User Rights & Consent Policy

The Data Controller responsible for processing your personal data is the operator of this platform. Contact details for data-protection enquiries, including the Data Protection Officer (where appointed), are available via the contact page or by written request to our registered address.

We may collect and process the following categories of personal data:

• Identity data: full name, username, or similar identifier.
• Contact data: email address, phone number, postal address.
• Usage data: IP address, browser type, pages visited, interaction timestamps.
• Transaction data: purchase history, payment method metadata (not full card details).
• Preference data: language, dietary requirements, marketing opt-ins.
• Communications data: messages sent through the platform's contact or messaging features.

We rely on the following legal bases under GDPR Article 6:

• Consent (Art. 6(1)(a)): where you have given clear, freely-given, specific, informed, and unambiguous consent — e.g., marketing communications or optional analytics.
• Contract (Art. 6(1)(b)): processing necessary to perform a contract with you, such as account management or order fulfilment.
• Legal obligation (Art. 6(1)(c)): processing required to comply with applicable laws (e.g., tax or anti-fraud obligations).
• Legitimate interests (Art. 6(1)(f)): processing for our legitimate interests, such as fraud prevention and platform security, provided such interests are not overridden by your rights.

Where consent is the chosen legal basis:

• Consent is obtained through a clear, affirmative action (e.g., ticking an un-pre-ticked checkbox).
• The request is presented in plain language, separate from other terms and conditions.
• A record of consent — including the version of the consent text, timestamp, and method — is stored.
• Consent is never bundled or made a pre-condition for a service unless strictly necessary.

Under GDPR Chapter III, you have the following rights:

• Right of access (Art. 15): obtain confirmation of whether your data is processed, and receive a copy.
• Right to rectification (Art. 16): have inaccurate or incomplete data corrected without undue delay.
• Right to erasure — "right to be forgotten" (Art. 17): request deletion of your data where no longer necessary or where consent is withdrawn.
• Right to restriction of processing (Art. 18): request that processing be restricted in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format and transmit it to another controller.
• Right to object (Art. 21): object to processing based on legitimate interests, including profiling.
• Rights related to automated decision-making (Art. 22): not be subject to solely automated decisions that produce significant effects, unless you have given explicit consent or it is necessary for a contract.

You may exercise any of the rights listed above free of charge by submitting a written request to our Data Protection contact (available on the Contact page). We will respond within 30 calendar days of receipt. We may request proof of identity before processing your request. If we are unable to action your request, we will explain the reasons in writing.

Where processing is based on consent, you have the right to withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal. You may withdraw consent by:

• Updating your preferences in your account settings.
• Clicking "unsubscribe" in any marketing email.
• Contacting us directly via the data-protection contact point.

Following withdrawal, we will cease the relevant processing activity as soon as technically feasible, and no later than within 72 hours.

Personal data is retained only for as long as necessary for the purposes for which it was collected, or as required by law. Retention periods are documented in our internal Records of Processing Activities (RoPA). Upon expiry of the applicable retention period, data is securely deleted or anonymised.

We use cookies and similar technologies to operate the platform and — where consent is required — to deliver analytics and personalised content. A cookie consent banner is presented on first visit and captures granular consent per category (strictly necessary, functional, analytics, marketing). Your preferences can be updated at any time via the Cookie Settings panel.

If personal data is transferred outside the European Economic Area (EEA), we ensure an equivalent level of protection through one of the following safeguards: an adequacy decision by the European Commission; Standard Contractual Clauses (SCCs) approved under Art. 46 GDPR; or other approved transfer mechanisms. Details of applicable safeguards are available on request.

You have the right to lodge a complaint with the competent supervisory authority in your Member State. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO) — uodo.gov.pl. We nevertheless encourage you to contact us first so that we may resolve any concern directly.

We may update this Policy periodically to reflect changes in law or our practices. Material changes will be communicated via platform notification or email at least 14 days before taking effect. Continued use of the platform after the effective date constitutes acknowledgement of the updated Policy. We will re-request consent where legally required.