Note: This is a machine translation. The Polish version of this document is legally authoritative.

This Privacy Policy sets out the rules for processing and protecting the personal data of Users of the website available at phubomi.pl, as well as the rules for using cookies.

Date of last update: 30.12.2025

§ 1 DATA CONTROLLER

1. The Data Controller is P.H.U. BOMI Michalina Kołcz, with its registered office at ul. Jasińskiego 20, 37-700 Przemyśl, Poland
   1. NIP: 795 104 64 88,
   2. REGON: 650176276,
   3. e-mail: info@phubomi.pl,
   4. phone: +48 16 678 28 68.
2. In all matters relating to the processing of personal data, you may contact the Controller at the e-mail address: info@phubomi.pl.
3. The Controller has not appointed a Data Protection Officer (DPO).

§ 2 PURPOSES, LEGAL BASES AND PERIOD OF DATA PROCESSING

1. Personal data is processed for the following purposes:
   1. handling enquiries and contact requests submitted via the forms on the website – the data is sent to the Controller's e-mail inbox and processed on the basis of Art. 6(1)(b) and (f) GDPR (taking action at the request of the data subject prior to entering into a contract and the Controller's legitimate interest). The data is stored for the period necessary to provide a response and conduct correspondence, and subsequently until the expiry of the limitation period for any claims;
   2. performance of sales contracts and handling of commercial cooperation – Art. 6(1)(b) and (c) GDPR. The data is stored for the duration of the contract and the period required by law (including tax and accounting regulations);
   3. sending the newsletter / marketing information – on the basis of consent, Art. 6(1)(a) GDPR. The data is processed until consent is withdrawn;
   4. analytical and statistical purposes (cookies, analytical tools) – Art. 6(1)(f) GDPR;
   5. establishing, pursuing or defending against claims – Art. 6(1)(f) GDPR.
2. Providing data is voluntary, however it is necessary to use the contact forms, receive an offer or enter into a contract.

§ 3 DATA RECIPIENTS

1. Data recipients may include entities cooperating with the Controller to the extent necessary to achieve the above-mentioned purposes, in particular:
   1. the provider of hosting and e-mail services: OVH (OVH Sp. z o.o.),
   2. providers of analytical tools (Google – Google Analytics, Google Tag Manager) and the cookie consent mechanism (Cookiebot), in accordance with § 5,
   3. accounting office, law firm, courier and transport companies – in connection with order fulfilment,
   4. public authorities authorised under the law.

§ 4 TRANSFER OF DATA OUTSIDE THE EEA

1. As a rule, the Controller does not transfer personal data outside the European Economic Area (EEA).
2. When using the tools of providers based outside the EEA (e.g. Google), data may be transferred to third countries on the basis of standard contractual clauses approved by the European Commission or other mechanisms ensuring an adequate level of data protection.

§ 5 COOKIES AND ANALYTICAL TOOLS

1. The website uses cookies – small text files saved on the User's device.
2. Cookies are used for functional, statistical and marketing purposes.
3. The website uses the following tools:
   1. Google Analytics – analysis of website traffic statistics,
   2. Google Tag Manager – tag management,
   3. Cookiebot – cookie consent management.
4. The User may change the cookie settings in their browser at any time or withdraw consent using the consent window (Cookiebot) on the website.

§ 6 RIGHTS OF DATA SUBJECTS

1. Every person has the right to:
   1. access their data and obtain a copy thereof,
   2. rectify (correct) data,
   3. erase data,
   4. restrict processing,
   5. data portability,
   6. object to processing,
   7. withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal),
   8. lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw).
2. To exercise the above rights, please contact the Controller (details in § 1).

§ 7 AUTOMATED DECISION-MAKING

1. Personal data is not used for automated decision-making, including profiling producing legal effects.

§ 8 FINAL PROVISIONS

1. The Controller reserves the right to amend this Privacy Policy. The current version is always available on the website.
2. In matters not regulated herein, the provisions of the GDPR and generally applicable Polish law shall apply.