Principles of personal data processing at MEDSPORT-AUTO

When collecting and processing personal data, MEDSPORT-AUTO complies with all of the data processing principles set out below and meets at least one of the legal conditions for processing personal data.

1. Principles of personal data processing:
   • "lawfulness, fairness and transparency",
   • "purpose limitation",
   • "data minimisation",
   • "accuracy",
   • "storage limitation",
   • "integrity and confidentiality".
2. Conditions for lawful processing of personal data:
   • the data subject has given consent to the processing of their personal data for one or more specific purposes;
   • processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract;
   • processing is necessary for compliance with a legal obligation to which the controller is subject;
   • processing is necessary in order to protect the vital interests of the data subject or of another natural person;
   • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
   • processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

While browsing our website, depending on your decision expressed in the cookie consent banner (for the sklep.medsport.info and sklep.momopolska.pl websites) or on your browser settings, one or more cookies may be saved on your computer (end device).

What data we collect about you

• Data collected manually

When you place an order, we collect data such as your first name, last name, company name, tax ID (NIP), address, phone number, and e-mail address, in order to properly complete the order, issue a sales document, and provide any necessary after-sales support, including handling complaints.

If you use the "FAST RETURN" function, we additionally collect: the order number, a list of the returned products, the reason for the return (optional), and - if you choose a refund to a bank account - your bank account number (IBAN). We use this data solely to process the return and, where applicable, to make the refund transfer.

• Data collected automatically

During your visit to our website, data relating to your visit is automatically collected, in particular your IP address, domain name, browser type, and operating system type. More information can be found in the section on cookies.

Who is the controller and how to contact us regarding data protection

The controller of your personal data is:

MEDSPORT-AUTO Mirosław Kowalczuk
Starowiejska 20
30-698 Kraków, Poland
phone: +48 12 660-1060

You can contact the Controller by phone, by post at the address above, or electronically at: biuro@medsport.info.

The Controller has not appointed a Data Protection Officer. For all matters related to the protection of personal data, please contact the Controller directly using the details provided above.

For what purpose and on what legal basis your data will be processed

Your personal data will be processed for the following purposes:

• selling products and services, including processing orders, returns and complaints - based on the necessity to perform a contract (Article 6(1)(b) GDPR);
• fulfilling legal obligations imposed on MEDSPORT-AUTO, e.g. tax and accounting obligations - based on Article 6(1)(c) GDPR;
• conducting marketing activities by e-mail, SMS, or similar electronic communication channels - solely on the basis of your voluntary, separate consent (Article 6(1)(a) GDPR and the provisions of the Polish Act on the Provision of Electronic Services and the Telecommunications Law);
• conducting remarketing activities (Meta/Facebook Pixel) - solely after consent has been given via the cookie banner, based on Article 6(1)(a) GDPR;
• handling any warranty claims - based on the necessity to perform a contract or the Controller's legitimate interest (Article 6(1)(b) or (f) GDPR);
• responding to correspondence and inquiries, and ensuring the security of the website - based on the Controller's legitimate interest (Article 6(1)(f) GDPR);
• archiving - based on a legal obligation or the Controller's legitimate interest.

Who will receive your data and where it may be transferred

Depending on the purpose of processing, your data may be disclosed to the following categories of recipients:

• courier companies handling delivery of your order (in particular DPD Polska and other carriers selected when placing the order);
• online payment service providers handling payments in the store (depending on the payment method you choose, this may include in particular: PayU, Przelewy24, PayPal, PayPo, Paynow, eCard);
• hosting and IT service providers used by the Controller to operate the online store;
• Meta Platforms, Inc. (Meta Pixel / Facebook Pixel) - only if you give your consent via the cookie banner on the store's website; in this case, data may be transferred to the United States on the basis of appropriate compliance mechanisms recognised by the European Commission (standard contractual clauses or another adequate transfer mechanism);
• law firms engaged by MEDSPORT-AUTO, e.g. to conduct legal proceedings;
• entities or authorities authorised under applicable law.

For how long your data will be processed

The period for which your personal data is processed depends on the purpose for which it is processed. The retention period is determined based on the following criteria:

• legal provisions that may require data to be processed for a specific period (e.g. data from sales documents is retained for the period required by tax and accounting regulations - generally 5 years from the end of the year in which the tax obligation arose);
• the period necessary for MEDSPORT-AUTO to provide its services and the necessary customer support, including handling complaints and returns;
• the period for which consent was given (e.g. consent to marketing cookies expires after 12 months, after which you will be shown the consent banner again on your next visit).

What rights you have

You have the right to:

• request access to personal data concerning you;
• rectification of your data;
• request completion of incomplete personal data, including by providing an additional statement;
• erasure of data or restriction of processing;
• object to further processing of your personal data;
• data portability.

You have the right to withdraw your consent at any time - in the case of consent to cookies, you can do this by changing your browser settings or deleting the "zgoda_cookies" cookie, which will cause the banner to be shown again on your next visit. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

When processing your data collected via cookies, MEDSPORT-AUTO is in most cases unable to identify you personally. Therefore, if you wish to exercise your rights, you may be asked to provide additional information to verify your identity.

If you have any concerns about the correctness of the processing of your personal data, you have the right to lodge a complaint with the supervisory authority, which is:

The President of the Polish Personal Data Protection Office (UODO)
ul. Stawki 2, 00-193 Warsaw, Poland
https://uodo.gov.pl

Consequences of not providing your data

Providing your data is voluntary; however, it may be a necessary condition for entering into a contract or providing services (e.g. processing an order, or handling a return or complaint). Without providing this data, the contract cannot be concluded or the request cannot be processed.

How we use profiling

If you give your consent via the cookie banner, we may use remarketing tools (Meta/Facebook) that display advertisements for our products on other websites based on products you have previously viewed in our store. This profiling does not produce legal effects concerning you and does not significantly affect you - it is used solely to tailor the advertisements shown to you.

How to obtain information about the processing of your data

Please direct any correspondence regarding the processing of your personal data to the Controller's address, or electronically to: biuro@medsport.info.

Use of cookies

Our websites use cookies, which we divide into two categories:

Necessary cookies (do not require consent) - without these, the website could not function properly:

• session cookie (PHPSESSID) - stores the state of your session, including your shopping cart contents, for the duration of your visit;
• cookie consent cookie (zgoda_cookies) - stores your decision made in the consent banner, valid for 12 months.

Cookies requiring consent - saved only after you click "Accept" in the cookie banner shown on the store's website:

• currency preference cookie (waluta) - remembers your selected display currency, valid for up to 10 years;
• Meta/Facebook Pixel cookie - used for remarketing and measuring the effectiveness of advertising on Facebook/Instagram;
• cookies that remember recently viewed products and categories (e.g. for the "back" button) and the source from which you arrived at our website.

The store's website displays a banner allowing you to accept or decline cookies that require consent. Until you make a decision, these cookies are not saved. You may change your decision at any time by deleting the "zgoda_cookies" cookie in your browser settings - the banner will then be shown again.

Regardless of the above, you can also manage cookies through your browser settings, including blocking them entirely. More information:

• Chrome,
• Firefox,
• Safari,
• Opera,
• Edge,
• Internet Explorer.

Configuring your browser to block the installation of cookies for specific websites you select, or for all websites, may result in the loss of certain functionalities and may make it difficult or impossible to make full use of the website.

Cookies cannot be used to infect your device with viruses or other malicious software (malware).

How we protect your personal data

Our databases are protected against access by unauthorised third parties, in particular through the use of access security measures (logins and passwords), encryption of the connection to the website (HTTPS protocol), and regular backups.

Changes to our privacy policy

We reserve the right to amend this privacy policy by publishing new content on our website. After any amendment, the updated privacy policy will appear on the website with a new date.

MEDSPORT-AUTO Kraków, 23 June 2026