§1 Management of personal data

1. The data controller is MAŁGORZATA BOCHIŃSKA, trading
   as "TECH-PLAST" MAŁGORZATA BOCHIŃSKA, at ul. Wrocławska 7B,
   55-220 Jelcz-Laskowice. The business is registered in the Central Register and
   Information on Economic Activity under Tax Identification Number (NIP): 9121315701, REGON 021741438.
2. You can
   contact the person responsible for supervising the processing of personal data within the organisation by email at biuro@tech-plast.com.pl, in writing to the
   Controller’s address, or by telephone on 603121990.
3. This Policy sets out the rules governing the processing of personal data by
   the Controller on the Website, including the legal basis, purposes and scope of
   such processing, as well as the rights of data subjects.
4. Personal data is processed by the Controller in accordance with applicable law
   , in particular in accordance with Regulation (EU)
   2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to
   the processing of personal data and on the free movement of such data, and
   repealing Directive 95/46/EC (General Data Protection Regulation) Official text
   of the GDPR:
   http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
5. The User’s rights are not absolute and do not apply to all
   personal data processing activities.
6. The Controller has appointed a Data Protection Officer (DPO). For matters relating to
   the processing of personal data, please contact the Data Protection Officer:
   MAŁGORZATA BOCHIŃSKA, biuro@tech-plast.com.pl.
   You may contact the DPO in particular to exercise your rights
   under the GDPR or to obtain information regarding the processing of your personal data
   .

§2 Definitions

1. Data Controller – MAŁGORZATA BOCHIŃSKA, trading as
   "TECH-PLAST" MAŁGORZATA BOCHIŃSKA, 7B Wrocławska Street, 55-220 Jelcz-Laskowice.
   The business is registered in the Central Register and Information on Economic Activity
   under Tax Identification Number (NIP): 9121315701, REGON 021741438.
2. Personal data – information relating to an identified or identifiable
   natural person, based on one or more specific factors that define their physical,
   physiological, genetic, mental, economic, cultural or social identity, including
   the device’s IP address, online identifier, and information collected via
   cookies and other similar technologies.
3. Policy – this Privacy Policy.
4. Cookie Policy – a document setting out the rules for the use of cookies on the Website, available
   at: https://simplefix.pl/polityka-cookies/.
5. Profiling – the automated processing of personal data involving
   the analysis and prediction of user behaviour.
6. GDPR / General Data Protection Regulation – Regulation (EU)
   2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing
   of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
7. Website – the website operated by the Administrator at simplefix.pl.
8. User – any individual who visits the Website or uses one or more
   of the services or features described in this Policy.

§3 Safety

1. The controller has implemented appropriate technical and organisational measures to ensure
   the security of personal data processing and, in particular, is responsible for and
   ensures that the data it collects is:
   • processed in accordance with the law;
   • collected for specified, legitimate purposes and not subject to further
   • processing that is incompatible with those purposes;
   • factually accurate and relevant to the purposes for which they are processed;
   • stored in a form that allows the data subjects to be identified for no longer than
   • than is necessary to achieve the purpose of the processing and
   • processed in a manner that ensures the appropriate security of personal data,
   • including protection against unauthorised or unlawful processing, and
   • accidental loss, destruction or damage, by appropriate means
   • technical or organisational.

§4 Purposes and legal basis for data processing

1. Pursuant to Article 6(1)(a) of the GDPR (consent), personal data may be
   processed for the following purposes:
   • Retargeting and behavioural advertising, including the display of personalised adverts in
   • based on the user’s activity history on the Website and on other websites
   • online. Data processing for these purposes is carried out solely on the basis of
   • the User’s consent as expressed in the cookie banner. Data may be collected for
   • through the use of cookies and similar technologies, in accordance with our Cookie Policy.
   • Storing data in cookies in accordance with the Cookie Policy available at:
   • https://simplefix.pl/polityka-cookies/
   • Contact via remote communication tools, in particular:
   • by phone, email or via the app.
   • Content moderation.
   • Content personalisation.
   • Marketing of the Administrator’s products and services and those of the Administrator’s partners.
   • Participation in a webinar or online training session.
   • Participation in competitions and loyalty schemes.
   • Invitations to take part in surveys and market research.
2. Pursuant to Article 6(1)(b) of the GDPR (performance of a contract), personal data may be processed for the following purposes:
   • The performance of a contract of sale or a contract for the provision of services, or the taking of action in relation to
   • a request made by the data subject prior to the conclusion of the specified contract or after its
   • upon conclusion of the contract, in particular: the right to a warranty and the right to have a complaint considered.
   • Complaints or withdrawal from a distance contract.
3. Pursuant to Article 6(1)(c) of the GDPR (a legal obligation incumbent on
   the Controller), personal data may be processed for the following purposes:
   • Issuing and storing invoices, bills or fulfilling other obligations
   • arising from tax and accounting regulations (the archiving obligation relating to
   • (accounting documents).
   • Cooperation with law enforcement agencies and public bodies.
   • The creation of registers and other documentation required by the GDPR.
4. Pursuant to Article 6(1)(f) of the GDPR (the Controller’s legitimate interests), personal data may be processed for the following purposes:
   • The simplefix.pl team.
   • Storing data necessary for the proper functioning of the Website in cookies
   • in accordance with our Cookie Policy.
   • Managing accounts on Facebook, Instagram and TikTok, and interacting with
   • Users of the specified websites.
   • Security measures for the Website, management of the Website and its proper
   • actions.
   • To compile statistics and analyse traffic on the website.
   • Direct marketing.
   • Settlement of claims brought by or against the Administrator.
   • Contact with the User.
5. Personal data may also be processed for other purposes if the Controller has
   an appropriate legal basis for doing so, in particular under Article 6 of the GDPR,
   provided that such purpose does not infringe upon the User’s rights and freedoms. In such a case
   , the User will be informed of the new purpose of processing before processing for that purpose begins
   .

§5 Profiling

1. The controller uses profiling for marketing purposes, which involves analysing
   the User’s activity on the Website using cookies and similar technologies.
2. Profiling may include:
   • ad personalisation based on browsing history,
   • an analysis of the User’s interaction with content on the Website,
   • tailoring the advertising content displayed on external websites (e.g. Google
   • (Ads, Facebook).
3. Profiling is carried out solely on the basis of the User’s consent.
4. You may withdraw your consent to profiling at any time by changing your settings or
   by contacting the Controller at the following email address: biuro@tech-plast.com.pl.

§6 Period of processing of personal data

1. The period for which the Controller processes data depends on the type of service provided and the purpose
   of the processing. As a general rule, data is processed for the duration of the service, until consent is
   withdrawn or a valid objection to the processing
   of data is raised in cases where the legal basis for the processing is the Controller’s legitimate
   interest.
2. The data processing period may be extended where processing is
   necessary to establish, exercise or defend against potential claims, and
   after that time only to the extent required by law.
   Once the processing period has expired, the data is permanently deleted or anonymised.
3. Detailed data retention periods depending on the purpose, e.g.:
   • Data relating to the performance of the contract – retained for the duration of the contract and thereafter until the expiry of the limitation period for claims (3 or 6 years).
   • Accounting and tax records – retained for the period required by law
   • tax law (currently 5 years).
   • Data obtained on the basis of consent – stored until consent is withdrawn
   • consent.
   • Data relating to user queries – stored for up to 12 months
   • months after the correspondence has ended.
     

§7 User Rights

1. You have the following rights in relation to your personal data:
   • access to your personal data,
   • to correct your personal data at any time,
   • to have your personal data deleted at any time,
   • to receive a copy of your data,
   • restrictions on the processing of personal data,
   • objection to the processing of personal data,
   • the transfer of personal data,
   • withdrawal of consent; the withdrawal of consent does not affect the lawfulness of the processing
   • made prior to its revocation,
   • objection to the processing of personal data on legitimate grounds
   • the Controller’s legitimate interests for marketing purposes, direct marketing and
   • for purposes other than marketing,
   • to lodge a complaint with the supervisory authority.
2. If you have any queries regarding the exercise of your rights, please contact the Data Protection Officer (DPO) by emailing biuro@tech-plast.com.pl.
3. In certain cases, the Controller may refuse to comply with a User’s request if
   the law requires the data to be processed further.
   

§8 Recipients of personal data

1. In order to ensure the proper operation of the Website, the Controller transfers the User’s personal
   data to other external entities, in particular: the hosting provider, courier companies
   , payment service providers and banks.
2. The Data Controller reserves the right to disclose personal data where required
   by applicable law, including the obligation to provide information to
   the relevant administrative or law enforcement authorities.

§9 Security of Personal Data

1. The controller carries out ongoing risk assessments to ensure that personal
   data is processed securely. Through these measures, the controller ensures, above
   all, that access to the data is restricted to authorised persons and only to the extent
   necessary for the performance of their duties.
2. The controller is obliged to take all measures permitted by law
   to ensure that all processing of personal data is recorded and carried out only
   by an authorised entity.
3. The Controller is also required to ensure that other entities working with
   the Controller guarantee that they apply appropriate security measures whenever
   they process Personal Data on the Controller’s behalf.
4. The administrator employs technical security measures, such as data
   transmission encryption (SSL/TLS), restricted access to systems, and procedures to protect against
   unauthorised access to data.

§10 Changes to the Privacy Policy

The current version of the Policy was adopted and has been in force since 7 November 2025.
The legal compliance of this document is guaranteed by the lawyers at KZ Law Firm

The policy is reviewed and updated on an ongoing basis.