How is your personal data processed?

This Privacy Policy is addressed to users who visit the website www https://www.cudovero.com and use the services available on it, such as the online store and the contact form.

In the remainder of this document, the website together with its related services will be jointly referred to as the Service. The Policy describes the rules for collecting and using the data of the Service’s users, which is collected directly from them or through cookies and similar technologies.

The data controller and how to contact them.

The controller of the data processed in connection with the use of the Service is DNL Equity Partners Sp. z o.o., with its registered office in Gdynia [81-389], ul. Świętojańska 87, KRS 0000989577, NIP 586-238-41-13, REGON 523009944, contact details: tel. +48 794 665 579.

The Controller can be contacted at the e-mail address: kontakt@cudovero.com or in writing at the address: 81-389 Gdynia, ul. Świętojańska 87.

Scope of the data collected

1. During a visit to the Service, data related to activity is collected automatically, such as the time spent on the site, search phrases, the number of subpages viewed, and the date and source of the visit.

2. The user may provide their data in order to register an account in the online store. The form requires identification and contact data to the extent necessary to use the account and complete purchases. It is also possible to provide additional data, but this is optional. The user’s account will record their orders, favorite products, payment history, complaints, etc.

3. In the case of purchases without registering an account, the user provides the data necessary to purchase, pay for and receive the order.

4. The Service allows the user to contact the Controller and provide them with identification and contact data, as well as data related to the content of the message.

5. With the user’s consent, their contact and/or analytical data may be collected for marketing purposes.

Processing for analytics purposes

1. 1. The Service uses Google Analytics tools, which collect information about users’ visits, including the time spent on the site, the subpages visited and the source of the visit.

   2. The user can block the operation of Google Analytics by installing the plug-in provided by Google: https://tools.google.com/dlpage/gaoptout

Source of the data

1. We collect data directly from users.

2. A user may provide the data of another person authorized to receive their order — in that case the user is the source of the order recipient’s data.

Purpose and legal basis for processing personal data

Data may be processed for the purpose of:

• analyzing network traffic, ensuring security within the Service and adapting content to users’ needs, on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR);

• answering questions asked, providing the requested offer and conducting correspondence in order to handle a matter, on the basis of consent and the Controller’s legitimate interest, namely fulfilling users’ requests (Article 6(1)(a) and (f) GDPR);

• setting up and using an account in the online store, on the basis of the contract for the provision of electronic services concluded with the user as the service recipient (Article 6(1)(b) GDPR);

• purchases in the online store, on the basis of a distance contract (Article 6(1)(b) GDPR);

• handling complaints, on the basis of the seller’s legitimate interest (Article 6(1)(f) GDPR);

• promoting goods and services or providing an offer, on the basis of the user’s consent (Article 6(1)(a) GDPR).

Right to withdraw consent

If consent is the basis for processing the data, it may be withdrawn at any time using the contact details available in the Service. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

Obligation or voluntariness of providing data

1. Providing data is voluntary but necessary. Failing to provide it will make it impossible, respectively, to:

   1. complete an order;

   2. set up an account in the online store;

   3. handle a complaint;

   4. receive an offer or ordered marketing materials;

   5. receive an answer to the question asked.

2. Providing the data necessary for the statistical analysis of the Service’s users is voluntary. You can use the so-called incognito mode to browse the site without sharing information about your visit to the Service with the Controller. Using incognito mode, and thus not providing data, does not affect your ability to use the Service.

Rights arising from the GDPR regarding the processed data

1. 1. 1. Every user of the Service has the right to:

• request access to their data from the Controller, as well as to obtain a copy of it (Article 15 GDPR);

• request that the Controller rectify or correct the data (Article 16 GDPR) — with regard to a request for rectification, when they notice that the data is incorrect or incomplete;

• request that the Controller erase the data (Article 17 GDPR);

• request that the Controller restrict processing (Article 18 GDPR) — e.g. when they notice that the data is incorrect, they may request that the processing of their data be restricted for a period allowing us to verify the accuracy of that data);

2. The user has the right to withdraw consent at any time, if the processing is carried out on the basis of consent.

2. At any time, you have the right to lodge a complaint with the President of the Personal Data Protection Office (www.uodo.gov.pl) about the processing carried out by the Controller.

Recipients of the personal data

The recipients of the personal data may only be entities authorized to receive it under the provisions of law (e.g. the Police or a court, in connection with proceedings being conducted). In addition, the data may be made available to couriers, postal operators, the hosting provider and the mail server provider.

The recipients of the data may be entities providing IT services to the Controller and the provider of the Google Analytics tools — Google Ireland Ltd.

Data retention period

Personal data will be stored:

• in the case of setting up an online account, for the duration of its use, and after it is closed the Controller will store billing data for 5 years following the year in which the tax obligation related to the order arose;

• data relating to settlements, for 5 years following the year in which the tax obligation related to the order arose;

• until consent is withdrawn or until the matter is resolved, and subsequently until the limitation period for the parties’ claims related to its fulfillment expires;

• in the case of a complaint, until any potential claims become time-barred;

• data related to the analysis of network traffic collected through cookies and similar technologies may be stored until the cookie expires. Some cookies never expire, and therefore the data retention period will be equivalent to the time necessary for the Controller to fulfill the purposes related to data collection, such as ensuring security and analyzing historical data related to site traffic.

Transfer of data to a third country or international organization

Users’ data may be transferred outside the European Economic Area (EEA), in particular to Google LLC, with its registered office in the USA.

Google LLC participates in the EU-US Data Privacy Framework, which has been recognized by the European Commission as providing an adequate level of personal data protection (European Commission decision of 10 July 2023).

In situations where data would be transferred to third countries not covered by a European Commission decision confirming an adequate level of protection, the Controller applies appropriate safeguards, such as standard contractual clauses (in accordance with Article 46 GDPR).

The user may obtain a copy of the safeguards concerning the transfer of data outside the EEA by sending a request to the Controller’s address.

Use of cookies and similar technologies

2. 1. 1. The Service allows information about the user to be collected through cookies and similar technologies, the use of which most often involves installing this tool on the user’s device (computer, smartphone, etc.). This information is used to remember the user’s decisions (choice of font, contrast, acceptance of the policy), maintain the user’s session (e.g. after logging in), remember the password (with consent), collect information about the user’s device and their visit for the purpose of ensuring security, and also to analyze visits and adapt content.

2. 1. 2. Information obtained through cookies and similar technologies is not combined with other data of the Service’s users, nor is it used to identify them by the Controller.

3. The user can set their browser to block certain types of cookies and other technologies, by specifying, for example, that only those that are necessary for the correct display of the site will be allowed. By default, most browsers permit the use of all cookies, but the user can change these settings at any time, and can also delete cookies that have already been installed. Each browser allows this through one of the options available in the settings or preferences. Detailed instructions are posted on the website of the manufacturer of the internet browser being used (the Help function). Instructions on how to disable cookie support in individual browsers can be found on the following pages:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=pl

Mozilla Firefox: https://support.mozilla.org/pl/kb/blokowanie-ciasteczek

Internet Explorer: https://support.microsoft.com/pl-pl/topic/jak-usun%C4%85%C4%87-pliki-cookie-w-programie-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

Safari: https://support.apple.com/pl-pl/guide/safari/sfri11471/mac

Opera: https://help.opera.com/pl/latest/web-preferences/#cookies

3. The user can also use the site in the so-called incognito mode, which blocks the possibility of collecting data about their visit.

3. In addition, the Controller may use cookies and similar technologies for marketing and analytics purposes, however only with the user’s voluntary and explicit consent, which they are asked for through appropriate technical solutions available in the Service. The user can change the cookie usage settings at any time. They can also delete them manually at any time.

Final provisions

3. 1. 1. The Policy is effective as of 1 October 2025.

3. 1. 2. The Controller reserves the right to make changes to the Privacy Policy in connection with the development of technology, changes in the law or the expansion of the Service’s functionality.

3. 1. 3. The user will be informed of any change to the Policy through its re-publication in the Service and an appropriate notice.