General Provisions

This Privacy Policy is addressed to Customers and other users of the test.medica-japan.pl online store. It sets out the rules for the collection, processing, and protection of personal data when using the website, creating a customer account, placing orders without registration, and subscribing to the newsletter.

Data Controller

Medica+ Oleksandr Kapitanskyi
ul. Hugo Kołłątaja 3/15, 20-006 Lublin, Poland
E-mail: support@test.medica-japan.pl
Phone / WhatsApp: +48 739 007 265

Legal Basis and Purposes of Data Processing

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

The Controller processes personal data on the following legal bases:

• Article 6(1)(b) GDPR – for the conclusion and performance of a sales contract, order processing, product delivery, payment handling, and customer communication;
• Article 6(1)(c) GDPR – for compliance with legal obligations, including tax, accounting, and consumer protection regulations;
• Article 6(1)(a) GDPR – based on the user's consent, particularly for newsletters and marketing communications;
• Article 6(1)(f) GDPR – for the Controller's legitimate interests, including website security, statistical analysis, marketing of its own products, and establishing, pursuing, or defending legal claims.

Providing personal data is voluntary but necessary for order fulfillment and the use of selected store services. Users may withdraw their consent at any time where processing is based on consent.

Categories of Personal Data

The Controller may process the following categories of personal data:

• full name;
• delivery and billing address;
• email address;
• telephone number;
• order history;
• payment information;
• IP address;
• device, browser, and operating system information;
• data stored in cookies.

Sharing of Personal Data

Personal data may be disclosed only to entities cooperating with the Controller to the extent necessary for providing services, including:

• courier companies (e.g., InPost, DPD, Allegro Delivery);
• payment service providers (e.g., Przelewy24, PayU);
• IT service providers, hosting providers, and server operators;
• accounting and legal service providers;
• marketing and analytics service providers.

Transfers of Personal Data Outside the European Economic Area

Due to the use of Google services (including Google Analytics and Google Ads) and other analytics or marketing service providers, personal data may be transferred outside the European Economic Area, particularly to the United States.

Such transfers are carried out in accordance with the GDPR based on an adequacy decision of the European Commission or by using Standard Contractual Clauses (SCCs), ensuring an appropriate level of protection for personal data.

Data Protection

The Controller applies appropriate technical and organizational measures to ensure the security of personal data. Personal data is processed lawfully, collected only for specified purposes, kept accurate and up to date, stored no longer than necessary, and protected against unauthorized access. Access to personal data is granted only to authorized persons.

Data Retention Period

• order-related data – for the duration of the contract and subsequently for the period required under tax and accounting regulations (generally 5 years from the end of the relevant tax year);
• customer account data – until the account is deleted by the user;
• data processed on the basis of marketing consent – until the consent is withdrawn;
• data relating to complaints or legal claims – until the expiration of the applicable limitation periods;
• technical data and system logs – for the period necessary to ensure website security and proper operation.

User Rights

Users have the right to:

• access their personal data;
• rectify inaccurate data;
• erase personal data;
• restrict processing;
• data portability;
• object to processing;
• withdraw consent at any time.

To exercise these rights, users may contact the Controller at support@test.medica-japan.pl. The Controller will respond without undue delay and no later than one month after receiving the request.

Users also have the right to lodge a complaint with the competent supervisory authority, namely the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, if they believe that the processing of their personal data violates the GDPR.

Updating Personal Data

Users may update their personal data at any time through their customer account or by contacting the Controller.

Cookie Policy

The Store uses cookies and similar technologies to ensure the proper functioning of the website, maintain user sessions, personalize content, perform statistical analysis, and conduct marketing activities.

Cookies may contain information such as:

• IP address;
• device information;
• browser type;
• operating system;
• user activity on the website.

The Store uses the following types of cookies:

• essential;
• functional;
• analytical;
• security;
• marketing.

Users may change their cookie preferences at any time through their browser settings. Disabling cookies may limit the functionality of certain parts of the Store.

Cookies may also be used by third parties, including Google and providers of advertising and analytics tools.

Technical Data

The Controller may collect technical data, including IP addresses, device information, browser details, and system logs, for the purposes of ensuring website security, compiling statistics, and analyzing website traffic. Such data may be disclosed to competent public authorities where required by applicable law.

Final Provisions

The Controller reserves the right to amend this Privacy Policy in the event of changes in legal regulations, technological developments, or changes in the operation of the online store. The current version of the Privacy Policy is always available on the Store's website.