Detailed information on the processing of personal data

Pursuant to Article 13 (1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27.04.2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU. L. of 2016 No. 119, p. 1, asamended, hereinafter: "RODO"), we provide you with the following information:

1.Administrator of personal data

The Administrator of your personal data is MZ-STORE joint-stock company with its registered office in Reda, Cypriana Kamila Norwida 47 (84-240) Street, registered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, 8th Economic Division of the National Court Register under the number 0000877266, having NIP: 5862363341 and REGON number: 387876117 (hereinafter: "Administrator"). You may contact the Administrator

in the following manner:

• by letter to the address given above;
• by e-mail:office@mz-store.pl

2.Purposes of processing, scope and legal basis of processing

The Administrator will process your personal data on the basis of the following regulations and for the following purpose:

• in order to provide services related to the maintenance and operation of your account on the website operating under the following Internet addresses: mz-store.pl, muscle-zone.pl, mz-store.co.uk, mz-store.de, mz-store.it, mz-store.at, mz-store.es (hereinafter: "Service") or the performance of a contract for the sale of goods available through the Service (hereinafter: "Contract") - the legal basis for processing is the necessity of processing for the performance of the contract (Article 6(1)(b) RODO), and with regard to data provided optionally - the legal basis for processing is consent (Article 6(1)(a) RODO);
• in order to handle purchases made without registering a customer account on the Site - in that case, the legal basis for processing is the necessity of processing to perform the Agreement (Article 6(1)(b) RODO);
• in order to provide Electronic Services in terms of providing access to Customers and others to content collected on the Websites - then the legal basis for processing is the necessity of processing to perform the Agreement (Article 6.1.b RODO);
• in order to comply with statutory obligations incumbent on the Administrator, arising in particular from tax and accounting regulations - then the legal basis for processing is a legal obligation (Article 6(1)(c) RODO);
• for complaint handling purposes - in which case the legal basis for processing is the necessity of processing to perform the Agreement (Article 6(1)(b) RODO);
• for analytical and statistical purposes - then the legal basis for processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO) consisting of conducting analysis of the activity of the Website users, as well as their preferences in order to improve the functionalities used and services provided;
• for the purpose of possibly establishing and asserting claims or defending against them - the legal basis of the processing is the legitimate interest of the Administrator (Article 6(1)(f) RODO) consisting in the protection of its rights;
• for marketing purposes of the Administrator or other entities on the basis of your consent (Article 6(1)(a) RODO).

Your Personal Data is processed for the purposes explained in this provision, primarily for the fulfillment of Orders and for the provision, personalization, development and security of the Electronic Services provided through the Websites. Accordingly, we process your Personal Data, such as your name, telephone number, customer number, home address (or other address indicated as delivery address), IP or e-mail address.All information that does not enable (including in combination with other information) your identification is considered non-personal data. Non-personal data is also referred to as anonymous data. If your Personal Data is combined with anonymous data, all data in such a package is treated as Personal Data. General rule: if we ask you to provide certain Personal Information, you can of course refuse our request. It is up to you to decide what information you provide to us. Presumably, however, in such a situation, we will not be able to provide you with the selected Electronic Services or fulfillment of the Sales Agreement (or they will not be available to you in an optimal way). For example, we cannot deliver an Order without a delivery address. If only certain information (mandatory information) is required in connection with a certain Electronic Service or Sales Agreement, we will inform you of this by marking it accordingly, e.g. by marking such field with *.

3.Period of storage of Personal Data

The period of processing of Personal Data by the Administrator depends on the type of Electronic Service or results from the Sales Agreement and the purpose of processing. As a rule, Personal Data is processed for the duration of the provision of the Electronic Service or the performance of the Sales Agreement, until the withdrawal of the consent given or the filing of an effective objection to the processing of Personal Data in cases where the legal basis for the processing of Personal Data is the legitimate interest of the Administrator. The period of processing of Personal Data may be extended in cases where the processing is necessary to establish and assert or defend against possible claims, and thereafter only if and to the extent required by law. After the expiration of the processing period, the Personal Data shall be irreversibly deleted or anonymized.

4.Recipients of data

Your Personal Data may be disclosed to external entities, including, in particular, couriers, customs agencies, marketing agencies, IT service providers to whom we outsource Personal Data processing services. Data is also disclosed to third-party Vendors offering goods on the Website as part of the marketplace functionality. Such entities process Personal Data on the basis of an agreement with us and only in accordance with our instructions, to the extent indicated by us. In case of a complaint, your Personal Data may be transferred to the product distributor, manufacturer or guarantor, depending on the Goods covered by the complaint. If we obtain your consent, your Personal Data may also be shared with other entities for their own purposes, including marketing purposes. With your consent, we may transfer your Personal Data, to the extent necessary for the performance of the Sales Agreement, to third-party online payment companies, if you select such type of payment through any of the payment systems. The transfer refers to the Personal Data necessary to complete the payment. Your selection of a particular payment type constitutes your consent to the transfer of data to the payment operator.

We may also transfer Personal Data to recipients located outside the European Economic Area (EEA) in so-called third countries. In this case, before transferring the data, we ensure that an adequate level of data protection is in place at the recipient (e.g. on the basis of an EU Commission decision stating an adequate level of protection for the country concerned or an agreement with the recipient on so-called European Union standard contractual clauses) or that your consent to the data transfer is available. You can obtain from us an understanding of recipients in third countries and obtain a copy of the specifically agreed regulations for ensuring an adequate level of data protection. Please use the data in Section 1 for this purpose.

5.Rights related to the processing of your personal data

You have the following rights related to the processing of your personal data:

• The right to withdraw your consent to data processing,
• The right to access your personal data,
• The right to request rectification of personal data,
• The right to request deletion of personal data,
• The right to request restriction of personal data processing,
• The right to object to the processing of data,
• The rightto portability of personal data, i.e. the right to receive from the Administrator your personal data, in a structured, commonly used machine-readable computer format. This makes it possible to send this data to another controller or to request that the Administrator send your data to another controller. However, only if such transmission is technically possible. The right to data portability applies to you only as to those data that we process under contract or on the basis of consent;
• The right to withdraw consent, i.e. to the extent that your data is processed on the basis of consent, it is possible to withdraw consent to data processing at any time. The withdrawal of consent does not affect the lawfulness of the processing that was carried out on the basis of that consent before its withdrawal. Consent can be withdrawn by sending a statement of withdrawal of consent to the mailing address or e-mail address indicated above: office@mz-store.pl;
• The right to lodge a complaint with an authority, i.e. you also have the right to lodge a complaint with a supervisory authority dealing with personal data protection, i.e. the President of the Office for Personal Data Protection.

To exercise the rights referred to in paragraphs (1) - (8), please contact the Administrator (contact details in paragraph 1 above).