Privacy Policy

I. General Information

  1. This Privacy Policy is a set of rules aimed at informing you about all aspects of the process concerning the collection, processing, and securing of your personal data. The Policy is addressed to all Users of the Data Controller's Website and those using the Newsletter and Survey services.
  2. The IdoSell online store service is provided to the Personal Data Controller by IAI S.A., al. Piastów 30, 71-064 Szczecin, NIP (Tax ID): PL5252767146, KRS (National Court Register): 0000891870, Regon (National Business Registry): 381595506. General information regarding the handling of information collected by entities that are clients of IAI S.A. and use the IdoSell system is available at https://www.iai-sa.com/pl/polityka-prywatnosci-i-bezpieczenstwa/
  3. This Policy sets out the rules for the processing of personal data by the Personal Data Controller, which is:

    Venusti sp. z o.o.,
    tel. +48 75 375 30 14,
    info@broroastery.com,
    NIP 6121860348,
    REGON 366578876.
    Seller's registered office address:
    Tygrysia 6a, 21-040 Świdnik, Poland
    (hereinafter: the "Controller")

    Contact with the Data Protection Officer, Ms. Daria Bartnicka, is possible via traditional mail addressed to the Controller's registered office or via email at: iod@odokancelaria.pl
  4. This Policy may be amended and updated in the event of changes in practices related to the processing of personal data (taking into account, inter alia, current case law and guidelines of the President of the Personal Data Protection Office - PUODO) or changes in generally applicable law. The Controller will adequately inform Users about changes to the Policy by placing relevant information on the Website, and in the case of Users subscribing to the Newsletter, by sending this information directly to the User's provided email address.
  5. Using the Controller's Website requires the User to read the content of this Privacy Policy and, in the case of subscribing to the Newsletter, to accept it.
  6. Providing personal data to the Controller is voluntary, however, in the case of processing data saved in strictly necessary cookies or communicating with the Controller via the contact form, providing data will be a necessary condition for achieving the indicated purposes and the proper functioning of the Website.

II. Definitions

  1. Controller means the entity that determines how and for what purposes Personal Data is Processed. The Controller is responsible for ensuring that processing complies with applicable data protection laws.
  2. Personal Data means any information relating to an identified or identifiable natural person.
  3. Process, Processing, or Processed means any operation or set of operations performed on Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  4. Processor means a natural or legal person or entity which Processes Personal Data on behalf of the Controller (other than an employee of the Controller).
  5. Website - https://www.broroastery.com/
  6. Controller's Fanpages on social networks:
  7. Electronic Services - services provided via the Website. The provision of Electronic Services to Users on the website takes place on the terms set out in this Policy.

III. Processing of Users' Personal Data

  1. The Controller may obtain Users' Personal Data, in particular, in the following cases:
    1. provision of Personal Data by Users (e.g., email or telephone contact, via or in any other way) pursuant to Art. 6(1)(f) of the GDPR (legitimate interest of the Controller – responding to a message or enquiry) in connection with the need to handle a reported matter or process an enquiry,
    2. pursuing claims and taking actions in connection with the defence of the Controller's rights, conducting legal proceedings, and, inter alia, enabling the use of the Website via cookies, preventing fraud when using the Website, in particular the operation, maintenance, improvement and provision of all its functions, as well as creating summaries, analyses and statistics for the Controller's internal needs, which includes in particular: reporting, marketing research, planning the development of the Website and Electronic Services, development work, creating statistical models pursuant to Art. 6(1)(f) of the GDPR (the aforementioned legitimate interest of the Controller),
    3. obtaining Users' Personal Data published on social media (Controller's Fanpage) (e.g., obtaining information from the Users' private social media profiles, to the extent that such information is visible as public) pursuant to Art. 6(1)(f) of the GDPR (legitimate interest of the Controller – promoting its own business and services, running a social media profile (Fanpage), building and strengthening relationships with clients, conducting analyses and statistics regarding the popularity and functioning of the profile, as well as establishing, pursuing, and defending against potential claims related to the use of the profile, responding to contact),
    4. the User's consent to the processing of provided personal data for the purpose of sending the Newsletter, pursuant to Art. 6(1)(a) (consent) sending commercial information – Newsletter, sharing marketing content via electronic communication, in accordance with Art. 398 of the Electronic Communications Law,
    5. obtaining or requesting Users to provide Users' Personal Data during Users' visits to the Controller's websites or when using any functions or resources available on or through the Website – specifically cookies and third-party cookies. When Users visit the Website, Users' devices and browsers may automatically share certain information (such as device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to the Website, and other technical information regarding communication), some of which may constitute Personal Data. During a visit to the Website, no Users' Personal Data will be stored by the Controller without an appropriate legal basis. Regarding cookies, the Controller – apart from strictly necessary cookies – will in each case obtain the User's consent for the installation of other cookies (including third-party Google Analytics cookies). Granting the aforementioned consent is optional and does not affect the ability to use the Website. Processing takes place pursuant to Art. 6(1)(a) (consent – regarding other cookies, excluding strictly necessary ones) and Art. 399 of the Electronic Communications Law (legal provision – regarding strictly necessary cookies).
    6. Account: pursuant to Art. 6(1)(b) of the GDPR (conclusion of a contract for the provision of electronic services).
    7. Survey: pursuant to Art. 6(1)(b) of the GDPR (conclusion of a contract for the provision of electronic services).
  2. Providing personal data is voluntary and is not a statutory requirement. However, in certain cases, without providing personal data, it is impossible to use the full functionality of the Website or Electronic Services. The categories of Users' Personal Data Processed by the Controller may, in particular, include:
    1. Personal details: first name(s), surname(s),
    2. Contact details: company details, email address, telephone number.
    3. Content of communications: all communications (enquiries, statements, views, and opinions) sent via the contact form or published on the Controller's website or Fanpages by the User.
    4. IP number, cookies, and information on how you use our Website and Electronic Services.
    5. Image: in the case of publishing a review, leaving a comment, or clicking the "Like" button on the Controller's social network (Fanpage) (provided the User has made their image available on their private account on that portal).
    6. Behavioural data (consent to Google Ads): Information about user activity on websites, ad clicks, data on time spent on the site, and interactions with content.
    7. as well as information collected via the OpenAI Pixel, including product page view events, adding a product to the basket and making a purchase, ad click identifiers, event identifiers, information about the traffic source, and transaction data, such as order value and currency — to the extent that this information is transmitted by the implemented integration.
  3. The Controller uses fanpage profiles on social networks. Public data shared by Users of social media may be used to:
    1. respond to private messages addressed to us,
    2. conduct discussions within comments under individual posts,
    3. share our posts with people following our Fanpage,
    4. carry out marketing activities consisting in informing about our services and ourselves via posts placed on our Fanpage, including sponsored posts displayed to a wider group of Users,
    5. compile statistics consisting in presenting data on the views of our posts, their reach, and the number of interactions; data presented to us by social network owners is statistical data, but it is created based on observation of behaviour on our Fanpage.
  4. Upon liking a post of the Controller, leaving a comment, sending a private message, or subscribing to the channel, the Controller jointly with:
    • Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland,
    • Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland,
    becomes the Joint Controller of your personal data shared on their Fanpage regarding the processing of data for statistical and advertising purposes.
  5. In connection with the above, we encourage you to read the privacy policies:
    • Facebook - https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0
      • necessary to comply with applicable laws, in particular in response to a request from a court or state authorities,
    • the e-commerce platform provider (IdoSell/IAI S.A.), including for technical mediation in transmitting data to Google tools (Google Analytics, Google Ads, Google Tag Manager) via the Google Tag Gateway function,
    • OpenAI — in connection with the Controller's use of the OpenAI Pixel tool for measuring ad conversions in ChatGPT. Depending on the terms of service and tool configuration, data may be processed to measure, report, optimise, and attribute conversions to ad campaigns. Under the relevant OpenAI Conversion Terms, the Controller and OpenAI generally act as independent personal data controllers, subject to exceptions specified in contractual documentation.
  • If we engage a third party to Process Users' Personal Data, under a data processing agreement concluded with such entity, the Processor will be obliged to:
    1. Process only the Personal Data specified in the Controller's prior written instructions; and
    2. implement all measures to protect the confidentiality and security of Personal Data and ensure compliance with all other requirements of generally applicable law.
  • Due to the use of Facebook, Instagram, TikTok, and Youtube services, data may be transferred by these entities to third countries - the United States of America (USA) or China in connection with sharing them internally by these entities to: Meta Platforms Inc., Google LLC (USA) or Beijing ByteDance Technology Co Ltd. (China), over which the Controller has no influence.

    • V. Third-Party Services

    1. The Website may contain features or redirecting links to websites and services provided by third parties that are not managed by us. The information you provide on these websites or services will be subject to their own privacy policies and data processing procedures.
    2. The Controller is not responsible for procedures related to processing by independent website Controllers and service providers.
    3. We encourage you to read the privacy and security policies of third parties before providing them with information.

    VI. Data Protection

    1. The Controller informs that it has implemented appropriate technical and organisational measures to protect Personal Data, in particular, including safeguards against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful and unauthorised forms of Processing, in accordance with applicable law.
    2. The Controller is not responsible for the actions or omissions of Users. Users are responsible for ensuring that all Personal Data is sent to the Controller securely.
    3. Personal data will not be subject to automated profiling, i.e., automated decision-making regarding the User, meaning decisions made by technical means without human involvement, producing legal effects concerning the profiled person or similarly significantly affecting the profiled person.

    VII. Data Accuracy

    1. The Controller takes all reasonable steps to ensure that:
      1. Users' Personal Data Processed by the Controller is accurate and, if necessary, kept up to date;
      2. any Users' Personal Data Processed by the Controller that is inaccurate (having regard to the purposes for which it is Processed) is erased or rectified without undue delay.
    2. The Controller may, at any time, ask Users about the accuracy of the Processed Personal Data.

    VIII. Data Minimisation

    The Controller takes all reasonable steps to ensure that the scope of Users' Personal Data it Processes is limited to the Personal Data reasonably required for the purposes set out in this Policy.

    IX. International Data Transfer

    Personal data may be shared and processed outside the European Economic Area (the European Economic Area comprises: the European Union, Iceland, Liechtenstein, and Norway, collectively "EEA"). If personal data is transferred outside the EEA, the Controller requires appropriate safeguards. The Controller will fulfil its obligations under Chapter V of the GDPR to ensure the legality of such processing, inter alia, based on European Commission decisions on an adequate level of privacy protection, such as the EU-US Data Privacy Framework.

    1. In connection with the use of OpenAI Pixel, data may be transferred to entities involved in providing OpenAI services, including outside the European Economic Area, if this stems from the relevant terms of service and the organisation of processing. In the event of a data transfer outside the EEA, the Controller ensures the application of an appropriate mechanism compliant with Chapter V of the GDPR. Information on the specific transfer mechanism should be determined based on the current contractual and data protection documentation of OpenAI.

    X. Retention Period for Personal Data

    1. The criteria determining the length of the period for which the Controller stores Users' Personal Data are as follows: The Controller retains copies of Users' Personal Data in a form permitting identification only for as long as is necessary to achieve the purposes set out in this Policy, unless generally applicable law requires a longer retention period. The Controller may, in particular, retain Users' Personal Data for the entire period necessary to establish, exercise, or defend legal claims (limitation of claims in accordance with Art. 118 of the Polish Civil Code).
    2. Personal data is stored:
      1. for a period of 30 days from the moment of contact (telephone, email from the Website), personal data may be processed for a longer period if, as a result of the submitted enquiry, the User decides to use the Controller's services (Newsletter);
      2. in the case of using our services (conclusion of a contract), for the duration of the contract and the period necessary to handle submitted complaints, until potential disputes are resolved and the parties are settled, taking into account the relevant limitation periods for claims;
      3. for the Controller's internal administrative purposes and other data processing purposes where the legal basis is the legitimate interest of the Controller, personal data will be stored until the Controller's legitimate interests constituting the basis for data processing are fulfilled or until an objection to such processing is raised earlier, following an appropriate analysis of the User's interests and the Controller's processing bases;
      4. in the case of data processed on our Fanpage, until an objection to its further processing is raised by clicking "unlike", withdrawing a "like" for a post, removing a comment to a post, or cancelling a Subscription;
      5. in the case of using our Newsletter services, for the duration of the service provision or until consent for sending commercial information by electronic means is withdrawn.
    3. Data related to conversion measurement using the OpenAI Pixel is stored for the period necessary to achieve the measurement purposes, in accordance with the tool's configuration and the relevant OpenAI terms. In a standard setup, OpenAI Pixel may store the **oppref cookie for up to 30 days, and the** obref cookie for up to 365 days. These are retention periods for identifiers in the browser, not the declared retention periods for all data on OpenAI's side. Actual periods may depend on tool configuration, User consent, and browser limitations.

    XI. Google Analytics

    1. The Controller uses the Google Analytics tool provided by Google LLC, whose infrastructure is located at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Controller points out that Google LLC (1600 Amphitheatre Parkway, Mountain View, California 94043, USA) has joined the EU-US Data Privacy Framework, i.e., it ensures an adequate level of security for the processing of personal data in accordance with the GDPR.
    2. As part of the use of the IdoSell e-commerce system, Google's tracking tags and scripts (Google Analytics, Google Ads, Google Tag Manager) may be provided via the Website's domain using the Google Tag Gateway feature offered by the IdoSell platform provider (IAI S.A.). Measurement requests are then technically handled through the infrastructure of the Website and IdoSell, and subsequently forwarded to Google for the purposes described below. Designating resources as "first-party" refers solely to the technical method of their delivery and does not mean that the data ceases to be transferred to Google or that it becomes data processed exclusively by the Controller. The application of this mechanism does not alter the processing purposes or legal bases indicated in this section, including the scope of required User consents and the operation of Consent Mode.
    3. Google Analytics allows for:
      1. Website traffic tracking: information about the number of users, number of visits, traffic sources (e.g., ads, search engines, social media).
      2. Monitoring user behaviour: analysing which pages are visited most often, time spent on the page, bounce rate.
      3. User segmentation: demographic, geographic, and technological data (e.g., device type, browser).
      4. Tracking goals and conversions: analysing how users perform specific actions, such as purchases, subscribing to the newsletter, or downloading materials.
    4. Google Analytics processes data, which may include:
      1. IP addresses: used to identify the geographical location of users, which in combination with other data may constitute personal data.
      2. Cookies: storing unique user and session identifiers, enabling the tracking of their activity, only after the User has given appropriate consent.
      3. Technical data: e.g., browser type, operating system, screen resolution, internet service provider.
    5. The Controller uses the IP address anonymisation function, which precludes the identification of Users (the last octet of the IP address is masked before storing or processing the data).
    6. The Controller processes data using the indicated tool in order to provide analyses and reports on website traffic and the effectiveness of marketing activities based on the legitimate interest of the Controller and the User's consent (acceptance of Google Analytics cookies). The Controller has concluded a relevant Data Processing Agreement with Google, regulating data security issues in a manner required by law.
    7. The Controller uses Consent Mode, which allows measuring traffic and conversions on the Website even if the User does not consent to the saving of cookies, while fully complying with GDPR requirements, where a tracking code is implemented to collect only basic, anonymised, and aggregated data regarding visit time on the Website, referrer information, and measuring conversions from ad campaigns. If the User consents to specific types of data processing (Google Analytics cookies), the respective tags will operate fully. If consent is not given, the tools will still function, but in a restricted mode, collecting anonymous data without any possibility of identifying the User. The Consent Mode tool helps meet the requirements stemming from the GDPR and the ePrivacy Directive, respecting Users' decisions regarding cookie consent.
    8. The retention period for collected data in the case of accepting Google Analytics cookies is 14 months.
    9. We encourage you to read the Google Privacy Policy available at: https://policies.google.com/privacy?hl=en
    10. The User may configure their browser to block cookies related to Google Analytics. Google Analytics uses cookies such as _ga, _gid, and _gat.
    11. The User may also use a Google Analytics opt-out browser add-on. Google offers a browser add-on to block Google Analytics, which can be downloaded from the official page: https://tools.google.com/dlpage/gaoptout. Once installed, the add-on will prevent data transmission to Google Analytics from all visited sites.

    XII. Google Ads

    1. The Controller uses Google Ads, an advertising tool provided by Google LLC, whose infrastructure is located at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The Controller points out that Google LLC (1600 Amphitheatre Parkway, Mountain View, California 94043, USA) has joined the EU-US Data Privacy Framework, i.e., it ensures an adequate level of security for the processing of personal data in accordance with the GDPR.
    2. The Google Ads service allows the use of tracking technologies, such as cookies and remarketing tags, which enable the display of ads tailored to users' interests.
    3. Google Ads may collect and process data regarding users' interactions with our ads and website, including:
      1. IP addresses,
      2. device identifiers,
      3. web browser information,
      4. geolocation data, and
      5. browsing history.
      This data is processed to evaluate the effectiveness of advertising campaigns and optimise advertising content.
    4. Users can manage their ad preferences via Google Ads settings (https://adssettings.google.com) and opt out of personalised ads through the Network Advertising Initiative page: https://www.networkadvertising.org/choices/
    5. We encourage you to read the Google Privacy Policy available at: https://policies.google.com/privacy?hl=en

    XIII. Facebook Pixel

    1. By using the tracking Pixel services provided by Facebook, the Controller becomes a joint controller of personal data together with the service provider, i.e., Meta Platforms Ireland Limited, Block J, Serpentine Avenue, Dublin 4, Ireland. The scope of joint data processing/joint controllership covers:
      1. collection of personal data, and
      2. its transfer to Facebook.
    2. The types of personal data subject to joint controllership with Meta Ireland in connection with the Controller's use of the Pixel product on its website are:
      1. information in HTTP headers, which contains information about the browser or app being used (e.g., user agent, location country/language),
      2. Information regarding standard/optional events, e.g., "Page view" or "app install", further object properties, and buttons clicked by website visitors, depending on the configuration of the Business Tool,
      3. online identifiers, including IP addresses and, if provided, Meta-related identifiers or device identifiers (e.g., mobile OS advertising identifiers), and information about opting out/limiting ad tracking.
      Further data processing by Meta Ireland is not part of the joint data processing with the Audited Party.
    3. Third parties, including Meta, may use cookies, web beacons, and similar technologies to collect or receive information from the website and elsewhere on the Internet and use it to provide measurement services, targeting, and ad delivery. The User may opt out of the collection and use of information about them for ad targeting; detailed information is available at: https://en-gb.facebook.com/business/help/165516217407801?id=1913105122334058. Additionally, the User may use mechanisms allowing them to make a choice (e.g., by providing a link to the pages http://www.aboutads.info/choices and http://www.youronlinechoices.eu/).
    4. We encourage you to read the joint controllership rules specified by Meta, link to the page: https://www.facebook.com/legal/controller_addendum, the Terms of Service for the Pixel product, link to the page: https://www.facebook.com/legal/terms/businesstools, and the mechanisms allowing Users to make a choice regarding its scope.

    XIV. Cookies

    1. The Controller may also use the OpenAI Pixel tool provided by OpenAI to measure the conversion of ads displayed in the ChatGPT service, including product page view events, adding a product to the basket, and making a purchase. In this regard, the following may be processed: event information and URL visited, ad click identifier, online identifiers, technical browser data, as well as transaction value and currency — to the extent transmitted by the implemented integration. The tool may save **oppref cookies (up to 30 days) and** obref cookies (up to 365 days). The OpenAI Pixel is only activated after obtaining the User's consent (Art. 6(1)(a) GDPR); withdrawing consent stops further measurement. Regarding this tool, the Controller and OpenAI generally act as independent data controllers, in accordance with the OpenAI Conversion Terms (https://openai.com/policies/conversion-terms/; technical documentation: https://developers.openai.com/ads/measurement-pixel). The User's rights in this respect are described in the section on the rights of data subjects.

    XV. Cookies

    1. When the User uses the Website, data concerning the user is automatically collected. This data may include:
      1. IP address,
      2. domain name,
      3. browser type,
      4. operating system type.
    2. This data may be collected by:
      1. cookies,
      2. the Google Analytics system,
      3. and may be recorded in server logs.
    3. Cookies are small textual information in the form of text files stored by the browser on your computer's hard drive or your smartphone's memory card. During subsequent visits to the website, the information stored in the cookie is sent back to the Website. This allows the Website to recognise you and tailor the content to your needs.
    4. To improve our Website, provide the most relevant content, and analyse how Users use our Website, we may use cookies.
    5. We may process data contained in cookies for the purposes of:
      1. personalising the Website: remembering information about the User so the User does not have to re-enter this information during subsequent visits;
      2. delivering ads, content, and information tailored to the User;
      3. monitoring aggregate website usage metrics, such as total visitors and page views.
    6. We use the following types of cookies:
      1. session cookies, which are temporary files stored on the visitor's device until they leave the Website;
      2. persistent cookies, which are stored on the visitor's terminal device for the time specified in the cookie parameters or until manually deleted;
    7. Cookies can be divided into the following categories:
      1. functional cookies are necessary for the proper functioning of the website and serve to remember, for example, login sessions, language preferences, form entries, or selected privacy options. You can block them in your browser, but some parts of the site may not work properly.
      2. analytical cookies allow us to check the number of visits and traffic sources in our store. They help us determine which pages are more and less popular and understand how users navigate the site. This allows us to study statistics and improve the performance of our store. The information collected by these cookies is aggregated, so it is not intended to establish your identity. If you do not allow their use, we will not know when you visited our website.
      3. advertising cookies allow advertising content to be matched to your interests, not only on our site but also off it. They may be installed by advertising partners via our website. Based on information from these cookies and activity on other sites, a profile of your interests is built. Advertising cookies do not directly store your personal data but identify your web browser and equipment. If you do not allow the use of these cookies, we will still be able to show you ads, but they will not be tailored to your preferences.
      4. Technologies used for advertising measurement may also include the OpenAI Pixel. Depending on the configuration, the tool may save identifiers in the **oppref and** obref cookies, used to attribute events in the store to interactions with ads in ChatGPT. These files are used exclusively within the scope permitted by applicable law and the User's consent settings.
    8. We use analytics and similar services that contain third-party cookies. While using the Website, third-party cookies may be used to enable the use of Website functionalities and integrated sites or to analyse the effectiveness of advertising campaigns and collect anonymous information about Website usage for statistical purposes.
    9. This Privacy Policy does not regulate the rules for using third-party cookies. Each third party defines its own rules for using cookies in its privacy policy. We encourage you to read the details regarding data processing under Google Analytics, provided in Google's explanations: https://support.google.com/analytics/answer/6004245, Facebook Pixel: https://www.facebook.com/privacy/policy
    10. The User may freely manage consents for selected cookies using a dedicated tool located on the Website. At the same time, please note that lacking consent, deleting, blocking, or restricting the placement of cookies may cause difficulties or even prevent the use of the Website.

    XVI. Newsletter

    1. Using the service of receiving marketing information (Newsletter) for direct marketing purposes is voluntary and possible only after prior consent is granted by the interested party.
    2. The Newsletter service is provided via the IdoSell system https://www.iai-sa.com/pl/polityka-prywatnosci-i-bezpieczenstwa/.
    3. Marketing information is sent via the following communication channels and in the form of:
      1. electronic mail as sent emails,
      2. telecommunications terminal equipment as SMS text messages.
    4. Subscription to the Newsletter is done by completing a form available on the Controller's Website (providing personal data in the form of a first name, telephone number, and email address) and accepting this Privacy Policy, which governs data processing rules and service provision terms.
    5. The service is provided free of charge for an indefinite period and may be irregular.
    6. The Service Recipient may at any time resign with immediate effect from receiving the Newsletter by informing the Service Provider via email at: info@broroastery.com or by clicking the link found in each electronic message constituting a Newsletter. Resignation is tantamount to terminating the contract for the provision of electronic services relating to the Newsletter.
    7. The Controller is not responsible for the User providing false data or the non-delivery of the Newsletter due to reasons beyond the Controller's control (e.g., technical problems on the internet service provider's side).
    8. The Controller undertakes to provide the service in accordance with the Policy and applicable law, protecting Users' personal data in accordance with the GDPR and the Personal Data Protection Act. The User undertakes to use the service in a manner consistent with the law and this Policy, and not to provide illegal content.

    XVII. Account

    1. The Controller provides an Account service electronically. The service is provided in accordance with legal provisions, in particular the Act of 18 July 2002 on providing services by electronic means and Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
    2. The Account service consists of creating an individual User account on the Website enabling the purchase of the Controller's products. The Terms and Conditions are available at the link https://www.broroastery.com/pol-terms.html

    XVIII. Survey

    1. The Controller provides a service. The aim of the survey is to share its results with the User in the form of:
      1. dedicated products.
    2. The Controller shall exercise due care to reply to the query within no more than 24 hours.

    XIX. Provision of electronic services

    1. It is prohibited for Users to provide illegal content.
    2. The User is obliged to use the Controller's Website and the offered Services in a manner consistent with the law, good practice, using true and factual data, and not otherwise acting contrary to the provisions of this Policy. The Controller is not responsible for the User providing false data or the non-delivery of a service due to reasons beyond the Controller's control (e.g., technical problems on the internet service provider's side).
    3. The User is obliged to maintain confidentiality and not to disclose to third parties any information obtained in connection with the provision of Services by the Controller, including commercial, organisational, technological, and financial information.
    4. The technical requirements necessary to use the Services provided electronically include access to the Internet, a device capable of using it such as a computer, laptop, or other mobile device with a web browser, access to electronic mail and a configured email account, any properly configured version of a web browser supporting cookies, among other things (Internet Explorer, Opera, Mozilla Firefox, Safari, Google Chrome).
    5. Using Internet-based Services, despite the Controller employing security measures intended to prevent or significantly hinder hacking attempts into the system, may entail a risk of unwanted infection of the IT system by malicious software. Therefore, the Controller additionally recommends using updated antivirus software and an appropriate system firewall.
    6. The User has the right to lodge a complaint regarding the provision of electronic services. Complaints should be submitted in writing directed to the Controller's registered office address or via email (indicated in Section I). The complaint should contain the User's name and surname, email address (for email submissions), a description of the problem forming the basis of the complaint, and the User's demand related to the complaint. The Controller will consider the complaint within 14 days of its receipt. The User will be informed of the result via the same communication channel.

    XX. Users' rights in connection with the processing of their personal data

    1. In connection with the processing of personal data, you have the following rights:
      1. right of access to processed personal data – on this basis, at the request of the data subject, the Controller provides information on the processing of their personal data, primarily concerning the purposes and legal bases for processing, the scope of the data held, entities to which personal data is disclosed, and the planned date of its deletion. As part of the right of access to data, the data subject may also request information on who their personal data is shared with and whether it is subject to profiling and automated decision-making processes. The data subject also has the right to obtain a copy of their data.
      2. right to rectification of data – on this basis, at the request of the data subject, the Controller rectifies any inconsistencies or errors concerning processed personal data, and supplements or updates it if incomplete or changed;
      3. right to erasure of data – on this basis, at the request of the data subject, the Controller deletes data whose processing is no longer necessary to fulfill any of the purposes for which it was collected, consent to its processing was withdrawn, or an objection was raised, and its retention is not required for the establishment, exercise, or defence of the Controller's legal claims;
      4. right to restriction and portability of processing – on this basis, at the request of the data subject, the Controller ceases operations on these personal data to the extent required by law, and also issues these personal data in a machine-readable format;
      5. right to lodge a complaint – exercising this right, a person who considers that their personal data is processed unlawfully may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland);
      6. right to object – the data subject may at any time object to the processing of personal data for the purposes for which it was collected and is processed, an objection regarding direct marketing - if personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them in this regard;
      7. right to withdraw consent – if we process personal data based on granted consent, the data subject may withdraw this consent at any time. The withdrawal of consent does not make the prior processing of personal data illegal; withdrawal of consent does not affect the lawfulness of past processing, but will ensure that personal data is no longer used for these purposes from the moment of withdrawal.
    2. A request concerning the exercise of the rights described above may be submitted by traditional mail by writing to the Controller's registered office address or via the email address indicated in Section I.
    3. The request should, as precisely as possible, indicate the subject of the demand, i.e., in particular, the addressee of the request and which of the rights described above the applicant wishes to exercise. If the Controller is unable to determine the content of the demand or identify the applicant based on the submission, they will request additional information from the applicant.
    pixel