KROX LABZ (“KROX LABZ”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, disclose and protect personal data when you visit or use https://kroxlabz.com (the “Website”), create an account, purchase our products, contact us, subscribe to communications, or otherwise interact with KROX LABZ.

This Privacy Policy is intended to comply with applicable data-protection laws, including the Regulation (EU) 2016/679 (“GDPR” / “RODO”), the Polish Act of 10 May 2018 on Personal Data Protection, and applicable Polish and European rules concerning electronic communications, cookies and direct marketing. (UODO)

1. Data Controller

The controller of your personal data is:

Legal business name: [REPLACE WITH FULL LEGAL COMPANY NAME]
Trading name: KROX LABZ
Registered address: [REPLACE WITH REGISTERED ADDRESS]
Country: Poland
NIP: [REPLACE WITH NIP]
REGON: [REPLACE WITH REGON, IF APPLICABLE]
KRS: [REPLACE WITH KRS, IF APPLICABLE]
Email: [REPLACE WITH PRIVACY/CONTACT EMAIL]
Website: https://kroxlabz.com

For questions concerning the processing of your personal data or to exercise your rights, please contact us using the contact details above.

Data Protection Officer

If KROX LABZ has appointed a Data Protection Officer (“DPO”), their contact details are:

DPO: [REPLACE IF APPLICABLE]
Email: [REPLACE IF APPLICABLE]

If no DPO is legally required or appointed, this section should be removed or replaced with an appropriate statement.

The obligation to appoint a DPO depends on the circumstances specified in GDPR and applicable Polish law; it should not be claimed merely because a company operates an online store. UODO notes that the DPO obligation can arise under GDPR and the Polish Data Protection Act. (UODO)

2. What Personal Data We Collect

Depending on how you use our Website, we may collect the following categories of personal data:

2.1 Account information

When you create an account, we may collect:

  • First and last name
  • Email address
  • Telephone number
  • Password or authentication information
  • Billing address
  • Shipping address
  • Account preferences
  • Order history

2.2 Order and transaction information

When you purchase products from us, we may collect:

  • Name
  • Billing address
  • Delivery address
  • Email address
  • Telephone number
  • Products purchased
  • Order number
  • Order value
  • Payment status
  • Delivery information
  • Returns, refunds and complaint information

We do not normally store complete payment-card details on our own servers when payments are processed by an external payment provider. Payment information may be processed directly by the relevant payment service provider according to its own privacy policy.

2.3 Contact information

If you contact us through our contact form, email, telephone, social media or other communication channels, we may process:

  • Name
  • Email address
  • Telephone number, if provided
  • Message content
  • Attachments you voluntarily provide
  • Information necessary to respond to your enquiry

2.4 Newsletter and marketing information

If you subscribe to our newsletter or marketing communications, we may process:

  • Name
  • Email address
  • Marketing preferences
  • Subscription status
  • Information concerning whether marketing emails are opened or interacted with, where applicable and lawfully collected

2.5 Technical and website information

When you visit our Website, certain technical information may be collected automatically, including:

  • IP address
  • Browser type and version
  • Device type
  • Operating system
  • Language settings
  • Date and time of access
  • Referring website
  • Pages viewed
  • Website interactions
  • Approximate location derived from technical information, where applicable
  • Cookie and similar technology identifiers

The exact information collected depends on the technologies enabled on the Website.

3. How We Use Your Personal Data

We may process personal data for the following purposes:

3.1 Processing and fulfilling orders

We use personal data to:

  • Process purchases
  • Confirm orders
  • Prepare products for shipment
  • Deliver orders
  • Communicate about orders
  • Process refunds and returns
  • Handle complaints
  • Provide customer support

3.2 Managing customer accounts

We use account information to:

  • Create and maintain customer accounts
  • Allow you to view your orders
  • Manage addresses and account details
  • Provide account-related services

3.3 Customer service

We process information necessary to answer questions, resolve problems and provide support.

3.4 Payments

We process information necessary to confirm and administer payments and transactions.

Payment information may be handled by third-party payment providers acting independently or as processors, depending on the relevant service arrangement.

3.5 Shipping and delivery

We may share necessary information with shipping and courier providers to deliver your order.

3.6 Legal and accounting obligations

We may process personal data when necessary to:

  • Comply with tax obligations
  • Maintain accounting records
  • Comply with applicable laws
  • Respond to lawful requests from authorities
  • Establish, exercise or defend legal claims

3.7 Website security

We may process technical information to:

  • Detect fraud
  • Prevent abuse
  • Protect our Website
  • Detect malicious activity
  • Maintain website security
  • Investigate technical incidents

3.8 Website improvement

Where legally permitted, we may use information concerning Website usage to understand how visitors use our Website and improve its functionality, performance and user experience.

3.9 Marketing

Where permitted by applicable law, we may send marketing communications about KROX LABZ products, promotions and services.

Where consent is required, we will request consent before sending the relevant marketing communications.

You may withdraw marketing consent or unsubscribe from marketing communications at any time.

4. Legal Bases for Processing

We process personal data only where we have an appropriate legal basis under Article 6 GDPR.

Depending on the circumstances, these legal bases may include:

4.1 Performance of a contract

We process personal data when necessary to:

  • Process your order
  • Deliver products
  • Manage your account
  • Process returns or refunds
  • Provide services you have requested

4.2 Legal obligation

We may process personal data when necessary to comply with legal obligations, including accounting, tax, consumer-protection and other applicable requirements.

4.3 Legitimate interests

We may process personal data where necessary for our legitimate interests, provided that those interests are not overridden by your rights and freedoms.

Examples may include:

  • Website security
  • Fraud prevention
  • IT security
  • Defending legal claims
  • Managing business relationships
  • Improving our services
  • Certain forms of direct marketing where legally permitted

4.4 Consent

Where consent is legally required, we will process personal data based on your consent.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

UODO emphasizes that consent must be voluntary, specific, informed and unambiguous. (UODO)

5. Cookies and Similar Technologies

Our Website may use cookies and similar technologies.

Cookies are small text files stored on your device that help websites operate, remember preferences and, where permitted, understand Website usage.

We may use the following categories:

5.1 Strictly necessary cookies

These cookies may be required for the Website to function, including:

  • Shopping cart functionality
  • Checkout
  • Login
  • Security
  • Session management
  • Cookie preferences
  • Other essential Website functions

These cookies may operate without consent where permitted by applicable law.

5.2 Preference cookies

These cookies may remember preferences such as language, currency or other Website settings.

5.3 Analytics cookies

Where enabled and where required, analytics technologies may help us understand:

  • Number of visitors
  • Pages visited
  • Website performance
  • User interactions
  • Traffic sources

5.4 Marketing and advertising cookies

Where enabled and where required, advertising or marketing technologies may be used to measure campaigns, personalize advertising or understand interactions with advertisements.

Such technologies will only be activated in accordance with applicable consent requirements.

Poland’s current electronic-communications legislation includes rules implementing the EU ePrivacy framework, so the actual cookie mechanism on the Website should correspond to the technologies KROX LABZ actually uses. (European Legislation Identifier)

Cookie choices

Where consent is required, you can accept or reject non-essential cookies through our cookie-consent mechanism.

You may also change your cookie preferences where the Website provides a cookie-preference mechanism.

Important: KROX LABZ should only list cookies and third-party tracking services that are actually installed on the Website.

6. Third-Party Services and Data Processors

To operate our Website and business, we may use third-party service providers.

Depending on the services actually used by KROX LABZ, these may include:

  • Website hosting providers
  • WooCommerce/WordPress services
  • Payment providers
  • Courier and delivery providers
  • Email service providers
  • Customer-support tools
  • Website analytics providers
  • Marketing platforms
  • Security and fraud-prevention services
  • IT and technical service providers
  • Accounting providers
  • Professional advisers
  • Legal advisers

These providers may process personal data only to the extent necessary for their services and, where applicable, under appropriate contractual arrangements.

Do not publish a list of providers that KROX LABZ does not actually use.

7. Payments

When you make a purchase, payment information may be processed by the payment provider selected during checkout.

Depending on the payment method available on the Website, this may include payment-card information, bank-transfer information or other payment information.

Where a payment provider processes your information as an independent controller, its own privacy policy will also apply.

KROX LABZ does not intentionally request or store your complete payment-card number or card security code unless such processing is specifically required and lawfully supported.

8. Delivery and Courier Services

To fulfil orders, we may provide delivery companies with information necessary to complete delivery.

This may include:

  • Name
  • Delivery address
  • Telephone number
  • Email address
  • Order number
  • Delivery information

The courier may process this information according to its own privacy policy and applicable law.

9. Marketing Communications

If you have lawfully subscribed to KROX LABZ marketing communications, we may send information about:

  • New products
  • Promotions
  • Discounts
  • Sports nutrition products
  • Educational content
  • Company news

Where consent is required, marketing communications will only be sent after obtaining the required consent.

You can unsubscribe at any time using the unsubscribe mechanism contained in marketing emails or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal.

10. Direct Marketing and Electronic Communications

We may communicate with you electronically concerning orders, accounts, customer-service matters and, where legally permitted, marketing.

Marketing communications will be handled in accordance with applicable Polish and European electronic-communications and data-protection laws.

KROX LABZ will not treat acceptance of marketing communications as a condition for purchasing products where such consent is not necessary for the purchase.

11. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Different categories of information may therefore be retained for different periods.

For example:

Customer and order information

We may retain information relating to purchases for the period necessary to:

  • Fulfil contractual and customer-service obligations
  • Meet accounting and tax requirements
  • Handle returns and complaints
  • Establish or defend legal claims

Account information

Account information may generally be retained while your account remains active, subject to applicable legal requirements.

Marketing information

Marketing information may be retained until:

  • You unsubscribe,
  • You withdraw consent, where consent is the legal basis, or
  • We otherwise determine that the information is no longer required,

subject to applicable legal obligations.

Contact enquiries

Contact information may be retained for the period necessary to answer the enquiry and maintain appropriate records, taking into account potential legal claims and business requirements.

Technical/security information

Security logs and technical information may be retained for periods appropriate to security, troubleshooting, fraud prevention and legal requirements.

UODO states that privacy information should tell individuals how long their data will be stored. (UODO)

12. Your Rights Under GDPR

Subject to applicable legal conditions and limitations, you have the following rights:

Right of access

You may request confirmation as to whether we process your personal data and request access to that data.

Right to rectification

You may request correction of inaccurate or incomplete personal data.

Right to erasure

You may request deletion of personal data where the legal requirements for erasure are satisfied.

Right to restriction

You may request restriction of processing in circumstances provided by GDPR.

Right to data portability

Where applicable, you may request your personal data in a structured, commonly used and machine-readable format and request transmission to another controller.

Right to object

You may object to processing based on legitimate interests.

You have a particularly strong right to object to processing for direct marketing purposes.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing that occurred before the withdrawal.

Rights relating to automated decision-making

Where applicable, you may have rights concerning solely automated decision-making, including profiling, that produces legal or similarly significant effects.

UODO identifies these rights, including access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making. (UODO)

13. How to Exercise Your Rights

To exercise your rights, contact:

Email: [REPLACE WITH PRIVACY EMAIL]

Please provide enough information for us to identify you and understand your request.

We may need to verify your identity before responding to a request in order to protect your personal data from unauthorized disclosure.

We will respond within the time period required by applicable law.

14. Right to Lodge a Complaint

You have the right to lodge a complaint with the supervisory authority responsible for data protection.

In Poland, the supervisory authority is:

Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office – UODO)

Address:
ul. Stanisława Moniuszki 1A
00-014 Warsaw
Poland

You can find information about the supervisory authority and data-protection rights on the official UODO website. (UODO)

This right does not prevent you from first contacting KROX LABZ to try to resolve your concern.

15. International Data Transfers

Some of our service providers may process personal data outside Poland or outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will take appropriate measures required by applicable data-protection law.

Depending on the circumstances, these measures may include:

  • An adequacy decision of the European Commission;
  • Standard Contractual Clauses approved by the European Commission;
  • Appropriate safeguards under GDPR; or
  • Another lawful transfer mechanism.

The GDPR contains specific rules governing transfers of personal data to third countries. (EUR-Lex)

16. Data Security

KROX LABZ takes reasonable technical and organizational measures designed to protect personal data against:

  • Unauthorized access
  • Accidental loss
  • Destruction
  • Alteration
  • Unauthorized disclosure
  • Other unlawful processing

Security measures may include access controls, authentication, encryption where appropriate, secure hosting, backups, monitoring and other technical safeguards.

However, no method of transmission or electronic storage can be guaranteed to be completely secure.

17. Data Breaches

If KROX LABZ becomes aware of a personal-data breach, we will assess the breach and take appropriate steps in accordance with applicable law.

Where GDPR requires notification to the supervisory authority or affected individuals, we will make the required notifications within the applicable timeframes.

18. Children’s Privacy

Our Website is intended for adults and is not knowingly directed at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided us with personal data unlawfully, please contact us so that we can assess and take appropriate action.

19. Automated Decision-Making and Profiling

KROX LABZ does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals unless such processing is lawfully permitted and the applicable GDPR requirements are satisfied.

If we introduce such processing in the future, we will provide the information required by applicable law.

20. Links to Third-Party Websites

Our Website may contain links to websites, applications or services operated by third parties.

We are not responsible for the privacy practices, security or content of third-party websites.

We recommend reviewing the privacy policy of each third-party service before providing personal information.

21. Social Media

KROX LABZ may maintain profiles or provide social-media features.

If you interact with our social-media profiles or embedded social-media content, the relevant social-media provider may process your personal data according to its own privacy policy.

Depending on how social-media features are implemented on the Website, additional consent may be required before certain third-party content or tracking technologies are activated.

22. Fraud Prevention and Website Security

We may process technical and transaction information to prevent:

  • Fraud
  • Unauthorized transactions
  • Account abuse
  • Payment abuse
  • Automated attacks
  • Spam
  • Malicious activity

Such processing may be based on our legitimate interests, legal obligations or another applicable legal basis.

23. Legal Claims

We may retain and process personal data where necessary to:

  • Establish legal claims
  • Exercise legal claims
  • Defend against legal claims
  • Protect our rights and property
  • Comply with legal proceedings
  • Cooperate with competent authorities

24. Business Transfers

If KROX LABZ undergoes a merger, acquisition, restructuring, sale of assets or similar transaction, personal data may be transferred as part of the transaction where legally permitted.

Any such transfer will be handled in accordance with applicable data-protection law.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes to our Website
  • Changes to our services
  • Changes to our data-processing practices
  • Changes in applicable laws
  • Changes to third-party service providers

When we make material changes, we may update the “Last Updated” date and, where required, provide additional notice.

26. Contact Us

If you have questions about this Privacy Policy or the way KROX LABZ processes personal data, please contact us:

KROX LABZ
Email: info@kroxlabz.com
Website: https://kroxlabz.com

Your Privacy Rights at a Glance

You may have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion
  • Restrict processing
  • Object to certain processing
  • Receive portable data where applicable
  • Withdraw consent
  • Object to direct marketing
  • Exercise applicable rights concerning automated decision-making
  • Lodge a complaint with the Polish supervisory authority

These rights are subject to the conditions and limitations provided by GDPR and applicable Polish law. (UODO)