Customer has the right to decide on cookie access to their computer by: 7.1. choosing the types of cookies they consent to collect immediately after entering the Store website and the cookie notification appears, 7.2. changing settings in their browser window Detailed information about cookie management and handling is also available in the software (web browser) settings.

1. The Store uses so-called social plugins (“plugins”) from social media services. When displaying the website www.bellywelly.eu containing such a plugin, the User’s browser will establish a direct connection to the servers of Facebook, Instagram, Google, Youtube, and Pinterest. Some of these service providers, especially Google and Meta (Facebook, Instagram), have their servers outside the European Economic Area (including in the USA), which involves transferring data to third countries. This transfer takes place based on standard contractual clauses.

2. The content of the plugin is transmitted by the given service provider directly to the User’s browser and integrated with the website. Thanks to this integration, the service providers receive information that the User’s browser has displayed the www.bellywelly.eu website, even if the User does not have a profile with the given service provider or is not currently logged in there. Such information (together with the User’s IP address) is sent directly by the browser to the server of the given service provider (some servers are located in the USA) and stored there.

3. If the User logs into one of the above social media services, the service provider will be able to directly assign the visit to the www.bellywelly.eu website to the User’s profile on that social media service.

4. If the User uses a given plugin, e.g., by clicking the “Like” button or the “Share” button, the appropriate information will also be sent directly to the server of the given service provider and stored there.

5. The purpose and scope of data collection, as well as its further processing and use by service providers, as well as the possibility of contact and the User’s rights in this regard and the possibility of making settings to ensure the User’s privacy protection, are described in the privacy policies of the service providers. 5.1. https://www.facebook.com/policy.php 5.2. https://help.instagram.com/519522125107875?helpref=page_content 5.3. https://policy.pinterest.com/pl/privacy-policy 5.4. https://policies.google.com/privacy?hl=pl

6. If the User does not want social media services to assign data collected during visits to the www.bellywelly.eu website directly to their profile on a given service, they must log out of that service before visiting www.bellywelly.eu. The User can also completely block the loading of plugins on the site by using appropriate browser extensions, e.g., blocking scripts with “NoScript”.

7. The Administrator uses remarketing tools on their website such as Google Ads. Their use involves using cookies from Google LLC related to the Google Ads service. As part of the cookie management mechanism, the User can decide whether the Service Provider may use Google Ads (external cookie administrator: Google LLC, based in the USA) in relation to them.