Privacy Policy

PRIVACY POLICY

1. This Privacy Policy sets out the principles for the processing of personal data collected via the online store https://oxymatic.eu/ (hereinafter: the “Online Store”).

2. The owner of the Store and simultaneously the data controller is the commercial entity NOVARTAG GmbH, conducting business under that name, with its registered office in Berlin, Germany (13437), at Lange Enden 29, entered into the Commercial Register HRB under number 222552 by the District Court in Berlin Charlottenburg, using the Tax Identification Numbers DE336311816 and PL8522672547, registered in the LUCID Register under number DE3532132945342, and using the e-mail address: pl@novartag.de.

3. Personal data collected by NOVARTAG GmbH via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also referred to as GDPR.

4. NOVARTAG GmbH takes special care to respect the privacy of Customers visiting the Online Store.

---

§ 1 Types of data processed, purposes and legal bases

1. NOVARTAG GmbH collects information on natural persons performing a legal act not directly related to their business activity, natural persons conducting business or professional activity on their own behalf, and natural persons representing legal persons or organisational units not being legal persons, to which the law grants legal capacity, hereinafter collectively referred to as Customers.

2. Customers’ personal data are collected in the case of:
   a) registering an account in the Online Store for the purpose of creating and managing an individual account. Legal basis: necessity for the performance of the contract for Account services (Art. 6(1)(b) GDPR);
   b) placing an order in the Online Store for the purpose of performing a sales contract. Legal basis: necessity for the performance of the sales contract (Art. 6(1)(b) GDPR);
   c) using the contact form service in the Online Store for the purpose of performing a contract for electronic services. Legal basis: necessity for the performance of the contact form service (Art. 6(1)(b) GDPR);
   d) using the chat service for the purpose of performing a contract for electronic services. Legal basis: necessity for the performance of the chat service (Art. 6(1)(b) GDPR).

3. When registering an account, the Customer provides:
   a) e-mail address.

4. During account registration, the Customer independently sets a password. The password may be changed later pursuant to §5.

5. When placing an order, the Customer provides:
   a) e-mail address;
   b) address details:

   • postal code and city;

   • street and house/apartment number;
     c) first and last name;
     d) telephone number.

6. For Entrepreneurs, this scope also includes:
   a) company name;
   b) VAT ID number.

7. When using the contact form, the Customer provides:
   a) e-mail address;
   b) surname;
   c) telephone number.

8. When using the chat, the Customer may provide:
   a) e-mail address;
   b) first and last name;
   c) telephone number.

9. Additional information may be collected during the use of the Online Store website, including: IP address, domain name, browser type, access time, operating system type.

10. Navigational data may also be collected (e.g., links clicked). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) – improving functionality and ease of use of electronic services.

11. For the purpose of establishing, pursuing, and enforcing claims, certain personal data provided by the Customer may be processed, such as name, surname, service usage details, data necessary to prove claims. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

12. Providing personal data is voluntary but necessary to register an account or place an order.

---

§ 2 Data recipients and storage period

1. Customer data are shared with service providers used by NOVARTAG GmbH. Providers act either as processors (acting under NOVARTAG GmbH’s instructions) or as independent controllers.
   a) Processors include hosting providers, accounting services, marketing systems, traffic analysis systems.
   b) Controllers include payment and banking service providers.

2. Service providers are located in Poland and other EEA countries.

3. Personal data are stored:
   a) Based on consent – until consent is withdrawn, then for the limitation period of potential claims (six years or three years depending on the type of claim).
   b) Based on performance of a contract – as long as necessary for contract performance and then for the limitation period.

4. When the Customer places an order, personal data may be transferred to delivery providers:
   a) courier companies;
   b) InPost Paczkomaty Sp. z o.o.;
   c) Poczta Polska S.A.

5. If the Customer chooses payment via przelewy24.pl, personal data are transferred to PayPro S.A.

6. If the Customer chooses the “eRaty Santander Consumer Bank” instalment system, data are transferred to Santander Consumer Bank S.A.

7. If the Customer chooses PayPo, data are transferred to PayPo Sp. z o.o.

8. Navigational data may be used to improve customer service and store performance.

9. If requested, NOVARTAG GmbH may disclose personal data to competent state authorities.

---

§ 3 Cookies and IP address

1. The Online Store uses cookies stored on the Customer’s device if allowed by the browser.

2. NOVARTAG GmbH uses:
   a) session cookies – deleted after the browser session ends;
   b) persistent cookies – remain until deleted or expired.

3. Own cookies are used for:
   a) customer authentication and maintaining sessions;
   b) statistical analysis and improving site structure.

4. External cookies are used for:
   a) promoting the Store via Facebook;
   b) analytics tools (Google Analytics);
   c) presenting the “Rzetelny Regulamin” certificate.

5. The cookie mechanism is safe; users may disable cookies but some functions may stop working.

6. Instructions for disabling cookies are available for various browsers.

7. NOVARTAG GmbH may collect IP addresses for diagnostics, statistics, administration, and security purposes.

8. The Online Store contains links to external websites; NOVARTAG GmbH is not responsible for their privacy policies.

---

§ 4 Rights of data subjects

1. Right to withdraw consent (Art. 7(3) GDPR).

2. Right to object to data processing (Art. 21 GDPR).

3. Right to erasure (“right to be forgotten”) (Art. 17 GDPR).

4. Right to restrict processing (Art. 18 GDPR).

5. Right of access to data (Art. 15 GDPR).

6. Right to rectification (Art. 16 GDPR).

7. Right to data portability (Art. 20 GDPR).

8. Requests are fulfilled within one month unless an extension is required.

9. Customers may submit complaints and requests to the Administrator.

10. Customers may request copies of standard contractual clauses.

11. Customers have the right to lodge a complaint with the President of the Personal Data Protection Office.

---

§ 5 Security management – password

1. NOVARTAG GmbH provides secure, encrypted connections (SSL certificate).

2. If a Customer loses their password, the Online Store enables password reset. Passwords are stored in encrypted form.

3. NOVARTAG GmbH never requests login or password information.

---

§ 6 Changes to the Privacy Policy

1. The Privacy Policy may be amended; Customers will be informed 7 days in advance.

2. Questions regarding the Privacy Policy should be directed to: pl@novartag.de

3. Last modified: 1 April 2024.