1. Who is the controller

The controller of your personal data is ZenithXR Cezary Sobociński. Correspondence address: ul. Henryka Sienkiewicza 3/1, 62-200 Gniezno (Tax ID 7842554642, REGON 545279537). For data protection matters, email support@zenithxr.pl. We have not appointed a Data Protection Officer; please contact us directly at the address above.

2. What data we collect and why

To process electronic payments, we provide the data required for the transaction to the operator selected by the Customer: PayU S.A. or WooPayments and Stripe, depending on the chosen method. This may include identification and contact details, billing information, the amount and status of the transaction, and payment identifiers.

Providing the data required to process an order is voluntary but necessary to conclude a contract. Marketing consent is always voluntary and may be withdrawn at any time.

3. Legal bases for processing

• Article 6(1)(b) GDPR : performance of a contract (order processing, account services and handling requests);
• Article 6(1)(c) GDPR : compliance with a legal obligation (invoicing, accounting and handling complaints);
• Article 6(1)(f) GDPR : our legitimate interests (contact, statistics, pursuing and defending claims, and preventing abuse);
• Article 6(1)(a) GDPR : your consent (newsletter, marketing and non-essential cookies).

4. Data recipients and processors

We disclose data only to trusted recipients, operators and processors to the extent necessary to process orders and provide services. These include:

Data may also be disclosed to authorised public authorities where required by law. Cookie consent is managed by the Complianz plugin operating within our store.

5. Transfers outside the EEA

Some service providers, such as Google, may process data outside the European Economic Area. In such cases, transfers are based on mechanisms compliant with the GDPR, in particular the European Commission's Standard Contractual Clauses or an adequacy decision such as the Data Privacy Framework. If we do not use such tools, the data remains within the EEA.

6. How long we retain data

• order and contract data: for the time needed to perform the contract and for the applicable limitation period;
• invoice and accounting data: for the period required by tax law, generally 5 years from the end of the tax year;
• Customer account data: until the account is deleted;
• data processed on the basis of consent (newsletter): until consent is withdrawn;
• analytics cookie data: for the period specified in sections 8 and 9 or until consent is withdrawn.

7. Your rights

In relation to the processing of your data, you have the right to: access your data and obtain a copy, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability , object to processing based on legitimate interests, and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

8. Cookies

Cookies are small files stored on your device. We use the following categories:

• Essential : required for the store to function (basket, login, security and remembering consent choices). They do not require consent.
• Functional : remember your preferences, such as currency, delivery country and language.
• Analytics : help us understand how you use the store, for example through Google Analytics 4. They are stored after you give consent.
• Marketing : if we use them, they are used to personalise advertising. They are stored only after you give consent.

On your first visit, you will see a consent banner provided by Complianz. You can accept all cookies, reject non-essential cookies or choose detailed settings. You can change or withdraw consent at any time by opening the cookie settings on the website. Essential cookies are always active; all others are enabled only after you give consent.

You can also manage cookies in your browser settings, including blocking or deleting them. Restricting essential cookies may affect how the store works, including the basket.

9. Analytics and third-party tools

We use Google Analytics 4 implemented using Google Tag Manager. These tools collect information including the pages visited, referral source, approximate location and device type. Analytics and marketing scripts are activated only after you give consent through the cookie banner. The service provider (Google) is also a data controller for these services under the terms of its privacy policies.

10. Changes to this policy

We may update this policy, for example when the law or the tools we use change. The current version, together with the date of the update, is always available on this page.