This Privacy and Cookies Policy (hereinafter referred to as the “Privacy Policy”) sets forth the rules for the processing of Customers’ personal data (the definition of Customer is explained in the Terms and Conditions of the Store) obtained through the online store available at the following web address: amumu.pl (hereinafter referred to as the “Store”).

If you have any concerns about the privacy policy, you can contact us at any time by sending an email to kontakt@amumu.pl.

# 1: Who is the controller of your personal data?

The administrator of your personal data is Kamila Dudojć conducting business under the name “Ilantris Kamila Dudojć” with permanent place of business at Kossaka 101, 64-920 Pila, NIP: 7642616373, REGON: 367435050, e-mail address: kontakt@amumu.pl, tel: 570 977 355

#2: Who can you contact regarding the processing of your personal data?

As part of the implementation of data protection in our organization, we have decided not to appoint a data protection officer due to the fact that it is not mandatory in our situation. You can contact kontakt@amumu.pl. by e-mail on matters related to data protection and privacy more broadly;

# 3: What information do we have about you?

Depending on the purpose, we may process the following information about you:

• name,
• residential address,
• business address,
• tax ID number,
• email address,
• phone number,
• data contained in correspondence addressed to us,
• details of orders placed,
• bank account number,
• IP address,
• image (profile photo),
• activity in relation to newsletters sent.

We have described the scope of the processed data precisely for each processing purpose. Information in this regard can be found later in this policy.

§ 4: How do we have your personal information?

In most cases, you give them to us yourself. This happens when:

• you register a user account,
• you place an order,
• you send complaints or withdraw from the contract,
• you sign up for the newsletter,
• add a comment or review about the product,
• you contact us.

In addition, some information about you may be automatically collected by tools we use:

• The mechanism of the site and the newsletter system collect your IP address,
• The mechanism of the newsletter system collects information about your activity with regard to the content sent to you within the newsletter, such as opening messages, clicking on links, etc.

# 5: Is your data safe?

We care about the security of your personal information. We have analyzed the risks involved in the various processes of processing your data, and then implemented appropriate security and data protection measures. We continuously monitor the state of our technical infrastructure, train our staff, look at the procedures in place, and make the necessary improvements. If you have any questions about your personal information, we are at your service at kontakt@amumu.pl.

# 6: For what purposes do we process your personal data?

These targets are more than one. Below is a list of them, followed by a more detailed discussion. We have also assigned to each purpose the corresponding legal basis for processing.

• User account registration and maintenance – art. 6 ust. 1 lit. b RODO,
• order handling – art. 6 ust. 1 lit. b RODO,
• handling of complaints or withdrawal from the contract – art. 6 ust. 1 lit. f RODO,
• newsletter mailing – art. 6 ust. 1 lit. a RODO,
• handling comments or product reviews – art. 6 ust. 1 lit. a RODO,
• mail handling – art. 6 ust. 1 lit. f RODO,
• Implementation of tax and accounting obligations – art. 6 ust. 1 lit. c RODO,
• creation of an archive for the possible need to defend, establish or assert claims, as well as for the identification of a returning customer – art. 6 ust. 1 lit. f RODO,
• self-marketing – art. 6 ust. 1 lit. f RODO.

User account – details

When you create a user account, you need to provide the necessary information: email address and password. Provision of data is voluntary, but necessary to create an account.

As part of editing your account data, you can provide your further data, in particular, data that can be used to place orders, such as your name, address of residence or place of business, tax ID number, telephone number. As part of editing your account details, you can also set your avatar, such as a profile picture that includes an image.

In addition, our system used for user accounts records your IP number, which you used when registering a user account.

The data provided by you in connection with the creation of an account is processed for the purpose of providing you with an electronic service consisting of providing you with a user account. This service is provided on the basis of a contract concluded under the terms and conditions described in the regulations, which means that in this regard the legal basis for the processing of your personal data is art. 6 ust. 1 lit. b RODO.

The data will be stored for the duration of the user’s account. You can decide to delete your account at any time, however, this will not lead to the removal of information about your orders placed using your account from our database. Order data is stored in our archive until the expiration of the statute of limitations for claims under the contract / for the entire period of operation of the site due to ensuring the possibility of identifying the returning customer, reconstructing his purchase history, discounts granted, etc., which is our legitimate interest referred to in Art. 6 ust. 1 lit. f RODO.

Orders – details

When placing an order, you must provide the data necessary to process the order. Depending on the details of the order, the data directory may be different. For example, if you order physical products, we need to know the address where we will deliver your order. If you are requesting a VAT invoice for a company, we need to know the tax ID number and business address. Provision of data is voluntary, but necessary to place an order.

In addition, our system used to handle the order process records your IP number, which you used when placing the order.

Each order is saved in our database, which means that your personal information assigned to the order is also accompanied by order information such as the products ordered, the selected payment method, the selected delivery method, the date of payment.

Data collected in connection with an order, is processed for the purpose of executing the contract concluded by placing the order (Art. 6(1)(b) RODO), issuing an invoice (Art. 6(1)(c) RODO in connection with the regulations governing the issuance of invoices), including the invoice in the accounting records and fulfilling other tax and accounting obligations (Art. 6(1)(c) RODO in connection with the provisions governing tax and accounting obligations) and for archival purposes for the possible need to defend, establish or assert claims, as well as to identify a returning customer, which is our legitimate interest (Art. 6(1)(f) RODO).

Order data will be processed for the time necessary for the execution of the order, and then until the expiration of the statute of limitations for claims under the concluded contract. In addition, after the expiration of this period, the data may still be processed by us for archival purposes for the possible need to defend, establish or assert claims, as well as to identify the returning customer. Remember also that we are required to keep accounting records, which may contain your personal information, for the period required by law.

Complaints and withdrawals – details

If you make a complaint or withdraw from the contract, you provide personal data contained in the body of the complaint or statement of withdrawal from the contract, which includes name, address, telephone number, e-mail address, bank account number. Provision of data is voluntary, but necessary to make a complaint or withdraw from the contract.

The data provided to us in connection with the filing of a complaint or withdrawal from the contract is used for the purpose of the complaint procedure or withdrawal procedure, and then for archival purposes, which is our legitimate interest (Article 6(1)(f) RODO).

Data will be processed for the time necessary to carry out the complaint procedure or withdrawal procedure. Complaint documents will be kept until the expiration of warranty rights. Statements of withdrawal will be kept with accounting records for the period required by law.

Newsletter – details

By signing up for the newsletter, you give us your name and email address. Providing data is voluntary, but necessary to subscribe to the newsletter.

In addition, our system used for the newsletter, records your IP number you used when signing up for the newsletter, determines your approximate location, the email client you use for email, and tracks your actions taken in connection with emails sent to you. Therefore, we also have information about which messages you opened, within which messages you clicked on links, etc.

The data provided to us by you in connection with signing up for the newsletter, is used for the purpose of sending you the newsletter, and the legal basis for its processing is your consent (Article 6(1)(a) RODO) given when signing up for the newsletter. Regarding the processing of information that does not come from you, but is collected automatically by our mailing system, we rely in this regard on our legitimate interest (Article 6(1)(f) RODO) to analyze the behavior of newsletter subscribers in order to optimize mailing activities.

You can unsubscribe from the newsletter at any time by clicking on the dedicated link included in each message sent as part of the newsletter or by simply contacting us. Despite your unsubscribing from the newsletter, your data will continue to be stored in our database for the purpose of identifying the returning subscriber and for the possible defense of claims related to the sending of the newsletter to you, in particular for the purpose of proving the fact that you gave your consent to receive the newsletter and the moment of its withdrawal, which is our legitimate interest referred to in Article 6 ust. 1 lit. f RODO.

You can modify your information provided for the purpose of receiving the newsletter at any time by clicking on the appropriate link visible in each message sent as part of the newsletter or simply by contacting us.

Comments and product reviews – details

When adding a comment or product review, you must provide at least a username that will be assigned to the comment or review (the name may include personal information, such as first or last name) and an email address. Providing this data is voluntary, but necessary to add a comment or opinion. You can also add your avatar (can include your image, such as a photo) and provide your website address, but it is not mandatory.

Data provided in connection with the addition of a comment or opinion will be processed in order to publish the comment or opinion on the site. The basis for processing is your consent (Article 6(1)(a) resulting from the submission of the form used to publish a comment or opinion. You can revoke your consent at any time by requesting that your comment or review be removed.

Your comment or opinion will be publicly available on the site for the duration of its availability on the Internet, unless you request the removal of the comment or opinion beforehand. At any time you can also modify the content of the comment, as well as modify the data assigned to it as about the person who added the comment or opinion.

Mail handling – details

When you contact us, you naturally provide us with your personal information contained in the body of your correspondence, in particular your e-mail address and name. Provision of data is voluntary, but necessary to make contact.

Your data in this case is processed for the purpose of contacting you, and the basis for processing is art. 6 ust. 1(f) RODO, i.e. our legitimate interest. The legal basis for post-contact processing is also our legitimate purpose of archiving correspondence for the purpose of ensuring that we can prove certain facts in the future (Article 6(1)(f) RODO).

The content of the correspondence may be subject to archiving and we are unable to clearly determine when it will be deleted. You have the right to request the history of correspondence you have had with us (if archived), as well as to request its deletion, unless its archiving is justified by our overriding interests, such as defense against potential claims on your part.

Tax and accounting obligations – details

If we issue an invoice to you, it becomes part of your accounting records, which will be kept for the period of time required by law. Your personal data is then processed for the purpose of fulfilling our tax and accounting obligations (Article 6(1)(c) of the RODO in conjunction with the regulations governing tax and accounting obligations).

Archive – details

As part of the description of the various purposes of personal data processing above, we have indicated the time limits for storing personal data. These deadlines are often related to our archiving of certain data for the purpose of ensuring that we can prove certain facts in the future, reconstruct the course of cooperation with the customer, exchanged correspondence, defense, establishment or assertion of claims. In doing so, we rely on our legitimate interest referred to in Art. 6 ust. 1 lit. f RODO.

Self-marketing – details

As part of our site, we use a mechanism to recover abandoned shopping carts. In a situation where you start the ordering process but do not complete it, our system will note this fact in order to take action to get you to finalize your order. These actions could be, in particular, sending you an email with an incentive to finalize your order or displaying a targeted advertisement while you are browsing the Internet.

We carry out the activities described above based on our legitimate interest referred to in Art. 6 ust. 1(f) of the RODO consisting of marketing its own products. You can oppose the activities conducted in this way at any time.

# 7: How long will we keep your personal data?

Data retention periods are indicated separately for each purpose of processing. You will find this information within the details dedicated to each separate processing purpose.

We draw your attention to the fact that we have adopted a model of storing your order data for the entire period of operation of our website. We conclude that this works to your benefit, as you can retrieve your purchase history at any time, and additionally benefit from discounts, if we provide any for our regular customers. However, if you do not want your order data to be stored for such a long time, you can object to its storage for the described purpose at any time. However, we inform you that we see our overriding interest in storing your order data until the expiration of the statute of limitations for claims under the sales contract with us.

# 8: Who are the recipients of your personal data?

We would venture to say that modern business cannot do without third-party services. We also use such services. Some of these services involve the processing of your personal data. Third-party service providers who are involved in the processing of your personal data are:

• A web host that stores data on a server,
• A cloud service provider that stores backups that may contain your personal data,
• The provider of the mailing system where your data is stored if you are a newsletter subscriber,
• The provider of the CRM system where we store your data to improve the customer service process and for archival purposes,
• Provider of an invoicing system that stores your data for invoicing,
• Accounting office that processes your data shown on invoices,
• A maintenance service provider who gains access to data if the technical work carried out concerns areas where personal data is located,
• other subcontractors who gain access to the data, if the scope of their activities requires such access.

All entities listed above process your data on the basis of personal data processing entrustment agreements with us and guarantee an adequate level of personal data protection.

Your data is shared with courier companies to the extent necessary to deliver your order. These companies become independent controllers of your personal data.

If necessary, your data may be shared with a legal advisor or lawyer bound by professional secrecy. The need may arise from a legal necessity requiring access to your personal information.

Your personal data may also be transferred to the tax authorities to the extent necessary to carry out tax, accounting and settlement obligations. This includes, in particular, all declarations, reports, statements and other accounting documents that contain your personal data.

In addition, if necessary, your personal data may be shared with entities, authorities or institutions entitled to access the data under the law, such as police, security services, courts, prosecutors.

Moreover, we use tools that collect a range of information about you related to your use of our website. It concerns, in particular, the following information:

• Information about the operating system and web browser you are using,
• reviewed by a bystander,
• time spent on the site,
• transitions between subpages,
• clicks on individual links,
• The source from which you go to our site,
• The age range you are in,
• Your Gender,
• Your approximate location limited to the village.
• Your interests determined by your online activity.

# 9: Do we transfer your data to third countries or international organizations?

Yes, part of the processing operations of your personal data may involve their transfer to third countries.

We transfer your personal data to third countries in connection with the use of tools that store personal data on servers located in third countries, particularly in the USA. The providers of these tools guarantee an adequate level of personal data protection through the relevant compliance mechanisms provided by the RODO, in particular by joining the Privacy Shield program or using standard contractual clauses.

The storage of personal data on servers located in third countries occurs within the following tools:

• MailChimp mailing system, whose provider is Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA – in terms of your name, email address, IP address and statistical information related to your responses to the messages we send,
• Google services as part of the G-Suite, whose provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – to the extent of all data that is processed as part of Google services, including those data contained in files subject to synchronization with Google Drive.

Both Rocket Science Group LLC and Google Ireland Limited ensure an adequate level of protection of personal data by applying the compliance mechanisms provided by the RODO, in particular through the use of standard contractual clauses.

# 10: Do we use profiling? Do we make automated decisions based on your personal data?

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly materially affect you.

Using certain tools, we may, for example, target you with personalized advertising based on previous actions you have taken on our site or suggest products that may interest you. We are talking about the so-called behavioral advertising.

# 11: What rights do you have in connection with the processing of your personal data?

The RODO grants you the following potential rights related to the processing of your personal data:

• The right to access your data and receive a copy,
• The right to rectify (amend) your data,
• The right to erasure (if, in your opinion, there is no basis for us to process your data, you can request that we erase it),
• The right to restrict data processing (you can request that we restrict the processing of your data only to the storage of your data or the performance of activities agreed with you if, in your opinion, we have incorrect data or are processing it unduly),
• The right to object to processing (you have the right to object to processing on the basis of a legitimate interest; you should indicate the particular situation that you believe justifies us stopping the processing covered by the objection; we will stop processing your data for these purposes unless we demonstrate that the grounds for our processing override your rights or that your data are necessary for us to establish, assert or defend claims),
• The right to data portability (you have the right to receive from us in a structured, commonly used machine-readable format the personal data you have provided to us under a contract or your consent; you can have us send this data directly to another entity),
• The right to withdraw consent to the processing of personal data, if you have previously given such consent,
• The right to lodge a complaint with a supervisory authority (if you find that we are processing your data unlawfully, you may file a complaint to this effect with the President of the Office for Personal Data Protection or other competent supervisory authority).

The rules related to the exercise of the rights indicated above are described in detail in Art. 16 – 21 RODO.

You can always ask us to provide you with information about what data we have about you and for what purposes we process it. Just send an email to kontakt@amumu.pl.

# 12: Do we use cookies and what they actually are?

Our website, like almost all other websites, uses cookies.

Cookies are small text information, stored on your terminal device (e.g. computer, tablet, smartphone), which can be read by our ICT system (our own cookies) or third-party ICT systems (third-party cookies). Cookies may record and store certain information, which can then be accessed by ICT systems for specific purposes.

Some cookies we use are deleted when the browser session ends, i.e. when the browser is closed (so-called session cookies). Other cookies are stored on your terminal device and allow us to recognize your browser the next time you visit the site (persistent cookies).

# 13: On what basis do we use cookies?

We use cookies based on your consent, except when cookies are necessary to properly provide electronic services to you.

Cookies that are not necessary for the proper provision of the electronic service will remain blocked until you agree to our use of cookies. When you visit our site for the first time, we display a message asking for your consent along with the option to manage cookies, i.e. decide which cookies you agree to and which you want to block.

# 14: Can you disable cookies?

Yes, you can manage your cookie settings within your web browser. You can block all or selected cookies. You can also block cookies of specific sites. You can also delete previously saved cookies and other site and plug-in data at any time.

Please note that disabling or restricting cookies may prevent you from using some of the features available on our website and cause difficulties in using the website, as well as many other websites that use cookies.

# 15: For what purposes do we use our own cookies?

Proprietary cookies are used to ensure the proper functioning of the various mechanisms of the site, such as maintaining the session after logging into the account, remembering the last browsed products and products added to the shopping cart, to operate the mechanism for the recovery of abandoned shopping carts.

Custom cookies also store information about your defined cookie settings made from the cookie management mechanism.

# 16: What third-party cookies are used?

The following third-party cookies Google Analytics, Facebook, social media tool. function within our website;

Google Analytics – details

We use the Google Analytics tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We carry out activities in this regard based on our legitimate interest in creating statistics and analyzing them in order to optimize our websites.

The information we have access to within Google Analytics is, in particular:

• Information about the operating system and web browser you are using,
• The subpages you are viewing,
• Time spent on the site and individual subpages,
• transitions between subpages,
• The source from which you go to our site.

Facebook – details

As part of the Facebook Ads system provided by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA, we use the available functions to target certain groups of users with targeted advertising messages. We perform activities in this regard based on our legitimate interest in marketing our own products or services.

The information collected within Facebook is anonymous, i.e. do not allow us to identify you. Depending on your activity on our sites, you may reach a certain audience, but we do not in any way identify individuals belonging to these groups.

Social tools – details

Our website uses plug-ins, buttons and other social media tools, collectively referred to as “plug-ins”, provided by social networks such as Facebook, Instagram.

The plug-ins collect certain information about you, such as your user ID, the site you visited, the date and time, and other browser information. Social network administrators use some of this information to personalize the viewing conditions of our site

Information collected by plugins may also be used by social network administrators for their own purposes, such as improving their own products. You can look for details in this regard in the regulations and privacy policies of individual social networks.

# 17: Are we targeting you with targeted ads?

Yes, we use Facebook Ads and Google Ads, where we can target ads to specific target groups defined based on various criteria such as age, gender, interests, occupation, job, activities previously undertaken on our site. These tools were described in detail under the question on third-party cookies, so we will not repeat this information here as well.

# 18: What are server logs?

Using the site involves sending requests to the server where the site is stored. Every request to the server is recorded in the server logs. Logs include, Your IP address, the date and time of the server, information about the web browser and the operating system you are using. Logs are saved and stored on the server. The data recorded in the server logs are not associated with specific individuals using the site and are not used by us to identify you. Server logs are only support material for the administration of the site, and their contents are not disclosed to anyone except those authorized to administer the server.

# 19: How does the product availability notification work?

At your request, we will send you by e-mail information about the availability of the products you indicated. The condition for us to send such information is that you agree to receive commercial information about the products of the online store and the processing of personal data to the e-mail address provided. Provision of data is voluntary, however, lack of consent to the processing of personal data, prevents sending information about the availability of the product.