Privacy policy

CONTENTS:

GENERAL PROVISIONS
GROUNDS FOR PROCESSING
PURPOSE, BASIS AND DURATION OF DATA PROCESSING IN THE ONLINE SHOP
RECIPIENTS OF DATA IN THE ONLINE SHOP
PROFILING IN THE ONLINE SHOP
RIGHTS OF THE DATA SUBJECT
COOKIES AND ANALYTICS IN THE ONLINE SHOP
FINAL PROVISIONS

1. GENERAL PROVISIONS

1.1. This privacy policy of the Online Shop is for information purposes only, which means that it does not constitute a source of obligations for Service Recipients or Customers of the Online Shop. The privacy policy primarily contains rules concerning the Administrator's processing of personal data in the Online Shop, including the grounds, purposes and duration of personal data processing and the rights of data subjects, as well as information on the use of cookies and analytical tools in the Online Shop.

1.2. The administrator of the personal data collected through the Online Shop is PRZEMYSŁAW WARDZYŃSKI, doing business under the name VORTEX CONSULTING PRZEMYSŁAW DANIEL WARDZYŃSKI, entered in the Central Register of Business Activity and Information of the Republic of Poland, maintained by the minister responsible for economic affairs, holding: business address and address for service: ul. Paczkowska 42, 04-693 Warsaw, Poland, NIP 5262261767, REGON 386084236, e-mail address: support@vortexvr.co.uk, telephone no: +48 516 530 153 - hereinafter referred to as the "Administrator" and being at the same time the Service Provider of the Online Shop and the Seller.

1.3. Personal data in the Online Shop are processed by the Administrator in accordance with the applicable legal provisions, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as "GDPR". Official text of the GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

1.4. The use of the Online Shop, including making purchases, is voluntary. Similarly, the related provision of personal data by the Customer using the Online Shop is voluntary, subject to two exceptions: (1) conclusion of agreements with the Administrator - failure to provide, in the cases and to the extent indicated on the website of the Online Shop, in the Terms and Conditions of the Online Shop and in this privacy policy, the personal data necessary for the conclusion and performance of a Sales Agreement or an agreement for the provision of Electronic Services with the Administrator makes it impossible to conclude such an agreement. The provision of personal data in such a case is a contractual requirement, and if the data subject wishes to conclude a given agreement with the Administrator, he/she is obliged to provide the required data. The scope of data required to conclude a contract is each time indicated beforehand on the website of the Online Shop and in the Terms and Conditions of the Online Shop; (2) statutory obligations of the Administrator - providing personal data is a statutory requirement resulting from generally applicable laws imposing an obligation on the Administrator to process personal data (e.g. processing of data for tax or accounting purposes), and failing to provide such data will make it impossible for the Administrator to fulfil those obligations.

1.5. The Administrator takes particular care to protect the interests of the persons whose personal data it processes and in particular is responsible for and ensures that the data it collects are: (1) processed lawfully; (2) collected for specified, legitimate purposes and not subjected to further processing incompatible with those purposes; (3) substantively correct and adequate in relation to the purposes for which they are processed; (4) kept in a form which permits identification of data subjects for no longer than is necessary to achieve the purpose of the processing; and (5) processed in a manner which ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical or organisational measures.

1.6. Taking into account the nature, scope, context and purposes of the processing and the risk of violation of the rights or freedoms of natural persons of varying probability and seriousness, the Administrator implements appropriate technical and organisational measures to ensure that the processing is carried out in accordance with the GDPR and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent the acquisition and modification by unauthorised persons of personal data transmitted electronically.

1.7. All words, phrases and acronyms appearing in this privacy policy and beginning with a capital letter (e.g. Seller, Online Shop, Electronic Service) shall be understood in accordance with their definitions contained in the Terms and Conditions of the Online Shop available on the pages of the Online Shop.

2. GROUNDS FOR PROCESSING

2.1. The Administrator is entitled to process personal data where, and to the extent that, one or more of the following conditions are met: (1) the data subject has given his or her consent to the processing of his or her personal data for one or more specified purposes; (2) the processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract; (3) the processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) the processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2.2. The processing of personal data by the Administrator requires in each case the existence of at least one of the grounds indicated in point 2.1 of the privacy policy. The specific grounds for the Administrator's processing of the personal data of Service Recipients and Customers of the Online Shop are indicated in the next section of the privacy policy, with reference to the given purpose of processing.

3. PURPOSE, BASIS AND DURATION OF DATA PROCESSING IN THE ONLINE SHOP

3.1. In each case, the purpose, basis, period and recipients of the personal data processed by the Administrator result from the activities undertaken by the respective Customer in the Online Shop or by the Administrator. For example, if a Customer decides to make a purchase in the Online Shop, his/her personal data will be processed for the purpose of performing the concluded Sales Agreement and will be made available to the carrier delivering the Product on behalf of the Administrator, while a person who only subscribes to the Newsletter will not have his/her data transferred to a carrier.

3.2. The Administrator may process personal data within the Online Shop for the following purposes, on the grounds and for the periods indicated in the table below:

Purpose of data processing	Legal basis for data processing	Data retention period
Performing a Sales Agreement or an agreement for the provision of an Electronic Service, or taking action at the request of the data subject prior to entering into these agreements	Article 6(1)(b) GDPR (performance of a contract) - processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract	The data is stored for the period necessary for the performance, termination or other expiry of the concluded Sales Agreement or Electronic Service agreement.
Direct marketing	Article 6(1)(f) GDPR (legitimate interest of the Administrator) - processing is necessary for the purposes of the Administrator's legitimate interests, consisting of looking after the interests and good image of the Administrator and its Online Shop and aiming to sell Products	The data is stored for the period of existence of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator's claims against the data subject related to the Administrator's business activities. The limitation period is determined by law, in particular the Polish Civil Code (the basic limitation period for claims related to business activities is three years, and for a Sales Agreement two years). The Administrator may not process the data for direct marketing purposes if the data subject effectively objects to it.
Marketing	Article 6(1)(a) GDPR (consent) - the data subject has consented to the processing of his/her personal data for marketing purposes by the Administrator	The data is stored until the data subject withdraws his or her consent to further processing for this purpose.
Bookkeeping	Article 6(1)(c) GDPR in conjunction with Article 74(2) of the Polish Accounting Act of 29 September 1994 - processing is necessary to fulfil a legal obligation to which the Administrator is subject	The data is retained for the period required by the law obliging the Administrator to keep accounts (5 years, counted from the beginning of the year following the financial year to which the data relates).
Establishing, asserting or defending claims which the Administrator may assert or which may be asserted against the Administrator	Article 6(1)(f) GDPR (legitimate interest of the Administrator) - processing is necessary for the purposes of the Administrator's legitimate interests, consisting of establishing, asserting or defending claims	The data is stored for the period of existence of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims that may be raised against the Administrator (the basic limitation period for claims against the Administrator is six years).
Use of the website of the Online Shop and ensuring its proper functioning	Article 6(1)(f) GDPR (legitimate interest of the Administrator) - processing is necessary for the purposes of the Administrator's legitimate interests, consisting of the operation and maintenance of the Online Shop website	The data is stored for the period of existence of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator's claims against the data subject related to the Administrator's business activities (as a rule three years, and for a Sales Agreement two years).
Keeping statistics and analysing traffic in the Online Shop	Article 6(1)(f) GDPR (legitimate interest of the Administrator) - processing is necessary for the purposes of the Administrator's legitimate interests, consisting of keeping statistics and analysing traffic in the Online Shop in order to improve its functioning and increase sales of Products	The data is stored for the period of existence of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator's claims against the data subject related to the Administrator's business activities (as a rule three years, and for a Sales Agreement two years).

4. RECIPIENTS OF DATA IN THE ONLINE SHOP

4.1. For the proper functioning of the Online Shop, including the performance of concluded Sales Agreements, the Administrator uses the services of external entities (such as the e-commerce platform provider, warehouse operator, carriers and payment processors). The Administrator only uses processors who provide sufficient guarantees of implementing appropriate technical and organisational measures so that the processing meets the requirements of the GDPR and protects the rights of the data subjects.

4.2. Personal data may be transferred by the Administrator to a third country. In such a case the Administrator ensures that this takes place to a country ensuring an adequate level of protection in accordance with the GDPR, and in the case of other countries, on the basis of standard data protection clauses. The Administrator ensures that the data subject can obtain a copy of his/her data. The Administrator transfers personal data only if and to the extent necessary for the specific purpose of the processing in accordance with this privacy policy.

4.3. The Administrator does not transfer data in every case or to all of the recipients or categories of recipients indicated in this privacy policy. Data is transferred only if it is necessary for the given purpose of processing and only to the extent necessary. For example, the data of a person who only subscribes to the Newsletter is not transferred to carriers or the warehouse operator.

4.4. The personal data of Service Recipients and Customers of the Online Shop may be communicated to the following recipients or categories of recipients:

warehouse operator and carriers - the Administrator makes the Customer's personal data available to the operator of its warehouse, XBS Logistics (Błonie, Poland), and to the carrier selected by the Customer at checkout (e.g. DHL, PostNord, Bring, Posten, Royal Mail and other national postal or courier operators), to the extent necessary to ship and deliver the Product to the Customer.
entities handling payments - the Administrator makes the Customer's personal data available to the entity handling the payment method chosen by the Customer: Shopify Payments (payment cards, Apple Pay, Google Pay), PayPal (Europe) S.à r.l. et Cie, S.C.A., or Klarna Bank AB (publ), to the extent necessary to handle the payment.
lenders - if the Customer chooses to pay in instalments or later with Klarna, the Administrator makes the Customer's personal data available to Klarna Bank AB (publ) to the extent necessary to handle this payment method.
providers of technical, IT and organisational solutions enabling the Administrator to run its business, including the Online Shop and the Electronic Services (in particular Shopify International Limited as the provider of the e-commerce platform, providers of order management, e-mail, hosting and customer service software) - the Administrator makes personal data available to them only in the case and to the extent necessary for the given purpose of processing in accordance with this privacy policy.
providers of accounting, legal or advisory services (in particular an accounting office, a law firm or a debt collection agency) - the Administrator makes personal data available to them only in the case and to the extent necessary for the given purpose of processing in accordance with this privacy policy.
providers of social plug-ins, scripts and similar tools placed on the website of the Online Shop which enable the browser of the person visiting the website to download content from these providers (e.g. logging in with social media login data) and to transmit personal data of the visitor to them for this purpose, including:
- Meta Platforms Ireland Ltd. - the Administrator uses Facebook social plug-ins (e.g. the Like or Share button, or login with Facebook) on the website of the Online Shop and therefore collects and shares personal data of the person using the website with Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) to the extent and in accordance with the privacy policy available at: https://www.facebook.com/privacy/policy/ (this data includes information about activities on the Online Shop website, including information about the device, pages visited, purchases made, advertisements displayed and how the services are used, regardless of whether the person has a Facebook account and is logged in).

5. PROFILING IN THE ONLINE SHOP

5.1. The GDPR requires the Administrator to provide information on automated decision-making, including profiling as referred to in Article 22(1) and (4) GDPR, and, at least in these cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. With this in mind, the Administrator provides information on possible profiling in this section of the privacy policy.

5.2. The Administrator may use profiling in the Online Shop for direct marketing purposes, but decisions made on its basis do not concern the conclusion or refusal of a Sales Agreement or the possibility of using Electronic Services in the Online Shop. The effect of profiling may be, for example, granting a person a discount, sending a discount code, reminding about unfinished purchases, suggesting a Product that may match the person's interests or preferences, or offering better conditions than the standard offer of the Online Shop. Despite profiling, it is up to the person to decide freely whether to use the discount or better conditions and make a purchase.

5.3. Profiling in the Online Shop involves the automatic analysis or prediction of a person's behaviour on the website of the Online Shop, e.g. adding a specific Product to the basket, browsing the page of a specific Product or analysing the history of purchases made in the Online Shop. The condition for such profiling is that the Administrator holds the person's personal data so that it can later send the person, for example, a discount code.

5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

6. RIGHTS OF THE DATA SUBJECT

6.1. Right of access, rectification, restriction, erasure or portability - the data subject has the right to request from the Administrator access to his/her personal data, its rectification, erasure ("right to be forgotten") or restriction of processing, has the right to object to processing and has the right to data portability. The detailed conditions for exercising these rights are set out in Articles 15-21 GDPR.

6.2. Right to withdraw consent at any time - a person whose data is processed by the Administrator on the basis of consent (Article 6(1)(a) or Article 9(2)(a) GDPR) has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

6.3. Right to lodge a complaint with a supervisory authority - the person whose data is processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner specified in the GDPR. The lead supervisory authority for the Administrator is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). The data subject may also lodge a complaint with the supervisory authority in the EU/EEA country of his or her habitual residence or place of work.

6.4. Right to object - the data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her based on Article 6(1)(e) or (f) GDPR, including profiling based on these provisions. In such a case, the Administrator may no longer process these personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

6.5. Right to object to direct marketing - where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, including profiling to the extent that it is related to such direct marketing.

6.6. In order to exercise the rights referred to in this section, the Administrator may be contacted in writing or by e-mail at the address indicated at the beginning of this privacy policy, or by using the contact form available on the website of the Online Shop.

7. COOKIES AND ANALYTICS IN THE ONLINE SHOP

7.1. Cookies are small pieces of information in the form of text files which are sent by a server and stored on the device of the person visiting the website of the Online Shop (e.g. on the hard drive of a computer or laptop, or the memory card of a smartphone, depending on the device used). Detailed information on cookies can be found, among others, here: https://en.wikipedia.org/wiki/HTTP_cookie.

7.2. The cookies that may be sent by the website of the Online Shop can be divided into different types according to the following criteria:

By supplier:

1) own (created by the Administrator's Online Shop website) and

2) third-party (belonging to entities other than the Administrator)

By storage period on the visitor's device:

1) session (stored until you log out of the Online Shop or close your web browser) and

2) persistent (stored for a specific period defined by the parameters of each file, or until deleted manually)

By purpose:

1) necessary (enabling the proper functioning of the Online Shop website),

2) functional/preference (allowing the website to be adapted to the visitor's preferences),

3) analytical and performance (collecting information about how the website is used),

4) marketing, advertising and social media (collecting information about the visitor in order to display advertisements, personalise them, measure their effectiveness and carry out other marketing activities, including on websites other than the Online Shop, such as social networks or other websites belonging to the same advertising networks)

7.3. The Administrator may process the data contained in cookies when visitors use the website of the Online Shop for the following purposes:

identifying Customers as logged in to the Online Shop and showing that they are logged in (necessary cookies);
remembering the Products added to the shopping basket in order to place an Order (necessary cookies);
remembering data from completed Order Forms, surveys or login data for the Online Shop (necessary and/or functional/preference cookies);
adapting the content of the website to the individual preferences of the Customer (e.g. language, currency, page layout) and optimising the use of the Online Shop (functional/preference cookies);
keeping anonymous statistics showing how the website of the Online Shop is used (analytical and performance cookies);
displaying advertisements, limiting how often they are shown, measuring their effectiveness and personalising them on the basis of an analysis of visitors' behaviour (e.g. repeated visits to specific pages), also when they visit other websites in the advertising networks of Google Ireland Ltd. and Meta Platforms Ireland Ltd. (marketing, advertising and social media cookies).

7.4. On the first visit, the Online Shop displays a cookie banner where the visitor can accept or reject cookies other than necessary ones. Analytical and marketing cookies are only used after the visitor's consent, which can be changed or withdrawn at any time via the cookie settings in the Online Shop.

7.5. In the most popular web browsers it is possible to check which cookies are being sent by the website of the Online Shop: in Chrome, Edge and Opera by clicking the icon to the left of the address bar and selecting "Cookies and site data"; in Firefox by clicking the shield or padlock icon in the address bar; and in Safari via Settings, the "Privacy" tab and "Manage Website Data".

7.6. By default, most web browsers accept cookies. You can determine the conditions for the use of cookies in your browser settings, for example by partially restricting or completely disabling them. In the latter case, however, some functions of the Online Shop may not work properly (e.g. Products may not be remembered in the shopping basket during the consecutive steps of placing an Order). Information on how to manage and delete cookies is available in the help section of your browser and on the following pages:

7.7. The Administrator may use Google Analytics 4, a service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in the Online Shop. This service helps the Administrator keep statistics and analyse traffic in the Online Shop. The data collected is processed to generate aggregated statistics that help administer the Online Shop and analyse its traffic. When using this service, the Administrator collects data such as the source and medium through which visitors reach the Online Shop, their behaviour on the website, information on the devices and browsers used, approximate geographical location, demographic data (age, gender) and interests. Google Analytics 4 does not store full IP addresses.

7.8. A person can easily block the transfer of information about his or her activity on the Online Shop website to Google Analytics, for example by rejecting analytical cookies in the cookie banner or by installing the browser add-on provided by Google Ireland Ltd.: https://tools.google.com/dlpage/gaoptout?hl=en.

7.9. Full information on how Google Ireland Ltd. processes data of visitors to the Online Shop (including information stored in cookies) can be found in the privacy policy of Google services at: https://policies.google.com/technologies/partner-sites.

7.10. The Administrator may use the Meta Pixel service provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) in the Online Shop. This service helps the Administrator measure the effectiveness of advertisements, find out what actions visitors take in the Online Shop and display tailored advertisements to them. Detailed information about Meta Pixel is available at: https://www.facebook.com/business/help/742478679120153.

7.11. You can manage how Meta Pixel works via the ad settings in your Facebook account: https://www.facebook.com/adpreferences/.

8. FINAL PROVISIONS

8.1. The Online Shop may contain links to other websites. The Administrator recommends that when you go to other websites, you read the privacy policies established there. This privacy policy applies only to the Administrator's Online Shop.