1. Data Controller

The controller is [COMPANY], [ADDRESS, POLAND], e-mail [EMAIL], company no. [KRS/NIP]. We decide how and why your personal data is processed.

2. UK Representative (Article 27 UK GDPR)

As we are established in Poland and offer goods to consumers in the UK, we have appointed a UK representative who acts as a contact point for you and for the ICO: [UK REPRESENTATIVE — name, address, e-mail].

3. Data Protection Officer

Where appointed, our data protection officer can be contacted at [EMAIL]. [Delete if no DPO is appointed.]

4. What Data We Process

Identity and contact details, delivery address, order and payment information, correspondence, and website usage data. Where you buy certain medical devices, your order may reveal health-related information (special category data).

5. Purposes and Legal Bases

(a) performing the sales contract, including delivery, returns and complaints — Article 6(1)(b);

(b) meeting legal obligations in tax, accounting, consumer and product law — Article 6(1)(c);

(c) our legitimate interests, such as fraud prevention, security, improving our service and direct marketing of similar products — Article 6(1)(f);

(d) where required, your consent, e.g. marketing messages or non-essential cookies — Article 6(1)(a).

For health-related (special category) data revealed by purchases we rely on [your explicit consent — Article 9(2)(a) — confirm].

6. Recipients

Couriers and logistics, our UK warehouse operator, payment service providers, IT and hosting providers, and professional advisers; public authorities where required by law.

7. International Transfers

Your data is processed in Poland (EEA). The UK recognises the EEA as providing adequate protection, so this transfer is permitted. For any transfer to other countries we use appropriate safeguards (e.g. the UK International Data Transfer Agreement).

8. Retention

We keep your data only as long as necessary — for the duration of the contract and then for the periods required by tax, accounting and limitation rules [specify periods].

9. Your Rights

Access, rectification, erasure, restriction, data portability, objection (including to direct marketing), and withdrawing consent at any time without affecting earlier processing. To exercise them contact [EMAIL].

10. Right to Complain (ICO)

You may complain to the UK supervisory authority, the Information Commissioner's Office (ICO), ico.org.uk , if you consider our processing unlawful.

11. Is Providing Data Required?

Providing the data needed to conclude and perform the contract is a contractual requirement; without it we cannot process your order. Marketing data is optional.

12. Automated Decision-Making

We do not take decisions producing legal or similarly significant effects based solely on automated processing [confirm].

13. Changes

We may update this notice; the current version is published on our website.