Privacy Policy

1. General Provisions

This Privacy Policy sets out the rules for processing the personal data of users of the website and online store available at www.athlecor.com (the "Website" or the "Online Store"), as well as the rules for using cookies and similar technologies.

The controller of personal data processed in connection with the use of the Website is:

ATHLECOR SP. Z O.O. ul. Chodkiewicza 3/21 02-593 Warszawa KRS: 0000963028 REGON: 521633147 NIP: 5213962576 email: athlecor@athlecor.pl tel.: +48 600 060 819

Address for correspondence / returns / complaints:

ATHLECOR SP. Z O.O. ul. Chodkiewicza 3/21 02-593 Warszawa email: athlecor@athlecor.pl tel.: +48 600 060 819

Personal data is processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

The Controller applies appropriate technical and organizational measures to ensure the security of personal data and to protect it against unauthorized access, loss, or modification.

2. Scope of Processed Data

In connection with the use of the Website, the following categories of data in particular may be processed:

a) Data provided in forms (e.g. when registering an account, placing an order, signing up for the newsletter, or using the contact form):

• first name, last name, company name (if applicable),
• email address, phone number,
• delivery address, billing address,
• data needed to issue an accounting document,
• data contained in correspondence (e.g. inquiries, complaints).

b) Data related to order fulfillment:

• information about ordered products,
• payment information (e.g. amount, payment method, date),
• order history.

c) Data collected automatically (system logs, cookies, analytics tools):

• IP address,
• browser type and version, operating system, device type,
• date and time of visit, pages visited, traffic source,
• data from cookies and similar technologies.

Providing personal data is generally voluntary but may be necessary to create an account, fulfill an order, or handle a complaint. Failure to provide required data may prevent the use of a given feature.

3. Purposes, Legal Bases, and Periods of Data Processing

Personal data is processed for the following purposes:

1. Account registration and maintenance. Basis: Art. 6(1)(b) GDPR (performance of a contract for services provided by electronic means). Period: until the account is deleted or claims become time-barred.
2. Conclusion and performance of the sales contract. Basis: Art. 6(1)(b) GDPR. Period: until the limitation periods for claims expire (usually 2 years for consumer claims, up to 6 years for general claims).
3. Fulfillment of tax and accounting obligations. Basis: Art. 6(1)(c) GDPR (legal obligation). Period: 5 years from the end of the tax year.
4. Handling inquiries and correspondence. Basis: Art. 6(1)(b) GDPR (before concluding a contract) or Art. 6(1)(f) GDPR (legitimate interest: communication). Period: until the matter is closed and any claims become time-barred.
5. Handling complaints. Basis: Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR. Period: for the duration of statutory warranty liability and until claims become time-barred.
6. Newsletter. Basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (direct marketing). Period: until consent is withdrawn or an objection is raised.
7. Direct marketing and profiling. Basis: Art. 6(1)(f) GDPR (the Controller's legitimate interest). Period: until an objection is raised.
8. Analytics and statistics. Basis: Art. 6(1)(f) GDPR (improving the Website). Period: until an effective objection is raised or the data is deleted.
9. Establishing, pursuing, or defending claims. Basis: Art. 6(1)(f) GDPR. Period: until the limitation periods for claims expire.

4. Data Recipients

Users' personal data may be shared with the following categories of recipients:

• IT service providers (hosting, system maintenance, store software providers),
• providers of order management and integration systems (e.g. BaseLinker),
• providers of accounting, legal, and advisory services,
• courier companies and postal operators handling delivery,
• providers of analytics and marketing tools, including Google Ireland Ltd., Microsoft Corporation, Meta Platforms Ireland Limited, Klaviyo, Inc.,
• payment service providers, in particular Autopay S.A.

For online payments, the data necessary to process the payment is transferred to: Autopay S.A., with its registered office in Sopot, ul. Powstańców Warszawy 6, 81-718 Sopot, KRS: 0000320590. Autopay acts as a separate data controller (details in the Autopay privacy policy available at autopay.pl).

5. Profiling

The Controller may use data for marketing profiling (e.g. selecting newsletter content, advertising based on browsing history). This profiling does not produce legal effects for the user and does not significantly affect the user. It only serves to tailor the offer.

6. User Rights

Users have the following rights under the GDPR:

1. The right of access to data (Art. 15 GDPR).
2. The right to rectification of data (Art. 16 GDPR).
3. The right to erasure of data ("the right to be forgotten", Art. 17 GDPR).
4. The right to restriction of processing (Art. 18 GDPR).
5. The right to data portability (Art. 20 GDPR).
6. The right to object to data processing (Art. 21 GDPR), including direct marketing.
7. The right to withdraw consent (without affecting the lawfulness of processing carried out before its withdrawal).
8. The right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, Warszawa).

Requests to exercise these rights can be sent to: athlecor@athlecor.pl.

7. Cookies and Third-Party Tools

The Website uses cookies to ensure proper operation, remember settings, compile statistics, and support marketing activities. Cookies can be managed in browser settings.

The Website uses tools from the following providers, among others:

• Google Analytics and Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland): traffic analysis and marketing tag management. The Controller uses IP anonymization. Data may be transferred to Google LLC (USA) under the EU-US Data Privacy Framework.
• Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA): a tool for analyzing user behavior on the site, recording session replays, heatmaps, and mouse cursor movements. The tool may record data about user behavior while browsing the Website, including clicks, scrolling, and navigation patterns. Data is transferred to Microsoft servers outside the EEA under standard contractual clauses. The Microsoft privacy statement is available at: privacy.microsoft.com/pl-pl/privacystatement
• Meta Platforms Ireland Limited (4 Grand Canal Square, Dublin 2, Ireland): the Meta Pixel for remarketing and social media integration. With regard to running the fan page and processing statistical data collected by the Meta Pixel, the Controller and Meta Platforms Ireland Limited are joint controllers. Data may be transferred to Meta Platforms, Inc. (USA).
• Klaviyo (Klaviyo, Inc., 125 Summer St., Boston, MA 02110, USA): an email and SMS marketing automation platform used to send the newsletter and personalized marketing messages. Data is transferred to the USA under standard contractual clauses. The Klaviyo privacy notice is available at: klaviyo.com/legal/privacy-notice
• Sourcebuster.js: a tool for identifying traffic sources (UTM parameters, referral source). Data is processed entirely in the user's browser.
• Payment systems (Autopay S.A., banks): online payment processing. Details in section 4.

Detailed information on how external providers process data can be found in their privacy policies.

8. Newsletter

Users can sign up for the newsletter. Unsubscribing is possible at any time via the link in the email footer or by sending a message to athlecor@athlecor.pl.

9. Data Transfers Outside the EEA

Data may be transferred outside the EEA in connection with the use of tools provided by companies such as Google, Meta, Microsoft, and Klaviyo. The Controller ensures that such transfers take place on the basis of appropriate legal mechanisms: an adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR).

10. Contact

In matters related to personal data protection, contact: ATHLECOR SP. Z O.O.ul. Chodkiewicza 3/21 (correspondence address) 02-593 Warszawa email: athlecor@athlecor.pl tel.: +48 600 060 819.