TABLE OF CONTENTS:

1. GENERAL PROVISIONS
2. BASIS FOR THE PROCESSING OF DATA
3. PURPOSE, BASIS AND PERIOD OF PROCESSING DATA IN THE ONLINE SHOP
4. DATA RECIPIENTS IN THE ONLINE SHOP
5. PROFILING IN THE ONLINE SHOP
6. THE RIGHTS OF THE DATA SUBJECT
7. COOKIES IN THE ONLINE SHOP AND ANALYTICS
8. FINAL PROVISIONS

§ 1. GENERAL PROVISIONS

• 1.1.
  This Privacy Policy of the website and the Online Shop is of informative nature, which means that it is not a source of obligations for Service Recipients or Customers of the Online Shop. The Privacy Policy contains, above all, the principles concerning the processing of data by the Controller on the website and in the Online Shop, including the basis, purpose and period of personal data processing and the rights of data subjects as well as information regarding the use of cookies and analytical tools in the Online Shop.
• 1.2.
  The Controller of the personal data collected via the websites: tergo.io and pl.tergo.io and the Online Shop shall be the limited liability company TERRA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ based in Poland (the office address and correspondence address: Piastowska 7/120, 80-332 Gdańsk, Poland), registered in the register of entrepreneurs of National Court Registry under the number: 0000857732; register court which holds the company’s documentation: District Court Gdańsk – Północ in Gdańsk, VIII Commercial Department of National Court Registry; share capital in the amount of: 500 000,00 PLN; tax ID no. NIP: 5862359150, National Economy Register No. REGON 386466110, e-mail address: [email protected] – here in after referred to as “Controller” and being simultaneously the Service Provider of the Online Shop and the Seller. In any matters related to the processing of personal data, you can contact the Administrator by writing to the following address: [email protected].
• 1.3. Personal data on the website and in the Online Shop shall be processed by the
  Controller in accordance with the binding legal regulations, in particular the Regulation (EU) 2016/679 of the
  European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the
  processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data
  Protection Regulation) ­ hereinafter referred to as “GDPR” or “GDPR Regulation”.
  The official text of the GDPR
  Regulation:
  http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
• 1.4. Using the website and the Online Shop, including shopping, is voluntary.
  Similarly, providing personal data by the Service Recipient or the Customer using the website and the Online Shop is voluntary,
  subject to two exceptions: (1) into contracts with the Controller – failure to provide the personal
  data
  necessary for the conclusion and performance of the Sales Contract or a contract for the provision of an Electronic
  Service with the Controller in the cases and within the scope indicated on the website of the Online Shop and the
  Regulations of the Online Shop and this Privacy Policy shall result in no possibility to enter into the contract.
  Providing personal data is a contractual requirement in such a case and if the data subject is willing to enter into
  the contract with the Controller, they shall be obligated to provide the required data. The scope of the data
  required to enter into the contract is each time specified in advance on the website of the Online Shop and in the
  Regulations of the Online Shop; (2) statutory obligations of the Controller – specifying the
  personal data is a
  statutory requirement resulting from the commonly binding legal regulations obligating the Controller to process the
  personal data (e.g. processing data to keep ledgers) and failure to specify the data will render it impossible for
  the Controller to perform the obligations.
• 1.5. The Controller assures due diligence to protect the
  interest of persons being data subjects, in particular being responsible and liable for and assuring that the data
  collected are: (1) processed in accordance with the Act; (2) collected for specific, legal purposes and not subject
  to further processing inconsistent with the purposes; (3) correct as regards the subject matter and adequate as
  regards the purpose of the processing; (4) stored in a form making it possible to identify the people they apply to,
  no longer than it proves necessary to attain the purpose of processing and (5) processed in a manner ensuring
  security of the personal data, including the protection against illicit or illegal processing or accidental loss,
  damage or destruction, with the use of appropriate technical and organisational measures.
• 1.6. Taking into account the nature, scope, context and purpose
  of processing as well as the risk of breaching the rights or freedoms of natural persons with varied likelihood and
  degree of threat, the Controller is implementing appropriate technical and organisational measures so that the
  processing takes place pursuant to the GDPR Regulation and it is possible to show it. The measures are reviewed and
  updated, as necessary. The Controller applies technical measures preventing the acquisition and modification of
  personal data sent electronically by unauthorised persons.
• 1.7. Any words, phrases and acronyms used in this privacy
  policy starting with a capital letter (e.g. Seller, Online Shop, Electronic Service) shall be
  understood in
  accordance with the definition contained in the Regulations of the Online Shop available on the websites of the
  Online Shop.

§ 2. BASIS FOR THE PROCESSING OF DATA

• 2.1. The Controller is authorised to process the personal data
  in cases, and to the extent, when at least one of the following conditions is met: (1) the data subject consented to
  the processing of their data to one or more specified ends; (2) processing is necessary for contract performance the
  data subject is a party to, or to take actions to the request of the data subject, prior to contract conclusion; (3)
  processing is necessary to meet the legal obligation of the Controller; or (4) processing is necessary for the needs
  resulting from the legally justified interests of the Controller or third party, except for situations when the
  interests or basic rights and freedoms of the data subject override such interests and they require personal data
  protection, especially when the data subject is a child.
• 2.2. The processing of personal data by the Controller each
  time requires having at least one basis indicated in item 2.1 of the privacy policy. Specific bases for processing
  personal data of the Service Recipients or the Customers of the website and the Online Shop by the Controller are specified in the
  following point of the privacy policy – as regards the specific goal of processing personal data by the Controller.

§ 3. PURPOSE, BASIS AND PERIOD OF PROCESSING DATA IN THE ONLINE SHOP

• • 3.1. Each time, the purpose, basis and period as well as the
    recipients of personal data being processed by the Controller result from actions undertaken by a given Service
    Recipient or Customer on the website and in the Online Shop.
  • 3.2.The Controller may process the personal data in the Online Shop
    for the purposes, on the bases and within the periods as follows:

§ 4. Personal data recipients on the website and in the online store

• 4.1. For the needs of proper website and the Online Shop functioning, inclusive of
  the performance of the Contracts of Sale entered into, it shall be necessary for the Controller to make use of
  external companies’ services (e.g. software provider, courier, or payment system provider). The Controller uses
  solely the services of such processing entities which ensure sufficient guarantee to implement appropriate technical
  and organisational measures so that the processing meets the requirements set out in the GDPR Regulation and
  protects the rights of data subjects.
• 4.2. The Controller may provide personal data to a third country,
  while the Controller ensures that it shall only be a third country which is considered to provide adequate level of
  protection – in accordance with the GDPR Regulation, and in the case of other countries, the data transfer will
  occur on the basis of the standard contractual clauses. The Controller ensures that the data subject has a right to
  get a copy of their data. The Controller provides personal data to a third country only in case and scope necessary
  to execute a certain purpose of data processing consistent with this privacy policy.
• 4.3. Providing data by the Controller does not take place in every
  case and not to all the recipients or categories of recipients defined in the privacy policy – the Controller
  provides the data only in the case it proves necessary to attain a given purpose of personal data processing and
  solely within the necessary scope.
• 4.4. Personal data of the Online Shop Service Recipients or
  Customers may be provided to the following recipients or categories of recipients:
  
  • 4.4.1. e-payments or payment card service providers – in the case
    of a Customer who uses in the Online Shop the option of e-payment or payment card, the Controller makes the
    collected Customer’s personal data available to the selected payment service provider in the Online Shop for the
    Controller to the extent necessary to perform the payment of the Customer.
  • 4.4.2. opinion poll system providers – in the case of a Customer
    who consented to express their opinion on the Sales Contract concluded, the Controller makes the collected
    personal data of the Customer available to the selected entity providing the system of opinion polls on Contracts
    of Sale concluded in the Online Store to the order of the Controller within a scope necessary for the Customer to
    present their opinion by means of an opinion poll system.
  • 4.4.3. service providers rendering for the Controller technical, IT or
    organisational solutions, making it possible for the Controller to conduct a business, inclusive of the Online
    Shop and Electronic Services provided via it (in particular computer software providers for the Online
    Shop, e-mail companies and hosting providers as well as software providers for company management and technical
    aid for the Controller) – the Controller makes the collected personal data of the Customer available to the
    selected provider operating to their order only in the case and to the extent necessary for attaining a given
    purpose of data processing in accordance herewith.
  • 4.4.4. accounting, legal and counselling services providers rendering for
    the Controller accounting, legal or counselling services (in particular an accounting agency, law firm
    or debt collection company) – the Controller makes the collected personal data of the Customer available to the
    selected provider operating to their order only in the case and to the extent necessary for attaining a given
    purpose of data processing in accordance herewith.
  • 4.4.5. providers of social plugins implemented in the Online Shop, of
    scripts and other similar tools enabling a person using the Online Shop to download content from the providers
    of the said plugins (i.e. logging in via social media profile) and for this purpose providing the
    providers with the personal data of the visitor, including also:
  • 4.4.5.1. Facebook Ireland Ltd. – the Controller uses Facebook
    social plugins in the Online Shop (e.g. “Like it” or “Share” button, logging in via Facebook profile) and
    therefore collects and discloses personal data of the Service Recipient using the Online Shop to Facebook Ireland
    Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland) to the extent and in accordance with the
    privacy principles available here: https://www.facebook.com/about/privacy/ (this data may include information
    about activities in the Online Shop – including information about the device, the visited websites, purchases,
    displayed ads and how to use the services – regardless of whether the Service Recipient has a Facebook account and
    is logged in to Facebook).

§ 5. PROFILING IN THE ONLINE SHOP

• 5.1. The GDPR Regulation obligates the Controller to inform about
  the automated decision-making process, including profiling referred to in Article 22, par. 1 and 4 of the GDPR
  Regulation, and – at least in those cases – the vital information concerning the decision-making process as well as
  the meaning and foreseeable consequences of processing for the person being the data subject. Bearing in mind the
  above, the Controller specifies in this point of the privacy policy the information concerning the possible
  profiling.
• 5.2. The Controller may use profiling in the Online Shop for direct
  marketing purposes, yet the decisions made on its basis by the Controller do not concern the conclusion or rejection
  to conclude the Sales Contract, or the possibility to make use of Electronic Services in the Online Shop. The result
  of profiling in the Online Shop may be e.g. discount for a given person, sending a discount code, reminding about
  unfinished purchase process, sending Product offers, which may be related to the interests or preferences of the
  person, or offering better conditions as compared with the standard offer of the Online Shop. Regardless of
  profiling, the person makes decisions freely, whether they want to use the discount given, or better conditions and
  buy a Product in the Online Shop.
• 5.3. Profiling in the Online Shop consists in automatic analysis or
  forecast of the conduct of a given person on the website of the Online Shop, e.g. by adding a given Product to the
  cart, browsing the page of a given Product in the Online Shop, or the analysis of the history of purchase in the
  Online Shop. The condition for such profiling is for the Controller to have the personal data of the person, so that
  they can later send them e.g. a discount code.
• 5.4. The data subject shall have the right not to depend on the
  decision which is only based on automated processing, including profiling, and has some legal effects on the person
  or similarly affects them.

§ 6. THE RIGHTS OF THE DATA SUBJECT

• 6.1. The right to access, rectify, restrict, erase or
  transmit – the data subject shall have the right to demand the Controller to have access to their
  personal data, rectify, erase (“the right to be forgotten”) or restrict the processing and shall have the right to
  object to the processing and transmit their data. Detailed conditions of the above rights shall be indicated in
  Articles 15­22 of the GDPR Regulation.
• 6.2. The right to withdraw the consent at any time –
  the person whose data are being processed by the Controller on the basis of the consent given (pursuant to Article
  6, par. 1, point a) or Article 9, par. 2, point a) of the GDPR Regulation), they shall have the right to withdraw
  their consent at any time without any impact on the compatibility with the right to process made based on the
  consent prior to the withdrawal.
• 6.3. The right to lodge a complaint with a supervisory
  body – the person whose data are being processed by the Controller shall have the right to lodge a
  complaint with a supervisory body in a manner and mode specified in the provisions of the GDPR Regulation and the
  Polish law, in particular the Personal Data Protection Act. The supervisory body in Poland shall be the President of
  the Office for Personal Data Protection.
• 6.4. The right to object – the data subject shall
  have the right, at any time, to lodge a complaint – for reasons related to their particular situation – as regards
  the processing of their personal data based on Article 6, par. 1, point e) (public interest or official authority)
  or f) (legitimate interest of the controller) in the case of profiling based on the provisions. The Controller in
  such a case must stop processing the personal data, unless they show the existence of legally significant and
  justified bases for the processing, overriding the interests, rights and freedoms of the data subject, or the bases
  for determining, pursuing or defending the claims.
• 6.5. The right to object as regards direct marketing
  – in the case the personal data are being processed for the needs of direct marketing, the data subject shall have
  the right, at any time, to lodge a complaint as regards the processing of their personal data for the needs of such
  marketing, including profiling, to the extent to which the processing is related to direct marketing.
• 6.6. The right to lodge a complaint to the supervisory body – if the owner of personal data or a third party decides that the method of processing personal data by the Administrator is not compliant with the provisions of the GDPR, he has the right to lodge a complaint with the Office for Personal Data Protection, based in Warsaw, at ul. Rates 2.
• 6.7 To perform the rights mentioned in this point of the privacy policy, one may contact the Controller by sending them an appropriate message in writing or via e-mail to the address of the Controller indicated at the beginning of the privacy policy or via contact form available on the Online Shop website.
• 6.8 Each person who leaves his data in order to make contact, receive an offer or analytical information / data, i.e. his carbon footprint, accepts receiving a reply to the e-mail address provided earlier, which does not contradict art. 172 of the Telecommunications Law.

§ 7. COOKIES IN THE ONLINE SHOP AND ANALYTICS

• • 7.1. Cookies are small pieces of text files sent by the server
    and saved at the visitor’s of the Online Shop (e.g. on the hard disk of a computer, laptop, or smartphone’s memory
    card – depending on the type of device used by the Online Shop’s visitor). Detailed information on Cookies as well
    as the history of their origin can be found e.g. at:
    https://en.wikipedia.org/wiki/HTTP_cookie
  • 7.2. Cookies, which can be sent via the Online Shop website, can be divided into various types, according to the following criteria:

• • 7.3. The Controller may process information contained in Cookies during visiting of the Online Shop website for the following particular reasons:

• • 7.4. Checking in the most popular internet browsers, which Cookie files (including the expiry period of Cookies and their provider) are being sent in a given moment by the Online Shop website can be done, as follows:

• 7.5. As a standard, most internet browsers on the market accept saving Cookies by default. Every person has the possibility to specify the conditions of using Cookies in the browser settings. It means that one may, e.g. partially restrict (e.g. temporarily) or fully disable saving Cookies – in the latter case it may have an impact on some functionalities of the Online Shop (for instance it may prove impossible to go through the Order using the Order Form owing to failure to save the Products in the cart in the course of subsequent stages of Order placement).
• 7.6. The browser settings concerning Cookies are essential as regards the consent to use Cookies by our Online Shop – in accordance with the law, such consent may also be expressed in the browser settings. In view of lack of such consent, change the browser setting accordingly as regards Cookies. Detailed information concerning the change in Cookies settings and their individual removal in the most common browsers is available in the help section of the browser and the following websites (click the link):
  
  Chrome
  Firefox
  Internet Explorer
  Opera
  Safari
  Microsoft Edge
• 7.7. The Controller may use Google Analytics and Universal Analytics services in the Online Shop, which are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The services help the Controller to analyse the frequency of visits in the Online Shop. The data collected are processed under the above services to generate statistics helpful while administering the Online Shop and analysing the frequency of visits in the Online Shop. The data are of collective nature. Using the above services in the Online Shop, the Controller collects such data as the sources and medium of acquiring visitors of the Online Shop and the manner of their conduct on the website of the Online Shop, information concerning their devices and browsers used to visit the website, IP and domain, geographical data and demographic data (age, sex) and interests.
• 7.8. It is possible to easily block sharing information with Google Analytics as regards the activity on the website of the Online Shop – install to that end an opt-out add-on made available by Google Ireland Ltd. available at: https://tools.google.com/dlpage/gaoptout?hl=pl.
• 7.9. Due to the use of advertising and analytical services in the Online Shop provided by Google Ireland Ltd., the Administrator indicates that detailed information on the rules of processing the data of visitors to the Online Shop (including information stored in Cookie files) by Google Ireland Ltd. is made available in the privacy policy of Google services available at:
  https://policies.google.com/technologies/partner-sites.
• 7.10. The Controller may use Facebook Pixel service, which is provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). The service helps the Controller to measure an effectiveness of adverts and to find out what actions do users of the Online Shop undertake and to show them matching adverts. Detailed information about Facebook Pixel you can find at:
  https://www.facebook.com/business/help/742478679120153?helpref=page_content.
• 7.11. Managing Facebook Pixel is possible through ads’ settings on a Facebook user’s account:
  https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

§ 8. FINAL PROVISIONS

• 8.1. The Online Shop may contain links to other websites. The Controller encourages that at the time of being transferred to other websites, become familiar with the privacy policy. This privacy policy shall apply only to the Online Shop of the Controller.