LIONELO WEBSITE PRIVACY POLICY

The controller of your personal data submitted via the Lionelo website (hereinafter also referred to as the Website) is BrandLine Group sp. z o.o. with its registered office in Poznań, ul. Adama Kręglewskiego 1, 61-248 Poznań, entered in the register of entrepreneurs of the National Court Register maintained by the District Court Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0000552768, NIP (Tax Identification Number): 7822579840, REGON: 361233546, BDO: 000008493, with a share capital of PLN 24,800.00 (hereinafter also referred to as BrandLine or the Controller).

The purpose of this Privacy Policy is to define the measures taken by BrandLine Group sp. z o.o. to protect personal data, as well as the scope and legal grounds for processing such data when the Website is used. All activities undertaken by BrandLine are governed by the laws applicable to personal data protection, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the GDPR), as well as the Act of 10 May 2018 on Personal Data Protection.

For all matters related to personal data protection, you may contact the Controller:

1. by post at: ul. Adama Kręglewskiego 1, 61-248 Poznań,
2. by e-mail at daneosobowe@brandlinegroup.com
3. by telephone: +48 612 222 980.

1. PERSONAL DATA CONTROLLER

   To ensure the security of Personal Data and respect your rights, Personal Data at BrandLine is:

   • processed lawfully, fairly and transparently,
   • collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes,
   • adequate, relevant and limited to what is necessary for the purposes for which it is processed, in accordance with the data minimisation principle,
   • accurate and, where necessary, kept up to date,
   • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed,
   • processed in a manner that ensures appropriate security of personal data: the Controller protects it against unauthorised or unlawful processing and against accidental loss, destruction or damage using appropriate technical and organisational measures. The Controller provides a secure, encrypted connection when personal data is transmitted through the Website. The Website pages are protected by an SSL certificate.

   The Controller takes all necessary measures to ensure that its subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process Personal Data on the Controller’s behalf.

2. DATA PROCESSING IN CONNECTION WITH USING THE WEBSITE

   In connection with the use of the Website, the Controller processes the personal data (hereinafter also referred to as Personal Data) of:

   • Users (all persons visiting and using the Website);
   • Customers (persons making purchases through the Website, both registered users and persons without an account on the Website);
   • Persons contacting the Controller through tools made available on the Website, i.e.:
     1. via instant messaging services such as Messenger and WhatsApp,
     2. via contact forms,
     3. by telephone,
     4. via the live chat function,
   • Newsletter recipients.
3. PURPOSES, LEGAL BASIS AND RETENTION PERIODS
   1. Personal Data of Users may be collected through cookies and other similar technologies and processed to ensure the proper operation of the Website, analyse traffic and how the Website is used, tailor content to User preferences, and conduct measurement and marketing activities, including displaying personalised advertisements, based on the consent given when configuring cookies (Article 6(1)(a) of the GDPR). The data is processed until consent is withdrawn or the relevant cookie expires, whichever occurs first. The use of cookies necessary for the proper operation of the Website does not require the User’s consent.
   2. Personal Data of persons contacting the Controller through tools available on the Website will be processed for the same purposes as User data and, additionally:
      1. to respond to their questions and handle their requests, pursuant to Article 6(1)(f) of the GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the Controller, consisting in responding to enquiries, ensuring efficient communication, sending marketing content where this is relevant to the enquiry, and establishing, pursuing or defending against potential claims.

         The data will be processed for the time required to respond to the enquiries, extended by the limitation period for any potential claims.

      2. in connection with the monitoring of telephone calls, in order to ensure high-quality customer service and safeguard the legal interests of the persons making contact, pursuant to Article 6(1)(a) of the GDPR, i.e. consent expressed by continuing the call.

         Personal Data will be processed for 3 months from the date on which it is obtained. If you decide to enter into an agreement with us, the data will be processed for the period appropriate to the performance of that agreement, in accordance with the provisions set out in Section 3.3 of the Website Privacy Policy concerning Website Customers. Providing data marked as mandatory is required in order for an enquiry to be accepted and handled; failure to provide it will make this impossible. Providing any remaining data is voluntary.

   3. Personal Data of Customers is processed for the same purposes as the Personal Data of Users and persons contacting the Controller through tools available on the Website (if the Customer uses such tools), and additionally:
      1. to handle concluded sales agreements, i.e. to process orders operationally, issue sales documents, dispatch or deliver ordered goods, handle returns and complaints, and fulfil obligations arising from warranties and statutory liability for defects.
         1. pursuant to Article 6(1)(b) of the GDPR, where processing is necessary for the performance of a sales agreement in accordance with the Store Terms and Conditions;
         2. pursuant to Article 6(1)(c) of the GDPR, where processing is necessary for compliance with a legal obligation to which the Controller is subject, in connection with the provisions of the Act of 30 May 2014 on Consumer Rights, the Act of 18 July 2002 on Providing Services by Electronic Means, the Accounting Act of 29 September 1994 and other accounting and tax legislation;

         Personal Data will be processed for the period necessary to perform the sales agreement, extended by the warranty period and the limitation period for any potential claims, or, where required by law, for the period prescribed by applicable legislation. Providing data marked as mandatory is required in order for an order to be accepted and processed; failure to provide it will prevent the order from being fulfilled. Providing any remaining data is optional.

      2. to enable participation in and the exercise of rights arising from the Customer’s participation in the additional Lionelo Protect Programme, including the use of the services specified therein, i.e. an extended product warranty, ordering a replacement product, or having an accident-damaged product repaired or replaced with a new one – pursuant to Article 6(1)(b) of the GDPR, where processing is necessary to provide the service selected by the Customer under the Lionelo Protect Programme on the basis of the accepted Lionelo Protect Programme Terms and Conditions.

         Personal Data will be processed for the duration of the service covered by the Lionelo Protect Programme, extended by the limitation period for any potential claims, or, where required by law, for the period prescribed by applicable legislation. Providing data marked as mandatory is required in order to use the services covered by the Lionelo Protect Programme; failure to provide it will make use of the service impossible. Providing any remaining data is optional.

      3. to register the Customer’s account and ensure the operation of their profile – to provide a service by electronic means (including the ability to view orders, check order status, use additional functions offered by the Controller and resolve technical problems) – pursuant to Article 6(1)(b) of the GDPR, where processing is necessary for the performance of an agreement to which the data subject is party, in accordance with the Store Terms and Conditions.

         Personal Data will be processed for the period during which the service is provided, i.e. while the person remains a registered Customer of the online store, and, after the account is deleted, for the period necessary to comply with the law and to establish, pursue or defend against potential claims.

      4. to survey Customer satisfaction by sending the Customer a request to review a product, based on the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, until an objection to the processing is raised.
      5. to conduct research and analyses aimed at improving the operation of available services, including evaluating the Website, based on the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, until an objection to the processing is raised.
      6. to send reminders about an abandoned cart and incomplete purchases, based on the Controller’s legitimate interest pursuant to Article 6(1)(f) of the GDPR, until an objection to the processing is raised.
      7. to handle correspondence received by and sent from the Controller, pursuant to Article 6(1)(f) of the GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the Controller, consisting in the proper and efficient conduct of its business and responding to enquiries sent to the Controller by post. The data is retained until it is no longer useful, depending on the content of the correspondence, generally in accordance with the applicable limitation periods for claims.
      8. to provide the Customer with commercial information concerning services provided by the Controller (marketing of the Controller’s own services), pursuant to Article 6(1)(f) of the GDPR, where processing is necessary for the purposes of the legitimate interests pursued by the Controller, consisting in marketing its own services, until an objection to the processing is raised.
      9. to collect waste electrical or electronic equipment (if the Customer chooses to return such waste equipment) in accordance with the information on waste equipment published on the Website, pursuant to Article 6(1)(c) of the GDPR, where processing is necessary for compliance with a legal obligation to which the Controller is subject, in connection with the provisions of the Act of 11 September 2015 on Waste Electrical and Electronic Equipment. The data will be processed only for the time required to provide the service, i.e. to collect the waste equipment.
      10. to take steps to receive, confirm and examine a report concerning illegal content and/or content incompatible with the Website’s services, and to communicate the decision made in connection with that report, pursuant to Article 6(1)(c) of the GDPR, where processing is necessary for compliance with a legal obligation to which the Controller is subject, in connection with the provisions of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act). Your data will also be processed after the report has been examined. The legal basis for this processing is the Controller’s legitimate interest in archiving the report to document how it was handled in the future and to defend against potential claims (Article 6(1)(f) of the GDPR). The data will be processed for the period necessary to examine the report and subsequently for the limitation period applicable to claims arising from the report.
   4. The Controller provides an electronic newsletter delivery service to persons who have provided their e-mail address for this purpose.
      1. Personal Data of newsletter recipients is processed for the same purposes for which the Controller processes User Personal Data and, additionally, for the purpose of providing the electronic newsletter delivery service, based on consent given when subscribing (Article 6(1)(a) of the GDPR). This consent is voluntary and may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal. Consent may be withdrawn using the unsubscribe link in the footer of each newsletter message or by sending an e-mail to the Controller.

         The data will be processed until consent is withdrawn or the newsletter service is discontinued, whichever occurs first.

   5. The Controller may organise competitions, loyalty programmes and other promotional or marketing campaigns through the Website, the detailed rules of which are set out each time in the terms and conditions of the relevant campaign. If a User participates in a competition or another campaign, the Controller processes their Personal Data to the extent necessary to conduct the campaign, in particular to receive and verify an entry, enable participation, contact the participant, determine the results, notify the participant of a win, and issue or deliver a prize. The legal basis for this processing is Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of an agreement concluded with the participant under the rules set out in the terms and conditions of the campaign, or in order to take steps at the participant’s request before entering into such an agreement.
   6. The data of all the above-mentioned persons is also processed in order to secure potential claims until the expiry of the applicable statutory limitation period.
4. DATA RECIPIENTS
   1. Personal Data may be disclosed to entities whose services the Controller uses in connection with operating the Website, providing services by electronic means and selling goods, including in particular:
      • IT service providers and IT system suppliers,
      • postal operators.
      • carriers.
      • logistics companies,
      • payment processing companies,
      • warehousing service providers,
      • marketing service providers,
      • goods distribution service providers,
      • server colocation service providers,
      • law firms,
      • consulting and auditing service providers,
      • companies providing servicing and repair services (in connection with complaints),
      • authorised entities upon a documented request
   2. The Website may use tools and plug-ins provided by third parties, in particular Meta Platforms Ireland Limited (Facebook, Instagram, WhatsApp), Google Ireland Limited (YouTube) and LinkedIn Ireland Unlimited Company (LinkedIn). The use of these functions may result in certain information being transferred to the providers of these services, in particular the IP address, online identifiers, device information and data concerning the User’s activity on the Website. Detailed rules governing data processing by individual providers are available in their current privacy policies published on their respective websites.
5. YOUR RIGHTS

   Providing Personal Data is always voluntary. However, failure to provide data marked as necessary will make it impossible to use the services provided through the Website. To the extent provided for by the GDPR and subject to the limitations set out therein, every person whose Personal Data is processed by the Controller has the following rights:

   1. Right of access – the right to ask BrandLine whether we process your data as the Controller and, if so, what data we process. Pursuant to Article 15 of the GDPR, a registered Customer of the Website has unrestricted access at any time to all of their Personal Data provided to the Controller, their order history, complaint history, list of favourite products and reviews.
   2. Right to rectification – the right to request that BrandLine correct inaccurate data or complete incomplete data. A registered Customer of the Website may correct their Personal Data independently at any time in their Profile within the Customer account.
   3. Right to erasure – the right to request the erasure of data processed by the Controller.
   4. Right to restriction of processing – the right to request that BrandLine restrict the processing of data.
   5. Right to data portability – the right, subject to the applicable conditions, to request that your data be transmitted directly to another controller indicated by you,
   6. Right to object – the right to object to the processing of Personal Data by the Controller,
   7. Right to object to automated decision-making, including profiling – the right to object to Personal Data being used in automated decision-making processes, including profiling.
   8. Right to withdraw consent – the right to withdraw previously given consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
   9. Right to lodge a complaint with a supervisory authority – if you consider that the processing infringes the law, you may lodge a complaint with the President of the Personal Data Protection Office, www.uodo.gov.pl.
6. DATA TRANSFERS OUTSIDE THE EEA

   As Personal Data is processed using Google Analytics, Google Tag Manager, Microsoft Clarity, Klaviyo, Meta and Shopify Plus tools, it may be transferred outside the European Economic Area. Google LLC (Google Analytics and Google Tag Manager), Microsoft Corporation (Microsoft Clarity), Klaviyo Inc. (Klaviyo), Meta Platforms, Inc. (Meta) and Shopify Inc. (Shopify Plus) carry out transfers outside the EEA using, pursuant to Article 45 of the GDPR, the transfer mechanism based on an adequacy decision for entities included on the EU-US Data Privacy Framework list, i.e. the data protection framework between the European Union and the United States implemented by the European Commission decision of 10 July 2023 and administered by the U.S. Department of Commerce (EU-U.S. DPF).

7. AUTOMATED DECISION-MAKING, INCLUDING PROFILING
   1. The Controller uses systems for automated decision-making, including profiling; however, this will not produce any legal effects concerning Users or similarly significantly affect them.
   2. The Controller’s profiling of Personal Data consists in processing data, including by automated means, and using it to evaluate certain information, in particular to analyse or predict the personal preferences of our Users.
   3. Information obtained as a result of automated decision-making, including profiling, will be used solely to tailor our marketing activities to Users’ needs and preferences.
8. COOKIES AND SIMILAR TECHNOLOGIES

   The Controller uses cookies or similar technologies (hereinafter also referred to as “Cookies”).

   What are Cookies?

   The Website uses cookies and similar technologies, such as browser local storage, tracking pixels, device identifiers and web beacons. These are pieces of information stored on or read from the User’s device while the Website is being used.

   These technologies may store, among other things, a session or device identifier, information about Website settings, pages visited, products viewed, the source of the visit, browser and device type, approximate location, and how the Website is used. To the extent that this information makes it possible to identify a User directly or indirectly, it constitutes Personal Data.

   There are three main types of Cookies:

   • session Cookies: temporary files specific to a particular visit and limited to sending a session identifier (a random string of digits generated by the server), so that the User does not have to enter the same information again after moving to another page of the Website or after leaving it completely. Session Cookies are not permanently stored on the User’s device and are deleted when the browser is closed;
   • persistent Cookies: files that store information about the User’s preferences and are retained in the cache of the browser or mobile device. Ending a browser session or turning off the device does not delete them from the device;
   • third-party Cookies: placed by BrandLine’s trusted partners and used to collect data from multiple websites or sessions.

   What types of Cookies do we use?

   The Website uses the following Cookies:

   1. Strictly necessary (system): Necessary technologies ensure security, maintain sessions, operate the shopping cart, support forms, save consent settings, and ensure that the Website is displayed and functions correctly. Without some of these technologies, it would not be possible to provide a service explicitly requested by the User.

      Necessary technologies are used without the User’s separate consent solely to the extent that the conditions laid down in Article 399(3) of the Electronic Communications Law are met. If the information associated with them constitutes Personal Data, the legal basis for its further processing is, depending on its function, the necessity to perform an agreement or take steps at the User’s request, or the Controller’s legitimate interest in ensuring the security and proper operation of the Website.

   2. Performance (analytics and statistics): Statistical and analytical technologies make it possible to measure the number of visits, analyse traffic sources, how Users navigate the Website and use its functions, and the effectiveness of changes made. Analytical data should not be treated as anonymous solely because it does not contain the User’s first and last name. It may include online identifiers, device identifiers and activity information and may therefore constitute Personal Data. Statistical and analytical technologies are optional and are activated only after consent has been given.
   3. Functional (preferences): Preference technologies make it possible to remember User choices such as language, region, interface settings or other settings affecting how the Website operates and appears. They are optional and are activated only after consent has been given.
   4. Marketing and advertising (targeting): Marketing technologies are used to measure advertising effectiveness, create audience groups, limit the number of times an advertisement is displayed, tailor advertising content, and conduct marketing activities both on and outside the Website. Marketing technologies are optional and are activated only after consent has been given.
   5. Unclassified technologies: Technologies whose purpose, provider or operating principles have not yet been determined are not activated until they have been classified and their purpose, retention period, provider, legal basis and any transfers of data outside the European Economic Area have been determined.

   Cookie retention period

   The cookie retention period depends on the type of cookie. Detailed information on how long the Controller retains cookies can be checked when visiting the Website. During the first visit, this information is displayed in a pop-up window. On subsequent visits, it can be accessed by clicking the Cookie Settings banner. Data retained by tool providers may be stored for a period different from the lifetime of a cookie. These periods result from the configuration of the respective services and should be specified in the information provided by the relevant provider.

   Managing Cookies and consenting to their use

   During the first visit, the User may:

   • reject all optional technologies,
   • accept all optional technologies,
   • make a separate choice for each category.

   Taking no action, continuing to browse the Website or closing the banner does not constitute consent.

   The User may change or withdraw consent at any time using the “Cookie Settings” link available in the Website footer. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

   Restricting the use of necessary technologies may cause certain Website functions, in particular the shopping cart, login, forms or purchasing process, not to work correctly. Refusal to consent to optional technologies must not prevent the use of the Website’s basic functions.

   Detailed information on changing cookie settings and deleting cookies independently in the most popular web browsers is also available in the web browser’s help section.