Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: ” RODO“) kindly inform you that:

1. The administrator of the personal data is : KoKo Group spółka z ograniczoną odpowiedzialnością (registered office address: ul. Lazurowa 85a/53, 01-479 Warsaw) entered in the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XII Economic Division of the National Court Register, KRS: 0000916509, NIP: 5223208183, REGON: 38973856600000, share capital 5 000 PLN (hereinafter: ” Administrator“).
2. Capitalized terms have the meaning given to them in the Regulations.
3. In all matters related to the processing of personal data, the Administrator should be contacted by e-mail at: kontakt@kokokamper.pl
4. The controller may process personal data for the purpose of:
   1. To enable the acquisition of the Gift Card by the Purchaser and the use of the Gift Card by the User – pursuant to Art. 6 paragraph. 1(b) RODO (processing is necessary for the conclusion and performance of the contract);
   2. To establish claims, assert or defend against them – on the basis of Art. 6 paragraph. 1(f) RODO (the processing is necessary for the purposes of the Administrator’s legitimate interest, which in this case is the processing of complaints and the possibility of effective establishment of claims, their investigation or defense against them);
   3. Fulfillment of obligations incumbent on the Administrator under tax law – based on Art. 6 paragraph. 1(c) RODO (processing is necessary for the Administrator to fulfill a legal obligation).
5. Provision of personal data by the Purchaser and the User indicated in the Regulations is necessary to acquire and use the Gift Card. Failure to provide them will result in the inability to acquire and use the Gift Card.

1. Personal data of Purchasers and Users will not be used for automated decision-making, including profiling.
2. Personal data of Buyers and Users will not be transferred to third countries (not belonging to the European Economic Area).
3. Recipients of personal data of Purchasers and Users will be the following entities:
   1. A company providing accounting services to the Administrator;
   2. A company providing data hosting services to the Administrator;
   3. A company providing legal services to the Administrator.

In addition, personal data may be transferred to entities to which the Administrator has a legal obligation to transfer data.

1. Personal data of Purchasers and Users will be stored:
   1. Until the expiration of the statute of limitations – in the case of personal data that are processed for the purpose of establishing, asserting and defending against claims;
   2. until an effective objection is lodged or the purpose of the processing is achieved – in the case of personal data that the Administrator processes due to its legitimate interest, in particular to conclude the purchase and use of the Gift Card.
2. In connection with the Administrator’s processing of the personal data of Purchasers and Users, they are entitled to certain rights:
   1. The right to know what personal data concerning Purchasers and Users is processed by the Administrator and to receive a copy of this data (the so-called right of access). The issuance of the first copy of the data is free of charge;
   2. If the processed data becomes outdated or incomplete (or otherwise incorrect) Purchasers and Users have the right to request rectification;
   3. In certain situations, the Purchaser and User may request the Administrator to delete personal data, such as when:
      • the data will cease to be needed by the Administrator for the purposes it informed;
      • effectively revoked consent to data processing – as long as the Administrator does not have the right to process data on any other legal basis;
      • processing is unlawful;
      • the need to delete the data arises from the Administrator’s legal obligation;
   4. The right to transfer data to another controller – this applies only to those data of Purchasers and Users that are processed under contract or by automated means;
   5. The right to object to the processing of personal data of Purchasers and Users for purposes arising from the legitimate interests of the Administrator;
   6. If the Purchaser and the User considers that the processed personal data is incorrect, the processing is unlawful, or the Administrator no longer needs the specified data, the Purchaser and the User may request that for a certain necessary period of time (e.g., to verify the correctness of the data or to assert claims) the Administrator not perform any operations on the data, but only store it;
   7. The Purchaser and User has the right to lodge a complaint with the President of the Office for Personal Data Protection if they consider that the Administrator’s processing of their personal data violates the provisions of the RODO or other data protection laws.