At muscle-zone.co.uk, we respect your right to privacy and place great importance on protecting your personal information. This Privacy Policy (hereinafter: Privacy Policy) explains how we collect, use, share and protect the data you entrust to us when you use our online store available at www.muscle-zone.pl (hereinafter: Store).

We act in accordance with applicable laws, in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: RODO) and Polish data protection regulations.

Provision of personal data is, in principle, voluntary, but necessary to conclude and execute the Sales Agreement, provide electronic Services, handle inquiries, returns and complaints, fulfill obligations under the law. Failure to provide data may prevent the use of certain services or functionalities of the Store.

We reserve the right to verify the veracity of the data provided during registration in the Online Store. If we find that the data is not true, we have the right to delete the Customer's Account, after sending an e-mail to the Customer with information that due to the falsity of the data the Account will be deleted.

1 Who is the Administrator of your personal data?

The personal data of Sellers and Buyers, as defined in the Store Regulations, are processed by the Administrator as the administrator of personal data within the meaning of Article 4(7) of the RODO and other applicable laws.

The personal data administrator is:

Contact in matters of personal data: e-mail: biuro@muscle-zone.pl, tel. +48 510 054 085 (Mon-Fri 8:00 - 16:00, charge as for a standard call according to the operator's price list) or in writing to the registered office address.

The Administrator has not appointed a Data Protection Officer. In matters related to the processing of personal data, you can contact Muscle-Zone directly using the data indicated in this section.

2 What personal data do we collect, for what purposes and on what basis?

2.1 Data provided during account registration and order placement

• Identification and contact data: name, surname, e-mail address, telephone number, shipping address (street, house/apartment number, postal code, city, country).
• Purpose: order processing, payment processing, invoicing, order communication, complaints and returns handling, user account maintenance, fulfillment of statutory obligations (taxes, accounting).
• Legal basis: Article 6(1)(b) RODO (performance of the contract), Article 6(1)(c) RODO (legal obligation), and in the area of claiming, Article 6(1)(f) RODO (legitimate interest of the Administrator).

2.2 Payment data

• Scope: first name, last name, address, information necessary to process payments (e.g. card type, bank details).
• Purpose: acceptance of payments, fulfillment of statutory obligations.
• Legal basis: Article 6(1)(b) RODO, Article 6(1)(c) RODO and Article 6(1)(f) RODO for protection of the Administrator's rights.

2.3 Data collected automatically when using the site

• Technical data: IP address, browser type, operating system, device type, access time, pages and products viewed.
• Purpose: to ensure proper operation of the site, security, statistics, personalization of content and offers, prevention of fraud.
• Legal basis: Article 6(1)(f) RODO (legitimate interest of the Administrator).

2.4 Data collected via cookies

• Scope: preferences, products in the shopping cart, browsing history.
• Purpose: improving site performance, personalization, traffic analysis, marketing.
• Legal basis: Article 6(1)(a) RODO (consent) for analytical and marketing cookies and Article 6(1)(f) RODO for essential cookies.

2.5 Data from correspondence

• Scope: data provided in messages (form, e-mail, telephone).
• Purpose: handling inquiries, complaints.
• Legal basis: article 6(1)(b) RODO or article 6(1)(f) RODO, and in the field of claim investigation article 6(1)(f) RODO.

2.6 Marketing data (newsletter).

• Scope: email address.
• Purpose: sending newsletter, informing about news, promotions, offers.
• Legal basis: Article 6(1)(a) of the RODO (consent), and in the area of claims, Article 6(1)(f) of the RODO.

2.7 Social media data

• Scope: data shared on profiles (e.g. username, message content).
• Purpose: handling inquiries, brand promotion.
• Legal basis: article 6(1)(f) RODO (communication and promotion).

The Administrator may also process personal data in order to fulfill obligations under national law, in particularthe Law on Provision of Electronic Services, the Law on Consumer Protection, the Law on Prevention of Money Laundering and other legal acts.

3 To whom do we share personal data?

The Administrator may entrust the processing of personal data to third parties with whom he has entered into appropriate entrustment agreements pursuant to Article 28(3) of the RODO.

Data may be disclosed to third parties, including in particular: couriers, customs agencies, marketing agencies, IT and hosting providers, online payment processors, providers of analytical and marketing tools, as well as accounting and legal services.

Data is also disclosed to third-party Vendors offering goods on the Website as part of the marketplace functionality. These entities process data on the basis of a contract with us and only in accordance with our instructions, ensuring appropriate data protection measures. A list of current processors may be made available to you upon request.

In case of complaints, data may be transferred to the Seller, distributor, manufacturer or guarantor, depending on the goods covered by the complaint.

With the user's consent, data may be shared with other entities for their own purposes, including marketing. If you choose online payment, the data necessary for payment processing will be transferred to the payment operator. The selection of a particular payment method constitutes consent to the transfer of data to the operator.

Any entities to which we share data are obliged to protect it in accordance with the RODO and the agreements concluded with us.

4 Transfers of data outside the European Economic Area

We may transfer personal data to recipients located outside the EEA in so-called third countries. Before transferring data, we ensure an adequate level of protection on the part of the recipient (e.g. an EU Commission adequacy decision or EU standard contractual clauses) or rely on your consent.

Information about recipients in third countries and copies of the safeguards in place can be obtained using the contact information indicated in Section 1.

5 How long do we keep personal data?

The duration of data processing depends on the type of service or contract and the purpose of processing. As a rule, data are processed for the duration of the service or contract, until the withdrawal of consent or effective objection, as long as the basis for processing is the legitimate interest of the Administrator. The period may be extended if the processing is necessary to establish, assert or defend claims, and after that time only to the extent required by law.

• The duration of the contract and the period for asserting claims (up to 6 years),
• the period required by law, including tax law (at least 5 years from the end of the fiscal year),
• until the withdrawal of consent (for data processed on the basis of consent),
• until the existence of the Administrator's legitimate interest (no longer than 3 years from the last contact).

After the expiration of the indicated periods, the data are irreversibly deleted or anonymized.

6 Your data protection rights

The data subject has rights under the RODO, including:

• The right to access data and information about processing.
• The right to rectify inaccuratedata and complete incompletedata.
• The right to erasure in the cases specified in the RODO.
• Theright to restrict processing.
• Theright to data portability in a structured format when based on consent or contract and processing is automated.
• The right to object:
  • on groundsof particular situation against processing based on Article 6(1)(f) of the RODO, including profiling, unless we demonstrate an overriding legal basis,
  • against direct marketing at any time.
• The right to withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
• The right to lodge a complaint with the President of the Office for Personal Data Protection (PUODO), Stanisława Moniuszki 1A Street, 00-014 Warsaw, tel. 22 531 03 00, website: uodo.gov.pl.

To exercise your rights, please contact us in accordance with point 1. For security purposes, we may ask for additional information to verify your identity. A response is provided no later than 1 month after receipt of a complete application.

7 Security measures

We use appropriate technical and organizational measures to protect data from unauthorized access, loss, destruction, modification or disclosure, including:

• Data encryption: SSL/TLS encrypted connections.
• Access control: access only for authorized persons committed to confidentiality.
• Pseudonymization and anonymization where possible.
• Backups performed regularly.
• Monitoring of systems for threats and vulnerabilities.

Systematically improve security measures to ensure the highest level of data protection.

8 Direct marketing

With separate consent, we may use data to send marketing offers available in the Store, newsletters, surveys and invitations by e-mail, SMS or telephone, in accordance with the scope of the consent given.

Data may be transferred to third-party companies for the sole purpose of providing these services to our company (distribution of marketing materials). We do not sell the data and do not transfer it to other entities for their own purposes without your express consent.

You can withdraw your consent at any time, including by editing your account settings or by sending an email to: biuro@muscle-zone.pl. After withdrawing your consent, we will not conduct direct marketing to you.

9 Profiling and automated decision-making

As part of direct marketing, we may make decisions by automated means, including profiling, based on the data we have (purchase history, products viewed, preferences). On this basis, we adjust the offer and possible discounts.

The legal basis is your consent for direct marketing purposes (Article 6(1)(a) RODO in conjunction with Article 22(2)(c) RODO). Consent can be withdrawn at any time. If you do not accept the assessment made automatically, you may file a complaint through the channels indicated in Section 1.

10 Information directed to Sellers

Sellers accessing Buyers' data must enter into a separate agreement with us for entrusting the processing of personal data in accordance with Article 28 RODO. The lack of an agreement prevents the use of the Store's functionalities allowing access to Buyers' data.

Sellers act as independent data controllers with regard to independent processing of Buyers' data (e.g. execution of sales contracts). They are obliged to fully comply with the RODO and to fulfill their information obligations to data subjects.

Data may be transferred to third parties only to the extent necessary, including IT providers, couriers, accountants, payment operators, payment operators, consulting firms and law firms on the basis of appropriate legal grounds. These entities are obliged to maintain confidentiality and compliance.

The Administrator is not responsible for the way data is processed by Sellers acting as separate administrators, while exercising due diligence by verifying the compliance of their actions with the law, including through documentation, entrustment agreements and control procedures.

It is prohibited for Sellers to use Buyers' data for marketing or other commercial purposes not directly related to the performance of the sales contract concluded through the Store.

11 Changes to the Privacy Policy

We reserve the right to change the Privacy Policy at any time to adapt it to changes in the law or in the way we process data. Any changes will be published on this page and will take effect on the date of publication, unless otherwise indicated.

We recommend that you check the Privacy Policy regularly to keep up to date with how we protect your data. We will notify you of significant changes by email if you have a Customer Account with us or have subscribed to our Newsletter.