I. General Provisions

1.1. Data Controller – The controller of personal data of users of the LAB HOME online store, available at https://labhome.pl, is: ZBADAJSIE SP. Z O.O., ul. Cypriana Kamila Norwida 1/2, 48-300 Nysa, KRS: 0000577238, NIP: 7532438338, REGON: 362556560, BDO: 000028101, hereinafter referred to as the “Controller”;
1.2. Contact with the Controller – contact with the Controller is possible via:
a) email: info@labhome.pl;
b) phone: +48 730 332 383;
c) mailing address: ul. Cypriana Kamila Norwida 1/2, 48-300 Nysa;
1.3. Purpose of this document – this Privacy Policy sets out the principles for processing personal data of LAB HOME online store users and the rules for using Cookies and similar technologies;

II. Scope of Data Processing

2.1. The Controller may process the following data:
a) name and surname;
b) email address;
c) phone number;
d) delivery address;
e) billing address;
f) data contained in correspondence;
g) data relating to orders;
h) IP address;
i) device and browser data;
j) data collected by Cookies;
2.2. Providing data is voluntary; however, to the extent necessary to fulfill an order, providing such data is a condition for concluding and performing the contract;

III. Purposes and Legal Bases for Processing

3.1. 3.1. Order fulfillment – personal data is processed for the purpose of:
a) accepting orders;
b) performing the sales contract;
c) delivering products;
d) processing payments;
e) handling complaints and returns;
Legal basis: Article 6(1)(b) GDPR – performance of a contract;
3.2. Fulfillment of legal obligations – The Controller processes data for the purpose of: maintaining accounting records, tax settlements, fulfilling obligations arising from legal provisions. Legal basis: Article 6(1)(c) GDPR;
3.3. Contact handling – data provided via the contact form or email is processed to respond to user inquiries. Legal basis: Article 6(1)(f) GDPR – legitimate interest of the Controller;
3.4. Establishment or defense of claims – data may be processed to establish, pursue, or defend claims. Legal basis: Article 6(1)(f) GDPR;
3.5. Newsletter – if a user subscribes to the Newsletter, their email address will be used to send commercial and marketing information. Legal basis: Article 6(1)(a) GDPR – consent, Article 10 of the Act on the Provision of Electronic Services, Article 398 of the Electronic Communications Law. Consent may be withdrawn at any time;
3.6. Marketing and analytics – The Controller uses analytical and advertising tools to: analyze website traffic, measure advertising effectiveness, optimize store operations. Legal basis: Article 6(1)(a) GDPR – user consent expressed via the cookie banner;

IV. Data Recipients

4.1. Data may be transferred to entities cooperating with the Controller only to the extent necessary to achieve the purposes described in this Privacy Policy. In particular, data recipients may include:
a) Hosting provider: nazwa.pl Sp. z o.o., ul. Mieczysława Medweckiego 17, 31-870 Kraków;
b) Payment operator – Przelewy24;
c) Courier and logistics companies – DPD and InPost, entities fulfilling deliveries of orders within Poland;
d) IT service providers – entities ensuring the maintenance, development, and security of the online store;
e) Marketing and analytics service providers – entities providing services related to: Google Analytics 4, Google Ads, Newsletter distribution;

V. Data Transfer Outside the European Economic Area

5.1. In connection with the use of Google services, some data may be transferred outside the European Economic Area, particularly to the United States. Data transfer is carried out in accordance with GDPR provisions and with the application of appropriate legal safeguards, in particular the European Commission’s standard contractual clauses or other mechanisms provided for by law;

VI. Data Retention Period

6.1. Data will be retained for the period:
a) necessary to perform the contract and for the time required to process complaints and claims;
b) required by tax and accounting regulations (as a rule, 5 years from the end of the tax year);
c) until claims become time-barred;
d) until consent is withdrawn – in the case of the Newsletter;
e) until consent for analytical and marketing cookies is withdrawn;

VII. Rights of Data Subjects

7.1. 7.1. Every person whose data is processed has the right to:
a) access their data;
b) rectify their data;
c) erase their data;
d) restrict processing;
e) data portability;
f) object to processing;
g) withdraw consent at any time;
h) lodge a complaint with the President of the Personal Data Protection Office;
7.2. A complaint may be submitted to: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl;

VIII. Profiling

8.1. The Controller may use tools that enable analysis of user behavior and tailoring advertisements to their interests;
8.2. Profiling does not produce legal effects concerning the user nor does it significantly affect them;

IX. Cookies

9.1. 9.1. General information – The Store uses Cookies and similar technologies for the purpose of:
a) ensuring proper functioning of the website;
b) maintaining user sessions;
c) traffic analysis;
d) conducting marketing activities;
9.2. Types of Cookies used:
a) Necessary Cookies – Ensure proper functioning of the store and do not require user consent;
b) Analytical Cookies – Allow analysis of how the website is used. Tool used: Google Analytics 4;
c) Marketing Cookies – Used to measure advertising campaign effectiveness and display tailored ads. Tool used: Google Ads;
9.3. Cookie management – during the first visit, the user may:
a) accept all Cookies;
b) reject non-essential cookies;
c) customize their preferences;
9.4. Consent may be withdrawn at any time via the cookie settings available on the website or browser settings;

X. Data Security

10.1. 10.1. The Controller applies appropriate technical and organizational measures to protect personal data against:
a) loss;
b) destruction;
c) unauthorized access;
d) disclosure;
e) modification;
10.2. The Store uses encrypted SSL/TLS connection;

XI. Changes to the Privacy Policy

11.1. The Controller may update this Privacy Policy in the event of changes to legal regulations, technology, or the way the store operates;
11.2. The current version of the Privacy Policy is always available on the store’s website along with the date of the last update;

XII. Final Provisions

12.1. 12.1. In matters not regulated by this Privacy Policy, the following provisions shall apply:
a) Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR);
b) Personal Data Protection Act;
c) Electronic Communications Law;
d) Act on the Provision of Electronic Services;
e) Other applicable provisions of Polish and EU law;

Privacy Policy update date: 2026-06-05