Privacy Policy

• 1 General Provisions

Dear User!

This Privacy Policy applies to the personal data of the Website Users (hereinafter also referred to as "Users", or as "You") consisting of the Web page at https://www.store.buypv.eu/  and the Online Store operating at https://www.store.buypv.eu/        (hereinafter referred to as the "Website").

The administrator of personal data of the Website Users is Buy PV sp. z o.o. with its seat in Warsaw, ul. Nabielaka 6 lok. 4, 00-743 Warsaw, entered into the Register of Entrepreneurs kept by the District Court for Kraków - Śródmieście in Cracow, XII Commercial Division of the National Court Register, under the KRS number: 0000446525, REGON: 122762008, NIP: 9930651788, capital stock: PLN 504,000.00.

The Administrator can be contacted by letter to the seat address of the Company indicated above, by telephone:

+48 500 115 700 or by e-mail to: kontakt@buypv.eu.

The protection of the privacy of the Website Users is very important to us. The administrator limits the use and collection of information about Website Users to the level that is necessary to provide Users with services at the highest level.

Below, we present the most important information about the principles of personal data processing by us. This information has been prepared taking into account the GDPR, i.e. the General Data Protection Regulation.

• 2 Glossary of terms

1. Administrator – Buy PV sp. z o.o. with its seat in Warsaw, ul. Nabielaka 6 lok. 4, 00-743 Warsaw, entered into the Register of Entrepreneurs kept by the District Court for Kraków - Śródmieście in Cracow, XII Commercial Division of the National Court Register, under the KRS number: 0000446525, REGON: 122762008, NIP: 9930651788, capital stock: PLN 504,000.00 (hereinafter also referred to as the "Company", "Seller" or "We")
2. Personal data - all kinds of information related to the user of the Website and identifying him personally, alone or in combination with other information provided, e.g. e-mail address.
3. Processing - all types of activities and operations performed on the personal data of Website users, e.g. analyzing for the purposes of providing services, saving their purchase history.
4. GDPR – Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
5. Website - a website (digital service) that allows consumers, entrepreneurs with consumer rights or entrepreneurs to conclude online sales contracts or contracts for the provision of electronic services with the Administrator. The website may also be called equivalent terms such as: web page https://www.store.buypv.eu/ online store www.store.buypv.eu/

6. Agreement - it should be collectively understood as the Sales Agreement and the Agreement for the Provision of Services, within the meaning of the Regulations of the Website https://www.store.buypv.eu/
7. User - any natural person visiting the Website as a guest or having an account in the online store https:// www.store.buypv.eu/ and https://www.store.buypv.eu/ joining the Newsletter service, contacting the Administrator via the contactform or via another shared messenger.

8. Product - a movable item constituting the subject of the Sales Agreement between the User and the Seller.Expressions not defined above and used in the content of the Privacy Policy have the meaning given to them in the regulations of the Website available at  https://www.store.buypv.eu/pl/i/Regulamin/3

• 3 Purpose of data processing

1. Below, we present you with information about the legal basis on which we use your personal data.
2. The administrator processes personal data in particular for the following purposes:
   1. presenting the offer to the User;
   2. creating a User Account on the Website and managing it;
3. creating the possibility of providing Electronic Services, Sales Agreements and full use of the Website (including placing Orders, making transactions and paying for orders placed);
4. ensuring the security of Electronic Services provided by the Administrator;
5. ensuring compliance with laws, regulations and guidelines for a given service sector;
6. adjusting the content of the Website to the interests of Users and optimizing the navigation of the Website so that the search for content is convenient and intuitive;
7. managing interactions for the purposes of establishing, maintaining or deepening relationships with customers / potential customers or users of the website, including conducting correspondence, providing commercial information by phone or e-mail;
8. handling the complaint process; exercising the right to withdraw from the concluded Agreement via the Website;
9. debt collection, conducting court, mediation and arbitration proceedings;
10. organization of promotional campaigns and competitions in which you can participate and loyalty programs;
11. making statistical analysis.

• 4 Legal basis for data processing

Depending on the purpose for which we process your personal data, the legal basis for their processing may be:

1. Exercising the rights and obligations arising from the Agreements concluded with the Administrator - e.g. Sales Agreements, Agreements for the Provision of Services [art. 6 sec. 1 b) of GDPR].
2. The legal obligation binding on us, in particular related to accountancy in the case of Orders involving an obligation to pay, or charge, collect and pay tax on goods and services [art. 6 sec. 1 c) of GDPR in connection with the provisions of the Accounting Act of 29 September 1994].
3. The legal obligation binding on us, in particular related to the calculation, collection and payment of tax on goods and services [art. 6 sec. 1 c) of GDPR in connection with the provisions of the Act of August 29, 1997 - Tax Ordinance and the Act of March 11, 2004 on VAT].
4. Your voluntary consent [Art. 6 sec. 1a) of GDPR].
5. Our legitimate interest in the processing of data for the purpose of establishing, investigating or defending any claims [art. 6 sec. 1 f) GDPR].
6. Our legitimate interest consisting in conducting correspondence, including replying to messages from Users or other persons [art. 6 sec. 1 f) GDPR].

• 5 The period of personal data processing

We will process the User's data only for the period in which we will have a legal basis for it, and thus until:

1. the period necessary for the implementation and settlement of the concluded Agreement expires or the confidentiality obligation lapses (if a separate declaration has been signed);
2. the legal obligation, obliging us to process your data, ceases to bind us, the possibility of pursuing any claims related to the Agreement concluded via the Website by any of the parties ceases to exist
3. The user withdraws his consent to the processing of data, if it was the basis for the processing of personal data; - depending on what is applicable in the given case and what will happen at the latest.

• 6 The method and purpose of processing of your personal data

In order to introduce and understand the principles and purposes of processing of your personal data, below we present the services and functionalities that may be related to the processing of your personal data.

1. Provision of Electronic Services via the Website - Account

The purpose of processing personal data by the Administrator is to enable you to use the services and functionalities offered on the Website. When registering the Account, the User is required to provide identifying data, including contact details (i.e. in particular name, surname, e-mail address, telephone number, address, and if the User runs a business, also the NIP number and company name). Providing this data is voluntary, but necessary to create an Account. Providing by the User a greater scope of personal data than necessary to create and operate the Account is voluntary.

Over time and in connection with the User's use of the functionality of the Website, we will collect information about you, which will concern the information you provide voluntarily, such as:

• delivery addresses for placed Orders;

• history and details of executed Orders;

• your bills (invoices, receipts and other accounting documents);

• discount / promotional vouchers that you will receive in connection with executed Orders;

• Your wish lists - regarding our Products;

• information about saved payment cards (logo, card brand, card number, registration date) that you can add to your account to improve the purchasing process.

When you register an Account, we undertake to provide you with the services and functionality of the Website. Thus, the Agreement for the Provision of Services is concluded on the basis of the provisions of the Act on Providing Services by Electronic Means. The legal basis for the processing of your personal data will be Art. 6 sec. 1 b) of GDPR (conclusion and implementation of the Agreement for the Provision of Services or taking action at the request of the data subject, before concluding the Agreement for the Provision of Services under the conditions specified in the Regulations).

We will store your data for the duration of the Agreement for the Provision of Services, and then until the expiry of the limitation period for claims under the contract. The limitation periods for claims result from the Act of 23 April 1964 - Civil Code. Unless a specific provision

provides otherwise, it is 6 years, and for claims related to running a business - 3 years.

Providing your personal data at this stage is voluntary, but failure to provide them will prevent the use of the functionality of our Website available to registered Users.

2. Conclusion of Sales Agreements via the Website

The purpose of processing personal data is to enable you to place and execute Orders via our Website. By submitting and confirming the Order, a Distance Sale Agreement is concluded between us. Thus, the legal basis for the processing of your personal data will be Art. 6 sec. 1 b) of GDPR (conclusion and performance of the contract).

At this stage, we will need your basic personal data, optionally your company data, address details and telephone number (for the purpose of delivering the ordered Products by courier companies cooperating with us). In addition, we will process payment information relating to you, such as your bank account number or payment card number or other payment service that you choose as your payment method.

The Administrator stores your data for the time necessary to perform the order and the Sales Agreement, and then until the expiry of the limitation period for claims under the Sales Agreement concluded. Claims under the Sales Agreement, as a rule, prescribe on general terms provided for in Art. 118 of the Act of 23 April 1964 - Civil Code (i.e. 6 years, and for claims related to running a business - 3 years), subject to the provision of art. 554 of the Civil Code, which provides for a 2-year limitation period for claims arising from sales made in the field of activity of the seller's enterprise.

In addition, the Administrator stores your tax data for a period of 5 years from the end of the tax year in accordance with the provisions of the Act of August 29, 1997 - Tax Ordinance and the Act of March 11, 2004 on VAT.

Financial data contained in accounting documents are stored for a period of 5 years, counting from the beginning of the year following the financial year to which the data relate - in accordance with the Act of 29 September 1994 on Accounting.

Providing your personal data is a prerequisite for the conclusion of the Sales Agreement and the execution of the order.

3. Handling of Users' rights, warranty, guarantee and the right to withdraw from the Agreement

The purpose of processing personal data is to enable you to use the rights granted by law, including the warranty, the right to withdraw from the Agreement, or the exercise of rights under the guarantee - if such is granted for the Products offered. By submitting a complaint or a declaration of withdrawal from the Agreement, you exercise your rights resulting from the provisions of law or the concluded Agreement, respectively. Thus, the legal basis for the processing of your personal data will be Art. 6 sec. 1 b) of GDPR or Art. 6 sec. 1 c) of GDPR (handling of rights resulting from the concluded Agreement or legal provisions).

At this stage, we will need your basic personal data, optionally your company data, address details and

telephone number (for the purposes of delivery of Products - if the complaint is accepted, by courier companies cooperating with us).

At this point, we will need information from you about what constitutes the basis for submitting a complaint or returning the purchased goods.

In addition, we will process payment information relating to you, such as your bank account number or payment card number or other payment service that you choose as your payment method for the purpose of a refund, if you are not interested in the new Products, and you decide to have the money paid back.

Providing your personal data at this stage is voluntary, but failure to provide them may prevent or significantly hinder the implementation of your rights. As a result, it will be difficult to handle your requests or they will be left unrecognized.

4. Contact form

As part of the Website, contact forms are available, which provide the possibility of contacting the Administrator in any matter regarding our activity. Using the form requires providing personal data necessary for contact and answering the inquiry, in particular: e-mail address. The User may also provide other data to facilitate contact or handling of the inquiry.

The purpose of processing personal data is to enable you to contact the Administrator in any matter that relates to our business and to reply to the message sent. Thus, the legal basis for the processing of your personal data will be Art. 6 sec. 1 f) of GDPR (i.e. the legitimate interest of the Administrator in the form of responding to messages from customers or other people). Data regarding the case you are addressing to us. Their scope will be different each time depending on the type of case.

Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to do so results in the inability to handle. Providing other data is voluntary.

5. Newsletter

The purpose of processing personal data is to enable you to use the service of our Website called "Newsletter", which consists in sending you to the indicated e-mail address, the so-called commercial information related to the activity conducted by the Administrator, about new products or promotions on the Website. We only need your e-mail address at this stage.

By clicking the "Subscribe" button after providing the required personal data on our Website, you consent to the processing of your personal data and to receive commercial and marketing information. Thus, the legal basis for the processing of your personal data will be Art. 6 sec. 1 a) of GDPR (consent expressed through a clear affirmative action, i.e. by pressing the "Subscribe" button).

This means that by providing your e-mail address and pressing the "Subscribe" button, you consent to the processing of your personal data, and therefore we will be able to send you commercial and marketing information

as part of the Newsletter service. Your consent is not a written declaration (traditional consent) but takes the form of an explicit affirmative action. Remember that you always have the right to withdraw your consent for data processing (without affecting the lawfulness of processing based on consent before its withdrawal).

We will store your data until you unsubscribe from the Newsletter. It is possible to unsubscribe from the Newsletter (thus withdrawing the consent granted) by clicking the "Unsubscribe me from the Newsletter" link, which is at the end of each commercial message we send or using the contact form.

Providing your personal data at this stage is voluntary, but failure to provide them may prevent the implementation of the Newsletter service. As a result, it will be impossible to receive information as part of the Newsletter service.

• 7 Marketing activities

With regard to the conducted marketing activities, we may, based on your consent [i.e. art. 6 sec. 1 a) of GDPR] process information that helps us adjust advertisements and content to your preferences and expectations, including the display of behavioural advertising. For this purpose, we may process, inter alia, IP address, data from cookies, or information about your traffic on the Website, including the Products you are viewing and your preferences in this regard.

• 8 Data recipients and references to other websites

1. We use the services of external entities to which the Users' data may be transferred, e.g.:
2. system provider for the implementation of electronic payments;
3. hosting provider and server administrator;
4. accounting office;
5. law offices if it is necessary to ensure compliance with the law or to establish, exercise or defend against claims;
6. entities providing day-to-day service to the Website;
7.  (please list other categories of recipients, if any).
8. The Administrator may share anonymised data (i.e. those that do not identify specific Users) with external service providers, trusted partners or research agencies in order to improve the overall quality and effectiveness of services provided by the Administrator or to participate in scientific research that brings broadly understood social benefit.
9. In order to perform the transaction, the Administrator may provide Users' personal data to entities providing services for the Administrator that process this data on behalf of the Administrator in order to perform the contract, while maintaining appropriate security measures.
10. The Administrator points out that the Website may contain links to other websites and services that constitute a service provided by third parties and are therefore beyond the Administrator's control. The Administrator is not responsible for the personal data protection practices used by these websites, therefore we recommend Users to read the content of privacy statements posted on partner websites, especially if they collect personal data.

• 9 Your rights

You have the following rights related to the processing of personal data:

1. the right to withdraw the consent given, with the proviso that the withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal;
2. the right to object to the processing of data due to your special situation - when we process your data on the basis of our legitimate interest;
3. the right to access your personal data;
4. the right to request the rectification of your personal data;
5. the right to request the deletion of your personal data when the data are no longer necessary for the purposes for which they were collected or otherwise processed or they are used unlawfully or, in a specific case, there is a legal obligation to delete them;
6. the right to transfer data in the cases specified in art. 20 of GDPR;
7. the right to request the restriction of the processing of your personal data (then the data will only be stored) - if:

• you question the correctness of the data,
• you believe that the processing is unlawful and you oppose their removal (requesting the restriction of their processing instead);
• the data are not needed for the purposes of processing, but you need them to establish, assert or defend claims;
• when you have objected to the processing pending the examination of the objection.

To exercise the above rights, please contact us (contact details in § 1 above). We will thoroughly verify requests, demands or objections in accordance with the applicable provisions on the protection of personal data. At the same time, we would like to inform you that these rights are not absolute, as the provisions allow to disregard them in certain situations.

You also have the right to lodge a complaint with the supervisory body dealing with the protection of personal data, i.e. the President of the Personal Data Protection Office.

• 10 Server Logs

1. When using the Website, the so-called web server logs, i.e. records regarding some parameters of users gaining access to the Website.
2. Logs contain in particular data such as the device's IP address, time of the event, data on the resource downloaded, referrer, user agent, cookie.
3. The data stored in the server logs are not associated with specific Users using the Website and are used as auxiliary material for administrative purposes. Moreover, their content is not disclosed to anyone except those authorized to administer the server.

• 11 Security and liability rules

1. The administrator has implemented reasonable, adequate business, economic, physical, technical and organizational measures to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and any other form of illegal processing.
2. The administrator has implemented appropriate policies and procedures for the protection of personal data and IT infrastructure.
3. The administrator manages personal data in accordance with internally adopted security and privacy protection requirements.

• 12 Transfer of personal data outside the EEA

The administrator informs that your personal data will not be transferred outside the European Economic Area.

• 13 Automated decision making and profiling

The administrator, in order to create your profile for marketing purposes and to send you direct marketing tailored to your preferences, will process your personal data (related to your activity on our Website in an automated manner), including in the form of profiling.

The result of profiling will be:

• determining your interest in the Products offered by the Administrator;
• research of the market and your behaviour and preferences;
• determining the directions and actions necessary to improve the quality of our services and products offered on the Website.

The above-mentioned actions will not, however, have any legal effects on you, nor will they significantly affect your situation. The only consequence for you will be displaying or sending notifications, messages or carrying out by the automatic mechanism other information / marketing activities tailored to your interests. If you opt out (by blocking the possibility of saving our cookies on your device) of profiling, you will not face any negative consequences. Advertisements and other marketing information will continue to be published, but will be less relevant to you.

• 14 Final provisions

1. Changes in the Privacy Policy of the Website may be influenced by the development of Internet technology, possible changes in the personal data protection law and development of the Website.
2. Changes to the Privacy Policy are effective from the date of their publication.