Concerned about the security and privacy of your personal data, KAMOKA SP. Z O.O. (KAMOKA Limited Liability Company) maintains this Privacy Policy. KAMOKA SP. Z O.O. is the owner of the websites: kamoka.pl, webcatalogue.kamoka.pl, orders.kamoka.pl, reklamacje.kamoka.pl, 7years.kamoka.pl and their versions in other language versions (hereinafter: the Services), as well as mobile applications designed to be installed on a mobile device with the Android or iOS operating system, including the KAMOKA catalog mobile application (webCataloge).

The Privacy Policy is a set of principles and rules regarding the protection of information, including personal data of Clients/Contractors, representatives of Contractors and other persons entrusting us with their personal data, including users of the Services and mobile applications (hereinafter: The User).

CONTROLLER OF PERSONAL DATA

1. The Controller of the personal data is KAMOKA SP. Z O.O. with its registered office in Warsaw, ul. Wenecka 12, 03-244 Warsaw (hereinafter : the Controller or KAMOKA), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 14th Economic Department of the National Court Register under the number. KRS: 0001016747, Tax ID No. NIP: 5213581408, Business Statistical No. REGON: 142603777.

2. Contact with the Controller in matters related to the protection of personal data is possible through the Controller's registered office address indicated above, e-mail address office@kamoka.eu, as well as through the contact form available at https://kamoka.pl/pl/contact.

3. The Controller has appointed a Data Protection Officer, who can be contacted at e-mail address: office@kamoka.eu or by mail at the Controller's registered office address indicated above.

4. The Controller shall carry out the processing of Users' personal data in accordance with the law, including in particular on the basis of Article 6 (1) (a), (b), (c) and (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), the Law of May 10, 2018 on the protection of personal data, the Act of July 18, 2002. on the provision of electronic services, and the Act of July 16, 2004. Telecommunications Law.

SCOPE, PURPOSE AND LEGAL BASIS OF PERSONAL DATA PROCESSING

Depending on the User, the manner and the purpose of data transfer, KAMOKA may process personal data within the following scope, purposes and legal grounds for processing personal data as specified below:

1. Use of the Services

The Controller may process personal data of Users visiting the Services to the extent of data that is transmitted by the User's browser, necessary for technical reasons to display the Services and ensure their safe and stable operation.

This may include the following information: the User's IP address, login data, version of the operating system, information about the status of virtualization and related applications, version of the software used by the User, hardware data of the User's computer. Acquisition of the aforementioned information is carried out through various types of technologies, including cookies, details of which are provided in this Privacy Policy.

2. Contacting the Controller through the "Ask online" form, other contact forms available on the Services and mobile applications, or through the Controller's other contact information

The Controller processes personal data of Users who contact the Controller via the "Ask online" form, other contact forms available on the Services or mobile applications, or via the Controller's other contact information. Personal data is processed in order to respond to Users' inquiries or to take other actions by the Controller resulting from the received inquiry. The personal data that will be processed for this purpose may include, in particular, name, surname, e-mail address, telephone number and other personal data provided in the content of the "Ask online" form or as part of an inquiry submitted through other contact forms available on the Services or mobile applications or contact data, including through e-mail contact or telephone contact.

Providing personal data is voluntary, but necessary in order to send an inquiry to the Controller and receive a response to the inquiry or for the Controller to take other actions resulting from the received inquiry.

The legal basis for processing personal data in connection with directing correspondence to the Controller that is not related to services provided to the User or any other agreement concluded with the User, will be the Controller's legitimate interest in responding to inquiries, directing inquiries, as well as ensuring the quality of cooperation with interested persons (Article 6(1)(f) GDPR). The legal basis for the processing of personal data in connection with directing correspondence to the Controller that is not related to the services provided to the User or any other contract concluded with the User, will be the Controller's legitimate interest in responding to inquiries, addressing inquiries, as well as ensuring the quality of cooperation with the persons concerned (Article 6(1)(f) GDPR).

If by filling out the "Ask online" form or any other form accessed on the Website or mobile applications, or by contacting the Controller via other contact data, personal data is provided that cannot be processed by the Controller on the basis of the Controller's legitimate interest or for the purpose of performing a contract or taking action prior to concluding a contract, the legal basis for its processing will be the voluntarily expressed consent (Article 6(1)(a) GDPR), which is expressed by the User sending a message and can be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.

3. Newsletter

The Controller processes the personal data of Users who have given their consent in order to carry out the Controller's marketing activities related to the sending of the Newsletter.
Personal data that will be processed for this purpose may include first name, last name, e-mail address.

Subscribing to the Newsletter means that the User consents to the Controller's sending marketing and commercial information by means of electronic communication within the meaning of the Electronic Services Act.

Providing personal data is voluntary, but necessary in order to receive the Newsletter.

The legal basis for the processing of personal data in this case will be voluntarily given consent (Art. 6(1)(a) GDPR), which can be revoked at any time and thus unsubscribed from the Newsletter by contacting the Controller at the contact details provided above or by clicking on the link in the message containing marketing or commercial information related to the Newsletter ("unsubscribe/subscribe" link). Withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.

4. Telemarketing activities – sending marketing information by phone, SMS.

The Controller processes personal data of Users who have given their consent in order to carry out the Controller's marketing activities related to telemarketing activities, i.e. sending marketing information by telephone, via SMS, to the telephone number provided by the User. Personal data that will be processed for this purpose may include first name, last name, phone number.

Provision of personal data is voluntary, but necessary in order to receive marketing information by phone, by SMS.

The legal basis for the processing of personal data in this case will be voluntarily given consent (Article 6(1)(a) of the GDPR and Article 172(1) of the Telecommunications Law), which can be revoked at any time by contacting the Controller at the contact details provided above or by informing the Controller during a telephone call. Withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.

5. Sending commercial information by e-mail

The Controller processes personal data of Users who have given their consent in order to carry out the Controller's marketing activities by sending marketing or commercial information via the e-mail address provided by the User. Personal data that will be processed for this purpose may include first name, last name, e-mail address.

Providing personal data is voluntary, but necessary in order to receive commercial or marketing information from the Controller.

The legal basis for data processing in this case will be voluntarily given consent (Article 6(1)(a) GDPR), which can be revoked at any time by contacting the Controller at the contact details provided above. Withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.

6. Organization of workshops/training sessions

The Controller processes personal data on the basis of consent for the purpose of conducting workshops/training courses. The personal data that will be processed for this purpose may include first name, last name, email address, telephone number and other data required for the workshop/training.

Provision of personal data is voluntary, but necessary in order to participate in the workshop/training.

The legal basis for data processing in this case will be voluntarily given consent (Article 6(1)(a) GDPR), which can be revoked at any time by contacting the Controller at the contact details provided above. Withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal.

Personal data will also be able to be processed regardless of the consent given, in connection with the investigation/defense of claims on the basis of Article 6(1)(f) of the GDPR, which is the legitimate interest of the Controller.

7. Recruitment processes

The Controller may process Users' personal data related to the Controller's recruitment processes, including for future recruitment based on relevant consents. The personal data that will be processed for this purpose may include data indicated in the content of the submitted application documents.

If the preferred form of employment is an employment contract - personal data provided in the recruitment process within the scope of Article 22 (1) § 1 of the Labor Code will be processed by the Controller on the basis of Article 6 (1) (b) and (c) of the GDPR in order to carry out the recruitment process, as the processing is necessary to fulfill a legal obligation incumbent on the Controller. Personal data provided in the recruitment process beyond the scope specified in Article 22 (1) § 1 of the Labor Code will be processed by the Controller on the basis of the consent referred to in Article 6 (1) (a) of the GDPR. The processing of personal data for future ongoing recruitments shall be based on the consent referred to in Article 6 (1) (a) GDPR. If the preferred form of employment is a civil law contract - the legal basis for the processing of data contained in the application documents is to take action prior to the conclusion of a contract at the request of the data subject pursuant to Article 6(1)(b) of the GDPR.

Personal data will also be able to be processed regardless of the consent given, in connection with the investigation/defense of claims on the basis of Article 6(1)(f) of the GDPR, which is the legitimate interest of the Controller.

Providing personal data specified in Article 22 (1) § 1 of the Labor Code is voluntary, but necessary to participate in the recruitment process. Failure to provide the personal data specified in Article 22 (1) § 1 of the Labor Code will result in the inability to participate in the
in the recruitment process. Providing personal data beyond the scope specified in Article 22 (1) § 1 of the Labor Code and giving consent to the processing of personal data in this connection is voluntary and is not a condition for participation in the recruitment process.

8. Video surveillance

The Controller processes Users' personal data in order to ensure the security of persons and property through video surveillance used on the premises managed by the Controller. In particular, video surveillance is used at the Controller's premises. Personal data from video surveillance includes image data and vehicle registration number.

Provision of personal data is voluntary, but necessary to stay on the Controller's premises. Failure to provide personal data will prevent entry/entry to the Controller's facilities covered by video surveillance.

Personal data recorded by the video surveillance system will be processed on the basis of Article 6(1)(c) of the GDPR in order to fulfill the Controller's legal obligation under Article 22 (2) of the Labor Code, as well as for purposes arising from the Controller's legitimate interest under Article 6(1)(f) of the GDPR, i.e. to ensure security, property protection, production control, and to maintain the secrecy of information the disclosure of which could expose the Controller to harm, and to establish, assert and defend claims.

9. Performance of the contract and handling of complaints

The Controller may process Users' personal data for purposes related to the provision of services and performance of contracts, including in connection with orders placed by Users (including orders placed through orders.kamoka.pl) or for the purposes related to the processing of reported complaints, including complaints reported through orders.kamoka.pl or equivalent pages available in other language versions. The scope of personal data that will be processed for these purposes depends on the scope of the inquiry/order/complaint submitted and may include personal data of the Controller's Client, as well as personal data of the Controller's Contractor's representative and other entities purchasing KAMOKA products.

Providing personal data is voluntary, but necessary in order to provide services or perform the contract, including placing an order or reporting a complaint.

Personal data will be processed in order to conclude and/or execute the contract or to take actions before concluding the contract (Art. 6 par. 1 lit. b) GDPR), to fulfill the Controller's obligations under accounting and tax laws related to the necessity of issuing accounting documents and bookkeeping, and to handle complaints (Art. 6(1)(c) GDPR) and on the basis of the Controller's legitimate interest, which is to confirm the fulfillment of obligations and to assert or defend against claims that may be made against the Controller (Art. 6(1)(f) GDPR).

10. Collection of personal data in the context of business contacts

In connection with the Controller's business activities, the Controller also collects personal data in other cases, including during business meetings or by exchanging business cards.

Personal data is collected for the purposes of initiating, maintaining and networking business contacts, based on the Controller's legitimate interest in accordance with Article 6(1)(f) of the GDPR.

Provision of data is voluntary, but necessary in order to establish business contact.

11. Processing of personal data of staff members of Contractors or Customers cooperating with the Controller

In connection with the conclusion of contracts in the course of its business activities, the Controller obtains from Contractors/Customers personal data of persons involved in the execution of these contracts, including contact persons, persons authorized to place orders, subcontractors. The scope of the processed personal data of Contractors/Customers' personnel is limited to the extent necessary for the performance of the contract and usually includes first name, last name, business contact information.

Provision of data is voluntary, but necessary for the performance of the contract. The source of acquisition of personal data in this case is the Client/Contractor for whom the staff member provides work or services, or directly the Client/Contractor's staff member.

The personal data will be processed on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR), related to enabling the proper and effective performance of the contract.

12. Extended Warranty program 7 years

The Controller may process Users' personal data for purposes related to the User's participation in the Extended Warranty 7 Year Program available at 7years.kamoka.pl.

The scope of personal data that will be processed for these purposes is determined by the content of the application form and may include personal data of the Controller's Customer, as well as personal data of the Controller's Contractor/Customer representative and other entities purchasing KAMOKA products covered by the aforementioned Program.

Providing personal data is voluntary, but necessary in order to join the Extended Warranty 7 Year Program.

Personal data will be processed for purposes related to the organization of the Program, i.e. for the purpose of accepting applications to the Program, determining the right to participate in the Program, granting an additional warranty for KAMOKA products covered by the above-mentioned Program, communicating on matters related to participation in the Program, processing potential complaints, and fulfilling legal obligations incumbent on the Controller under the law in connection with the organization of the Program, including accounting and tax obligations (art. 6(1)(b) and (c) of the GDPR) and on the basis of the Controller's legitimate interest, which is to confirm the fulfillment of obligations and to assert or defend against claims that may be directed against the Controller (Art. 6(1)(f) of the GDPR).

13. Distributor Zone

The Controller may process the data of Users who are Distributors for purposes related to the Users' use of the Distributor Zone available at https://kamoka.pl/pl/signup which allows access to news and regulations.

The scope of personal data that will be processed for these purposes is derived from the content of the Distributor Zone enrollment form and may include personal data of the Distributor, as well as personal data of the Distributor's representative and other entities designated by the Distributor.

Providing personal data is voluntary, but necessary in order to enroll and access the Distributor Zone.

The personal data will be processed for the purpose related to the use of the Distributor Zone, i.e. for the purpose of accepting applications for access to the Distributor Zone, establishing the right to access the Distributor Zone, communicating on matters related to the use of the Distributor Zone, processing possible complaints, and fulfilling the Controller's legal obligations under the law, including accounting and tax obligations (Art. 6(1)(b) and (c) of the GDPR) and on the basis of the Controller's legitimate interest, which is to confirm the fulfillment of obligations and to assert or defend against claims that may be made against the Controller (Art. 6(1)(f) of the GDPR).

STORAGE PERIOD OF PERSONAL DATA

The period of data processing by the Controller depends on the type of service provided and the purpose of processing.

1. Personal data processed for the purpose of fulfilling a legal obligation incumbent on the Controller will be kept for the period prescribed by law.
2. Personal data processed for the purpose of fulfilling the legitimate interests of the Controller will be kept until the purpose of processing exists, but no longer than until an effective objection is made
3. Personal data processed for the purpose of entering into or performing a contract will be kept for the duration of the contract, and thereafter for the period necessary to:
   - servicing Customers/Contractors (e.g. handling complaints);
   - securing or vindicating potential claims arising from concluded agreements;
   - fulfill the Controller's legal obligation (e.g., arising from tax or accounting regulations).
4. Personal data processed for the purpose of recruitment processes will be kept for the period necessary and reasonable for the purposes of their collection, i.e. until the end of the recruitment process, and in relation to future recruitment, personal data will be processed for a period of 3 years.
5. Personal data processed as part of video surveillance will be processed for a period of 3 months from the date of recording. If the recordings constitute evidence in a proceeding conducted under the law, or the Controller becomes aware that they may constitute evidence in the proceeding, the period is extended until the legal conclusion of the proceeding.
6. Personal data processed on the basis of expressed consent will be kept by the Controller until the consent is withdrawn. After the withdrawal of consent, the data may be processed to defend against possible claims in accordance with the statute of limitations for such claims.

The retention period of personal data may be extended if the processing is necessary to establish or assert claims or defend against claims, and thereafter only if and to the extent required by law.

LEGAL BASIS FOR PROCESSING PERSONAL DATA

1. Article 6(1)(a) GDPR - processing of personal data on the basis of the data subject's consent.

2. Article 6(1)(b) GDPR - processing of personal data that is necessary for the performance of a contract or for taking action prior to entering into a contract.

3. Art. 6(1)(c) GDPR - processing of personal data that is necessary to fulfill a legal obligation of the Controller

4. Article 6(1)(f) GDPR - processing of personal data on the basis of the Controller's legitimate interests, including the investigation of claims and defense against claims.

SOURCE OF OBTAINING PERSONAL DATA

We may obtain personal data directly from Users, as well as from others, including employers/other entities you represent.
From the employers/entities that the User represents, the Controller receives such data as: name, surname, business contact information (phone number, e-mail address), position held or function performed.

RECIPIENTS OF PERSONAL DATA

1. Recipients of personal data may be only trusted entities supporting the Controller in the performance of services and within the limits of generally applicable law, entities that guarantee the security of personal data processing.

2. If necessary, personal data may be transferred to KAMOKA Group companies. Recipients of personal data may also be entities in the IT industry, providing administrative, accounting, human resources, consulting, legal, postal and courier services, as well as other contractors who provide services to the Controller.

3. Due to contracts with third parties, the Controller may transfer personal data outside the European Economic Area (EEA). Please be advised that the Controller transfers personal data outside the EEA on a minimalist basis and takes verification measures to ensure lawful conditions for such transfers, if any, in particular the Controller ensures data protection by:
   - cooperating with processors of personal data in countries, for which a relevant decision of the European Commission has been issued regarding the determination of an adequate level of protection for personal data;
   - applying standard contractual clauses issued by the European Commission;
   - application of binding corporate rules approved by the relevant supervisory authority.

4. The controller may be obliged to transfer personal data to the competent authorities of a state when such obligation arises from the law or an enforceable decision of such authority.

USERS' RIGHTS

1. The Controller ensures that the rules adopted in the Privacy Policy ensure that all Users exercise their rights under generally applicable laws, including the GDPR.

2. We inform that the User has the right to:

   1. access to the content of their personal data in accordance with Article 15 GDPR;

   2. rectify your personal data if the data processed is incorrect or incomplete in accordance with Article 16 GDPR;

   3. request the erasure of personal data in the cases specified in Article 17 GDPR;

   4. request the restriction of the processing of personal data in the cases specified
      in Article 18 GDPR;

   5. to transfer personal data, i.e. the right to receive personal data provided to the Controller and to send it to another controller in the cases specified in Article 20 GDPR - if the processing is based on consent or on the basis of a contract;

   6. to object to the processing of personal data - if the processing is based on the legitimate interest of the Controller;

   7. withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal - if processing is carried out on the basis of consent;

   8. to obtain intervention from the Controller, to express one's own position and to challenge a decision based on automated processing of personal data.

3. The exercise of the above rights listed in (a) - (h) can be done by sending the request electronically to the Controller's e-mail address or by letter to the Controller's registered office address.

4. The User also has the right to lodge a complaint with the Polish supervisory authority, i.e. the President of the Office for Personal Data Protection or the supervisory authority of another European Union member state with jurisdiction over the data subject's habitual residence or work, or over the place of the alleged infringement.

5. The controller has the right to retain certain data if required by applicable regulations or done for a legitimate purpose.

AUTOMATED PROCESSING OF PERSONAL DATA, PROFILING

The User's personal data will not be used for automated decision-making affecting the User's rights and obligations or freedoms within the meaning of the GDPR.

COOKIES.

1. As part of the operation of the Website and mobile applications, it is possible to use cookies as an identification mark. The Controller sends so-called "cookies" through the websites kamoka.pl, webcatalogue.kamoka.pl, orders.kamoka.pl, reklamacje.kamoka.pl, 7years.kamoka.pl and their equivalents in other language versions, as well as mobile applications, including the mobile application of the KAMOKA catalog (webCataloge) and saves them on the User's hard drive. Cookies are protected from being read by third parties by means of standard web browser security.

2. The Controller uses two types of cookies: short-term (session-cookies), which are stored on the User's device and remain there until the session of a given browser ends, and then are permanently deleted from the device's memory, and long-term (permanent) cookies, stored on the User's device, where they remain until they are deleted.

3. The following types of cookies are used within the Service and mobile applications:
   a) "essential" cookies, enabling the use of services available within the Service and mobile applications, e.g. authentication cookies used for services that require authentication within the Service, for security purposes, e.g. used to detect abuse of authentication within the Service; it is not possible to reject such cookies when using the Service or mobile applications; however, you can set your browser to block these cookies, but some elements of the Service or mobile applications will then not work; these cookies do not store any personal data;
   b) "performance" cookies, enabling the collection of information about the use of the Service's websites and mobile applications;
   c) "performance" cookies, enabling the collection of information about the use of the Website and mobile applications;
   d) "functional" cookies, making it possible to "remember" the settings selected by the User of the Website or mobile applications and personalize the User's interface, e.g. with regard to the selected language or region of origin of the User, font size, web page layout, etc.

4. The purpose of using cookies within the Service is to correctly configure the Controller, consisting of adapting the content of the Service's websites to the User's preferences, recognizing the User's device and its location, remembering selected settings, authenticating the User with the Controller and providing a session, as well as full functionality of the websites and analysis and research and auditing of the audience and providing advertising services. In addition, cookies are used to ensure the security and reliability of the Website. The purpose of the use of cookies within the mobile applications is to correctly configure the Controller to customize the User's preferences/interface of use/view of the mobile application, as well as to analyze visits within the mobile applications using the analytical tool Google Analytics. The Controller's use of cookies does not cause damage to the User's computer or mobile device, nor does it cause configuration changes to the User's telecommunications device and the software installed on that device.

5. According to the law, the Controller may store cookies if they are necessary for the operation of the Website or mobile applications. The legal basis for the use of necessary cookies is Article 6(1)(f) of the GDPR, i.e. the Controller's legitimate interest in ensuring that the Website and mobile applications are displayed with a high level of quality and security.

6. The Controller does not use other types of cookies than necessary without the User's consent. Consent can be given independently and at any time, including through the settings of your web browser (by means of appropriate configuration of settings). Acceptance of cookies is not necessary to use the Website or mobile applications, but failure to do so may result in some functionality not working properly. The user can delete cookies at any time using the available functions in their web browser. The legal basis for the use of the aforementioned cookies is the User's consent, in accordance with Article 6(1)(a) of the GDPR. The User may change or withdraw his/her consent at any time.

7. Google Analytics: The Controller also uses external cookies, placed as part of the Google Analytics tool, used to analyze Users' activities on the KAMOKA Catalog (webCataloge) Sites and mobile applications, which allows measuring and analyzing traffic on the KAMOKA Catalog (webCataloge) Sites and mobile applications for statistical purposes. In this regard, general and anonymous statistical data are collected, where the collected data are not used to identify the User, nor are they combined to allow such identification, hence the data collected within Google Analytics do not have the nature of personal data. Activities in this regard are carried out by the Controller on the basis of a legitimate interest, consisting in the creation of statistics and their analysis for the purpose of optimization of the Website and mobile applications KAMOKA Catalog (webCataloge). The user can disable the sharing of activity information with Google Analytics by installing the Google Analytics blocking browser add-on - see the Google Analytics blocking add-on page for more information. We recommend that you read the Google Analytics data protection information. Detailed information on data collection policies in connection with Google Analytics can be found on the website available at this link.

8. Google reCAPTCHA: The Controller uses the reCAPTCHA service offered by Google as part of certain registration and contact forms offered on the KAMOKA catalog (webCataloge) Services and mobile applications, including the Newsletter subscription form. The reCAPTCHA service is used to distinguish between inputs from an individual and abuses caused by automated queries (bots). Data collection and analysis does not identify the User. For more information about Google reCAPTCHA and Google's privacy policy, please visit: https://policies.google.com/privacy. The legal basis for processing in this case is the legitimate interest of the Controller to protect forms, Services and mobile applications from attacks and to verify that queries are made by individuals and not by automated systems (bots).

9. The Service may contain links to websites administered by third parties, independent of the Controller. They may have separate clauses or privacy policies related to data protection. The Controller encourages you to familiarize yourself with their content. With regard to websites linked to the Website, which are not owned and controlled by the Controller, the Controller is not responsible for their content, nor for the rules of confidentiality protection applicable to them.

CHANGES

1. The Controller reserves the right to update and change this Privacy Policy by publishing a new version on its website https://kamoka.pl/pl. Changes to the Privacy Policy will be made visible at least 14 days in advance before the date of entry into force of the changes. Any changes to the Privacy Policy may take place in order to ensure even better security of Users.

2. This Privacy Policy is valid from 01/01/2023.

We hope that our rules will always allow you to enjoy the comfortable use of the Controller's websites and mobile applications. In case of any doubts and additional questions regarding the protection of privacy, please contact us by sending messages via e-mail to the following e-mail address: Office@kamoka.eu or by mail to the Controller's registered address.