1. What Data May We Process?

The scope of data processed depends on how the store is used. In particular, we may process:

• identification and business contact data of a person representing the Customer or acting on the Customer's behalf,
• first and last name, email address, telephone number, and job title, if provided,
• company details, including name, address, NIP, REGON, and other data required to manage the account and orders,
• data relating to orders, deliveries, payments, invoices, complaints, and correspondence,
• technical data related to use of the website, such as IP address, device and browser information, logs, and activity on the website,
• data collected through cookies and similar technologies — in accordance with the consents given.

2. Purposes and Legal Bases for Processing

3. Payments via ING Pay

If the Customer chooses online payment, the data necessary to complete the transaction may be transferred to the operator of the ING Pay payment gateway, ING Bank Śląski S.A.

The scope of data transferred in connection with a payment is limited to the data required to process and settle the transaction. To the extent that ING Bank Śląski S.A. independently determines the purposes and means of processing data related to the payment service, it acts as a separate data controller in accordance with its own privacy and payment service documentation.

4. Data Recipients

Personal data may be transferred only to the extent necessary to provide specific services and fulfil specific obligations. Data recipients may include in particular:

• Shoper S.A. — provider of the online store software and infrastructure,
• ING Bank Śląski S.A. — operator of the ING Pay payment gateway, if online payment is selected,
• DHL or another agreed carrier — to the extent necessary to complete the delivery,
• entities providing accounting, IT, hosting, maintenance, and advisory services,
• Google Ireland Limited — where Google Analytics is used and the appropriate consent has been given,
• banks, financial institutions, and other entities involved in processing the selected payment method,
• public authorities and other entities entitled to receive data under applicable law.

5. Google Analytics and Analytics Data

The store may use Google Analytics to measure traffic and how the website is used. Analytics data is collected using appropriate technologies only after the user has given the required consent, where such consent is required.

The user may change cookie consent settings at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

6. How Long Do We Store Data?

• account-related data — for the period during which the account is used and then for the period necessary to settle the relationship and protect against claims,
• data related to orders and contracts — for the duration of the contract and then until the expiry of the applicable limitation periods for claims,
• accounting and tax documents — for the period required by applicable law,
• data processed on the basis of consent — until consent is withdrawn, unless further storage is required on another legal basis,
• technical data and security logs — for a period justified by system security and the need to detect abuse.

7. Is Providing Data Mandatory?

Providing data is generally voluntary; however, failure to provide data required to create an account, place an order, issue a sales document, make a payment, or complete delivery may make it impossible to provide the relevant service.

8. Rights of the Data Subject

Within the limits provided for by the GDPR, you have the right to:

• access your data and obtain a copy,
• rectify your data,
• erase your data,
• restrict processing,
• data portability, where the statutory conditions are met,
• object to processing based on legitimate interests,
• withdraw consent at any time where processing is based on consent,
• lodge a complaint with the President of the Personal Data Protection Office.

To exercise your rights, contact us at: sklep@iotsolution.pl.

9. Transfers of Data Outside the European Economic Area

In connection with the use of certain technology or analytics services, data may be processed outside the European Economic Area. In such cases, mechanisms provided for under the GDPR are applied, in particular adequacy decisions or standard contractual clauses, depending on the specific provider and service.

10. Profiling and Automated Decision-Making

The Controller may use information about a user's activity in the store, in particular technical data, information about pages visited, and interactions with the website, for profiling in order to analyse how the store is used and — where the user has given the appropriate consent — to tailor content or communications to the user's predicted interests.

Profiling may involve automated analysis of available information and may result in assigning the user to a particular audience group or predicting the user's interests. The effect of profiling may include presenting content, offers, or messages that are better matched to the user's predicted interests.

Profiling does not produce legal effects concerning the user or similarly significantly affect the user. The Controller does not make decisions concerning store users based solely on automated processing, including profiling, that would produce legal effects concerning them or similarly significantly affect them.

11. Cookies

The store uses cookies necessary for the proper operation of the website. Additional cookies, in particular analytics cookies, are used in accordance with the user's consent settings.

Detailed information about the types of cookies, their purposes, and how consent can be managed is provided in the store's separate Cookies Policy.

12. Data Security

We apply technical and organizational measures appropriate to the risks associated with data processing, including measures designed to protect the confidentiality, integrity, and availability of data and to restrict access to persons and entities that should have such access.

13. Changes to the Privacy Policy

This Policy may be updated in the event of changes to how the store operates, the services used, providers, or applicable laws. The current version of the document is published on shop.iots.eu.

Effective from: 31 August 2026.