Politica de confidențialitate

PRIVACY POLICY OF THE "LIPSS" ONLINE STORE

(hereinafter – the "Privacy Policy")

Last updated: 23 February 2026

This Privacy Policy has been drawn up in accordance with the requirements of European law, the General Data Protection Regulation (GDPR; Regulation (EU) 2016/679), which governs the legal relationships connected with the collection, processing and storage of personal data, as well as citizens' right to privacy and their right to express their own views.

1. DEFINITIONS

1.1. The following terms are used in this Privacy Policy:

1.1.1. LIPSS limited liability company (00-695 Warsaw, ul. Nowogrodzka 50/54 unit 515, Poland, NIP 7011266432, REGON: 542059841), which owns the "Lipss" online store, sells products or services, and is the controller of personal data within the meaning of Article 4(7) GDPR, responsible for its processing in accordance with this Privacy Policy and applicable law.

1.1.2. "Administration of the website of the 'Lipss' online store" (hereinafter – the Website Administration) – persons authorised to manage the website who act on behalf of the "Lipss" online store, process and store personal data, and also determine the purpose of personal data processing, the content of the personal data subject to processing and collection, and the actions or operations carried out on personal data.

1.1.3. "'Lipss' Online Store" – an online platform on the Internet located at: https://lipss.pl, by means of which the User can purchase goods or services.

1.1.4. "Personal data" – any information relating directly or indirectly to a specific or identifiable natural person (the personal data subject), including the User of the service.

1.1.5. "Processing of personal data" – any action (operation) or set of actions (operations) carried out with or without the use of automation on personal data, including: collection, recording, organisation, accumulation, storage, adaptation (updating, modification), retrieval, use, disclosure (distribution, making available), depersonalisation, blocking, erasure, and destruction of the User's personal data.

1.1.6. "Confidentiality of personal data" – the mandatory requirement not to allow personal data of a subject (the User) to be disclosed without the personal consent of the natural person, or another legal basis observed by the Website Administration or other persons who have gained access to the personal data.

1.1.7. "User of the 'Lipss' Online Store website" or "User" – a natural person who can be identified directly or indirectly, in particular by reference to a first and last name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Article 4(1) GDPR). A User is a person who purchases "Lipss" goods or services or merely visits the "Lipss" Online Store website.

1.1.8. "Cookies" – a small piece of data sent by a web server and stored on the user's computer, which the web client or web browser sends to the web server in an HTTP request each time it attempts to open a page of the given website.

Cookies are divided into the following categories:

• session cookies – temporary files stored on the user's device until they log out, leave the website, or close the browser;
• persistent cookies – stored on the user's device for the period specified in the cookie's parameters or until they are manually deleted;
• necessary (essential) cookies – required for the website to function properly, enabling the use of basic features;
• functional cookies – enabling the user's preferences to be remembered and the interface to be personalised;
• marketing/business cookies – used to deliver content tailored to the user's interests and to carry out statistical and business analyses.

1.1.9. "IP address" – a unique network address of a node in a computer network based on the IP protocol.

2. SUBJECT OF THE PRIVACY POLICY

2.1. By using the website or by purchasing goods or services in the "Lipss" Online Store, the User confirms their consent to the collection and processing of personal data by "Lipss", the Website Administration and authorised persons.

2.2. The User grants the Website Administration and "Lipss" consent to process the information received, including the collection, organisation, accumulation, storage, adaptation (updating, correction), use, distribution, depersonalisation, blocking, and destruction of the personal data specified in the questionnaire for the purposes of activities aimed at creating a database of participants, preparing statistical reports, conducting market research, as well as interacting with the User, including via telecommunications networks, including the sending of SMS and e-mail messages, until such consent is withdrawn.

2.3. The User agrees that the Website Administration and "Lipss" have the right to interact with the User through direct contact using various means of communication, including but not limited to: traditional mail, e-mail, the Internet, etc.

2.4. The personal data subject to processing and collection under this Privacy Policy includes, but is not limited to, the following data:

2.4.1. Customer data (of the natural person User):

• first name and/or last name;
• e-mail;
• telephone;
• company name;
• organisation number and address;
• delivery address;
• link to the natural person's social media profile;
• IP address.

2.4.2. Transaction data:

• information concerning payment by the natural person (the User) and other information concerning services or goods, and orders in the "Lipss" Online Store.

2.4.3. Financial data:

• information about the bank account and credit or debit card, information concerning the account and invoice, and the payment method.

2.4.4. Contact data:

• information or records created as a result of contact with "Lipss" or the Website Administration. This may be, for example: a telephone conversation, online contact, contact via e-mail, traditional mail, or messengers such as Viber, Telegram, WhatsApp or others.

2.4.5. Technical data:

• IP address, date and time of the request, content of the request, access status / HTTP status code, the website sending the request, the browser, the operating system and its interface, the language and version of the browser software.

3. COOKIE POLICY

3.1. "Lipss" and the Website Administration collect information about Users' visits to the "Lipss" Online Store in order to obtain visit statistics and assess the effectiveness of their use, to develop an individual approach and adapt to the interests of each User. The Website Administration and "Lipss" do this using various technologies, one of which is cookies. These are data that the website may send to the browser and which will be stored on the computer for further identification by the website.

3.2. Cookies are used to assess the effectiveness of websites (for example, to measure the number of visitors and the time they spend on the "Lipss" Online Store website), to identify the most interesting and most visited topics and pages, and also to ensure ease of navigation and use of the aforementioned website, without collecting any information about personal data. Cookies may also be used to develop a personalised approach based on the previous experience of the User or another person with the "Lipss" Online Store and the benefits derived from it. Over time, this information allows us to improve quality.

3.3. Cookies are text files that are transmitted by the "Lipss" Online Store to the User's device, which allows the "Lipss" Online Store website to be improved. Cookies are unique to the User's account or browser.

3.4. The User will be informed about the use of cookies during their first visit to the "Lipss" online store website. If the User objects to the collection of information using cookies, it is possible at any time to adjust this decision in the Cookie Settings Centre.

3.5. Browsers give the User the ability to manage cookies as required. The User may at any time manage and/or delete, restrict, or block cookies from the website by modifying the browser configuration. If the user does not consent to the use of cookies on the "Lipss" Online Store website, they should first disable cookies in their browser.

3.6. Through browser settings, the User can choose which cookies they consent to and which they do not. Such settings depend directly on the browser used by the User:

• cookie settings in Chrome;
• cookie settings in Firefox;
• cookie settings in Internet Explorer;
• cookie settings in Safari.

If the User has decided to block certain functional cookies, they may not be able to use some "Lipss" services. In addition to the settings that may be available on the "Lipss" online store website, the User may withhold consent to the use of certain cookies.

3.7. Cookies may be stored both by LIPSS (first-party cookies) and by external service providers (third-party cookies), such as Facebook, Google, YouTube or TikTok, in order to perform analytical, marketing, or social functions. Data transferred to third parties is, where possible, anonymised. LIPSS is not responsible for the privacy policies of external content or service providers, including embedded content, and recommends reviewing the privacy rules applicable to those providers.

4. COLLECTION AND USE OF PERSONAL DATA

4.1. "Lipss" and the Website Administration collect personal data in the following cases:

• when the user visits the "Lipss" Online Store website;
• when the User fills in the contact form on the "Lipss" Online Store website;
• when the User subscribes to the newsletter posted on the "Lipss" Online Store website;
• when the User contacts "Lipss" or the Website Administration by telephone, including via messenger, e-mail, the website chat, or social media;
• "Lipss" and the Website Administration may receive a natural person's personal data when the user clicks the "like" or "share" button on social media or interacts in other ways with the official "Lipss" pages on Facebook, TikTok, Instagram and other platforms.

5. PURPOSE OF COLLECTING AND PROCESSING PERSONAL DATA

5.1. The "Lipss" Online Store and the Website Administration use the User's personal data:

5.1.1. Contractual purposes:

• in order to conclude a contract, the contractual data concerning the natural person, namely: first and last name, telephone number, e-mail address and delivery address;
• to conclude contracts, perform, manage and enforce services or the sale of products, including any related contracts and additional documents such as annexes, amendments, etc.;
• to make personal data available to a partner, to provide services or to sell goods to a natural person;
• to manage payments or fees and receivables;
• to inform the User of changes/additions to all services or goods provided or sold through the "Lipss" Online Store, as well as the Privacy Policy and Cookie Policy;
• when "Lipss" and the Website Administration ship goods ordered by the User, and those goods are shipped in-house or by a logistics (postal) company;
• to inform about the expected time for the provision of the service or delivery of the goods to the User.

5.1.2. Legal purposes:

• for statistics, analyses and market research;
• to analyse and improve "Lipss" products and services;
• to ship products by post to Users (logistics companies);
• to disclose the User's personal data to authorised state authorities in accordance with the law;
• to support "Lipss" business processes;
• to monitor, verify and record communication between the User and "Lipss";
• from time to time, to send the User labelling information, useful information, newsletters, new offers, and information about the opening hours of "Lipss" stores;
• to inform the user of the results of the consideration of requests (if any);
• to provide information about the contact person who will be in touch with the User;
• in order to propose that the Customer join various campaigns, programmes, loyalty schemes, etc. organised by "Lipss";
• in order to enable "Lipss" to provide and run various campaigns, programmes, loyalty schemes, etc., including registering the User in its own database of persons taking part in such campaigns, programmes, loyalty schemes, etc.;
• in order to enable the User to be included in various policies, rules, regulations, instructions, etc. governing the conduct by "Lipss" of campaigns, programmes, loyalty schemes, etc.;
• in order to inform Users about the procedures for conducting campaigns, programmes, loyalty schemes, etc. organised by "Lipss", and to inform them about changes introduced to the policies, rules, regulations, instructions, etc. governing the conduct by "Lipss" of campaigns, programmes, loyalty schemes, etc.;
• to fulfil other legal obligations.

6. USER RIGHTS

6.1. With regard to their personal data subject to collection, accumulation, processing, storage and use by "Lipss" and the Website Administration on the basis of the General Data Protection Regulation (GDPR; Regulation (EU) 2016/679), the User has the following rights:

• to have information about the sources of collection, the place of storage of their personal data, the purpose of its processing, and its location;
• to obtain information about the conditions for making information available;
• to access their personal data;
• to obtain confirmation from the controller that their data has been processed;
• to obtain information as to whether their personal data is being processed;
• to submit to "Lipss" a reasoned request objecting to the processing of their personal data;
• to send requests to the controller regarding the rectification or erasure of personal data or the restriction of the processing of personal data concerning the data subject, and to object to such processing;
• to protect their personal data against unlawful processing and accidental loss, destruction, or damage as a result of intentional concealment, failure to provide, or untimely provision, as well as protection against the provision of untrue information or information that discredits the honour, dignity and business reputation of the natural person;
• to lodge a complaint regarding the processing of their personal data with a supervisory authority;
• if personal data is transferred to a third country or an international organisation, the data subject should be informed of the appropriate safeguards in accordance with Article 46 GDPR concerning the processing of personal data;
• to apply legal remedies in the event of a breach of the personal data protection regulations;
• to raise objections regarding the restriction of the right to process their personal data when giving consent;
• to withdraw consent to the processing of personal data;
• to know the mechanism of automated personal data processing;
• to make changes to their incomplete or incorrect data;
• to have personal data erased if the person has effectively exercised the right to object to the processing of data;
• to withdraw consent to the processing of personal data at any time;
• to object to the use or processing of personal data by "Lipss" and the Website Administration, if that person believes it affects their rights and freedoms.

6.2. To exercise the rights listed above, please contact "Lipss" by e-mail: hello@lipss.pl. When "Lipss" receives a request from the User to exercise one of the above rights, "Lipss" may ask the User to confirm their identity before proceeding with the request. This is necessary to ensure the protection and security of personal data.

6.3. The controller is obliged to respond to the User's request within 30 days of receiving it, in accordance with Article 12 GDPR. The exercise of rights is free of charge, unless the User's requests are manifestly unfounded or excessive — in which case the controller may charge a fee or refuse to act, in accordance with Article 12(5) GDPR.

7. TRANSFER AND DISCLOSURE OF A NATURAL PERSON'S PERSONAL DATA

7.1. "Lipss" and the Website Administration do not transfer or disclose any of the User's personal data without their consent, except for the purposes mentioned in this Privacy Policy or where required by law.

7.2. "Lipss" and the Website Administration may use the services of third parties to deliver and sell goods to the User, including, among others, courier companies such as InPost and DPD. All contractors acting on behalf of "Lipss" process the User's personal data only in accordance with "Lipss"' instructions and strictly comply with this Privacy Policy, the cookie rules, and European Union law.

Where personal data is transferred outside the European Economic Area, legal mechanisms ensuring an adequate level of data protection are applied, such as adequacy decisions issued by the European Commission or Standard Contractual Clauses (SCC) approved by the European Commission.

7.3. "Lipss" and the Website Administration may transfer the User's personal data outside the European Union in accordance with the obligations arising from this Privacy Policy and the cookie rules, or with the law, in the following cases:

• the European Commission or another authorised body has determined that the country to which the personal data is transferred ensures an adequate level of personal data protection;
• the service provider/product seller, in accordance with this Privacy Policy, is bound by the appropriate and specific contractual obligations required by the applicable data protection regulations.

8. MEASURES TO PROTECT THE USER'S PERSONAL DATA

8.1. "Lipss" and the Website Administration take measures to ensure the protection and security of the User's personal data at all stages of its processing, including through organisational and technical measures. In particular, "Lipss" uses the HTTPS protocol, which ensures the encryption of data transmitted between the User and the website, thereby increasing the security of the information transmitted.

8.2. "Lipss" and the Website Administration take all necessary measures to prevent accidental loss, use, or unauthorised access to, alteration of, or disclosure of the User's personal data.

8.3. "Lipss" and the Website Administration have implemented a process to respond to personal data security breaches or incidents and will inform the User and any relevant regulatory authorities of a suspected breach or incident if "Lipss" or the Website Administration are required to do so by law.

8.4. Where "Lipss" or the Website Administration transfer the User's personal data, "Lipss" will require third parties to take measures to protect the personal data. "Lipss" and the Website Administration do not grant any rights to third parties to use the User's personal data for their own purposes. A third party may use the User's personal data for a specific purpose and in accordance with "Lipss"' instructions.

9. ADDITIONAL INFORMATION REGARDING THE USER'S PERSONAL DATA

9.1. "Lipss" and the Website Administration are not obliged to transfer the User's personal data to third parties.

9.2. The User's personal data is stored for the period necessary to achieve the processing purposes referred to in this Policy, and thereafter for the period arising from the provisions of law, including tax and accounting regulations. In the case of data related to the purchase of goods, the storage period is 5 years from the end of the calendar year in which the last purchase was made, unless the law requires longer storage.

When storing data, Lipss and the Website Administration take into account in particular:

• the duration of achieving the processing purposes and the period during which they are obliged to provide services and sell products;
• the need to ensure and manage the relationship with the User;
• obligations arising from regulatory, accounting, reporting and legal requirements or instructions.

After the indicated periods have elapsed, the data is deleted or anonymised, unless further storage is required by law.

9.3. Processing is lawful only if the data subject (the User) has consented to the processing of their personal data for one or more specified purposes. In accordance with paragraph 1 of Article 8 GDPR, the processing of a child's personal data is lawful if the child is at least 16 years old. If the child is under 16 years of age, the processing is lawful only if the parent or legal guardian has consented to it.

9.4. The "Lipss" Online Store website may contain hyperlinks to other websites. However, if the User has used these hyperlinks, they should bear in mind that those websites are not controlled by either "Lipss" or the store's Website Administration. Therefore, neither "Lipss" nor the Website Administration is responsible for the protection and privacy of any information the User provides while on such websites, and those websites are not covered by this Privacy Policy. The User should be careful and review the privacy policy applicable to the specific website.

10. ADDITIONAL TERMS

10.1. "Lipss" has the right to make changes to the Privacy Policy without the User's consent, provided that it notifies the User of such changes within 30 (thirty) calendar days of making them. Changes to the Privacy Policy are made by posting a new, current version of the Privacy Policy at the following link: https://lipss.pl/pl/privacy/. By following this link, the current version of the Privacy Policy can always be found.

10.2. The new Privacy Policy enters into force upon its publication on the "Lipss" online store website, unless the new version of the Privacy Policy provides otherwise.

10.3. In the event of changes that materially alter the User's privacy rights, "Lipss" or the Website Administration will send additional information by e-mail to the User. If the User does not agree to the changes to this Privacy Policy, they should contact "Lipss" electronically by writing to the e-mail address: hello@lipss.pl

10.4. If the User does not agree to any of the changes introduced to the Privacy Policy, they should stop using the "Lipss" Online Store website; they also have the right to request that the Website Administration and "Lipss" delete their personal data. If "Lipss" or the Website Administration do not receive the User's refusal to accept the new version of the Privacy Policy, this means that the User consents to the new version of the Privacy Policy.

10.5. The User (for citizens of the European Union) may lodge a complaint regarding breaches of the law by "Lipss" or the Website Administration under the General Data Protection Regulation (GDPR; Regulation (EU) 2016/679) with a court or with the European Data Protection Supervisor. The contact details of the aforementioned supervisor can be found at the link below:

https://edps.europa.eu/about-edps/contact_en.

10.6. The User (for citizens of Poland) may lodge a complaint regarding breaches of the law by "Lipss" or the Website Administration with the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, UODO). The contact details of the aforementioned office can be found at the link: https://uodo.gov.pl/pl/p/kontakt.