LA VEGA

§1 Administration of personal data

1. The administrator of the personal data is LAVEGA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ based in Warsaw, Juliana Ursyna Niemcewicza 17 17/35, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw. Warszawy, XII Economic Department of the National Court Register under the KRS number 0001160235, NIP: 7011249497, REGON: 7011249497, share capital in the amount of ZŁ 5 000,00.
2. Contact with the person who supervises the processing of personal data in the organization is possible by e-mail at: hello@la-vega.com, in writing to the Administrator’s address or by phone at 783870239.
3. This Policy contains rules regarding the Administrator’s processing of personal data on the Website, including the grounds, purposes and scope of personal data processing and the rights of data subjects.
4. Personal data is processed by the Administrator in accordance with applicable laws, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) Official text of the RODO Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
5. The User’s rights are not absolute and do not apply to all personal data processing activities.

§2 Definitions

1. Administrator – LAVEGA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ based in Warsaw, Juliana Ursyna Niemcewicza 17 17/35, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, XII Economic Department of the National Court Register under KRS number . Warszawy, XII Economic Department of the National Court Register under the KRS number 0001160235, NIP: 7011249497, REGON: 7011249497, share capital in the amount of ZŁ 5 000,00.
2. Personal data – information about a natural person identified or identifiable by one or more specific factors that determine physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, Internet ID and information collected through cookies and other similar technology.
3. Policy – this Privacy Policy.
4. Cookies Policy – the document that defines the rules of using cookies on the Website available at: https://la-vega.com/cookies.
5. Profiling – automated processing of personal data that involves analyzing and predicting user behavior.
6. RODO / Regulation RODO – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27.04.2016 on the protection of natural persons in relation to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.
7. Service – the Internet service operated by the Administrator at la-vega.com.
8. User – any natural person visiting the Site or using one or more of the services or functionalities described in the Policy.

§3 Security

1. The controller has implemented appropriate technical and organizational measures to ensure the security of the processing of personal data, and in particular is responsible for and ensures that the data it collects are:
   • processed in accordance with the law;
   • collected for designated legitimate purposes and not subjected to further processing incompatible with those purposes incompatible with those purposes;
   • Substantially correct and relevant to the purposes for which they are processed;
   • stored in a form that makes it possible to identify the persons to whom they relate, not longer than necessary to achieve the purpose of the processing, and
   • processed in a manner that ensures adequate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by means of appropriate technical or organizational measures.

§4 Purposes and legal basis for data processing

1. Based on Article 6 ust. 1 lit. a) of the RODO Regulation (consent), personal data may be processed for purposes:
   • Marketing of products and services of the Administrator and the Administrator’s partners.
   • Retargeting and behavioral advertising, including the display of personalized ads based on the User’s activity history on the Website and on other websites. Data processing for these purposes is carried out only on the basis of the User’s consent expressed in the cookie banner. Data may be collected via cookies and similar technologies, in accordance with the Cookies Policy.
   • Newsletter Dispatches.
   • Moderation of content on the Service.
   • Save data in cookies in accordance with the Cookies Policy.
   • Publication of reviews of a product or service.
   • Participate in a webinar or online training.
   • Contact through remote communication tools, in particular: telephone, email or application.
   • Participation in contests and loyalty programs
   • Invite participation in surveys and market research
   • Operation and maintenance of the user’s account on the Website.
   • Personalization of content on the Service.
2. Based on Article 6 ust 1 lit. b) of the RODO Regulation (performance of a contract), personal data may be processed for purposes:
3. Performing a contract of sale or a contract for the provision of a Service or taking action at the request of the data subject before or after the conclusion of the indicated contract, in particular: the right of warranty, consideration of
   • Complaint or withdrawal from a contract concluded at a distance
   • User account management.
4. Based on Article  6 ust 1 lit. c) of the RODO Regulation (legal obligation incumbent on the Administrator), personal data may be processed for purposes:
   • Issuance and storage of invoices, receipts or fulfillment of other obligations under tax and accounting regulations, (archiving obligation for accounting documents).
   • Cooperation with law enforcement agencies and public institutions.
   • Creation of records and other documentation mandated by RODO regulations.
5. Based on article 6 ust 1 lit. f) RODO Regulations (legitimate interest of the Administrator) personal data may be processed for purposes:
   • Proper execution of the contract, will be processed for the duration of the contract and the rights arising therefrom, such as the right of complaint. Provision of data is voluntary, but also necessary.
   • Safeguard the security of the Service, the management of the Service and its proper operation.
   • To conduct statistics and analysis of traffic on the Website.
   • Direct marketing;
   • Determine claims raised by or against the Administrator.
   • User Contact.
   • Service Support la-vega.com.
   • To store data necessary for the proper operation of the Service in cookies in accordance with the Cookie Policy.
   • Supporting the account on Instagram, TikTok and interacting with Users of the indicated portals.
   • Data may be transferred to the following recipients or categories of recipients of personal data, i.e. courier companies, postal operators, law firms, accounting firms, IT service providers and service providers.
6. Personal Data may also be processed for other purposes if the Administrator has an appropriate legal basis for doing so, in particular under Article 6 of the RODO, provided that this purpose does not violate the User’s rights and freedoms. In this case, the User will be informed of the new purpose of processing before processing for that purpose begins.

§5 Profiling

1. The Administrator uses profiling for marketing purposes by analyzing the User’s activity on the Website using cookies and similar technologies.
2. Profiling may include:
   • personalization of advertisements based on browsing history,
   • analysis of the User’s interaction with content on the Service,
   • customization of displayed advertising content on external services (e.g. Google Ads, Facebook).
3. Profiling shall take place only on the basis of the User’s consent.
4. The User may revoke consent to profiling at any time by changing settings or by contacting the Administrator at e-mail address: hello@la-vega.com.

§6 Period of processing of Personal Data

1. The period of data processing by the Administrator depends on the type of service provided and the purpose of processing. As a general rule, data are processed for the duration of the service, until the withdrawal of the consent given or the filing of an effective objection to data processing in cases where the legal basis for data processing is the legitimate interest of the Administrator.
2. The period of data processing may be extended in cases where the processing is necessary for the establishment and assertion of possible claims or defense against claims, and thereafter only if and to the extent required by law. After the expiration of the processing period, the data shall be irreversibly deleted or anonymized.
3. Specific data retention periods depending on the purpose, such as:
   • Data related to the performance of the contract – kept for the duration of the contract and then until the expiration of the statute of limitations for claims (3 or 6 years).
   • Accounting and tax data – kept for the period required by tax law (currently 5 years).
   • Marketing data (newsletters, behavioral advertising) – kept until consent is withdrawn.
   • Data related to user inquiries – stored for up to 12 months after the end of correspondence.

§7 User Rights

1. You have the following rights with respect to your personal data:
   • access to your personal data,
   • rectification of your personal data at any time,
   • to delete your personal data at any time,
   • receive a copy of your data,
   • restrict the processing of your personal data,
   • object to the processing of personal data,
   • portability of personal data,
   • withdraw consent; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal,
   • object to the processing of personal data on the basis of the legitimate interest of the Administrator for marketing, direct marketing and non-marketing purposes,
   • to lodge a complaint with a supervisory authority.
2. In order to exercise the above rights, the User may contact the Administrator by sending a message to the e-mail address hello@la-vega.com or correspondence to the Administrator’s registered office address. The Administrator undertakes to process the request within 30 days of its receipt.
3. In some cases, the Administrator may refuse to comply with the User’s request if the law requires further data processing.

§8 Recipients of personal data

1. The Administrator, in order to properly conduct the Service, provides the User’s personal data to other external entities, in particular: Hosting company, courier companies, payment operators, accounting office Starling, Omnisend, Banks.
2. The Administrator reserves the right to disclose personal data in a situation where this will result from applicable laws, including the obligation to provide information to the relevant administrative or law enforcement authorities.

§9 Transfer of personal data outside the EEA

1. The level of protection of Personal Data outside the European Economic Area (EEA) may differ from that provided by European law. For this reason, the Administrator transfers Personal Data outside the EEA in the following cases:
   • When it is necessary for the performance of a contract.
   • When the Administrator uses technology and infrastructure providers from outside the EEA, such as, but not limited to: marketing, analytics, advertising, cloud services and CRM systems providers.
2. The Administrator shall ensure an adequate degree of protection, primarily by:
   • cooperating with processors of Personal Data in countries for which a relevant decision of the European Commission has been issued regarding the determination of an adequate level of protection for Personal Data;
   • applying binding corporate rules approved by international certification standards and the relevant supervisory authority;
   • application of standard contractual clauses issued by the European Commission pursuant to Article 46 of the RODO.
   • Personal data may also be transferred outside the EEA based on the User’s consent. The User shall be informed of this event in advance.

§10 Security of Personal Data

1. The Administrator shall conduct a risk analysis on an ongoing basis to ensure that Personal Data is processed by him in a secure manner. Through its actions, it shall ensure, first of all, that only authorized persons have access to the data and only to the extent that it is necessary due to the tasks they perform.
2. The Administrator shall take all measures permitted by law to ensure that all operations on Personal Data are recorded and performed only by an authorized entity.
3. The Administrator shall also be obliged to ensure that other entities cooperating with the Administrator guarantee the application of appropriate security measures whenever they process Personal Data on behalf of the Administrator.
4. The Administrator shall apply technical safeguards such as encryption of data transmission (SSL/TLS), restriction of access to systems and procedures to protect against unauthorized access to data.

§11 Changes to Privacy Policy

1. The Policy is continuously reviewed and updated.
2. The current version of the Policy has been adopted and is effective as of 2025-05-15.