Privacy Policy of Katemedia.pl

1. General Information

1. This Privacy Policy explains how personal data is collected, used, stored and protected in connection with the online store Katemedia.pl, available at https://katemedia.pl.

2. We are committed to processing personal data lawfully, fairly and transparently, in accordance with applicable legislation, including:

   • Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR);

   • the Polish Personal Data Protection Act of 10 May 2018;

   • the Polish Electronic Communications Law of 12 July 2024;

   • other applicable laws governing online sales and electronic services.

3. Browsing our website generally does not require users to provide personal information. However, certain data is necessary when placing orders, creating customer accounts, contacting us or using specific services.

4. We process personal data only for specified, legitimate purposes and to the extent necessary to achieve those purposes.

2. Data Controller

The controller responsible for processing personal data is:

Marcin Gola, trading as “Shaky GSM”

• Registered business address: ul. 11 Listopada 31, 28-300 Jędrzejów, Poland

• Office and shipping warehouse: ul. Słowackiego 8, 28-300 Jędrzejów, Poland

• Tax Identification Number (NIP): 6562265818

• Email: sklep@katemedia.pl

• Telephone: +48 570 025 000

• Website: https://katemedia.pl

For matters relating to personal data protection, individuals may contact the Controller by email or by writing to the registered business address.

The office and warehouse at ul. Słowackiego 8 are used primarily for order fulfilment, shipments, returns and complaints.

3. Categories of Personal Data

Depending on the services used, we may process the following categories of personal data:

• First and last name;

• Company name and business identification details, including tax identification numbers;

• Residential, billing and shipping addresses;

• Email address;

• Telephone number;

• Order history, purchased products, payments, returns and complaints;

• Customer account information, including account identifiers and securely handled authentication data;

• Messages and correspondence exchanged with us;

• Technical data, including IP addresses, session identifiers, browser information and cookie-related data;

• Other information voluntarily provided when necessary to handle an enquiry, complaint or service request.

We do not ordinarily require special categories of personal data, such as health information, religious beliefs or political opinions. Users should avoid providing such information unless strictly necessary.

4. Purposes and Legal Bases for Processing

We process personal data for the purposes described below.

4.1. Order Processing and Sales Contracts

Personal data is processed to receive and fulfil orders, issue sales documents, arrange payments, deliver products and communicate with customers regarding purchases.

Legal basis: Article 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract.

4.2. Customer Account Management

Data is used to create and maintain customer accounts, store order histories, manage delivery addresses and provide account-related functionality.

Legal basis: Article 6(1)(b) GDPR.

4.3. Returns, Complaints and Service Requests

Personal data is processed to handle product complaints, returns, warranty requests, statutory customer rights and technical service cases.

Legal basis: Article 6(1)(b) GDPR, Article 6(1)(c) GDPR where processing is required by law, and Article 6(1)(f) GDPR where necessary to establish, exercise or defend legal claims.

4.4. Accounting and Tax Obligations

We process data necessary for issuing invoices, maintaining financial records, tax reporting and fulfilling other legal obligations.

Legal basis: Article 6(1)(c) GDPR.

4.5. Customer Communication

Information submitted by email, telephone or contact forms is processed to respond to enquiries and handle correspondence.

Legal basis: Article 6(1)(b) GDPR where communication concerns a contract, or Article 6(1)(f) GDPR where processing is necessary for our legitimate interest in managing business correspondence.

4.6. Newsletter and Marketing Communications

Where the recipient has provided the required consent, we may send information about our products, promotions, new arrivals and special offers.

Legal basis: Article 6(1)(a) GDPR where processing is based on consent, or, where applicable, Article 6(1)(f) GDPR for legitimate interests relating to direct marketing.

Sending commercial electronic communications is subject to the consent requirements of Article 398 of the Polish Electronic Communications Law, where applicable.

Recipients may withdraw their consent at any time by contacting us or using the unsubscribe mechanism provided in marketing communications.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.7. Website Security

Technical data may be processed to protect the website, prevent fraud, detect unauthorised activity, secure customer accounts and maintain reliable operation.

Legal basis: Article 6(1)(f) GDPR – our legitimate interest in ensuring the security of our systems and users.

4.8. Legal Claims

We may retain and process information necessary to establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR.

4.9. Website Analytics

Where analytics tools are used, information about website usage may be processed to evaluate traffic, improve website functionality and assess service performance.

Technologies requiring consent to access or store information on users' devices are subject to the applicable cookie consent requirements.

Legal basis for processing personal data: Article 6(1)(a) GDPR where consent applies, or Article 6(1)(f) GDPR in appropriate circumstances.

5. Recipients of Personal Data

Personal data may be disclosed to authorised third parties where necessary for the operation of our business, including:

• Payment service providers and banks;

• Courier companies, postal operators and parcel collection services;

• Hosting providers and IT infrastructure suppliers;

• E-commerce platform providers, warehouse management services and order management systems;

• Customer support and communication service providers;

• Accounting, tax, legal and IT service providers;

• Analytics and advertising service providers, where used and legally permitted;

• Public authorities where disclosure is required by law.

We disclose only the information reasonably necessary for the relevant purpose.

Where service providers process personal data on our behalf, appropriate contractual arrangements, including data processing agreements where required, are used.

6. Data Retention

Personal data is retained only for as long as necessary for its intended purpose, subject to applicable legal requirements.

• Order information: For the duration of the sales contract and any subsequent period required for legal obligations or legal claims.

• Accounting and tax records: For the legally required retention period, generally five years, calculated in accordance with the relevant Polish tax legislation.

• Customer accounts: For as long as the account remains active, followed by any legally justified retention period.

• Complaints and service requests: For the duration of the case and any period necessary for legal obligations or legal claims.

• Customer correspondence: For as long as necessary to resolve the enquiry and, where justified, to document the communication or protect legal interests.

• Newsletter information: Until consent is withdrawn or an effective objection to marketing is made, depending on the applicable legal basis. Evidence of previously granted consent may be retained where necessary to demonstrate legal compliance.

• Technical data and cookies: According to the purpose of the technology, applicable retention settings and legal requirements.

When personal data is no longer required, it is deleted or anonymised unless further retention is legally required.

7. Data Subject Rights

Under the GDPR, individuals have the following rights, subject to the conditions established by law:

1. Right of access: To obtain confirmation of processing and receive a copy of personal data.

2. Right to rectification: To correct inaccurate or incomplete information.

3. Right to erasure: To request deletion where the legal requirements are satisfied.

4. Right to restriction: To request restriction of processing in certain circumstances.

5. Right to data portability: To receive or transfer personal data where Article 20 GDPR applies.

6. Right to object: To object to processing based on legitimate interests, including an unconditional right to object to processing for direct marketing purposes.

7. Right to withdraw consent: To withdraw consent at any time without affecting earlier lawful processing.

8. Right to lodge a complaint: To complain to the relevant supervisory authority.

Requests may be submitted to:

sklep@katemedia.pl

We respond without undue delay, normally within one month of receiving a request. This period may be extended where permitted under the GDPR.

Certain requests may be limited where processing is required by law, including tax and accounting obligations.

8. Supervisory Authority

Individuals who believe that their personal data has been processed unlawfully may lodge a complaint with the Polish supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)

ul. Stanisława Moniuszki 1A
00-014 Warsaw, Poland

Website: https://uodo.gov.pl

Individuals are not required to contact us before lodging a complaint with the supervisory authority.

9. Voluntary and Mandatory Information

Providing personal data is generally voluntary. However, certain information is necessary to use specific services.

• Orders require sufficient contact, billing and delivery information.

• Invoices require information specified by applicable tax legislation.

• Customer accounts require information necessary to create and maintain an account.

• Contact forms require information allowing us to respond.

• Newsletter subscriptions require an email address and any necessary marketing consent.

Failure to provide essential information may prevent us from providing the requested service.

10. Cookies and Similar Technologies

10.1. What Are Cookies?

Cookies are small files or pieces of information stored on a user's device when visiting a website.

They may be used to maintain sessions, remember settings, operate shopping carts and analyse website usage.

10.2. Types of Cookies

Strictly Necessary Cookies

These cookies support essential website functions, including shopping carts, login sessions and security.

Where strictly necessary for a service requested by the user, they do not require consent.

Functional Cookies

These may remember preferences and provide additional website features.

Depending on their purpose, they may require prior consent.

Analytics Cookies

These may collect information about website traffic, popular products, user interaction and technical performance.

Analytics technologies requiring consent are used only after the necessary consent has been obtained.

Marketing Cookies

These may measure advertising performance, support audience creation or enable personalised advertising.

Marketing technologies requiring consent are activated only after consent has been obtained.

10.3. Managing Cookie Preferences

Users should be able to accept or reject optional categories of cookies independently.

Rejecting optional cookies should not prevent access to essential shopping functions.

Where a cookie consent management mechanism is provided, users may change or withdraw their choices at any time.

Users may also manage cookies through their browser settings.

Disabling certain cookies may affect some website features.

10.4. Third-Party Technologies

Where third-party analytics, advertising or other online technologies are used, their providers may process certain technical information.

The scope of processing depends on the service, its configuration and applicable consent choices.

Information about technologies in use, their providers, purposes and retention periods should be available through the cookie preference settings.

11. International Data Transfers

Certain IT or online services may involve transfers of personal data outside the European Economic Area, depending on the providers used.

Where such transfers take place, they are carried out in accordance with Chapter V GDPR.

Applicable safeguards may include an adequacy decision issued by the European Commission or appropriate safeguards such as Standard Contractual Clauses.

Information about specific international transfers and relevant safeguards may be requested from the Controller.

12. Automated Processing and Profiling

Our online store may use automated systems for routine activities such as order processing, transactional notifications and website performance analysis.

Automation does not necessarily involve automated decision-making that produces legal or similarly significant effects.

Where automated decision-making, including profiling, within the meaning of Article 22 GDPR is carried out, individuals will receive the information required by law, including information about the underlying logic, significance and envisaged consequences.

13. Personal Data Security

We take appropriate steps to protect personal data against unauthorised access, loss, destruction, disclosure and unlawful processing.

Technical and organisational safeguards are selected according to the nature of the information, the scope of processing and the associated risks.

Access to personal data should be limited to authorised persons and service providers with a legitimate need to process it.

We take appropriate steps to maintain security and respond to identified threats or personal data breaches.

14. Business Customers (B2B)

Katemedia.pl serves both individual consumers and business customers, including electronics repair businesses and other commercial entities.

In connection with B2B relationships, we may process information relating to sole traders, company representatives, employees and designated business contacts.

Processing may include:

• Negotiating and performing contracts;

• Managing orders and payments;

• Issuing invoices and other sales documents;

• Managing commercial terms and discounts;

• Maintaining business communications;

• Processing complaints and returns;

• Establishing, exercising or defending legal claims.

The applicable legal bases may include Article 6(1)(b), 6(1)(c) or 6(1)(f) GDPR, depending on the individual and the purpose.

Our legitimate interests may include maintaining commercial relationships and performing agreements with business customers.

Business contact details may also be obtained from the organisations represented by the relevant individuals.

15. Repair and Complaint Information

When processing product complaints, technical service requests or repairs, we may collect information such as:

• Device brand and model;

• Serial number or device identifier, where necessary;

• Description of the reported issue;

• Service and complaint history;

• Photographs or technical documentation;

• Purchase records and warranty information.

This information is used only as necessary to verify the request, provide the service, fulfil legal obligations or protect legal claims.

Customers should avoid sharing passwords, access codes or other confidential information unless genuinely necessary and provided through an appropriately secure, agreed method.

16. External Websites

Our website may contain links to external websites, social media platforms, marketplaces and third-party services.

When visiting external websites, users may be subject to the privacy practices of the relevant operators.

We encourage users to review those privacy policies.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legislation, website functionality, technologies or personal data processing practices.

The current version is published at:

https://katemedia.pl

Where changes require additional information to be provided or new consent to be obtained, we will take the necessary steps under applicable law.

18. Contact Information

For questions relating to this Privacy Policy or the processing of personal data, please contact:

Katemedia.pl – Marcin Gola “Shaky GSM”

Registered business address:
ul. 11 Listopada 31
28-300 Jędrzejów, Poland

Office and shipping warehouse:
ul. Słowackiego 8
28-300 Jędrzejów, Poland

Email: sklep@katemedia.pl
Telephone: +48 570 025 000