• Part I explains the terms used in the Policy and provides our contact details and information about your rights.
• Part II contains detailed information regarding the processing of your personal data, provided separately for each processing activity.
• Part III contains information on the processing of your personal data on our Social Media profiles.
• Part IV provides information on cookies.

I. GENERAL PROVISIONS

§ 1. Data Controller

1. The Controller of your personal data is PRZEMYSŁAW SZOPA, with its registered office at ul. Św. Rocha 99, 35-330 Rzeszów, Poland; tel. +48 575108055. Further in this Privacy Policy, we refer to ourselves in the first person or as the “Controller” or “We”. Our business identification details: NIP (VAT ID): 8133723575, REGON: 364806110.
2. You can contact us:
   • By post: ul. Św. Rocha 99, 35-330 Rzeszów, Poland
   • By email: hello@raccooncycles.com
   • By phone: +48 575108055

§ 2. Definitions Used in the Privacy Policy

• “Website” – the online store available at www.velopoint.pl;
• “Policy” – this document, i.e., the Privacy Policy you are currently reading;
• “GDPR” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
• “Social Media” – social media platforms such as Facebook, YouTube, Instagram, and other networks where we maintain official profiles.

§ 3. Personal Data Security

1. All personal data that you provide on the Website or that we collect about you while you use the Website is processed by us as the Controller in compliance with the GDPR.
2. We employ technical measures required by current data protection laws to prevent unauthorized persons from obtaining and modifying personal data transmitted electronically via our Website.

§ 4. Your Rights Regarding Personal Data

1. Because we process your personal data, you have:
   • The right to access your personal data,
   • The right to rectify your data,
   • The right to request the erasure of your personal data where permitted by the GDPR,
   • The right to restriction of processing within the scope defined by the GDPR.
2. In Parts II–IV of this Policy, you will find information about additional rights available to you in specific situations.
3. If you wish to exercise your rights or learn more about them, please contact us using the contact details provided in § 1 Section 2 of this Policy.

§ 5. Right to Object

1. Whenever you provide us with personal data or when we collect it ourselves, you have the right to object to its processing. The right to object applies in two scenarios:
   • Direct marketing: You do not need to justify an objection to direct marketing.
   • Other legitimate interests: An objection based on our other legitimate interests requires justification based on your particular situation. Please explain to us why we should not process your data.
2. To exercise your right to object, please contact us using the details in § 1 Section 2.

§ 6. Complaint to the Supervisory Authority

§ 7. Inquiries and Publication Location

1. If you have any questions regarding our Policy, please contact us using the details provided in § 1 Section 2.
2. This Policy is published online at https://velopoint.pl/content/2-polityka-prywatnosci and is also available at our registered office.

II. INFORMATION REGARDING PERSONAL DATA PROCESSING IN INDIVIDUAL PROCESSES

§ 8. Contact via Contact Form, Email, or Phone

• Purpose of processing: Answering your message and resolving the matter you raised.
• Your rights: Outlined in § 4 and § 5 of this Policy.
• Is providing data mandatory? Voluntarily provided; however, without your contact details, we may be unable to resolve your inquiry.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest).
• Our legitimate interest: Resolving your inquiry and responding to your message.
• Data recipients: Entities hosting (storing) the Website or personal data for us, as well as providers of communication channel management tools.
• Retention period: For the time necessary to resolve your inquiry, and depending on its nature, for the period required to demonstrate that we resolved it (statute of limitations for claims).
• Data transfer outside the EEA: No.

§ 9. Account Registration on the Website

• Purpose of processing:
  • Performance of the contract for establishing an account on the Website.
  • Performance of services provided to you based on the Website Terms & Conditions.
  • Marketing purposes, including sending newsletters and promotional information by email, analyzing your content preferences, matching communications to your interests, personalizing the Website, products, and ads on social media or external sites based on your site behavior, interaction history, device info, and location.
• Your rights: Outlined in § 4 and § 5 of this Policy, plus the right to data portability under GDPR conditions.
• Is providing data mandatory? Voluntary; however, without it, you cannot create an account, use registered services, or subscribe to commercial communications.
• Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest). If you consent to receive email marketing, legal bases also include Art. 10 of the Polish Act on Providing Services by Electronic Means and Art. 172 of the Polish Telecommunications Law. You may withdraw consent at any time.
• Our legitimate interest: Conducting marketing activities and improving communication efficiency by analyzing user engagement.
• Data recipients: Pickup points delivering your products, electronic payment operators, shipping/courier companies, newsletter and marketing automation service providers, hosting/data storage providers, legal counsel, and debt collection agencies.
• Retention period: For the duration of the account contract and the statute of limitations period for claims; for marketing activities, until you object to processing or withdraw consent for email communications.
• Data transfer outside the EEA: No.

§ 10. Order Processing Without Account Registration

• Purpose of processing: Performance of services based on the Website Terms & Conditions and marketing activities (as specified in § 9).
• Your rights: Outlined in § 4 and § 5 of this Policy, plus the right to data portability.
• Is providing data mandatory? Voluntary; however, without it, you cannot complete an order or receive commercial communications.
• Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interest), supplemented by relevant Polish electronic communications statutes upon consent.
• Our legitimate interest: Conducting direct marketing and improving communications based on content engagement.
• Data recipients: Bicycle pickup points, electronic payment operators, courier/shipping providers, marketing automation tools, hosting providers, legal and debt collection entities.
• Retention period: Duration of marketing activities, until an objection is raised or consent is withdrawn.
• Data transfer outside the EEA: No.

§ 11. Customer Reviews on Google, Facebook, Website, or Products

• Purpose of processing: Measuring customer satisfaction and ensuring the highest quality of service. We may send emails containing links to review forms.
• Your rights: Outlined in § 4 and § 5.
• Is providing data mandatory? Voluntary; however, without it, we cannot receive your feedback to improve our services.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest).
• Our legitimate interest: Enhancing service quality and providing top-grade products.
• Data recipients: Hosting providers, administrative support services, and entities aggregating/publishing online store or product reviews.
• Retention period: For the duration of the published review or until an objection is submitted.
• Data transfer outside the EEA: No.

§ 12. Newsletter

• Purpose of processing: Marketing activities consisting of sending newsletters and commercial communications via email, analyzing content preferences, and tailoring communications.
• Your rights: Outlined in § 4 and § 5, plus the right to data portability.
• Is providing data mandatory? Voluntary; without it, you cannot receive commercial emails.
• Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR, and electronic communications consent provisions.
• Our legitimate interest: Optimizing our communication strategy based on subscriber engagement.
• Data recipients: Newsletter delivery and marketing automation providers, hosting providers, administrative contractors.
• Retention period: Duration of marketing campaigns, until consent is withdrawn or an objection is lodged.
• Data transfer outside the EEA: No.

III. OUR SOCIAL MEDIA PROFILES

§ 13. Interacting with Our Social Media Profiles

• Purpose of processing: Responding to direct messages, engaging in comment discussions under posts, displaying profile posts (including sponsored posts), and analyzing aggregated statistical data (views, reach, demographics) provided by platform operators (e.g., Meta/Facebook Ireland Ltd., Instagram).
• Your rights: Outlined in § 4 and § 5.
• Is providing data mandatory? Voluntary. Due to platform mechanisms, your public name/handle and profile picture will be visible to us when you interact.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest).
• Our legitimate interest: Communicating with users, displaying posts, promoting services, and analyzing profile stats.
• Data recipients: Social media operators, specifically Facebook Ireland Ltd., Google Ireland Limited, and Instagram Inc.
• Retention period: Time needed to handle inquiries/claims, or for as long as you follow our profile / retain your public comments.

IV. COOKIES INFORMATION

§ 14. What Are Cookies and Why We Use Them

1. Our Website uses cookies—small text files stored on your end device (e.g., computer, tablet, smartphone). Cookies are read by the Website primarily to optimize page usability and collect statistical data.
2. We store and access cookies for the following purposes:
   • Website configuration & functionality: Adapting page layout to your device parameters, remembering preferences (language, region, font size), and saving page history for recommendations.
   • Marketing: Collecting data on your actions to deliver personalized content and retargeted advertisements across third-party websites.
   • User authentication: Verifying browser session authenticity.
   • Performance optimization: Improving the speed and stability of Website services.
   • Analytics & research: Creating anonymous statistics to optimize page structure.
   • Security: Ensuring platform integrity and reliability.

§ 15. Types of Cookies

• Session cookies: Temporary files stored in your browser until it is closed.
• Persistent cookies: Stored on your device until manually deleted or expired.
• Third-party cookies: Originating from external analytics and ad providers (see § 18).

§ 16. How to Delete Cookies

1. You can adjust your browser settings to block or manage cookies on your device.
2. Saved cookies can be cleared via your browser options or operating system tools.
3. Guides for popular browsers:
   • Firefox: Cookie deletion guide
   • Chrome: Cookie deletion guide
   • Safari: Cookie deletion guide
   • Opera & Internet Explorer: Available via their respective support centers.

§ 17. Impact of Browser Setting Changes

§ 18. Third-Party Cookies & International Transfers

1. Third-party cookies placed on your device include services from:
   • Google Analytics: (Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for website traffic analytics.
   • Google Ads: (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) for ad optimization and remarketing.
   • Facebook.com: (Facebook Inc., USA / Facebook Ireland Ltd., Ireland).
2. You can block Google Analytics tracking by installing the official browser add-on: https://tools.google.com/dlpage/gaoptout.
3. Transatlantic transfers of personal data resulting from US-based tools comply with applicable European Commission adequacy mechanisms and data protection frameworks (such as the EU-U.S. Data Privacy Framework).