General information

This document sets out the principles of the privacy policy of the naxpower.com website (hereinafter referred to as the “Website”). The Website Administrator is NAC Spółka z ograniczoną odpowiedzialnością [limited liability company] with its headquarters in Raszyn, Al. Krakowska 39, 05-090 Raszyn, registered in the National Court Register by the District Court for the capital city of Warsaw in Warsaw, XIV Commercial Division of the National Court Register, under KRS number: 0000137349 NIP [tax ID]: 5342208485 REGON [National Official Business Register]: 0152642270, share capital: 6,090,000 PLN.

Personal data collected by the Website Administrator are processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJEU L 119/1), hereinafter referred to as: GDPR.

The Website Administrator makes special efforts to protect the privacy and information provided to him, regarding the Website’s Customers. The Administrator selects and applies appropriate technical measures, including such of programming and organisational nature, with due diligence, that ensure protection of processed data, and, in particular, protect the data from being accessed by unauthorised parties, against their disclosure, loss, destruction or unauthorised modification, as well as from being processed in infringement of the applicable law.

The Website is not addressed to persons under 18 years of age. The Personal Data Controller does not provide for the deliberate collection of data regarding persons under 18 years of age. The use of the Website is tantamount to a declaration of being 18 years old.

Personal Data

Personal Data Controller

The Controller of your personal data is:

NAC Sp. z o.o.

Al. Krakowska 39, 05-090 Raszyn

Regarding your personal data, you can contact the Personal Data Controller via: • email: info@naxpower.com

• mail: Al. Krakowska 39, 05-090 Raszyn
• phone: +48 22 314 93 79

Purposes and legal framework for processing of personal data

The Personal Data Controller processes your personal data for the following purposes and within the following scope: in order to provide Services that do not require the creation of an account and the purchase of goods, i.e. browsing the Website, Goods search engine, we process personal data regarding your activity on the Website, i.e. data regarding the Goods viewed by you, data regarding sessions of your device, operating system, browser, location, unique ID, IP address;

in order to create statistics on the use of individual functionalities available on the Website, to facilitate the use of the Website and to ensure the IT security of the Website, we process personal data regarding your activity on the Website and the amount of time spent on each of the subpages of the Website, your search history, location, IP address, device ID, data about your web browser and operating system;

in order to examine claims, complaints and inquiries and to answer Customers’ questions we process the personal data provided by you in the contact form, claims and inquiries, or to answer questions posed in another form, including by phone or in writing, and certain personal data provided by you in the contact form available on the Website, an email message, during a telephone conversation or in postal correspondence, as well as data regarding the ordering of goods and other services rendered by us that are the reason for a claim, complaint or inquiry, as well as the data contained in documents attached to claims, complaints and inquiries;

in order to market goods and services originating from us and from our customers and partners, including remarketing; for this purpose we process data concerning your activity on the Website, which are recorded and stored via cookies, in particular the search history, the login dates, the history and your activity related to our communication with you. In the case of remarketing, we use data concerning your activity with the purpose to reach you with our marketing messages outside of the Website; we use services of external suppliers for this purpose as well. These services consist in displaying our messages on websites other than the Website. For details on this subject see the provisions regarding cookies;

The Website is not intended for submitting claims and notifications related to the purchase of goods via the online store at www.topmarket.pl. To this end, fill in the form available at https://www.topmarket.pl/rma/

Categories of personal data collected and processed

The Personal Data Controller processes the following categories of personal data: contact data, i.e. first name, surname, electronic address (email), home address, telephone number;

data on the activity on the Website;

data regarding inquiries, complaints, inquiries and requests related to the operation of the Website;

data regarding marketing services.

Voluntary provision of personal data

The provision of the mandatory personal data by you is voluntary; however, it is conditional for answering the question or considering the notification or claim by the Personal Data Controller via the Website, by email, telephone or in writing. In the case of an inquiry submitted via the contact form, it is mandatory to provide at least the email address and the content of the inquiry.

Data processing time

Personal data will be processed for the period necessary for the performance of services consisting in the provision of information and answers to inquiries, marketing activities and other services rendered for the Customer as well as for possible seeking of redress. The personal data will be deleted in the following cases: when the data subject requests their removal or withdraws his or her consent;

one year after the information/response to the inquiry has been given

if the data subject does not take any action after the claim has been examined – after the expiry of the limitation period for the claims to which the claim is related (as a rule, six years for consumers or three years for entrepreneurs);

after having obtained reliable information that the stored data are out of date.

Certain data in this respect, i.e. email address, first name and surname, may be stored for a further period of three years or longer if it is necessary for evidentiary purposes, in the event of seeking redress related to services provided by the Website – this data will not be used for marketing purposes.

We store customer-related data for a period of time corresponding to the life cycle of the cookies stored on devices or until they are deleted on the Customer’s device by the Customer.

Your personal data regarding preferences, behaviours and choice of marketing content can be used as basis for automated individual decision-making aimed at the presentation of an offer for goods and services provided via the Website – known as profiling; however, profiling will not be used to make any decisions affecting your legal situation and will not have any legal effect.

Personal Data recipients

We transfer your personal data to the following categories of recipients, upon their request: state authorities, e.g. the prosecutor’s office, police, President of the Personal Data Protection Office (UODO), President of the Office of Competition and Consumer Protection (UOKiK),

service providers used by us to operate the Website.

Data subject rights

Under the GDPR, you have the right: to request access to your personal data;

to request rectification of your personal data;

to request erasure of your personal data;

to requests restriction of the personal data processing;

to object to the processing of personal data;

to request a transfer of personal data.

The Personal Data Controller shall, without undue delay and in any case not later than within one month of the reception of the request, provide you with information about the actions taken in relation to your request. If necessary, the period of one month may be extended by another two months due to the complex nature of the request or the number of requests.

In any event, the Personal Data Controller shall inform you about such an extension within one month of receiving the request, stating the reasons for the delay.

Right of access to personal data (Article 15 of the GDPR)

You have the right to obtain from the Personal Data Controller confirmation as to whether or not your personal data
are being processed.

If the Controller processes your personal data, you have the right: to access to the personal data;

to obtain information on the purposes of the processing, the categories of personal data processed, the recipients or categories of recipient of such data, the envisaged period for which the personal data will be stored, or the criteria used
to determine that period, on your rights under the GDPR and the right to lodge a complaint with a supervisory authority, on the source of these data, on the existence of automated decision-making, including profiling and the safeguards applied in connection with the transfer of such data to third countries, provided that they are transferred to them, i.e. outside the European Union and countries belonging to the European Economic Area (EEA);

to receive copies of your personal data;

If you want to request access to your personal data, please submit your request to: info@naxpower.com.

Right to rectification of personal data (Article 16 of the GDPR)

If your personal data are inaccurate, you have the right to request from the Controller an immediate rectification of your personal data.

You also have the right to request from the Controller to have your personal data completed.

If you want to request the rectification or completion of your personal data, please submit your request to: info@naxpower.com.

Right to erasure, the ‘right to be forgotten’ (Article 17 of the GDPR)

You have the right to request the Personal Data Controller to erase your personal data when: your personal data are no longer necessary in relation to the purposes for which it was collected or otherwise processed;

you have withdrawn withdraws consent, to the extent to which the personal data has been processed based on your consent;

your personal data have been unlawfully processed;

you have objected to the processing of your personal data for the purposes of direct marketing, including profiling, to the extent to which the processing of personal data is related to direct marketing;

you have raised an objection to the processing of your personal data in connection with the processing necessary for the performance of a task carried out in the public interest or the processing necessary for the purposes of legitimate interests of the Personal Data Controller or a third party.

Despite submitting a request to erase personal data, the Personal Data Controller may process your data further for the purpose of establishment, exercise or defence of your legal claims, of which you will be informed.

If you want to request erasure of your personal data, please submit your request to: info@naxpower.com

Right to request restriction of personal data processing (Article 18 of the GDPR)

You have the right to request a restriction of the processing of your personal data when: you question the correctness of your personal data – the Personal Data Controller will restrict the processing of your personal data for a time allowing the verification of the correctness of this data;

when the processing of your data is unlawful, and instead of an erasure of personal data you request a restriction of the processing of your personal data;

your personal data are no longer needed for processing purposes, but are needed for the establishment, exercise or defence of your legal claims;

when you have raised an objection to the processing of your personal data – until it has been determined whether the legitimate interests pursued by

the Personal Data Controller override the grounds indicated in your objection.

If you want to request restriction of the processing of your personal data, please submit your request to: info@naxpower.com

Right to object personal data processing (Article 21 of the GDPR)

You have the right to object at any time to the processing of your personal data, including profiling, in connection with: processing for purposes arising from the legitimate interests pursued by the Controller or by a third party;

• processing for direct marketing purposes.

If you want to object the processing of your personal data, please submit your request to: info@naxpower.com.

Right to portability of the personal data (Article 20 of the GDPR)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit those data to another personal data controller.

You can also request to have the personal data transmitted directly from the Personal Data Controller to another controller, where technically feasible.

If you want to request a transmission of your personal data, please submit your request to: info@naxpower.com

Right to withdraw consent

You have the right to withdraw your consent at any time

The withdrawal of consent to the processing of personal data shall not affect the lawfulness of processing based on your consent before its withdrawal.

If you want to withdraw your consent to the processing of your personal data, submit your request to the address: info@naxpower.com or use the appropriate functionalities in your Account.

Complaint with the supervisory authority

If you think that the processing of your personal data infringes on the GDPR, you have the right to lodge a complaint with the supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office (PUODO).”