1. This Privacy and Cookies Policy describes how LA MANIA limited liability company with its registered office in Warsaw uses information about you that constitutes personal data within the meaning of the provisions of the General Data Protection Regulation (GDPR). Should you require further information regarding your rights in relation to the processing of your personal data, please do not hesitate to get in touch. This Privacy Policy applies to all Customers of the Online Store and visitors to our websites, who may, but do not have to, be our Customers. The La Mania Online Store operates on the Shopify platform.
2. Please take a moment to read this Privacy Policy carefully. By using and accessing any of the Services in the Online Store, you confirm that you have read and understood this Privacy Policy and consent to the collection, use and disclosure of your data as described in this document.
3. In the event of any inconsistencies or conflicts between this Policy and consents granted by an individual, the Company shall have the right to take action and determine the scope of such action, in accordance with the provisions of the Policy and relevant legislation. In the event of a conflict between the Policy and the content of information clauses provided by the Company when collecting personal data (usually under forms in the Store or on individual pages), the information by which the Customer should be guided is the information provided to them within the aforementioned information clauses.
   
   DEFINITIONS

Please note that the following terms and definitions are used in this Policy and should be understood as follows:

1. Controller or Company - LA MANIA sp. z o.o. with its registered office in Warsaw (00-718), ul. Czerniakowska 87A, is entered in the register of entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number 0001141101, NIP 5214096276, REGON 540296844, with share capital of PLN 405,000.00 and e-mail address: e-lamania@lamania.eu
2. Cookies - means IT data, in particular small text files, saved and stored on devices through which the User uses the websites of the Online Store.
3. Controller's Cookies - means Cookies placed by the Controller in connection with the provision of services by electronic means by the Controller through the Online Store.
4. External Cookies - means Cookies placed by the Controller's partners through the website of the Online Store
5. Personal Data - any information relating to an identified or identifiable natural person through one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including the device IP, location data, online identifier and information collected through cookies and other similar technology.
6. Policy - this Privacy Policy.
7. Device - means an electronic device through which the User obtains access to the Online Store
8. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
9. Online Store - the Online Store operated by the Controller at www.lamania.eu.
10. User - any natural person visiting the Online Store or using one or more services or functionalities described in the Policy. A person becomes a Customer when they register in the Online Store or subscribe to the Newsletter service.
    
    §1. GENERAL PROVISIONS

1.     LA MANIA sp. z o.o. is the Controller of personal data collected through the Online Store. The company's registered office is located in Warsaw (00-718), ul. Czerniakowska 87A, entered in the register of entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number 0001141101, NIP 5214096276, REGON 540296844, with share capital of PLN 405,000.00 and e-mail address: e-lamania@lamania.eu - hereinafter referred to as the "Controller" and at the same time being the Service Provider of the Online Store and the Seller.

2.     Personal data processed in the Online Store is done so by the Controller in accordance with the applicable provisions of law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as the "GDPR" or the "GDPR Regulation".

3.     The Controller has appointed a data protection officer, who may be contacted in all matters relating to the processing of personal data and the exercise of rights related to data processing. Should you require further information regarding the Data Protection Officer at LA MANIA Sp. z o.o., please refer to the company website, www.lamanie.eu. You will find details in the "Contact" and "Personal Data" tabs. Should you wish to contact the Data Protection Officer, please use the following contact details: address:

a)    The registered office address of LA MANIA Sp. z o.o. is marked "Data Protection Officer".

b)    E-mail address: iodo@lamania.eu

4.     Use of the Online Store, including the making of purchases, is entirely voluntary. Similarly, the related provision of personal data by the User or Customer using the Online Store is voluntary, subject to two exceptions: (1) Concluding agreements with the Controller – failure to provide personal data necessary to conclude and perform a Sales Agreement or an agreement for the provision of an Electronic Service with the Controller in the cases and scope indicated on the Online Store website and in the Online Store Terms and Conditions and this Privacy Policy will result in the inability to conclude such agreement. In such cases, the provision of personal data is a contractual requirement. If the data subject wishes to conclude a given agreement with the Controller, they are obliged to provide the required data. In each case, the scope of data required to conclude an agreement is indicated in advance on the Online Store website and in the Online Store Terms and Conditions, (2) Statutory obligations of the Controller – the provision of personal data is a statutory requirement arising from generally applicable provisions of law that impose an obligation on the Controller to process personal data (e.g. the processing of data for the purpose of keeping tax or accounting books). The failure to provide such data will prevent the Controller from fulfilling those obligations.

5.     The Controller takes particular care to protect the interests of persons whose personal data it processes, and is responsible for ensuring that the data it collects is:

a)    The processing of this data is in accordance with the law,

b)    Collected for specific, lawful purposes and not further processed in a manner that is incompatible with those purposes,

c)     Accurate and sufficient for the purposes for which they are processed,

d)    stored in a form that allows identification of the persons to whom they relate for no longer than is necessary to achieve the purpose of processing,

e)    The processing of personal data is to be carried out in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing, and against accidental loss, destruction or damage. This is to be achieved by means of appropriate technical or organisational measures.

6.     In light of the nature, scope, context and purposes of processing, as well as the risk of infringement of the rights or freedoms of natural persons of varying likelihood and severity, the Controller implements appropriate technical and organisational measures. The purpose of this is to ensure that processing is carried out in accordance with this Regulation and to be able to demonstrate this. These measures are subject to regular review and update as required. The Controller implements technical measures to prevent unauthorised persons from obtaining and modifying personal data transmitted electronically.

7.     All words, expressions and acronyms appearing in this Privacy Policy and beginning with a capital letter (e.g. Seller, Online Store) shall be understood in accordance with their definition contained in the Online Store Terms and Conditions, available on the Online Store websites.

§2. LEGAL BASES FOR DATA PROCESSING

1. The Controller is entitled to process personal data in cases where - and to the extent to which - at least one of the following conditions is met: (1) the data subject has consented to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of an agreement to which the data subject is party or in order to take steps at the request of the data subject before entering into an agreement; (3) processing is necessary for compliance with a legal obligation incumbent on the Controller; or (4) processing is necessary for the purposes of legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
2. Please note that the processing of personal data by the Controller requires the existence of at least one of the bases indicated in §2.1 of the Privacy Policy in each case. The specific bases for processing personal data of Users and Customers of the Online Store by the Controller are indicated in the next point of the Privacy Policy – with reference to the given purpose of personal data processing by the Controller.
   
   §3. PURPOSE, BASIS AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE
3. In each case, the purpose, basis and period as well as the recipients of personal data processed by the Controller result from the actions taken by a given Service Recipient or Customer in the Online Store or by the Controller. For example, if the Customer decides to make purchases in the Online Store and chooses personal collection of the purchased Product instead of courier delivery, their personal data will be processed for the purpose of performing the concluded Sales Agreement, but will not be disclosed to the carrier performing shipments on behalf of the Controller.
4. The Controller may process personal data within the Online Store for the following purposes, on the following bases and for the periods indicated below:
   
   a) Conclusion and performance of an agreement between the User and the Controller, including registration of an Account in the Online Store

Legal basis: Article 6(1)(b) GDPR

Storage period: Until the end of cooperation between the User and the Controller, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

b) Fulfilment of legal obligations incumbent on the Controller, including those arising from tax and accounting regulations

Legal basis: Article 6(1)(c) GDPR in conjunction with the relevant provisions of generally applicable law

Storage period: Until the expiry of the statutory archiving period for documentation (including accounting and bookkeeping documentation), after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

c) Marketing of products or services supplied by the Controller

Legal basis: Article 6(1)(a) GDPR.

Storage period: Until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

d) Marketing of products or services supplied by third parties

Legal basis: Article 6(1)(a) GDPR

Storage period: Until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

e) Personalising advertisements directed to the User on the Internet (including profiling).

Legal basis: Article 6(1)(a) GDPR

Storage period: Until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

f) Receiving commercial information, including the Newsletter, abandoned cart reminders, invitations to review purchased products

Legal basis: Article 6(1)(a) GDPR, (Article 6(1)(b) GDPR),

Storage period: until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

g) Publishing User reviews concerning the Controller's products in the Online Store

Legal basis: Article 6(1)(a) GDPR

Storage period: Until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

h) Providing the User with notifications concerning the availability of products in the Online Store

Legal basis: Article 6(1)(a) GDPR

Storage period: Until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

i) Operating the Online Store by the Controller

Legal basis: legitimate interest of the Controller, Article 6(1)(f) GDPR

Storage period: Until the User raises a justified objection to the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

j) Establishing and maintaining contact with the Controller through the contact form and Chatbox available in the Online Store

Legal basis: Article 6(1)(a) GDPR

Storage period: until the User withdraws the consent granted for the processing of personal data or until the Controller determines that the data are no longer useful for the purpose of processing, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

k) Conducting analyses and statistics concerning the use of the Online Store by Users

Legal basis: legitimate interest of the Controller, Article 6(1)(f) GDPR

Storage period: For the period necessary to conduct analyses and statistics on the use of the Online Store, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

l) Processing Cookies necessary to ensure the proper functioning of the Online Store

Legal basis: legitimate interest of the Controller, Article 6(1)(f) GDPR

Storage period: For the period indicated in the descriptions of the individual Cookies, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

m) Processing Cookies other than Cookies necessary to ensure the proper functioning of the Online Store

Legal basis: Article 6(1)(a) GDPR

Storage period: For the period indicated in the descriptions of the individual Cookies, in accordance with § 8 of the Policy, or until the User withdraws the consent granted for the processing of personal data, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

n) Recording User activity in the Online Store server logs

Legal basis: legitimate interest of the Controller, Article 6(1)(f) GDPR Storage period: For the period resulting from the rules for the protection of IT systems adopted by the Controller, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

o) Keeping legally protected information confidential and the necessity of protecting IT systems

Legal basis: legitimate interest of the Controller,  Article 6(1)(f) GDPR

Storage period: For the period resulting from the rules for the protection of IT systems adopted by the Controller, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

p) Establishing or pursuing claims or defending against claims

Legal basis:, Article 6(1)(f) GDPR, Article 9(2)(f) GDPR

Storage period: Until the expiry of the limitation periods for claims resulting from the provisions of law or until the final conclusion of proceedings concerning such claims, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

r) Improving the quality of services provided, including examining User satisfaction

Legal basis: legitimate interest of the Controller, which is improving the standards of User service, Article 6(1)(f.) GDPR), Article 6(1)(a.) GDPR),

Storage period: For the period necessary for the Controller to conduct analyses, after which the data will be deleted, unless the Controller has previously demonstrated the necessity of their further processing

§4. DATA RECIPIENTS IN THE ONLINE STORE

1.     In order for the Online Store to function properly, including for the performance of concluded Sales Agreements, it is necessary for the Controller to use the services of external entities (such as a software provider, courier or payment service provider, for example). The Controller only uses the services of processors that can demonstrate that they have implemented appropriate technical and organisational measures to ensure that processing meets the requirements of the GDPR and protects the rights of data subjects.

2.     The Online Store's services are hosted by Shopify, which collects and processes personal data concerning your behaviour on the Online Store. Any information that you submit to the Online Store will be transferred to, and made available to, Shopify, as well as to third parties that may be located in countries other than your place of residence. This is for the purpose of providing and improving the Services. In addition, to protect, develop and improve our business, we use certain enhanced Shopify features that include data obtained from your interactions with our store, other merchants and Shopify. To provide these features, Shopify may use personal data collected about your interactions with our Online Store, other merchants, and Shopify. In such circumstances, Shopify is responsible for processing your personal data, including responding to your requests relating to the use of your personal data for these purposes. To learn more about how Shopify uses your personal data and the rights available to you, please read the Consumer Privacy Policy. Depending on your place of residence, you may be able to exercise certain rights concerning your personal data by clicking the link to the Shopify Privacy Portal.

3.     Data transfer by the Controller does not occur in every case or to all the recipients or categories of recipients indicated in the Privacy Policy. The Controller only transfers data when it is necessary to achieve a given purpose of personal data processing, and only to the extent necessary to achieve this purpose. For example, if the customer opts for personal collection, their data will not be transferred to the carrier cooperating with the Controller.

4.     To register with us or log in to the Controller's websites later, you can use our own procedure or the Facebook Connect and Google services. To do this, we will redirect you to the relevant service provider's website. The service provider will then provide data (e-mail address, platform ID and, optionally, name) in order to create an account.

5.     The personal data of users and customers of the Online Store may be transferred to the following recipients or categories of recipients:

a)    Carriers, freight forwarders and courier brokers: if a customer uses the Online Store's product delivery method by postal or courier shipment, the Controller makes the customer's collected personal data available to the selected carrier, freight forwarder or intermediary performing shipments on behalf of the Controller, to the extent necessary to deliver the product to the customer.

b)    Entities handling electronic or payment card payments: if a customer uses these payment methods in the Online Store, the Controller makes their collected personal data available to the selected entity handling these payments in the Online Store on behalf of the Controller, to the extent necessary to process the payment made by the customer.

c)     Providers of review survey systems: if a customer agrees to provide feedback on the Sales Agreement, the Controller will make their personal data available to the selected provider of the review survey system for Sales Agreements in the Online Store, on behalf of the Controller, to the extent necessary for the customer to provide feedback using the review survey system.

d)    Service providers who supply the Controller with technical, IT and organisational solutions that enable the Controller to conduct business activities, including the Online Store and the electronic services provided through it (in particular, providers of computer software for operating the Online Store, email and hosting providers, and providers of software for company management and technical support for the Controller). The Controller makes the customer's collected personal data available to the selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing consistent with this privacy policy.

e)    Providers of accounting, legal and advisory services, who provide the Controller with accounting, legal or advisory support (e.g. an accounting office, law firm or debt collection company). The Controller makes the customer's personal data available to the selected provider, acting on its behalf, only in cases where it is necessary to achieve a given purpose of data processing, consistent with this Privacy Policy.

6.     Recipients of the user's personal data include the following service providers acting on behalf of the Controller, who have set non-changeable data terms:

a) Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (hereinafter referred to as 'Google LLC'), link to Google LLC's privacy policy: https://policies.google.com/privacy?hl=pl;

b) Meta Platforms, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA (hereinafter referred to as 'Meta Platforms, Inc.'), link to the Meta Platforms, Inc. privacy policy: https://www.facebook.com/privacy/policy/.

c) Klaviyo, 125 Summer Street, 6th Floor, Boston, MA 02111, USA (hereinafter referred to as 'Klaviyo'), link to Klaviyo's privacy policy: https://www.klaviyo.com/legal/privacy/privacy-notice;

d) Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-7329, USA (hereinafter referred to as 'Microsoft Corporation'), link to the Microsoft Corporation privacy policy: https://www.microsoft.com/pl-pl/privacy/privacystatement.

e) Rebuy, Inc., 6004 St. Johns Ave., Minneapolis, MN 55424, USA (hereinafter referred to as 'Rebuy'), link to the Rebuy privacy policy: https://www.rebuyengine.com/legal/privacy-notice.

f) Shopify Inc. , 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada (hereinafter referred to as 'Shopify'), with a link to the Shopify privacy policy: https://www.shopify.com/legal/privacy.

g) Scope Digital Ventures Limited (LTD), registered in Dublin, Ireland (CRN: 669893), 13 Adelaide Road, Dublin 2, D02 P950, Ireland (hereinafter 'Swish'), link to the Swish privacy policy: https://swish.app/legal/privacy-policy.

h) TikTok USDS Joint Venture LLC, 5800 Bristol Parkway, Suite 300, Culver City, CA 90230, USA (hereinafter 'TikTok'), link to the TikTok privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

i) Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, California 94104-5401, USA (hereinafter referred to as 'Claude'), link to the Anthropic privacy policy: https://www.anthropic.com/legal/privacy.

j) Elevar, LLC, 1350 Seaside Plantation Drive, Charleston, South Carolina 29412, USA (hereinafter 'Elevar'), link to the Elevar privacy policy: https://getelevar.com/legal/privacy/.

A detailed description of the tools provided by the above-mentioned entities is included in §7 of the Policy.

§5. PROFILING IN THE ONLINE STORE

1. The GDPR imposes an obligation on the Controller to provide information about automated decision-making, including profiling, as referred to in Articles 22(1) and (4). In such cases, the Controller must also provide meaningful information about the logic involved, as well as the significance and consequences of the processing for the data subject. Taking this into account, this section of the Privacy Policy provides information about possible profiling.
2. The Controller may use profiling in the Online Store for direct marketing purposes. However, decisions made on this basis do not relate to the conclusion or refusal to conclude a sales agreement or the possibility of using electronic services in the Online Store. Examples of the effects of profiling in the Online Store include granting a person a discount, sending them a discount code, reminding them about unfinished purchases, sending them a proposal for a product that may correspond to their interests or preferences, or offering them better terms than the Online Store's standard offer. Despite profiling, the person in question is free to decide whether to use the discount or better terms received in this way to make a purchase in the Online Store.
3. Profiling in the Online Store involves the automatic analysis or prediction of a person's behaviour on the Online Store website. This may include adding a specific product to the basket or viewing a specific product page in the Online Store, for example, or analysing previous purchases made in the Online Store. Such profiling is only possible if the Controller has the personal data of the relevant person, in order to be able to send them a discount code, for example.
4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects concerning them or similarly affects them significantly.
   
   §6. RIGHTS OF THE DATA SUBJECT
5. Right of access, rectification, restriction, erasure or portability: the data subject has the right to request access to their personal data from the Controller, as well as the right to request its rectification or erasure ('right to be forgotten'), restriction of processing or portability. The detailed conditions for exercising these rights are set out in Articles 15–21 of the GDPR.
6. Right to withdraw consent at any time. Where a person's data are processed by the Controller on the basis of consent granted under Article 6(1)(a) or Article 9(2)(a) of the GDPR, that person has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent.
7. The right to lodge a complaint with a supervisory authority: a person whose data is processed by the Controller has the right to lodge a complaint with a supervisory authority in accordance with the provisions of the GDPR and Polish law, particularly the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
8. Right to object: The data subject has the right to object, at any time and on grounds relating to their particular situation, to the processing of their personal data based on Article 6(1)(e) (public interest or public tasks) or (f) (legitimate interests of the Controller), including profiling based on these provisions. In this case, the Controller may no longer process these personal data unless they can demonstrate compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject, or for establishing, pursuing or defending legal claims.
9. Right to object to direct marketing: where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing purposes, including profiling, insofar as it is related to direct marketing.
10. To exercise the rights set out in this section of the Privacy Policy, please contact the Controller by sending an appropriate written or email message to the address provided at the beginning of the Privacy Policy, or by using the contact form on the Online Store website.
    
    §7. COOKIES IN THE ONLINE STORE, USAGE DATA AND ANALYTICS
11. Cookies are small text information in the form of text files, sent by the server and saved on the side of the person visiting the Online Store website (e.g. on the hard drive of a computer, laptop or on the memory card of a smartphone - depending on the device used by the visitor to our Online Store). Detailed information about Cookies, as well as the history of their creation, can be found, among others, here: http://pl.wikipedia.org/wiki/Ciasteczko.
12. The Controller may process data contained in Cookies when visitors use the Online Store website for the following purposes:
    a) identifying Users as logged in to the Online Store and showing that they are logged in;
    b) remembering Products added to the basket in order to place an Order;
    c) remembering data from completed Order Forms, surveys or login data for the Online Store;
    d) adjusting the content of the Online Store website to the User's individual preferences (e.g. regarding colours, font size, page layout) and optimising the use of the Online Store websites;
    e) keeping anonymous statistics showing how the Online Store website is used;
    f) remarketing, i.e. examining the behavioural characteristics of visitors to the Online Store through anonymous analysis of their actions (e.g. repeated visits to certain pages, keywords, etc.) in order to create their profile and provide them with advertisements tailored to their predicted interests, including when they visit other websites in the advertising network of Google Ireland Ltd. and Facebook Ireland Ltd.
13. As standard, most web browsers available on the market accept the saving of Cookies by default. Everyone has the option to determine the conditions for using Cookies through the settings of their own web browser. This means that it is possible, for example, to partially restrict (e.g. temporarily) or completely disable the ability to save Cookies - in the latter case, however, this may affect certain functionalities of the Online Store (for example, it may prove impossible to complete the Order path through the Order Form due to Products in the basket not being remembered during subsequent steps of placing the Order).
14. Web browser settings regarding Cookies are important from the point of view of consent to the use of Cookies by our Online Store - in accordance with the regulations, such consent may also be expressed through web browser settings. In the absence of such consent, the web browser settings regarding Cookies should be changed accordingly.
15. Detailed information on changing Cookie settings and deleting them independently in the most popular web browsers is available in the web browser help section and on the following pages (just click the relevant link):
    
    a) in the Chrome browser
    b) in the Firefox browser
    c) in the Internet Explorer browser
    d) in the Opera browser
    e) in the Safari browser
    f) in the Microsoft Edge browser
    
16. The cookies used in the Online Store are not harmful either to the visitor or to the computer/end device used by them, therefore we recommend not disabling their support in browsers.
17. Information on the types of cookies used by the Controller is provided to Users in the form of a banner (window), which you can display at any time through this link.
18. In the case of certain types of cookies, the User's consent is required, which they may change or revoke at any time by setting their preferences in the banner (window) available through this link.
19. If you consent to the use of all types of cookies, your consent will be valid for 12 months unless you change it earlier. If you do not consent, your choice will be stored for 14 days.
20. The following types of cookies are used in the Online Store belonging to the Controller:
    a) session cookies (temporary): they are stored on Visitors' devices until the end of the session of a given browser. After the session ends, the information is permanently deleted from Users' devices,
    b) persistent cookies: they are not deleted after the browser is closed and may be used by the Controller in the future.
21. Depending primarily on the purposes and legal basis of processing personal data collected through cookies, they may be stored for the time indicated in §3 of the Policy.
22. Personal data collected through cookies concerning a visitor who is not a Customer will be stored until an objection is raised. The Controller may delete personal data if they have not been used for marketing purposes for 3 years, unless provisions of law oblige the Controller to process personal data for a longer period.
23. Some personal data may be stored for a longer period in case the visitor has any claims against the Controller or for the purpose of pursuing claims by the Controller or defending against claims (also those of third parties), for the period of their limitation prescribed by law, in particular the Civil Code. In each case, the longer personal data storage period shall prevail.
    
    § 8. ANALYTICAL, STATISTICAL AND MARKETING TOOLS USED WITHIN THE ONLINE STORE
24. The Controller uses tools that enable analytical, statistical and marketing activities within the Online Store of other providers that use cookies (third-party cookies). The providers of these tools are the entities listed in §4. Further information about these entities' cookies can be found in their privacy policies. These third-party cookies may be saved on the end device of a person visiting the Online Store. These third parties may be independent controllers or joint controllers with the Controller.
25. In connection with the Controller's use of tools that support the Online Store's functionality and the implementation of marketing and analytical activities, personal data may be transferred to third countries (i.e. outside the European Economic Area (EEA)), particularly to the United States of America (USA), where entities that cooperate with the Controller maintain the IT infrastructure used to process personal data. In such situations, your data will only be transferred to countries that ensure an adequate level of protection, or to countries that do not ensure an adequate level of protection where appropriate safeguards are in place, including standard contractual clauses adopted by the European Commission.
26. The Controller uses analytical and marketing tools that collect the following information about Users and their activity in the Online Store:
    
    a) information about the operating system and web browser,
    b)viewed subpages,
    c) time spent in the Online Store,
    d) transitions between individual subpages,
    e) clicks on links,
    f) sources from which the User goes to the Online Store website,
    g) approximate location of the User,
    h) User interests determined on the basis of their online activity.
    
27. Analytical cookies are activated only on the basis of your consent (Article 6(1)(a) GDPR). You may reject them or withdraw your consent at any time through the cookie banner.
28. Marketing cookies are activated only on the basis of your consent (Article 6(1)(a) GDPR in conjunction with Article 398 of the Electronic Communications Law - PKE). You may reject them or withdraw your consent at any time through the cookie banner.
29. The following analytical, statistical and marketing tools operate in the Online Store:
    
    CLAUDE
    Claude is a tool based on an AI language model, integrated with the Online Store ecosystem through a plugin available in the Klaviyo App Marketplace. The tool enables analysis of data collected in the store ecosystem and generation of marketing content using artificial intelligence. Anthropic may process customer profile data, transaction data and order history from the Shopify platform, as well as e-mail campaign data, marketing automations, segments and behavioural events collected in Klaviyo. The purpose of processing is to analyse the effectiveness of marketing activities, personalise communication and generate content based on real store data.

Detailed information is available at the following link: https://www.anthropic.com/legal/privacy

ELEVAR

Elevar is a specialised conversion tracking and data management tool (so-called server-side tracking), created primarily for Online Stores on the Shopify platform. It helps precisely measure sales and marketing activities and improve the quality of analytical and advertising data in the Online Store,

Elevar collects data on Users' behaviour, attribution data, order data, User data and the user's consent status, and then transfers them to configured platforms, e.g. GA4, Google Ads, Meta Ads, TikTok Ads, Klaviyo or other marketing/analytical tools.

Detailed information is available at the following link   https://getelevar.com/legal/privacy/

FACEBOOK ADS

Facebook Ads are marketing and analytical tools available within Facebook. Information collected by Facebook Ads is anonymous, i.e. it does not allow the Controller to identify Users. However, we inform you that Facebook may combine the collected information with other information about Users visiting the Service, collected as part of your use of Facebook, and use it for its own purposes, including marketing purposes. Such actions by Facebook are no longer dependent on the Controller.

Detailed information is available at the following link:
  https://pl-pl.facebook.com/help/443357099140264?helpref=about_content.

GOOGLE ADS

Google Ads is a tool that enables measurement of the effectiveness of advertising campaigns carried out by the Controller, allowing analytics of data such as keywords or the number of unique Users. The Google Ads platform also makes it possible to display the Controller's advertisements to persons who have previously visited the Service.

Detailed information is available at the following link: https://policies.google.com/technologies/ads?hl=pl.

GOOGLE ANALYTICS 4

It counts visits and sessions, analyses where traffic comes from and how visitors navigate the pages, identifies the most popular content and groups users by behaviour. Data are pseudonymised and aggregated - they cannot be used to identify a specific person.

GOOGLE ANALYTICS AND GOOGLE SIGNALS

Google Analytics is a tool enabling automatic collection of information about the User's use of the Online Store through a tracking code implemented in the website code, which uses Google LLC Cookies. The Operator bases its activities within Google Analytics on its legitimate interest consisting in conducting analyses and statistics concerning the use of the Online Store by Users.

Within Google Analytics, no data are collected that would enable identification of the User, but only information concerning, among others, the operating system and web browser used by the User, subpages viewed by the User, time spent on websites and subpages, sources from which the User goes to the Online Store, and the approximate location of the User (limited to the name of the locality

Detailed information is available at the following link:
  https://www.google.com/intl/pl/policies/privacy/partners.

Another Google Analytics service used by the Controller is Google Signals. Google Signals collects cross-device data from Users who have logged in to their Google account on multiple devices and have enabled ad personalisation on their account, such as: Gmail, Google+, YouTube, Google Play and other Google platforms. This feature enables the creation of personalised topics for Users, displaying campaigns of interest to them, using different devices and analysing their behaviour using specific reports in which no identifying Personal Data are collected.

Detailed information is available at the following link
  https://support.google.com/analytics/answer/7532985?hl=pl#zippy=%2Ctematy -w-tym-artykule

KLAVIYO

Klaviyo is an e-mail marketing, CRM and marketing automation tool. Klaviyo will be integrated with Shopify and may process User data, order data, product data, marketing consents and selected behavioural events from the store. Klaviyo may use data for: User segmentation, sending newsletter campaigns, marketing automations, abandoned cart messages, messages after browsing products, post-purchase communication, winback communication, personalisation of e-mail content, analysis of communication effectiveness. Klaviyo may also use onsite tracking and cookies to recognise known users and attribute their activity on the website to the customer profile, of course taking into account the required consents.

Detailed information is available at the following link
  https://www.klaviyo.com/legal/privacy/privacy-notice;

MICROSOFT CLARITY

Microsoft Clarity is an analytical tool that allows us to analyse actions on our website in order to improve it and adapt it to the needs of Users. With the information obtained, we may, for example, adjust our offer. The way Microsoft Clarity works consists in recording User behaviour on our website and replaying, in the form of video recordings, User movements on the Online Store website, and generating so-called heat maps, thanks to which we can reproduce this behaviour and observe which places on our website are most frequently visited.. Microsoft Clarity automatically masks sensitive form fields (passwords, payment data) and anonymises IP addresses

Detailed information is available at the following link
  https://privacy.microsoft.com/en-us/privacystatement

REBUY

Rebuy is a tool for personalising the shopping experience, product recommendations, upsell and cross-sell. The tool may process data concerning User behaviour, products, basket, orders and interactions with product recommendations. The purpose is to personalise the offer, recommend products and analyse the effectiveness of recommendations.

Detailed information is available at the following link https://www.rebuyengine.com/legal/privacy-notice

SHOPIFY

Shopify is a commerce platform enabling management of the Online Store. It uses cookies to ensure the proper functioning of the Online Store, in particular to: maintain the user session, handle the order and payment process, remember user preferences, ensure security and prevent abuse.

Detailed information is available at the following link: https://www.shopify.com/pl/legal/privacy

SWISH / WISHLIST

SWISH / WISHLIST is a tool that enables the User to add products to a wishlist, remove them and return to saved products. Swish will be integrated with Klaviyo, thanks to which selected wishlist events may be used in marketing communication.

Detailed information is available at the following link https://swish.app/legal/privacy-policy

TIKTOK ADS

TikTok Ads is a tool used for ad delivery, remarketing, conversion measurement and campaign optimisation.

TikTok Pixel is a measurement tool that tracks how TikTok ads affect our Online Store. The Pixel enables monitoring sales, User activity or finding relevant ad audiences. If you consent to the use of this cookie on our Website, then through this tool TikTok will obtain information that you visited our Website. This information is assigned to your profile in this service, if you have one. Thanks to this, we can commission advertisements on TikTok to those persons who have already visited our Website or its individual subpages (remarketing).

Detailed information is available at the following link  https://www.tiktok.com/legal/page/eea/privacy-policy/en

§9. FINAL PROVISIONS

1. Please note that the Online Store may contain links to other websites. The Controller encourages you, after moving to other websites, to read the privacy policy established there. Please note that this Privacy Policy applies only to the Controller's Online Store.
2. We reserve the right to amend this Privacy Policy in the event of changes in legal provisions, guidelines of authorities responsible for supervising personal data protection processes, technology using which we process personal data (provided that the change affects the wording of this document), as well as in the event of a change in the methods, purposes or legal bases of our processing of personal data.
3. In matters not regulated in the Privacy Policy and concerning its subject matter, and in the event of any part of the Privacy Policy being inconsistent with applicable law, the relevant provisions of Polish law shall apply in place of the challenged provision of the Policy, in particular: (1) Act of 23 April 1964 - Civil Code, (2) Act of 2 March 2000 on the protection of certain consumer rights and liability for damage caused by a dangerous product, (3) Act of 27 July 2002 on special terms of consumer sales and amending the Civil Code, (4) Act of 18 July 2002 on the provision of services by electronic means (hereinafter: the Act on Electronic Services), (5) Act of 10 May 2018 on the protection of personal data.
4. The current version of the Privacy and Cookies Policy was adopted and is effective from 17.06.2026.
   
   

Facebook / Instagram Information Clause

1. LA MANIA sp. z o.o. with its registered office in Warsaw (00-718), ul. Czerniakowska 87A, is the Controller of personal data of users of fanpages operated by LA MANIA on the Facebook and Instagram platforms and in Messenger.
2. Irrespective of the above, the Facebook and Instagram platform is operated by Meta Platforms Ireland Limited, which - as a separate Controller or joint Controller - also processes data of users using its functionalities. You can find the rules for data processing by Meta at facebook.com/about/privacy/update
3. In matters related to the processing of your personal data, you can contact us:
   a) electronically: iodo@lamania.eu
   b) in writing to the registered office address of LA MANIA Sp. z o.o. marked "Data Protection Officer"
4. We process data in relation to persons who interact with our profile, in particular by:
   a) following or liking the LA MANIA fanpage;
   b) adding comments under our posts or replies to comments;
   c) expressing reactions to posts or comments (e.g. "Like", other reactions);
   d) sending messages via Messenger;
   e) sharing our posts;
   f) participating in contests organised by LA MANIA through the platform.
5. Depending on the type of interaction, we process the following categories of data: name and surname or nickname visible in the profile, image (if included in the profile photo or content), content of comments and messages and other information visible in your public profile.
   We also process aggregated, anonymised statistics concerning user activity on our fanpage, generated by Meta tools. You can find more information here:
   facebook.com/legal/terms/information_about_page_insights_data
6. Use of the LA MANIA profile and interaction with it is voluntary. If you decide to be active - for example, leave a comment or send a message - you will then provide us with data that we will process. Failure to provide personal data does not affect the possibility of viewing the content we publish, but it may prevent the use of selected functions, such as commenting.
7. We process users' personal data on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR) for the following purposes:
   a) operating the profile and communication with users - responding to comments and messages, moderating content;
   b) informing about activities, offers, services and events;
   c) analysis of viewing and engagement statistics - for the purpose of optimising communication;
   d) organising contests and promotional campaigns - if they are conducted through the platform;
   e) establishing, pursuing or defending possible claims.
   If you see a LA MANIA advertisement on the Meta platform, this is based on your consent given to Meta for the display of personalised advertisements - based on your activity on our website (collected using Facebook Pixel, on the basis of your cookie consent) or other data made available by you within the Meta ecosystem. More information can be found in our Privacy Policy
8. User data may be made available to entities providing services to LA MANIA related to operating social media (e.g. communication or advertising agencies) - exclusively on the basis of a data processing agreement and strictly to the extent necessary to perform the commissioned tasks.
   The content of comments is publicly available to other platform users. Data may also be available to Meta Platforms Ireland Limited as the Controller of the platform.
9. LA MANIA does not independently transfer profile user data outside the European Economic Area (EEA). Meta Platforms Ireland Limited may, however, transfer data to third countries - in particular to the USA - on the basis of mechanisms provided for in the GDPR (including standard contractual clauses). Details of transfers can be found in Meta's privacy policy facebook.com/about/privacy/update
10. To the extent that LA MANIA is the Controller of your data in connection with operating the profile, we do not use automated decision-making that would produce legal effects or similarly significantly affect you.
11. We process data for the duration of the existence of our profile, unless earlier:
    a) you raise an effective objection to processing,
    b) the purposes for which the data were processed cease to exist.
    
    The content of comments is stored until they are deleted - by you or by us as part of moderation. You can stop following the profile at any time directly on the platform. Irrespective of our storage periods, Meta applies its own data retention rules.
12. In connection with the processing of your personal data by LA MANIA sp. z o.o., you have the following rights:
    a) the right to access your data and receive a copy thereof;
    b) the right to rectify data if they are incorrect or incomplete;
    c) the right to erase data in the cases specified in the GDPR;
    d) the right to restrict processing;
    e) the right to object to the processing of data based on the legitimate interest of the Controller, including to processing for direct marketing purposes
    f) If you consider that the processing of personal data by the Controller infringes the provisions of the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office at uodo.gov.pl.

Joint controllership of LA MANIA sp. z o.o. and Meta Platforms Ireland Limited

1. LA MANIA sp. z o.o. and Meta Platforms Ireland Limited are joint controllers of personal data to the extent that both process data of users visiting the LA MANIA fanpage for the purpose of generating platform statistics. Joint controllership results from joint purposes and joint means of processing data in this area.
2. The statistics provided to LA MANIA are anonymised - they do not contain data allowing direct identification of the user. However, the process of generating them itself is based on prior collection by Meta of personal data of platform users.
3. The detailed rules of joint controllership are regulated by the page insights addendum available at facebook.com/legal/terms/page_Controller_addendum
4. LA MANIA is responsible for:
   a) ensuring the legal basis for data processing to the extent to which it is the Controller;
   b) fulfilling the information obligation towards users in relation to the processing purposes carried out by LA MANIA;
   c) ensuring that the user has the possibility to object to the processing of their data in the scope of statistics.
5. Meta is responsible for:
   a) ensuring the legal basis for processing data for the purposes of platform statistics;
   b) exercising the rights of persons whose data are stored by Meta;
   c) reporting personal data breaches to the competent supervisory authority and notifying persons affected by the incident;
   d) applying appropriate technical and organizational measures ensuring the security of the processed data.
6. The lead supervisory authority for joint controllership is the Irish Data Protection Commission, irrespective of Article 55(2) GDPR. The full arrangements between the joint controllers and the rules for data processing by Meta are available at the following addresses:Joint Controller Arrangements and Meta Privacy Policy

TikTok Information Clause

1. LA MANIA sp. z o.o. with its registered office in Warsaw (00-718), ul. Czerniakowska 87A, operates an official profile on the TikTok platform and is the Controller of personal data of users interacting with this profile.
2. The TikTok platform is operated by TikTok Technology Limited with its registered office at 2 Cardiff Lane Grand Canal Dock, Dublin 2, D02 E395, Ireland (hereinafter: TikTok Ireland) - which is a separate data Controller of persons using the service functionalities. The rules for data processing by TikTok are available at the following link tiktok.com/legal/page/eea/privacy-policy/pl
3. In matters related to the processing of your personal data, you can contact us:
   a) electronically:  iodo@lamania.eu
   b) in writing to the registered office address of LA MANIA Sp. z o.o. marked "Data Protection Officer"
4. We process data of users active on our profile, in particular those who:
   a) followed our profile;
   b) published a comment under our materials;
   c) expressed reactions to content (e.g. "Like", "Save", "Share");
   d) contacted us using a direct message;
   e) participated in a contest organised by LA MANIA.
   
   The scope of processed data includes: name and surname or nickname visible in the profile, image (if publicly available), content of comments and messages and other information made available in the public profile.
5. Use of the LA MANIA profile and interaction with it is voluntary. If you decide to be active - for example, leave a comment or send a message - you will then provide us with data that we will process. Failure to provide personal data does not affect the possibility of viewing the content we publish, but it may prevent the use of selected functions, such as commenting.
6. The basis for processing is the legitimate interest of LA MANIA sp. z o.o. (Article 6(1)(f) GDPR). We process data for the following purposes:
   a) managing the profile and ongoing communication with users - responding to comments and messages, moderating content;
   b) presenting the activities, product and service offer of LA MANIA and informing about events;
   c) analyzing reach and engagement in order to optimise content published by LA MANIA;
   d) organizing contests or promotional campaigns carried out through the platform;
   e) establishing, pursuing or defending claims that may arise from using the profile.
7. User data may be made available to agencies and entities cooperating with LA MANIA in handling social media, acting exclusively on the basis of data processing agreements and on the instructions of LA MANIA.
8. The content of comments is publicly visible to other platform users. Data may also be available to TikTok Technology Limited as the Controller of the platform.
9. LA MANIA sp. z o.o. does not independently transfer profile user data outside the European Economic Area. TikTok Technology Limited may, however, transfer data to third countries, including China, on the basis of mechanisms compliant with the GDPR - in particular standard contractual clauses approved by the European Commission.
10. To the extent that LA MANIA sp. z o.o. is the Controller of your data in connection with operating the profile, we do not use automated decision-making that would produce legal effects or similarly significantly affect you.
11. We process data for the period of activity of our profile on the TikTok platform, unless earlier:
    a) you raise an effective objection to processing,
    b) the purposes for which the data were processed cease to exist.
    Comments are stored until they are deleted. You can stop following the profile or remove your reactions at any time directly on the platform. TikTok Technology Limited applies its own, independent data retention rules.
12. In connection with the processing of your personal data by LA MANIA sp. z o.o., you have the following rights:
    a) the right to access your data and receive a copy thereof;
    b) the right to rectify data if they are incorrect or incomplete;
    c) the right to erase data in the cases specified in the GDPR;
    d) the right to restrict processing;
    e) the right to object to the processing of data based on the legitimate interest of the Controller, including to processing for direct marketing purposes.
    f) If you consider that the processing of personal data by the Controller infringes the provisions of the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office at uodo.gov.pl.

Joint controllership - LA MANIA sp. z o.o. and TikTok Technology Limited

1. LA MANIA sp. z o.o. uses the TikTok Pixel tool placed on its website. Therefore, in relation to data processed through this tool, LA MANIA sp. z o.o. and TikTok Technology Limited act as joint controllers of personal data - i.e. they jointly determine the purposes and means of processing. The scope of joint controllership covers activities related to statistics and optimisation of LA MANIA marketing campaigns on the TikTok platform.
2. Detailed rules of joint controllership are available at ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms
3. LA MANIA is responsible for:
   a) ensuring the legal basis for data processing to the extent to which LA MANIA is the Controller;
   b) fulfilling the information obligation towards users regarding processing purposes on the part of LA MANIA;
   c) proper configuration of TikTok tools in the LA MANIA infrastructure, guaranteeing the security of user data.
4. TikTok is responsible for:
   a) ensuring the legal basis for processing data for the purposes of statistics and platform functioning;
   b) exercising the rights of persons whose data are stored by TikTok;
   c) reporting security incidents to the competent supervisory authority and notifying affected persons within the scope of TikTok's obligations;
   d) maintaining an appropriate level of technical and organisational security of processed data.
5. The lead supervisory authority for joint controllership is the Irish Data Protection Commission. The full rules for data processing by TikTok are available at tiktok.com/legal/page/eea/privacy-policy/pl