PRIVACY POLICY OF THE VPXSHOP.COM ONLINE STORE

Effective from: 11 October 2026

§ 1. Data controller

1. The controller of your personal data is VPX spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Warsaw, ul. Aleja Jana Pawła II 27, 00-867 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0001200086, tax ID (NIP) 5273187425, REGON 543006746, share capital PLN 5,000.00 (the Controller, we or us).
2. The Controller operates the online store at vpxshop.com (the Store).
3. This Policy explains what data we collect, why, how long we keep it, who we share it with and what rights you have. We apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Polish data protection and electronic communications law.

§ 2. Contact about personal data

1. For matters relating to personal data, you can contact us:
   • by email: vpxshop@protonmail.me,
   • by post: VPX sp. z o.o., ul. Kieślowskiego 3D/28, 02-962 Warsaw, Poland.
2. We have not appointed a data protection officer. All data protection matters are handled directly by the Controller.
3. You can also message us on Signal or Telegram: +44 7951 753325 (English), +48 886 163 888 (Polish). These messaging apps are run by third-party companies that process data under their own terms and may store it outside the European Economic Area. If you prefer not to use them, please email us instead.

§ 3. Where we get your data from

1. You provide most of the data yourself when you:
   • place an Order or create an account,
   • subscribe to the newsletter,
   • contact us by email or messaging app,
   • submit a complaint or return, or post a review.
2. Some data is collected automatically when you use the Store, e.g. IP address, device and browser type, and pages visited. We do this through cookies and similar technologies described in § 9.
3. We receive payment status information from the payment operator and parcel status information from carriers.
4. Providing data is voluntary, but without the data needed for an Order (name, delivery address, email, phone number) we cannot fulfil it.

§ 4. Purposes, legal bases and retention periods

We process only the data needed for each purpose.

Purpose	Legal basis (GDPR)	How long we keep the data
Concluding and performing the sales contract: Order, payment, delivery	Art. 6(1)(b)	Until the contract is performed, then until the limitation periods for claims expire
Running your Store account	Art. 6(1)(b)	Until the account is deleted
Points and rewards scheme	Art. 6(1)(b)	Until the account is deleted or the scheme ends
Issuing sales documents, accounting and tax	Art. 6(1)(c)	5 years from the end of the calendar year in which the tax payment deadline expired
Handling complaints, returns and withdrawals	Art. 6(1)(b) and (c)	Until the matter is closed, then until the limitation periods for claims expire
Establishing, pursuing and defending claims	Art. 6(1)(f), our legitimate interest	Until the limitation periods under the Polish Civil Code expire
Replying to emails and messages	Art. 6(1)(f), our legitimate interest	For the time needed to handle the matter, then up to 12 months
Newsletter and marketing emails	Art. 6(1)(a), your consent	Until you withdraw consent or unsubscribe
Publishing Product reviews	Art. 6(1)(f), our legitimate interest	While the review is published or until you object
Statistics and traffic analysis	Art. 6(1)(a), your consent to analytics cookies	According to the retention period set in Google Analytics, up to 14 months
Advertising and remarketing	Art. 6(1)(a), your consent to marketing cookies	Until you withdraw consent, no longer than the lifetime of the cookie
Store security and abuse prevention	Art. 6(1)(f), our legitimate interest	Usually no longer than 12 months

You can withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

§ 5. Who we share data with

1. We share data only where needed for the purposes in § 4. Recipients may include:
   • hosting: LH.pl sp. z o.o., which stores the Store’s data on its servers,
   • email delivery: LH.pl sp. z o.o., which delivers Order emails,
   • BLIK payment operator: Payments Solution sp. z o.o. with its registered office in Krasnosielc, Poland (SimPay), KRS 0000711723,
   • parcel shipping: Furgonetka.pl and the carriers you choose: InPost (parcel lockers), DPD and GLS,
   • newsletter: Sender.net,
   • analytics and advertising: Google Ireland Limited (Google Analytics, Google Ads, Google Merchant Center), only after you consent to the relevant cookies,
   • website security: Defiant Inc. (Wordfence), which analyses traffic to block attacks,
   • accounting: the accounting firm serving the Controller,
   • public authorities, where required by law.
2. Some of these companies process data on our behalf under a data processing agreement. Others, e.g. the payment operator and carriers, may act as separate controllers for their own services.

§ 6. Transfers outside the European Economic Area

1. Some of our providers, e.g. Google and Defiant Inc. (Wordfence), may process data in the United States.
2. Such transfers are based on the European Commission’s decision on the EU-US Data Privacy Framework, where the provider is certified under it, or on standard contractual clauses approved by the European Commission.
3. You can obtain a copy of these safeguards by writing to the address in § 2.

§ 7. Your rights

1. You have the right to:
   • access your data and receive a copy,
   • rectify your data,
   • have your data erased,
   • restrict processing,
   • data portability, where we process data based on consent or a contract,
   • object to processing based on our legitimate interest, and to object to direct marketing at any time,
   • withdraw your consent at any time.
2. To exercise these rights, write to the address in § 2. We will reply without undue delay and no later than within one month.
3. We must keep some data even if you ask us to delete it, e.g. accounting documents for the period required by tax law.

§ 8. Complaint to the supervisory authority

If you believe we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. You can also contact the data protection authority in the EU country where you live or work.

§ 9. Cookies

1. Cookies are small files stored in your browser. They let the Store remember, for example, the contents of your cart and your chosen language.
2. We use the following types of cookies:

Type	What it is for	Example tools	Consent required
Strictly necessary	Cart, login, checkout, chosen language and currency, remembering your cookie choice	WordPress, WooCommerce, Polylang, FOX Currency Switcher, cookie banner	No
Functional	Convenience features, e.g. product filters and search	Store filter and search plugins	Yes
Analytics	Visit statistics and Store performance	Google Analytics	Yes
Marketing	Measuring ad performance and remarketing	Google Ads, Meta Pixel	Yes

3. On your first visit we show a banner where you can accept all cookies, reject them or choose categories. Rejecting is as easy as accepting.
4. You can change your choice at any time using the Cookie settings link in the Store footer.
5. You can also delete or block cookies in your browser settings. Blocking strictly necessary cookies may prevent you from placing an Order.

§ 10. Data security

We use an encrypted SSL connection, two-factor login to the admin panel, a firewall that protects against attacks, and regular backups. Only people who need data for their work have access to it.

§ 11. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

§ 12. Changes to this Privacy Policy

1. We may change this Policy, e.g. after changes in the law, our providers or Store features.
2. The current version is always available in the Store. We will announce significant changes in the Store and notify registered users by email.
3. This Policy is also available in Polish. In the event of any discrepancy, the Polish version prevails.
4. This Policy is effective from 11 October 2026.