Privacy policy of the avena.pl and fairino.eu websites and the avena.pl/sklep online shop

Effective from: 28 October 2026

English translation. The Polish version is published at www.avena.pl/polityka-prywatnosci.

§1. Data controller

1. The controller of the personal data of Customers and of persons visiting the online shop avena.pl/sklep (the “Shop”), as well as of persons using the websites avena.pl and fairino.eu, including the enquiry forms, is Beata Szulc, conducting business under the name Beata Szulc AVENA TECHNOLOGIE with its registered office in Gdynia, ul. Solna 7B, 81-577 Gdynia, Poland, entered in CEIDG (the Polish Central Register and Information on Economic Activity), NIP (tax identification number) 6692193365 (the “Controller”).

2. Contact with the Controller in matters relating to the processing of personal data:

   • e-mail: robotics@avena.pl
   • telephone: +48 516 234 402
   • correspondence address: ul. Solna 7B, 81-577 Gdynia, Poland

3. The Controller has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR.

§2. Definitions

• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).
• Personal data – any information relating to an identified or identifiable natural person.
• Customer / User – a natural person using the Shop or placing an Order in it, including a natural person acting on behalf of a Customer that is a legal person.
• Shop – the online shop available at avena.pl/sklep.
• Websites – the websites available at avena.pl and fairino.eu.

§3. Purposes, legal bases and retention periods

The Controller processes personal data for the following purposes:

• Conclusion and performance of a sales contract (accepting and fulfilling the Order, delivery, contact regarding the Order)
  • legal basis: Art. 6(1)(b) GDPR – necessary for the performance of a contract
  • retention period: for the duration of the contract and until the limitation periods for claims expire
• Issuing and storing invoices and accounting documents
  • legal basis: Art. 6(1)(c) GDPR – legal obligation (Polish Tax Ordinance, Accounting Act, VAT Act)
  • retention period: 5 years from the end of the calendar year in which the tax payment deadline expired
• Handling complaints and withdrawals from contracts
  • legal basis: Art. 6(1)(b) and (c) GDPR
  • retention period: until the complaint procedure is completed, and then until the limitation periods expire
• Establishing, pursuing or defending claims
  • legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Controller
  • retention period: until the limitation periods for claims expire (as a rule 6 years / 3 years for claims related to business activity)
• Correspondence (e-mail and telephone enquiries and enquiries from the forms on the avena.pl and fairino.eu websites; form submissions are passed to the Controller's CRM system and sales team and are deleted from the website server after 30 days)
  • legal basis: Art. 6(1)(f) GDPR – legitimate interest (handling enquiries)
  • retention period: up to 12 months from the last contact, unless a longer period is justified
• Statistics and traffic analysis in the Shop
  • legal basis: Art. 6(1)(f) GDPR – legitimate interest (developing and improving the Shop)
  • retention period: until an effective objection is raised, no longer than 24 months
• Marketing of own products (if the Customer consents)
  • legal basis: Art. 6(1)(a) GDPR – consent
  • retention period: until consent is withdrawn

§5. Recipients of data

Personal data may be transferred to the following categories of recipients:
a) courier and logistics service providers – to the extent necessary to deliver the Goods (FedEx, Hellmann Worldwide Logistics);
b) the bank servicing the Seller's account – PKO Bank Polski S.A. – for handling payments;
c) the accounting office providing accounting services to the Controller;
d) the shop platform and hosting provider – Wix.com Ltd. – as a processor under a data processing agreement;
e) providers of IT tools used by the Controller (e-mail, analytics tools, a CRM system for handling enquiries and offers, the website server);
f) legal and tax advisers and law firms – to the extent necessary for the Controller's legal services;
g) public authorities – in cases provided for by law (e.g. tax offices, courts).
All entities processing data on behalf of the Controller do so under a data processing agreement and only to the extent and for the purpose specified by the Controller.

§6. Transfers of data outside the European Economic Area (EEA)

Because the Controller uses the Wix.com platform and popular IT tools (including e-mail providers and analytics services), personal data may be transferred to third countries, including the United States.
Data are transferred outside the EEA on the basis of:
a) a decision of the European Commission finding an adequate level of data protection (e.g. the Data Privacy Framework for certified entities in the USA), or
b) standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
The Customer may obtain a copy of the safeguards applied by contacting the Controller.

§7. Rights of data subjects

Every person whose data are processed has the following rights:

the right of access to their data and to receive a copy of them (Art. 15 GDPR);
the right to rectification of inaccurate or incomplete data (Art. 16 GDPR);
the right to erasure (“right to be forgotten”) – in the cases set out in Art. 17 GDPR;
the right to restriction of processing (Art. 18 GDPR);
the right to data portability – for data processed by automated means on the basis of consent or a contract (Art. 20 GDPR);
the right to object to processing based on the Controller's legitimate interest (Art. 21 GDPR);
the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl) – if the person considers that the processing of their data infringes the GDPR.

To exercise the above rights, contact the Controller by e-mail at robotics@avena.pl or in writing at the address of the registered office.

§8. Voluntary provision of data

Providing personal data is voluntary; however:

providing identification and contact data and a delivery address is necessary to conclude and perform a sales contract – failure to provide them makes it impossible to place and fulfil an Order;
providing a NIP (tax identification number) is necessary if the Customer requests a VAT invoice issued to a business;
providing data for marketing purposes is entirely voluntary and is not a condition for placing an Order.

§9. Profiling and automated decision-making

Customers' personal data are not subject to automated decision-making producing legal effects concerning the Customer or similarly significantly affecting the Customer, including profiling within the meaning of Art. 22 GDPR.

§10. Cookies and similar technologies

The Shop uses cookies – small text files stored on the User's device that make it possible to use the Shop's functions and to compile statistics.
Types of cookies used:
a) necessary – required for the Shop to work properly (e.g. the shopping cart, the User's session); they are used without the need to obtain consent;
b) analytical / statistical – used to measure traffic and analyse the use of the Shop; used on the basis of the User's consent;
c) functional – used to remember the User's preferences; used on the basis of the User's consent;
d) marketing – used to display personalised advertising content; used on the basis of the User's consent.
The User may change the cookie settings in their web browser at any time, including disabling cookies. Restricting the use of cookies may affect some functions of the Shop.
Cookie consents are also managed through the cookie banner displayed on the first visit to the Shop.

§11. Data security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or modification, in particular: encrypted connections (SSL/TLS), control of access to data, regular software updates and data processing agreements with IT service providers.

§12. Changes to the Privacy Policy

The Controller reserves the right to make changes to the Privacy Policy, in particular in the event of changes in the law, in the technologies used or in the scope of the services provided.
The current version of the Privacy Policy is available at www.avena.pl/polityka-prywatnosci, and its English translation at fairino.eu/privacy.
Changes take effect when the new version of the Privacy Policy is published on the above website.

Beata Szulc AVENA TECHNOLOGIE
ul. Solna 7B
81-577 Gdynia, Poland
NIP: 6692193365