Privacy and Cookies Policy

1. Data Controller

The controller of personal data is EKRAM Karolina Bańcerowska,
ul. Małopolska 4 A, 26-600 Radom, Poland,
VAT ID: 9482322071,
e-mail: ekram@ekram.pl,
tel.: +48 608 460 935.

2. Scope of the Policy

This Privacy Policy defines the rules for processing personal data of users of the online store esklepmedyczny.com.pl, in particular Customers, persons contacting the Seller, and newsletter subscribers.

3. Purposes and Legal Basis for Data Processing

Personal data is processed for the following purposes:

• conclusion and performance of a sales contract and order processing – Art. 6(1)(b) GDPR,
• fulfilment of legal obligations incumbent on the Controller (e.g. tax, accounting) – Art. 6(1)(c) GDPR,
• handling inquiries addressed to the Controller – Art. 6(1)(f) GDPR (legitimate interest of the Controller),
• marketing of own products or services to existing Customers – Art. 6(1)(f) GDPR,
• newsletter and electronic marketing communication – Art. 6(1)(a) GDPR (consent).

4. Types of Processed Data

The Controller processes personal data voluntarily provided by users, in particular:

• first and last name,
• email address,
• phone number,
• correspondence and delivery address,
• invoice data (company name, VAT ID, address),
• data contained in correspondence addressed to the Controller.

5. Obligation or Voluntary Provision of Data

Providing personal data is:

• necessary to conclude a sales contract – to the extent required for order processing,
• voluntary – in the case of newsletter, contact form, and marketing activities.

Failure to provide data necessary for order processing will prevent the execution of the order.

6. Source of Data

Personal data comes directly from the data subjects and, to the extent necessary for contract performance, from payment operators and courier companies.

7. Data Recipients

Personal data may be transferred to entities cooperating with the Controller, only to the extent necessary to achieve processing purposes, in particular:

• IT and hosting service providers,
• payment operators,
• accounting offices and bookkeeping services,
• courier and postal companies,
• public authorities – in cases provided for by law.

8. Data Transfers Outside the EU/EEA

Personal data may be transferred outside the European Economic Area only in connection with the use of tools such as Google or Meta (Facebook), with appropriate legal safeguards, in particular standard contractual clauses.

9. Data Retention Period

Personal data is stored:

• for the duration of the contract and after its completion – until the limitation period for claims expires,
• in accordance with legal obligations (e.g. tax regulations),
• in the case of data processed based on consent – until the consent is withdrawn.

10. Rights of Data Subjects

Each person has the right to:

• access their data,
• rectify data,
• erase data (right to be forgotten),
• restrict processing,
• data portability,
• object to data processing,
• withdraw consent at any time.

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office.

11. Profiling

The Controller does not use automated decision-making or profiling within the meaning of the GDPR.

12. Cookies and Similar Technologies

The store uses cookies:

• necessary – required for proper functioning of the store,
• analytical – used to analyze traffic statistics (e.g. Google Analytics),
• marketing – used for marketing purposes (e.g. Meta/Facebook – if enabled).

Analytical and marketing cookies are used only after obtaining the user's consent via a cookie banner. Consent can be withdrawn or modified at any time.

13. Google Customer Reviews

After making a purchase in the online store esklepmedyczny.com.pl, the Customer may be asked to consent to participate in the Google Customer Reviews survey program.

If consent is given, data such as the email address and information about the order may be transferred to Google LLC in order to send a one-time survey regarding the shopping experience.

Participation in the survey is entirely voluntary, and the legal basis for data processing is the user’s consent – Article 6(1)(a) GDPR.

Detailed information about how Google processes personal data can be found in Google’s Privacy Policy: https://policies.google.com/privacy.

14. Final Provisions

This Privacy Policy is effective from the date of its publication on the store's website. The Controller reserves the right to update it in the event of changes in legal regulations or data processing methods.

This Privacy Policy constitutes an integral part of the Terms and Conditions of the store esklepmedyczny.com.pl.