Privacy policy

OF THE MOMENTUM ONLINE STORE

available at mmntm.pl

§ 1. GENERAL PROVISIONS

1. The controller of personal data collected through the online store available at mmntm.pl (hereinafter: the "Store") is Mateusz Żurkiewicz, conducting business as a sole trader under the business name MMNTM Mateusz Żurkiewicz, registered in the Central Register and Information on Economic Activity (CEIDG), Tax Identification Number (NIP): 9581766055, National Business Registry Number (REGON): 545118679, address: ul. Nasypowa 9/147, 81-177 Gdynia, Poland (hereinafter: the "Controller").

2. The Controller may be contacted on matters relating to personal data at the e-mail address: mmntmcontact@gmail.com or in writing at: ul. Nasypowa 9/147, 81-177 Gdynia, Poland.

3. The Controller has not appointed a Data Protection Officer. All matters relating to the protection of personal data should be addressed directly to the Controller.

4. This Privacy Policy sets out the rules for processing the personal data of Customers and other persons using the Store (hereinafter jointly: "Users"), including the purposes and legal bases for processing, data retention periods, categories of data recipients, and the rights available to Users, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: the "GDPR"), the Polish Act of 18 July 2002 on the Provision of Electronic Services, and the Polish Act of 12 July 2024 — Electronic Communications Law (hereinafter: the "ECL").

§ 2. PURPOSES, LEGAL BASES AND PERIODS OF DATA PROCESSING

The personal data of Users is processed for the following purposes:

1. Concluding and performing the Sales Agreement — covering: first and last name, delivery address, e-mail address, phone number, and data relating to the order and payment. Legal basis: Article 6(1)(b) GDPR (necessity for the performance of a contract or to take steps prior to entering into a contract). Retention period: for the duration of the agreement, and thereafter until the expiry of the limitation period for claims arising from it (as a rule 6 years, and for claims related to the conduct of business activity — 3 years).

2. Fulfilling legal obligations incumbent on the Controller, including tax and accounting obligations (e.g. issuing invoices/receipts). Legal basis: Article 6(1)(c) GDPR in connection with the provisions of the Polish Tax Ordinance Act and the Polish Accounting Act. Retention period: 5 years, counted from the end of the calendar year in which the tax payment deadline relating to the transaction fell.

3. Handling complaints and statements of withdrawal from the agreement. Legal basis: Article 6(1)(c) GDPR (obligation arising from the Consumer Rights Act) and Article 6(1)(f) GDPR (the Controller's legitimate interest in defending against claims). Retention period: for as long as necessary to handle the matter, and until the expiry of the limitation period for any resulting claims.

4. Handling reports concerning incidents related to Medical Devices, as referred to in § 8 of the Store's Terms of Service. Where a report contains information about a User's state of health, such data constitutes a special category of personal data within the meaning of Article 9 GDPR and is processed solely to the extent necessary to clarify the report and to fulfil the obligations arising from the Medical Devices Act.

5. Direct marketing (newsletter) — solely with the User's consent, covering: e-mail address and first name (if provided), via the Shopify Email tool. Legal basis: Article 6(1)(a) GDPR (consent) and Article 398 of the ECL. Retention period: until consent is withdrawn.

6. Analysis of Store visit statistics (Google Analytics) — solely with the User's consent expressed via cookie settings. Legal basis: Article 6(1)(a) GDPR in connection with Articles 399–400 of the ECL. Retention period: in accordance with the data retention settings in Google Analytics, and no longer than until consent is withdrawn.

7. Marketing and remarketing on social media, including ad personalisation (Meta Pixel) — solely with the User's consent expressed via cookie settings; this may involve profiling in order to tailor the advertisements displayed. Legal basis: Article 6(1)(a) GDPR in connection with Articles 399–400 of the ECL. Retention period: in accordance with the validity period of Meta's cookies, and no longer than until consent is withdrawn.

8. Establishing, pursuing, or defending against claims. Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest). Retention period: until the expiry of the limitation period for claims.

§ 3. RECIPIENTS OF DATA

1. Users' personal data may be disclosed to the following categories of recipients, to the extent necessary to achieve the purposes indicated in § 2:

a) Shopify International Limited / Shopify Inc. — the provider of the platform on which the Store operates (hosting, management of the Customer account, cart, and orders);

b) Paynow (Krajowy Integrator Płatności S.A.) — the electronic payment operator, to the extent of data necessary to process payments;

c) furgonetka.pl and its partner carriers — to the extent of data necessary to deliver shipments;

d) Shopify Email — to the extent of the e-mail address of Users who have consented to receive the newsletter;

e) Google Ireland Limited (Google Analytics) — to the extent of data collected via analytical cookies, provided the User has given consent;

f) Meta Platforms Ireland Limited (Meta Pixel) — to the extent of data collected via marketing cookies, provided the User has given consent;

g) the accounting office engaged by the Controller — to the extent of data necessary to maintain accounting records;

h) public authorities entitled to request data under applicable law (e.g. tax offices, courts).

2. The Controller does not sell Users' personal data to third parties for marketing purposes other than as indicated in this Privacy Policy.

§ 4. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

1. Some of the recipients indicated in § 3 (in particular the providers of Shopify, Google, and Meta services) may process personal data outside the European Economic Area (EEA), including in Canada or the United States.

2. The transfer of data outside the EEA takes place on the basis of a European Commission decision finding an adequate level of data protection (including, in respect of Canada, to the extent covered by the PIPEDA legislation, or in respect of entities certified under the EU-U.S. Data Privacy Framework programme), or on the basis of standard contractual clauses approved by the European Commission, ensuring an adequate level of protection for personal data.

3. The User may obtain a copy of the relevant safeguards by contacting the Controller using the details indicated in § 1(2).

§ 5. USER RIGHTS

1. The User has the right to: access their personal data; rectify their data; erase their data ("the right to be forgotten"); restrict processing; data portability; object to processing based on the Controller's legitimate interest, including profiling for direct marketing purposes — in every such case; and to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

2. The User has the right to lodge a complaint with a supervisory authority. In Poland, this authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) (ul. Stawki 2, 00-193 Warsaw, Poland). A User whose habitual residence is in another EU country may also lodge a complaint with the supervisory authority competent for their place of residence, in accordance with Article 77 GDPR.

3. To exercise their rights, the User may contact the Controller using the details indicated in § 1(2).

§ 6. COOKIES

1. The Store uses cookies and similar technologies that store information or gain access to information already stored on the User's terminal device, in accordance with Articles 399–400 of the Electronic Communications Law and the GDPR.

2. The Store uses the following categories of cookies:

a) necessary — required for the proper functioning of the Store (including maintaining the session, the cart, and the order placement process); their use does not require the User's consent;

b) analytical (Google Analytics) — used to collect statistics on Store visits; require the User's consent;

c) marketing (Meta Pixel) — used to display personalised advertisements and measure their effectiveness; require the User's consent.

3. Consent to analytical and marketing cookies is expressed through the relevant settings in the consent management panel displayed on the first visit to the Store, and may be withdrawn at any time by changing those settings or the settings of the web browser.

4. Disabling cookies in the web browser may limit the functionality of the Store.

§ 7. DATA SECURITY

1. The Controller applies appropriate technical and organisational measures to ensure the security of the personal data processed, appropriate to the identified risk, including measures to protect against unauthorised access, loss, or destruction of data.

2. Access to personal data is granted only to persons authorised by the Controller and to entities processing data under data processing agreements concluded with the Controller.

§ 8. FINAL PROVISIONS

1. The Controller reserves the right to amend this Privacy Policy, in particular in the event of changes in the law, changes in the scope of the Store's business activity, or changes in the tools used. The Controller shall notify Users of any amendments by publishing the updated version of the Privacy Policy on the Store's website.

2. This Privacy Policy enters into force on 15 September 2026.