STORE PRIVACY POLICY

Privacy Policy for the MARIE MARGO store

I Personal Data Controller Information
We kindly inform you that the controller of your personal data is MARIE MARGO MARIA MARGIEWICZ, with its registered office at ul. Obozowa 62, 01-426 Warsaw, using tax identification number (NIP) 694-167-38-23, hereinafter referred to as the “Company”. Contact with the Company regarding personal data protection is also possible via email at: info@mariemargo.pl.
II Purposes and Legal Bases for Personal Data Processing
To operate in accordance with the scope of our business, the Company processes your personal data for various purposes, but always in compliance with the law. Below you will find the detailed purposes of personal data processing along with their legal bases.

1. first name,
2. last name,
3. telephone number,
4. email address
5. IP address

The legal basis for such data processing is Article 6(1)(b) of the GDPR, which allows personal data to be processed if it is necessary for the performance of a contract or to take steps prior to entering into a contract;
For the purpose of issuing invoices and fulfilling other obligations arising from tax law, such as storing accounting documentation for 5 years, we process personal data such as:

1. first and last name,
2. company name,
3. residential address or registered office address,
4. tax identification number (NIP),
5. other invoice data.

The legal basis for such data processing is Article 6(1)(c) of the GDPR, which allows personal data to be processed if such processing is necessary for the Personal Data Controller to comply with legal obligations;
For analytical purposes, i.e., to study and analyze activity on the Company’s website, we process personal data such as:

1. date and time of website visits,
2. operating system type,
3. approximate location,
4. type of web browser used to view the website,
5. time spent on the website,
6. visited subpages,
7. subpage where a contact form was completed.

The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows personal data to be processed if the Personal Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is to understand customer activity on the website);
For the purpose of using cookies on the website, we process such text information (cookies will be described in a separate section). The legal basis for such processing is Article 6(1)(a) of the GDPR, which allows personal data to be processed based on voluntarily given consent (when first entering the website, a request for consent to use cookies appears);
For the purpose of website administration, we process personal data such as:

1. IP address,
2. server date and time,
3. web browser information,
4. operating system information

— this data is automatically saved in so-called server logs each time the Company’s website is used. Website administration without a server and without this automatic saving would not be possible. The legal basis for such data processing is Article 6(1)(f) of the GDPR, which allows personal data to be processed if the Personal Data Controller thereby pursues its legitimate interest (in this case, the Company’s interest is website administration);
For the purpose of you posting a comment on the website under a published article, we process personal data such as:

1. first name or username,
2. IP address.

The legal basis for such processing is Article 6(1)(a) of the GDPR, which allows personal data to be processed based on voluntarily given consent (in this case, we assume that posting a comment is simultaneous consent to the processing of personal data);
For marketing purposes, we process personal data such as:

1. first name
2. last name
3. email address

The legal basis for such processing is Article 6(1)(a) of the GDPR, which permits the processing of personal data based on voluntarily given consent (consent is optional and, once given, may be withdrawn at any time).
III Cookies

1. The Company, like other entities, uses so-called cookies on its website—short text files saved on the user’s computer, phone, tablet, or other device. They can be read by our system as well as by systems belonging to other entities whose services we use (e.g., Facebook, Google).
2. Cookies serve many functions on the website, most of which are useful. We will attempt to describe them below (if the information is insufficient, please contact us):

• ensuring security — cookies are used to authenticate users and prevent unauthorized use of the client panel. They therefore serve to protect the user’s personal data from unauthorized access;
• impact on processes and performance of website use — cookies are used to ensure that the website functions smoothly and that the features available on it can be used, which is possible in part by remembering settings between successive visits to the website. They therefore enable efficient navigation of the website and individual subpages;
• session state — cookies often store information about how visitors use the website, e.g., which subpages they view most frequently. They also enable the identification of errors displayed on certain subpages. Cookies that record the so-called “session state” therefore help improve services and increase browsing comfort;
• maintaining session state — if a client logs into their panel, cookies enable the session to be maintained. This means that after navigating to another subpage, the user does not need to re-enter their login and password each time, which enhances the comfort of using the website;
• creating statistics — cookies are used to analyze how users interact with the website (how many open the website, how long they remain on it, which content generates the most interest, etc.). This allows for continuous improvement of the website and adaptation of its operation to user preferences. To track activity and create statistics, we use Google tools such as Google Analytics; in addition to reporting website usage statistics, the Google Analytics pixel may also serve, together with some of the cookies described above, to help display more relevant content to the user in Google services (e.g., in Google search) and across the web;
• using social features — our website includes the Facebook pixel, which enables users to like our Facebook page while using the website. However, for this to be possible, we must use cookies provided by Facebook.

3. Importantly, many cookies are anonymized for us—without additional information, we are unable to identify your identity based on them.
4. Your web browser allows the use of cookies on your device by default, which is why we request your consent to use cookies upon your first visit. However, if you do not wish to have cookies used while browsing the website, you can change the settings in your web browser—completely block the automatic handling of cookies or request notification each time a cookie is placed on your device. Settings can be changed at any time.
5. Respecting the autonomy of all persons using the website, we nevertheless feel obliged to warn you that disabling or restricting the handling of cookies may cause quite serious difficulties in using the website, e.g., in the form of the need to log in on each subpage, longer page loading times, limitations in using functionalities, limitations in liking the page on Facebook, etc.

IV Right to Withdraw Consent

1. If the processing of personal data is based on consent, you may withdraw that consent at any time—at your own discretion.
2. If you wish to withdraw your consent to the processing of personal data, you may do so by:

• sending an email directly to the Company at info@mariemargo.pl or
• clicking the link in the email message, attached at the end of the message or
• deleting the comment posted under the article or
• deleting the posted review of services.

3. If the processing of your personal data was based on consent, its withdrawal does not render the processing of personal data up to that point unlawful. In other words, until the consent is withdrawn, we have the right to process your personal data, and its revocation does not affect the lawfulness of processing carried out prior to withdrawal.

V Requirement to Provide Personal Data

1. Providing any personal data is voluntary and depends on your decision. However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of the service.

VI Automated Decision-Making and Profiling
We kindly inform you that we do not engage in automated decision-making, including profiling.
VII Recipients of Personal Data
Like most entrepreneurs, we use the assistance of other entities in our business activities, which often involves the need to transfer personal data. Accordingly, when necessary, we transfer your personal data to the following recipients, such as companies engaged in:

• Accounting
• Office administration
• IT services
• Newsletter distribution (only for marketing purposes)

1. In addition, it may happen that, for example, on the basis of an applicable legal provision or a decision of a competent authority, we will be required to transfer your personal data to other entities, whether public or private. Therefore, it is extremely difficult for us to predict who may request access to personal data. Nevertheless, we assure you that we analyze each request for disclosure of personal data very carefully and thoroughly to avoid inadvertently transferring information to an unauthorized person.

VIII Transfer of Personal Data to Third Countries

1. We kindly inform you that in connection with the provision of services, your personal data may be transferred by us outside the European Economic Area.
2. The GDPR imposes certain restrictions on the transfer of personal data to third countries because, since European regulations generally do not apply there, the protection of personal data of European Union citizens may unfortunately be insufficient. Therefore, every personal data controller is obliged to identify the legal basis for such transfer.

Your personal data will be transferred outside the European Economic Area to Google LLC based on appropriate legal safeguards. In the case of data transfers to the United States, the provisions of the EU-US Privacy Shield agreement are observed. Transfers of data to other countries outside the European Economic Area are based on standard contractual clauses. The transfer of data outside the European Economic Area does not affect the ability to exercise the rights of the data subject.

3. We will provide you with additional clarifications regarding the transfer of personal data at any time, particularly if this matter raises your concerns.

IX Period of Personal Data Processing

1. In accordance with applicable law, we do not process your personal data “indefinitely,” but only for the time necessary to achieve the specified purpose. After this period, your personal data will be irreversibly deleted or destroyed.
2. Regarding the specific periods for processing personal data, we kindly inform you that we process personal data for the following periods:

• duration of the contract — with respect to personal data processed for the purpose of concluding and performing the contract;
• 3 years or 10 years + 1 year — with respect to personal data processed for the purpose of establishing, pursuing, or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
• 1 year — with respect to personal data collected during service quotation, where no contract was concluded promptly;
• 5 years — with respect to personal data related to fulfilling obligations under tax law;
• until consent is withdrawn or the purpose of processing is achieved, but no longer than 5 years — with respect to personal data processed on the basis of consent;
• until an objection is effectively raised or the purpose of processing is achieved, but no longer than 5 years — with respect to personal data processed on the basis of the legitimate interest of the Data Controller or for marketing purposes;
• until the data becomes outdated or loses its usefulness, but no longer than 3 years — with respect to personal data processed primarily for analytical purposes, use of cookies, and website administration.

1. Periods in years are counted from the end of the year in which we began processing personal data, in order to streamline the process of deleting or destroying personal data. Separate calculation of the deadline for each concluded contract would involve significant organizational and technical difficulties, as well as considerable financial expenditure, so establishing a single date for deleting or destroying personal data allows us to manage this process more efficiently. Of course, if you exercise your right to be forgotten, such situations are considered individually.
2. The additional year related to the processing of personal data collected for the purpose of performing the contract is dictated by the fact that you may hypothetically submit a claim just before the expiration of the limitation period, the request may be delivered with significant delay, or you may incorrectly determine the limitation period for your claim.
3. Periods in years are counted from the end of the year in which we began processing personal data, in order to streamline the process of deleting or destroying personal data. Separate calculation of the deadline for each event would involve significant organizational and technical difficulties, as well as considerable financial expenditure, so establishing a single date for deleting or destroying personal data allows us to manage this process more efficiently. Of course, if you exercise your right to be forgotten, such situations are considered individually.
4. The additional year related to the processing of personal data collected for the purpose of performing the contract is dictated by the fact that you may hypothetically submit a claim just before the expiration of the limitation period, the request may be delivered with significant delay, or you may incorrectly determine the limitation period for your claim.

X Rights of Data Subjects

1. We kindly inform you that you have the right to:

• access your personal data;
• rectify personal data;
• erase personal data;
• restrict the processing of personal data;
• object to the processing of personal data;
• data portability.

2. We respect your rights arising from personal data protection regulations and strive to facilitate their exercise to the greatest extent possible.
3. We note that the aforementioned rights are not absolute, and therefore in some situations we may lawfully refuse to comply with them. However, if we refuse to grant a request, it is only after thorough analysis and only in situations where refusal is necessary.
4. Regarding the right to object, we clarify that you have the right at any time to object to the processing of personal data on the basis of the legitimate interest of the Data Controller (these have been listed in Section III) in connection with your particular situation. However, you must remember that, in accordance with the regulations, we may refuse to comply with the objection if we demonstrate that:

• there are legitimate grounds for processing that override your interests, rights, and freedoms or
• there are grounds for establishing, pursuing, or defending claims.

5. Furthermore, you may at any time object to the processing of your personal data for marketing purposes. In such a case, upon receiving the objection, we will cease processing for that purpose.
6. You may exercise your rights by:

• sending an email directly to the Company at info@mariemargo.pl

XI Right to Lodge a Complaint
If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office.
XII Final Provisions

1. In matters not regulated by this Privacy Policy, the provisions of personal data protection law shall apply.
2. This Privacy Policy is effective as of December 1, 2025.