PRIVACY POLICY

I. PERSONAL DATA CONTROLLER

The controller of personal data is Refloactive sp. z o.o. with its registered office in Bydgoszcz, at ul. Fordońska 40, 85-719 Bydgoszcz, entered in the register of entrepreneurs of the National Court Register under KRS No. 0000903671, NIP 5542932613, REGON 362872596, with a share capital of PLN 50,000.00 (hereinafter: the “Controller”).

The privacy of users visiting the website at https://refloactive.com/ (the “Website”) is particularly important to the Controller. Data provided by users is used solely for the purposes specified in this privacy policy (the “Privacy Policy”).

II. CONTACTING THE CONTROLLER

The Controller may be contacted:

by e-mail at: office@refloactive.com;
in writing, by sending correspondence to: Refloactive sp. z o.o., ul. Fordońska 40, 85-719 Bydgoszcz, Poland.

For matters concerning personal data protection, the contact details specified in Section III below may be used.

III. CONTACT REGARDING PERSONAL DATA PROTECTION

For matters concerning personal data protection and the exercise of rights under the GDPR, you may contact the Controller:

by e-mail at: office@refloactive.com;
in writing, by sending correspondence to: Refloactive sp. z o.o., ul. Fordońska 40, 85-719 Bydgoszcz, Poland.

IV. INFORMATION SECURITY

The Controller applies appropriate technical and organisational measures to keep your personal data secure, including safeguards protecting personal data against unauthorised access, loss or destruction. Appropriate personnel, organisational, technical (IT) and physical safeguards have been implemented to ensure the security of personal data.

Personal data may be processed for different purposes and on different legal bases, depending on how and why it was provided to the Controller. These purposes and legal bases are described in more detail in Section V below.

V. PERSONAL DATA PROVIDED TO THE CONTROLLER BY USERS, PROCESSING OF PERSONAL DATA, PURPOSES AND LEGAL BASES FOR PROCESSING

To the extent that the Controller collects personal data from users, the Controller performs the obligations of a data controller and processes data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the “GDPR”), as well as other generally applicable provisions of law.

Purpose	Legal basis for processing	Data retention period
Providing, operating and ensuring the security of the Website	Article 6(1)(b) GDPR - to the extent that processing is necessary to provide the user with an electronically supplied service; Article 6(1)(f) GDPR - the Controller’s legitimate interest in ensuring the proper, stable and secure operation of the Website, maintaining technical logs, preventing abuse and investigating incidents	for the period of use of the Website and, with respect to technical data and logs, for the period necessary to ensure security, operate the Website and investigate any incidents
Registration, verification of the application and maintenance of an Account on the Website, including granting permissions and assigning the appropriate price list	Article 6(1)(b) GDPR - to the extent that processing is necessary to take steps prior to entering into an agreement for maintaining an Account and to perform that agreement; Article 6(1)(f) GDPR - the Controller’s legitimate interest in ensuring Website security, protecting commercial information and verifying entitlement to use specific functionalities and price lists	for the period during which the registration application is reviewed and, after the Account is created, for the period during which the Account is maintained, followed by the period necessary to establish, exercise or defend legal claims; data relating to refusal of access may be retained for the period necessary to demonstrate the basis for the decision and protect the Controller’s legitimate interests
Handling a Request for Quotation, taking steps prior to entering into a contract, and entering into and performing the contract	Article 6(1)(b) GDPR - processing necessary to take steps at the request of the data subject prior to entering into a contract and to perform a contract to which the data subject is party	for the period during which steps are taken with a view to entering into the contract and the contract is performed, and thereafter until expiry of the limitation period for claims arising from the contract
Handling telephone contact, electronic and traditional correspondence, and the contact form	Article 6(1)(f) GDPR - the Controller’s legitimate interest in conducting communications, responding to enquiries, handling submissions and demonstrating the course of correspondence; Article 6(1)(b) GDPR - where contact concerns taking steps prior to entering into a contract	for the period of correspondence and handling the matter, and thereafter for the period necessary to demonstrate the course of the correspondence, but no longer than 12 months from the end of the correspondence, unless further retention is necessary to establish, exercise or defend legal claims
Direct marketing of the Controller’s own activities	Article 6(1)(f) GDPR - the Controller’s legitimate interest in promoting its activities. Where commercial information, including direct marketing, is sent by e-mail, telephone or other telecommunications terminal equipment, Article 398(1) of the Electronic Communications Law also applies and requires the user’s prior consent Article 6(1)(a) GDPR - where you consent to receiving marketing communications by e-mail, telephone number or during telephone calls, the legal basis will also include Article 398(1) of the Electronic Communications Law.	until an objection to the processing of personal data is made, where the legal basis for processing is a legitimate interest or until you withdraw your consent to the processing of personal data, where the legal basis for processing is consent
Sending the newsletter	Article 6(1)(a) GDPR - user consent; where the newsletter contains commercial information or direct marketing - also Article 398(1) of the Electronic Communications Law	until you withdraw your consent to the processing of personal data
Establishing, pursuing and enforcing claims and defending against claims in proceedings before courts and other public authorities	Article 6(1)(f) GDPR, i.e. processing for the purposes of our legitimate interest in establishing, pursuing and enforcing claims and defending against claims in proceedings before courts and other public authorities	until expiry of the limitation period applicable to the relevant claims and, where proceedings have been initiated, until their final conclusion
Compliance with legal obligations imposed on the Controller, in particular tax, accounting, archiving and reporting obligations	Article 6(1)(c) GDPR, i.e. processing is necessary for compliance with legal obligations imposed on us under applicable law, in particular tax and accounting regulations	until the legal obligations imposed on the Controller which justified the processing of personal data cease to apply

VI. SCOPE AND SOURCES OF DATA

The scope of personal data processed depends on how the Website is used and the purpose of processing. In particular, the Controller may process:

in connection with contact and correspondence - first and last name, e-mail address, telephone number, message content and other information voluntarily provided by the user;
in connection with the newsletter - e-mail address and, where required by the form, also first and last name;
in connection with registration, verification and maintenance of an Account - first and last name, e-mail address, telephone number, position, name of the represented entity, address, NIP, REGON, Account identifier, information on the status and permissions of the Account, the assigned price list and other data necessary to verify the application and maintain the Account;
in connection with entering into and performing contracts - first and last name, contact details, position, name of the represented entity, address, NIP, REGON and other data necessary to enter into and perform the contract;
in connection with use of the Website - IP address, device and browser information, data contained in system logs, online identifiers, information on activity on the Website and on consents granted;
other data provided to the Controller in connection with a specific matter or service.

Data is obtained directly from the data subject, in particular through forms, e-mail, during Account registration, when submitting a Request for Quotation or when entering into a contract. Data may also originate from an entity represented by that person, a contractor of the Controller or publicly available sources, in particular the National Court Register (KRS) and the Central Register and Information on Business (CEIDG), especially to the extent necessary to verify a registration application and the entity’s details.

VII. RIGHTS

You have the right to:

access your personal data and receive a copy of it;
rectify your data;
have your data erased;
restrict processing;
data portability;
object to processing;
withdraw your consent at any time where processing is based on consent;
lodge a complaint with the President of the Personal Data Protection Office.

Where data is processed on the basis of Article 6(1)(f) GDPR, the data subject may object on grounds relating to his or her particular situation. The Controller will cease processing unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of that person, or grounds for the establishment, exercise or defence of legal claims.

Where data is processed for direct marketing purposes, the data subject may object at any time. Once an objection has been made, the data will no longer be processed for that purpose.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn. Consent may be withdrawn by contacting the Controller and, in the case of the newsletter, also by using the unsubscribe link included in each message.

VIII. ENTRUSTING THE PROCESSING OF PERSONAL DATA

The Controller may engage another entity to process personal data for the purpose of carrying out a specific task. Where the processing of personal data is entrusted to an external entity, the data processing agreement specifies in particular the subject matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the Controller.

IX. RECIPIENTS OF PERSONAL DATA

Personal data may also be disclosed by the Controller to external recipients whose services the Controller uses to properly support processes connected with the provision of its services. Recipients of your personal data may include the following categories of entities:

providers of IT, hosting, maintenance and administrative services;
providers of analytics and statistics tools;
providers of marketing services and newsletter distribution systems;
providers of social media platforms and content embedded in the Website;
providers of Website accessibility and security tools;
providers of telecommunications and postal services;
law firms, tax advisers, auditors and providers of accounting services;
providers of document archiving and destruction services;
payment operators, courier or logistics companies - where their services are actually used;
public authorities and other entities entitled to receive data under applicable law.

In each case, the processing of your personal data by the above recipients will take place on the basis of an appropriate authorisation, a data processing agreement or applicable provisions of law.

X. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

As a rule, your personal data will be processed within the European Economic Area (EEA). Exceptionally, it may be transferred to our partners processing it outside the European Economic Area (EEA), but only to the extent necessary in connection with our cooperation with those partners. Personal data will be transferred to countries for which the European Commission has issued an adequacy decision and, where no such decision exists, appropriate safeguards will be used, including standard contractual clauses approved by the European Commission. We also seek to ensure that our partners provide an appropriate level of personal data protection. You may obtain a copy of the safeguards applicable to personal data transferred outside the EEA by contacting the Controller using the contact details set out above.

XI. AUTOMATED DECISION-MAKING AND PROFILING

The Controller does not make decisions concerning users based solely on automated processing, including profiling, which produce legal effects concerning them or similarly significantly affect them. In connection with the use of optional advertising technologies, third-party providers may analyse users’ activity in order to personalise content or advertisements. Such technologies are activated after the required user consent has been obtained.

XII. INFORMATION ON WHETHER PROVIDING DATA IS REQUIRED OR VOLUNTARY AND THE CONSEQUENCES OF FAILURE TO PROVIDE DATA

Providing personal data is generally voluntary. However, providing data marked as required may be necessary to use a specific Website functionality, create and maintain an Account, carry out verification of a registration application, submit a Request for Quotation, receive a response to an enquiry, subscribe to the newsletter or enter into and perform a contract. Failure to provide such data may make it impossible to achieve the relevant purpose. Where required by law, providing data may constitute a statutory obligation.

XIII. COOKIES AND SIMILAR TECHNOLOGIES

The Website uses cookies and similar technologies, in particular browser local storage, pixel tags and other online identifiers, hereinafter collectively referred to as “cookies”.

Cookies are small pieces of information stored on a user’s device or information accessed through the user’s device when using the Website.

Cookies may be used directly by the Controller or by third-party service providers whose tools, functionalities or content have been placed on the Website.

Cookies used on the Website are divided into the following categories:

essential cookies - enable the proper and secure operation of the Website and use of its basic functionalities, in particular ensuring security, preventing abuse and remembering privacy settings;
functional - enable the Website to remember preferences selected by you, e.g. regarding privacy, completion of online forms made available by us, and Website settings;
analytics and statistics - enable measurement of Website traffic, creation of statistics and analysis of how individual Website functionalities are used, which helps improve the operation of the Website;
advertising and marketing - cookies used when advertising campaigns are conducted in order to tailor advertising and remember advertising settings.

The storage of information on a user’s device or access to information already stored on that device takes place in accordance with Article 399 of the Act of 12 July 2024 - Electronic Communications Law.

Cookies necessary to carry out the transmission of an electronic communication or to provide an electronically supplied service requested by the user may be used without obtaining the user’s consent.

Where the use of essential cookies involves the processing of personal data, the legal basis for processing is: (a) Article 6(1)(b) GDPR - where processing is necessary for the performance of a contract or provision of a service requested by the user; or (b) Article 6(1)(f) GDPR - where processing is necessary for the purposes of the Controller’s legitimate interest in ensuring the proper, stable and secure operation of the Website.

Functional, analytics, statistics and advertising cookies which are not necessary for the proper operation of the Website are used after the user’s prior consent has been obtained. The legal basis for the processing of personal data by means of such cookies is Article 6(1)(a) GDPR.

During the first visit to the Website, the user may use the consent management panel to:

accept all optional cookies;
reject all optional cookies;
make an individual selection of particular cookie categories.

Consent is voluntary and may be changed or withdrawn at any time using the “Cookie Settings” button or link available on the Website. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Cookies used on the Website may be:

temporary - automatically deleted after a specified expiry date;
persistent - remain active in the browser until you delete them, which you may do at any time;
stored in the browser’s local storage - remain stored until they are deleted by the user, the Website data is cleared or the browser settings are changed.

Cookies and similar technologies may also be used by third-party providers whose tools, functionalities or content have been placed on the Website. Such providers may process data in accordance with their own privacy policies. A detailed list of providers, purposes, categories and retention periods is set out in Appendix 1.

Most web browsers allow users to delete cookies from the computer’s hard drive (through browser settings), block all incoming cookies or display a warning before a cookie is saved.

If the user uses such an option (i.e. restricts or disables cookies in the browser settings), use of the Website may be impossible or limited. Deleting or blocking certain cookies may affect the availability of Website functionalities, the correct display of the Website and the loss of preferred Website settings.

You may use the options offered by each browser to view and delete cookies and to restrict or control their acceptance. For further information, please refer to the help content or privacy/security settings of the browser you use. Default settings for the most commonly used browsers may be changed in accordance with the instructions available at the following links: Chrome; Edge; Firefox; Safari; or Opera.

XIV. CHANGES TO THE PRIVACY POLICY

The Controller may amend the Privacy Policy, in particular in order to adapt it to the requirements of applicable law, by informing users of the changes on the Website and, where possible, also by e-mail.

An integral part of the Privacy Policy is the list of cookies used on the Website, constituting Appendix 1 to the Privacy Policy.

Appendix 1 - list of cookies used on the website https://refloactive.com/

Name	Service	Purpose	Cookie type and expiry
session	Refloactive (Shopify Oxygen)	Session management: cart context, B2B account, login (technically required)	HTTP cookie, browser session
cart	Refloactive (Shopify)	Stores the cart ID (technically required)	HTTP cookie, browser session
_tracking_consent, _cmp_a	Shopify	Stores the status of your cookie consent (technically required)	HTTP cookie, approx. 1 year
_shopify_y	Shopify	Analytics: visitor recognition; only set with consent to analytics cookies	HTTP cookie, approx. 1 year
_shopify_s	Shopify	Analytics: session attribution; only set with consent to analytics cookies	HTTP cookie, approx. 30 minutes
Login and checkout cookies	Shopify International Ltd.	Authentication and checkout on Shopify domains (technically required)	HTTP cookies in accordance with Shopify's policies
refloactive-cookie-consent	Refloactive	Stores the selection made in the cookie banner	Local storage, indefinite
refloactive_configurator_*	Refloactive	Temporary storage of the product configuration in the configurator	Local storage, 48 hours
refloactive-cart (print-files)	Refloactive	Stores uploaded print files and previews for the configurator	IndexedDB, until deleted
Session storage of the configurator and quote assistant	Refloactive	Temporary states during use (including editConfigState, refloactive.cart.wizard)	Session storage, until the tab is closed
Google Maps (including NID)	Google Ireland Limited	Map display on the contact page; only loaded after a click or with consent to marketing cookies	Third-party cookies in accordance with Google's policies, up to approx. 6 months

Cookie settings

Manage your cookie preferences and consent.