Privacy Policy and Cookie Policy

for the MOYA online store — https://moyamatcha.com

---

1. General Information

1. This document defines the privacy policy for the online store https://moyamatcha.com/ (hereinafter referred to as the "Online Store"). The data controller for the Online Store is the Seller – MOYA EUROPE Sp. z o.o., ul. Karłowicza 9A 02-501 Warsaw, NIP: PL7010520584, Regon: 363010610, entered in the National Court Register under no. 0000586397, E-mail: hello@moyamatcha.com.
2. Personal data collected by the Controller is processed in accordance with the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter GDPR).
3. The Controller takes special care to protect the privacy and information provided to them concerning the Online Store's Customers. The Controller selects and applies appropriate technical, programming, and organizational measures with due diligence, ensuring the protection of processed data, particularly securing data against unauthorized access, disclosure, loss, destruction, unauthorized modification, as well as against processing in violation of applicable laws.
4. Personal data will be processed in accordance with the principles set out in Art. 5 (GDPR). Personal data shall be:
   
   1. processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
   2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);
   3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
   4. accurate and, where necessary, kept up to date (‘accuracy’);
   5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) subject to implementation of appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject (‘storage limitation’);
   6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

2. Personal Data We Collect and Use

1. We ensure that the collection and use of your personal data are lawful.
2. The Controller may process the following personal data of Customers necessary for establishing, shaping the content, changing, or terminating the legal relationship regarding services provided electronically, including:
   
   1. Customer's surname and first names;
   2. Customer's residential address and delivery address;
   3. Correspondence address, if different from the address mentioned in point b;
   4. Customer's email addresses;
   5. Phone number;
   6. IP address;
   7. Information about the web browser and the device used to view the online store.

3. Legal Basis for Personal Data Processing

1. The legal bases for personal data processing stem from the provisions of the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - General Data Protection Regulation). When we inform about personal data processing based on:
2. Art. 6(1)(a) GDPR – this means that we process personal data based on received consent,
3. Art. 6(1)(b) GDPR – this means that we process personal data because it is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract,
4. Art. 6(1)(c) GDPR – this means that we process personal data to fulfill a legal obligation,
5. Art. 6(1)(f) GDPR – this means that we process personal data for the purposes of the legitimate interests pursued by the controller.

4. Purposes of Personal Data Processing

1. Customers' personal data are collected in case of:
   
   1. account registration in the Online Store, for the purpose of creating and managing an individual account. Legal basis: necessity for the performance of the Account service contract (Art. 6(1)(b) GDPR);
   2. placing an order in the Online Store, for the purpose of performing the sales contract. Legal basis: necessity for the performance of the sales contract (Art. 6(1)(b) GDPR);
   3. using the newsletter service in the Online Store for the purpose of performing the electronically supplied service contract. Legal basis: necessity for the performance of the Newsletter service contract (Art. 6(1)(b) GDPR).
   4. marketing, analytical, and statistical activities of the Controller or its partners (third parties) or other so-called third parties with whom we cooperate, e.g., presenting you with advertisements and offers, also tailored to your interests based on profiling (we analyze your activity in a simplified manner (e.g., your purchase history and behavior on our website) thanks to which we can better adapt not only to specific, general groups of our Customers, but also to your preferences). However, our actions do not significantly affect your decisions, e.g., purchasing decisions – legal basis: Art. 6(1)(f) GDPR, i.e., the legitimate interest of the Controller or a third party;
2. For other purposes, the Customer's personal data may be processed based on:
   
   1. applicable legal provisions – when processing is necessary to fulfill a legal obligation incumbent on the Controller, e.g., when the Controller settles sales contracts based on tax or accounting regulations (Art. 6(1)(c) GDPR);
   2. necessity for purposes other than those mentioned above, arising from the legitimate interests pursued by the Controller or by a third party, in particular for establishing, pursuing, or defending claims, conducting correspondence with Customers, including via contact forms (including replying to Customer messages), market and statistical analyses (Art. 6(1)(f) GDPR).
3. Social media. We have profiles on Facebook and Instagram. Personal data are or may be processed to conduct profiles on these services, including fanpages, in accordance with the regulations applicable to these services and under the conditions specified by the administrators of these services, i.e.:
   
   1. for marketing and analytical activities – Art. 6(1)(f) GDPR;
   2. for statistical and advertising purposes carried out through tools provided by the applications of individual social networking sites. The legal basis for processing personal data for these purposes is the necessity for purposes arising from the legitimate interest of the Administrator, which consists of carrying out its own marketing and maintaining its image – Art. 6(1)(f) GDPR.
      Joint controllership of personal data within social media portals:
      As the owner of the Fanpage, the Administrator is a joint controller of personal data with respect to personal data collected for statistical or advertising purposes in the case of Facebook, Instagram: together with Meta Platforms Ireland Limited in Ireland, Serpentine Avenue, Block J, Dublin 4, Ireland (Meta). The rules for processing personal data on Facebook by Meta are available at https://www.facebook.com/privacy/explanation. The rules for processing personal data on Instagram by Meta are available at https://help.instagram.com/.
      Information regarding mutual agreements between the controllers is available at https://www.facebook.com/legal/terms/page_controller_addendum.
      

5. Period of Personal Data Processing

1. Data processed for the purpose of contract performance are stored for the period necessary to perform, terminate, or otherwise expire the concluded Sales Agreement or Electronic Service Agreement.
2. Data processed on the basis of applicable legal provisions are stored for the period required by law, obliging the Controller, e.g., to keep tax records (until the expiration of the tax liability limitation period, unless tax laws provide otherwise).
3. Data processed for purposes arising from the legitimate interests of the Controller will be stored for the period of existence of the legitimate interest pursued by the Controller, but no longer than the limitation period for claims.
4. Personal data processed for purposes covered by a consent statement will be processed until the consent is withdrawn.
   

6. Recipients of Personal Data

1. The recipients of Customer data may be entities fulfilling orders on behalf of the Seller and handling them: shipping companies and carriers (Inpost, Fedex, UPS), accounting firms, IT solution providers, payment processing companies, banks, marketing service providers, warehousing service providers, telecommunications service providers, law firms, authorized state authorities.
   
2. The entities providing online payment services are:
   
   1. PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A. (R.C.S. Luxembourg B 118 349)
   2. PayU – PayU Spółka Akcyjna with its registered office in Poznań, at ul. Grunwaldzka 182, entered in the register of entrepreneurs of the National Court Register maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań, VIII Commercial Division of the National Court Register under KRS number 0000274399, NIP number 7792308495, REGON 300523444, share capital PLN 4,944,000, paid-up capital PLN 4,944,000, being a payment service provider within the meaning of the Act of 19 August 2011 on payment services,
   3. Stripe – Stripe Payments Europe, Ltd., a 1 Grand Canal Street Lower, Grand Canal Dock, Dublin.
   4. Shopify Payments - Shopify International Limited, The Sidings, 4th Floor, Grand Canal Quay, Dublin D02 E7K8, Ireland
3. We entrust the processing of personal data, among others, to:
   
   • Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA – for the purpose of using the mailing system, used for sending newsletters,
   • Klaviyo, Inc., 125 Summer Street, 6th Floor, Boston, MA 02110, USA – for marketing purposes exclusively for email, SMS, social media campaigns launched or indicated by the Administrator using the edrone system,
     

   • IDEA COMMERCE S.A., ul. Jana Karola Chodkiewicza 61, 85-667 Bydgoszcz, NIP: 7010682602

   • Thulium sp. z o.o., ul. Stanisława Klimeckiego 4, 30-705 Kraków, NIP: 6783144527
4. All entities to whom we entrust the processing of personal data guarantee the application of appropriate measures for the protection and security of personal data required by law.
5. Your personal data is generally processed within the European Economic Area (hereinafter: "EEA"). However, due to the Administrator's cooperation with third parties in connection with the Online Store's activities, your personal data may be transferred to a country outside the EEA, where the entity cooperating with the Administrator maintains tools for processing personal data in cooperation with the Administrator. In the event of such data transfer, it will only take place to the necessary extent, related to the provision of services by these entities to the Administrator.
6. In the case of transferring personal data to entities located outside the EEA, the Administrator ensures compliance with the requirements set out in Chapter 5 of the GDPR, including the application of appropriate safeguards for the transfer in the form of standard contractual clauses adopted pursuant to a decision of the European Commission. You can obtain a copy of the safeguards for personal data transferred outside the EEA by contacting the Administrator at the email address: hello@moyamatcha.com.

For other purposes

the Customer's personal data may be processed based on:

1. applicable legal provisions – when processing is necessary to fulfill a legal obligation incumbent on the Controller, e.g., when the Controller settles sales contracts based on tax or accounting regulations (Art. 6(1)(c) GDPR);
2. necessity for purposes other than those mentioned above, arising from the legitimate interests pursued by the Controller or by a third party, in particular for establishing, pursuing, or defending claims, conducting correspondence with Customers, including via contact forms (including replying to Customer messages), market and statistical analyses (Art. 6(1)(f) GDPR).

Social media

We have profiles on social media on Facebook and Instagram. Personal data are or may be processed to conduct profiles on these services, including fanpages, in accordance with the regulations applicable to these services and under the conditions specified by the administrators of these services, i.e.:

1. for marketing and analytical activities – Art. 6(1)(f) GDPR;
2. for statistical and advertising purposes carried out through tools provided by the applications of individual social networking sites. The legal basis for processing personal data for these purposes is the necessity for purposes arising from the legitimate interest of the Administrator, which consists of carrying out its own marketing and maintaining its image – Art. 6(1)(f) GDPR.

Joint controllership of personal data within social media portals:

As the owner of the Fanpage, the Administrator is a joint controller of personal data with respect to personal data collected for statistical or advertising purposes in the case of Facebook, Instagram: together with Meta Platforms Ireland Limited in Ireland, Serpentine Avenue, Block J, Dublin 4, Ireland (Meta). The rules for processing personal data on Facebook by Meta are available at facebook.com/privacy/explanation. The rules for processing personal data on Instagram by Meta are available at help.instagram.com.

Information regarding mutual agreements between the controllers is available at facebook.com/legal/terms/page_controller_addendum.

5. Period of Personal Data Processing

1. Data processed for the purpose of contract performance are stored for the period necessary to perform, terminate, or otherwise expire the concluded Sales Agreement or Electronic Service Agreement.
2. Data processed on the basis of applicable legal provisions are stored for the period required by law, obliging the Controller, e.g., to keep tax records (until the expiration of the tax liability limitation period, unless tax laws provide otherwise).
3. Data processed for purposes arising from the legitimate interests of the Controller will be stored for the period of existence of the legitimate interest pursued by the Controller, but no longer than the limitation period for claims.
4. Personal data processed for purposes covered by a consent statement will be processed until the consent is withdrawn.

6. Recipients of Personal Data

1. The recipients of the Customer's data may be entities performing the order on behalf of the Seller and dealing with its service: shipping and transport companies (InPost, FedEx, UPS), accounting firms, IT solution providers, payment processing companies, banks, marketing service providers, warehouse service providers, telecommunications service providers, law firms, authorized state authorities.
2. The entities providing online payment services are:
   1. PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A. (R.C.S. Luxembourg B 118 349);
   2. PayU – PayU Spółka Akcyjna with its registered office in Poznań, at ul. Grunwaldzka 182, entered into the register of entrepreneurs of the National Court Register kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, VIII Commercial Division of the National Court Register under KRS number 0000274399, NIP 7792308495, REGON 300523444, share capital PLN 4,944,000, paid-up capital PLN 4,944,000, being a payment service provider within the meaning of the Act of August 19, 2011, on payment services;
   3. Stripe – Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin.
3. We entrust the processing of personal data to, among others:
   • Klaviyo Inc., 125 Summer Street, Floor 6, Boston, Massachusetts 02111, United States – for the purpose of using the Klaviyo mailing system, for sending newsletters;
   • Klaviyo Inc., 125 Summer Street, Floor 6, Boston, Massachusetts 02111, United States – for marketing purposes, solely for email, SMS, and social media campaigns launched or indicated by the Administrator using the Klaviyo system;
   • Idea Commerce S.A. with its registered office in Bydgoszcz, ul. Jana Karola Chodkiewicza 61, 85-667 Bydgoszcz, e-mail: biuro@idea-commerce.com, NIP: 7010682602, KRS: 0000875683, REGON: 36702741100000;
     
   • tawk.to inc., 187 East Warm Springs Rd, SB298, Las Vegas, Nevada, USA 89119.
4. All entities to whom we entrust the processing of personal data guarantee the application of appropriate personal data protection and security measures required by law.
5. Your personal data is generally processed within the European Economic Area (hereinafter: "EEA"). However, due to the Administrator's cooperation with third parties in the operation of the Online Store, your personal data may be transferred to a country outside the EEA, where the entity cooperating with the Administrator maintains tools for processing personal data in cooperation with the Administrator. In the event of such a data transfer, it will only take place to the necessary extent, related to the provision of services by these entities to the Administrator.
6. In the case of transferring personal data to entities located outside the EEA, the Administrator ensures compliance with the requirements set out in Chapter 5 of the GDPR, including the application of appropriate safeguards for the transfer in the form of standard contractual clauses adopted by a decision of the European Commission. You can obtain a copy of the personal data transfer safeguards outside the EEA by contacting the Administrator at the e-mail address: hello@moyamatcha.com.

7. Your rights regarding personal data protection

1. Due to the voluntary nature of providing your personal data, you have the right to:
   1. access your personal data (Art. 15 GDPR);
   2. rectify your personal data (Art. 16 GDPR);
   3. erase your personal data ("right to be forgotten", Art. 17 GDPR);
   4. restrict the processing of your personal data (Art. 18 GDPR);
   5. data portability (Art. 20 GDPR);
   6. object (Art. 21 GDPR).
      
2. Right of access to data: You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed. If so, you have the right to access this data, as well as to receive additional information about: the purposes of processing, the categories of relevant data, the recipients or categories of recipients to whom the data have been or will be disclosed, in particular recipients in third countries or international organizations, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period, the right to request from us rectification, erasure or restriction of processing of data, the right to object to such processing, as well as the right to lodge a complaint with a supervisory authority, the source of the data, if your data were not collected from you, automated decision-making, including profiling, and the rules for making them, as well as the significance and envisaged consequences of such processing for you. Upon receipt of such a request, we are obliged to provide a copy of the personal data undergoing processing. If such a request is made electronically and if we do not receive any other reservation, the information will also be provided electronically.
   
3. Right to rectification of data: You have the right to request from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
4. Right to erasure of data (to be forgotten): You have the right to request from us the immediate erasure of personal data concerning you. In such a case, we are obliged to erase personal data without undue delay if one of the following grounds applies:
   1. you have withdrawn your consent to the processing of your personal data and we have no other legal basis for processing it,
   2. you have successfully objected to the processing of your data,
   3. your personal data has been processed unlawfully,
   4. your personal data must be erased for compliance with a legal obligation,
   5. your data has been collected in connection with the offer of information society services.
      
5. Right to restriction of processing
   You have the right to request from us the restriction of processing in the following cases:
   1. when you contest the accuracy of the data – for a period enabling us to verify the accuracy of the data,
   2. the processing is unlawful, and you oppose the erasure of the data and request the restriction of their use instead,
   3. we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims,
   4. you have objected to processing your data – pending the verification whether our legitimate grounds override yours.
6. Automated decisions, including profiling
   You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
   
7. The right does not apply if that decision: 
   1. is necessary for entering into, or performance of, a contract between you and us,
   2. is authorised by Union law or Polish law and which lays down appropriate measures to safeguard your rights and freedoms and legitimate interests, or is based on your explicit consent.
      
8. Right to lodge a complaint: You have the right to lodge a complaint regarding the processing of your personal data with the supervisory authority: President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, kancelaria@uodo.gov.pl. 
   
9. Consent to the processing of personal data may be withdrawn at any time. The withdrawal of consent to data processing does not affect the lawfulness of data processing carried out by the Administrator based on consent before its withdrawal.
   
10. 10. To exercise your rights, please contact us at the e-mail address: hello@moyamatcha.com. 

 

COOKIES POLICY

1. The Administrator uses cookies. 
2. Cookies are IT data, in particular text files, stored in Users' devices and intended for using websites. 
3. The "cookies" used by the Administrator are safe for the User's devices. In particular, this way it is not possible for viruses or other unwanted software or malicious software to get into Users' devices. These files allow to identify the software used by the User and adapt the Services individually to each User. "Cookies" usually contain the name of the domain from which they originate, their storage time on the device, and an assigned value.
4. Due to the purpose of collection, we distinguish the following Cookie files:
a) necessary: essential for the proper functioning of the website – files processed based on the legitimate interest of the administrator (Art. 6 sec. 1 lit. f GDPR);
b) statistical: they allow us to analyze traffic on the website, learn about our users' preferences, analyze their behavior on the website, and enable interactions with external networks and platforms – files processed based on the user's voluntary consent (Art. 6 sec. 1 lit. a GDPR);
c) marketing: they allow for adjusting displayed advertisements and content to our users' preferences and conducting personalized marketing campaigns – files processed based on the user's voluntary consent (Art. 6 sec. 1 lit. a GDPR).
5. In terms of their validity, we distinguish two categories of cookies:
a) session files – existing until the end of a given session,
b) persistent files – existing after the session ends.
6. In terms of distinguishing the entity administering cookies, we distinguish:
a) our own cookies,
b) third-party cookies.
7. "Cookies" may be used by advertising networks, in particular the Google network, to display advertisements tailored to how the Client uses the Online Store. For this purpose, information about the Client's navigation path or time spent on a given page may be stored.
8. Regarding information about the Client's preferences collected by the Google advertising network, the Client can view and edit information resulting from "cookies" using the tool: https://www.google.com/ads/preferences/.
9. The User can independently and at any time change the settings for "cookies", specifying the conditions for their storage and access by "cookies" to the User's device. Changes to the settings mentioned in the previous sentence can be made by the User using the web browser settings or through service configuration. These settings can be changed in particular in such a way as to block the automatic handling of "cookies" in the web browser settings or to inform about their every placement on the User's device. Detailed information about the possibilities and methods of handling "cookies" are available in the software settings (web browser).
10. To learn how to manage cookies, including how to disable them in your browser, you can use your browser's help file. You can find information on this topic by pressing the F1 key in your browser. In addition, you will find appropriate instructions on the following subpages, depending on the browser you use:
Firefox
Chrome
Safari
Internet Explorer / Microsoft Edge
11. Limiting the use of "cookies" may affect some functionalities available on the website. 
12. The Service also collects external cookies, so-called third-party cookies, which come from external servers.
13. Due to the Administrator's cooperation with other entities within the Online Store, for the purposes of this cooperation, the browser also saves cookie files that come from entities with whom the Administrator cooperates. In this way, among other things, information about viewed Products is collected. The cookie files sent by these entities are particularly intended to ensure the proper functioning of the Online Store and improve the effectiveness of presenting advertisements that match your online activity. Your data in the above scope will be processed within the scope of the consent you have given, among other things, to ensure the correctness and attractiveness of the presented product and service advertisements or to make proper settlements for the publication of these advertisements. If you do not want the aforementioned partner to process your data collected on our websites to ensure the correctness and attractiveness of the product and service advertisements presented to you – you can withdraw your consent. (Google Analytics, Google ADS, Meta Pixel, edrone, Tawk to).

 

The Administrator reserves the right to change this privacy policy with cookies. The new version will be posted on the online store's website.