Free shipping to PL from 200 PLN Shipping within 24 hours Cheap overseas shipping On the market since 2005 Blog Help
Categories Manufacturers MENU Blog Cart

Your shopping cart is empty!

Privacy Policy

At mz-store.com we respect your right to privacy and place great importance on the protection of personal data. This Privacy Policy (hereinafter:“Privacy Policy”) explains how we collect, use, share, and protect the data you entrust to us when using our online store available at www.mz-store.com (hereinafter:“Store”).

We operate in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter:“GDPR”), as well as Polish regulations on the protection of personal data.

Providing personal data is generally voluntary, but it is necessary for the conclusion and performance of the Sales Agreement, the provision of electronic services, the handling of inquiries, returns, and complaints, and the fulfillment of legal obligations. Failure to provide such data may prevent you from using certain services or features of the Store.

We reserve the right to verify the accuracy of the data provided during registration in the Online Store. If it is determined that the data is inaccurate, we have the right to delete the Customer’s Account after first sending the Customer an email informing them that the Account will be deleted due to inaccurate data.

1. Who is the Controller of your personal data?

The personal data of Sellers and Buyers, as defined in the Store’s Terms and Conditions, is processed by the Administrator as the controller of personal data within the meaning of Article 4(7) of the GDPR and other applicable laws.

The controller of personal data is:

MZ-Store S.A., with its registered office in Reda (84-240), at 47 Cypriana Kamila Norwida Street, registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Gdańsk-North in Gdańsk, 8th Commercial Division of the National Court Register, under KRS number: 0000877266, REGON: 38787611700000, NIP: 5862363341, BDO: 000517970, share capital: 5,000,000.00 PLN, paid in full.

If you have any questions regarding the processing of personal data, please contact us by email at office@mz-store.pl, by phone at +48 510 054 085 (Mon.–Fri. 8:00 a.m.–4:00 p.m., charged as a standard call—according to the applicable carrier’s rate schedule) or in writing to our registered office address.

The Data Controller has not appointed a Data Protection Officer. For matters related to the processing of personal data, you may contact MZ-STORE directly using the contact information provided in Section 1 of the Privacy Policy.

2. What personal data do we collect, for what purposes, and on what basis?

We collect various types of personal data depending on how you use our Store. Below are the categories of data and the purposes for which they are processed:

  • Data provided during account registration and when placing an order:

- Identification and contact information: first name, last name, email address, phone number, shipping address (street, house/apartment number, ZIP code, city, country).

- Purpose: Order fulfillment, payment processing, invoicing, communication regarding orders, handling complaints and returns, maintaining user accounts, and fulfilling the Controller’s statutory obligations arising, in particular, from tax and accounting regulations.

- Legal basis: Article 6(1)(b) of the GDPR (performance of a sales contract or provision of a user account service), Article 6(1)(c) of the GDPR (the Controller’s legal obligation), for the purpose of potentially establishing and pursuing claims or defending against them – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.

  • Payment data: first name, last name, address, information necessary to process payments (e.g., payment card type, bank details).

- Purpose: Accepting payments for ordered products; fulfilling the Controller’s statutory obligations arising, in particular, from tax and accounting regulations.

- Legal basis: Article 6(1)(b) of the GDPR (performance of a sales contract), Article 6(1)(c) of the GDPR (the Controller’s legal obligation), for the purpose of potentially establishing and pursuing claims or defending against them – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.

  • Data collected automatically while using the website:

- Technical data: IP address, browser type, operating system, device type, time of access to the website, pages and products viewed.

- Purpose: To ensure the proper functioning of the website, security, usage statistics, personalization of content and offers, and fraud prevention.

- Legal basis: Article 6(1)(f) of the GDPR (the Controller’s legitimate interest—ensuring the functionality and security of the website, conducting statistical analyses), for the purpose of potentially establishing and pursuing claims or defending against them – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.

  • Data collected via cookies:

- Data regarding your activity on the website: Preferences, products added to the shopping cart, browsing history.

- Purpose: Improving website performance, personalizing the user experience, analyzing website traffic, and for marketing purposes (displaying personalized ads).

- Legal basis: Article 6(1)(a) of the GDPR (your consent) for marketing and analytics cookies, or Article 6(1)(f) of the GDPR (the Controller’s legitimate interest) for cookies necessary for the website to function. You can find details about cookies in our Cookie Policy.

  • Correspondence Data: If you contact us (e.g., via the contact form, email, or phone), we collect the data contained in your correspondence.

- Purpose: To handle inquiries and complaints.

- Legal basis: Article 6(1)(b) of the GDPR (actions taken at the request of the data subject prior to entering into a contract) or Article 6(1)(f) of the GDPR (the Controller’s legitimate interest—conducting correspondence and providing customer service), for the purpose of potentially establishing and pursuing claims or defending against them, the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.

  • Marketing data (if you have consented to receive the newsletter): Email address.

- Purpose: Sending a newsletter with information about new products, promotions, and offers.

- Legal basis: Article 6(1)(a) of the GDPR (your consent), for the purpose of potentially establishing and pursuing claims or defending against them—the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) in protecting its rights.

  • Data collected in connection with the use of social media: If you communicate with us through our social media profiles (e.g., Facebook, Instagram), we may process the data you share with us there (e.g., username, message content).

- Purpose: Handling inquiries, brand promotion.

- Legal basis: Article 6(1)(f) of the GDPR (the Controller’s legitimate interest—communication with customers and promotion), for the purpose of potentially establishing and pursuing claims or defending against them—the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights.

The Controller may also process personal data to fulfill obligations arising from national law, in particular the Act on the Provision of Electronic Services, the Consumer Protection Act, the Anti-Money Laundering Act, and other legal acts.

3. To whom do we disclose personal data?

The controller may entrust the processing of personal data to third parties with whom it has entered into appropriate data processing agreements in accordance with Article 28(3) of the GDPR.

Personal data may be disclosed to external entities, including, in particular: couriers, customs agencies, marketing agencies, IT service providers, hosting service providers, online payment processors, providers of analytical and marketing tools, accounting and legal service providers to whom we outsource services related to the processing of personal data.

In the event of a complaint, personal data may be transferred to the Seller, the product distributor, the manufacturer, or the warranty provider, depending on the product subject to the complaint.

If we obtain your consent, your personal data may also be shared with other entities for their own purposes, including marketing purposes. With your consent, we may transfer your personal data, to the extent necessary to fulfill the Sales Agreement, to third-party companies that process online payments, if you select this type of payment through one of the payment systems. The transfer applies to the personal data necessary to process the payment. Selecting a specific payment method constitutes your consent to the transfer of your data to the payment processor.

We assure you that all third parties to whom we disclose your data are obligated to protect it in accordance with applicable GDPR regulations and the data processing agreements we have entered into with them.

When you make a purchase in the Store, we transfer your first name, email address, and order number to Trustpilot A/S, based in Copenhagen (Denmark), which, on our behalf, sends you an invitation to leave a review of your purchase. Trustpilot processes this data as a data processor under a data processing agreement (Article 28 of the GDPR). The basis for processing is our legitimate interest (Article 6(1)(f) of the GDPR), which consists of assessing customer satisfaction and building the Store’s credibility. Submitting a review is voluntary, and the invitation data is stored by Trustpilot for no longer than 3 years. You may request its earlier deletion using the contact information provided in section 1.

4. Transfer of Data Outside the European Economic Area (EEA)

We may also transfer personal data to recipients located outside the European Economic Area (EEA) in so-called third countries.

In this case, before transferring the data, we ensure that the recipient provides an adequate level of data protection (e.g., based on an EU Commission decision confirming an adequate level of protection for the relevant country or an agreement with the recipient on the so-called European Union standard contractual clauses) or that you have given your consent to the transfer of data.

You can contact us to obtain information about recipients in third countries and receive a copy of the specifically agreed arrangements regarding the assurance of an adequate level of data protection. Please use the contact information provided in section 1 for this purpose.

5. How long do we retain personal data?

The period during which the Controller processes Personal Data depends on the type of Electronic Service or is determined by the Sales Agreement and the purpose of the processing. As a general rule, personal data is processed for the duration of the provision of the Electronic Service or the performance of the Sales Agreement, until consent is withdrawn or a valid objection to the processing of personal data is raised in cases where the legal basis for processing personal data is the Controller’s legitimate interest. The period of personal data processing may be extended if the processing is necessary to establish, assert, or defend against potential claims, and after that time only to the extent required by law. Upon expiration of the processing period, personal data is permanently deleted or anonymized. Personal data will be processed for the duration of:

- the term of the contract and for the time necessary to pursue claims (up to 6 years);

- as required by law (e.g., tax laws require at least 5 years from the end of the tax year);

- until consent is withdrawn (for data processed on the basis of consent);

- as long as the Controller’s legitimate interest exists (no longer than 3 years from the last contact).

In certain cases, data may be retained for a longer period if its further processing is necessary to establish, assert, or defend claims, including in the context of internal complaint proceedings or in connection with obligations arising from legal regulations.

After the specified periods have elapsed, personal data is permanently deleted or anonymized in a manner that prevents the identification of the data subject.

6. Your Rights Regarding Personal Data Protection

As a data subject, you have the following rights under the GDPR:

  • Right of access: You have the right to obtain confirmation from us as to whether we are processing your personal data, and if so, to access that data and information regarding its processing, including the categories of data processed, the purposes of processing, the categories of recipients, and the retention period.
  • Right to rectification: You have the right to request the rectification of your personal data that is inaccurate, as well as the completion of incomplete data.
  • Right to erasure (“right to be forgotten”): You may request the erasure of your personal data if:

- The data is no longer necessary for the purposes for which it was collected or otherwise processed.

- You withdraw your consent to the processing, and there is no other legal basis for the processing.

- You object to the processing of your data (Article 21(1) of the GDPR), and there are no overriding legitimate grounds for the processing.

- The data is being processed unlawfully.

- The data must be erased to comply with a legal obligation under Union law or the law of a Member State to which we are subject.

  • Right to Restriction of Processing: You have the right to request that we restrict the processing of your data.
  • Right to data portability: You have the right to receive the personal data you have provided to us, in a structured, commonly used, machine-readable format and to transmit it to another controller without hindrance from us, provided that the processing is based on consent or a contract and is carried out by automated means. You may also request that this data be transferred directly to another controller, provided that this is technically feasible.
  • Right to Object:

- Objection on grounds related to your specific situation: You may object at any time to the processing of your personal data based on the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), including profiling, for reasons related to your specific situation. In such a case, we will cease processing your data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or grounds for the establishment, exercise, or defense of legal claims.

- Objection to Direct Marketing: You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling, to the extent that such processing is related to such direct marketing. Once you have objected, your data will no longer be processed for these purposes.

  • Right to Withdraw Consent: If the processing of your data is based on your consent (e.g., to receive a newsletter), you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
  • Right to lodge a complaint with a supervisory authority: If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office (PUODO).

Address: ul. Stanisława Moniuszki 1A, 00-014 Warsaw

Phone: 22 531 03 00

Website: www.uodo.gov.pl

To exercise the above rights, please contact us using the contact information provided in section 1 or fill out the GDPR rights request form available here:LINK and send it to the email address indicated in section 1. To ensure the security of your data, we may ask you to provide additional information to verify your identity.

We will respond to your request no later than 1 month after receiving it.

7. Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, modification, or disclosure. Our measures include, but are not limited to:

Data encryption: All connections to our store are encrypted using the SSL/TLS protocol, which ensures the security of the information transmitted.

Access controls: Only authorized employees and contractors who are bound by confidentiality obligations have access to your personal data.

Pseudonymization and anonymization: Whenever possible, we use pseudonymization and anonymization techniques to minimize the risk of identification.

Backups: We regularly back up data to ensure it can be recovered in the event of a failure.

System monitoring: We continuously monitor our systems for potential threats and security vulnerabilities.

We are committed to continuously improving our security measures to ensure the highest level of protection for your data.

8. Direct Marketing

If you provide separate consent, we may use the personal data you provide to send you marketing offers available in the Store, the Newsletter, surveys, and invitations—via email, text message, or phone, depending on the scope of your consent.

Personal data provided to us in this manner may be transferred to third-party companies solely for the purpose of providing these services to our company, and it enables marketing agencies and technical providers to distribute digital and printed direct marketing materials.

We never share your personal data for marketing purposes, nor do we sell or exchange it with other entities for purposes other than those described above, unless you give your informed consent to such sharing.

You have the right to withdraw your consent to the processing of your personal data for direct marketing purposes at any time.

Once you withdraw your consent to the processing of your Personal Data for direct marketing purposes, we will no longer be able to send you any direct marketing offers or information previously sent based on your consent to the processing of your Personal Data.

You can opt out of receiving direct marketing materials as follows: 
by editing your Customer Account settings—unchecking the relevant consent options in the tab; 
by submitting a request via email to: office@mz-store.pl.

9. Profiling and Automated Decision-Making

In the process of providing direct marketing services, we make decisions in an automated manner, including through profiling, based on the data we hold about you that identifies your preferences (such as purchase history, products viewed, and preferences). Based on this information, we assign you a personal profile that is relevant to our ability to offer you our services or those of our partners, as well as the amount of discounts we may grant you.

These decisions are made automatically based on statistical analyses. Decisions made in this automated manner influence the selection of services and products offered to you that, in our assessment, may be of interest to you.

Automated decision-making for direct marketing purposes is based on the voluntary consent you have provided. (Article 6(1)(a) of the GDPR in conjunction with Article 22(2)(c) of the GDPR). You may withdraw your consent at any time without affecting the lawfulness of the processing prior to its withdrawal.

If you disagree with our assessment of the situation based on such automated processing, you may file a complaint through the communication channels specified in Section 1 of the Privacy Policy.

10. Information for Sellers

In cases where Sellers gain access to Buyers’ personal data (e.g., to fulfill an order), a separate data processing agreement, as referred to in Article 28 of the GDPR, is required. Failure to enter into such an agreement prevents the use of the Store’s features that allow access to Buyers’ personal data.

Sellers act as independent controllers of personal data to the extent that they process Buyers’ data on their own, in particular for the purpose of fulfilling sales contracts concluded through the Store.

Sellers are required to ensure that data processing complies with applicable laws, including the GDPR, and to fulfill their obligation to inform data subjects.

Personal data may be transferred to third parties only to the extent necessary to achieve the purposes indicated above, including, among others, providers of IT, courier, accounting, and payment services, payment operators, consulting firms, and law firms on the basis of data processing agreements or other appropriate legal grounds under the GDPR. These entities are required to maintain confidentiality and process data in accordance with applicable laws.

The Controller is not liable for the manner in which Sellers process personal data if they act as separate data controllers. Nevertheless, the Controller exercises due diligence to verify that Sellers process data in accordance with applicable laws, including by reviewing documentation, requiring the conclusion of a data processing agreement, and maintaining internal control procedures.

Any use of Buyers’ personal data obtained by Sellers for any marketing or other commercial purposes not directly related to the performance of a sales contract concluded through the Store is prohibited.

All activities of Sellers related to the processing of personal data must comply with the GDPR and be limited to the extent necessary to achieve the purpose of the processing. In particular, Sellers are required to ensure data security and respect the rights of data subjects by implementing appropriate technical and organizational measures to ensure data security.

11. Changes to the Privacy Policy

We reserve the right to amend this Privacy Policy at any time to adapt it to changes in the law or in the way we process data.

Any changes will be posted on this page and will take effect on the date of publication, unless otherwise indicated.

We recommend that you review the Privacy Policy regularly to stay informed about how we protect your data.

We will notify you of significant changes via email if you have a Customer Account with us or have subscribed to our newsletter.