SERUM collects and processes personal data (name and surname, address, e-mail address, telephone number) in accordance with the provisions of the Regulation of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as "GDPR"). In order to run the SERUM website, through which Users can make purchases in the SERUM online store (hereinafter referred to as "Website"), it applies the required technical measures to ensure the protection of processed personal data and to secure personal data against their disclosure to unauthorized persons, takeover by unauthorized persons, processing in violation of the law and change, loss or destruction.

You have the right to ask us at any time to obtain:

1. information: whether your data is being processed and other information, in particular about a breach of the protection of your data;

• 2. access to your data;
• 3. rectification of your data;
• 4. being forgotten (removal of data from the website);
• 5. restrictions on the processing of your data;
• 6. transferring your data;
• 7. object to the processing of your personal data, under the terms set out in Article 21 of the GDPR;
• 8. not to be subject to a decision based solely on automated processing (including profiling).

Personal data administrator

The administrator of personal data is SERUM spółka z ograniczoną odpowiedzialnością with its registered office in Piła (postal code 64-920) at ul. Okólna 21/4, entered into the register of entrepreneurs under the NIP number: 7642641193, REGON:
369023423, email address: contact@serumstudios.eu, hereinafter referred to as "SERUM" or "Administrator". Personal data processing means activities and operations performed on the personal data of Users, including storage or analysis for the purposes of the services of the misbhv.com website. Users' personal data will not be sold to third parties, and in particular will not be transferred to other entities for the purpose of sending third-party marketing materials.

Processing purposes

SERUM processes the personal data of Users in order to fulfill an order placed on the Website, owned by the Administrator, and any contact concerning a placed or initiated order process, registering a User account and fulfilling a sales (purchase) agreement, based on art. 6 sec. 1 letter b) of the GDPR, as well as to fulfill legal and fiscal obligations in connection with completed orders, based on art. 6 sec. 1 letter c) of the GDPR. The personal data obtained may also be used in the legitimate interest of the Administrator, based on the premise indicated in art. 6 sec. 1 letter f) of the GDPR, e.g. to pursue claims and defend in legal disputes and court proceedings, and for direct marketing. Providing data is voluntary, but necessary to create a User account and make a purchase.

In addition, in the event of additional consents being given, personal data will be processed by the Administrator in the following manner:

"Newsletter"

The Newsletter is available only to persons over 16 years of age. When ordering the service, the User declares that they are over 16 years of age and can independently express such consent. The data obtained will be processed for the purpose of distributing information about the Administrator's products and promotional campaigns, i.e. for marketing purposes (direct marketing, based on the consent expressed by the User, i.e. based on the premise indicated in art. 6 sec. 1 letter a) of the GDPR. Providing data is voluntary, but necessary to subscribe to the newsletter.

"Contact form"

Personal data obtained through the contact form will be used to process the submitted query and any further contact, in accordance with the consent granted, based on the premise indicated in art. 6 sec. 1 letter a) of the GDPR. The consent granted may be withdrawn at any time, which does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal. Providing data is voluntary, but necessary to process/answer the submitted application/question.

"Contractors"

Personal data will be used for the proper implementation of contracts concluded by the Administrator, on the basis of the premise indicated in art. 6 sec. 1 letter b) of the GDPR or in the scope of fulfilling legal and fiscal obligations on the basis of the premise indicated in art. 6 sec. 1 letter c) of the GDPR and also on the basis of art. 6 sec. 1 letter f) of the GDPR, on the basis of a legitimate interest, which is the possibility of implementing contracts and maintaining proper communication between the parties, in the case of personal data of persons indicated in concluded contracts, who are not parties to these contracts. Providing data is necessary to conclude and implement the contract. The personal data in question may also be used for the legitimate interest of the Administrator, which should be considered direct marketing of own products and services, on the basis of the premise indicated in art. 6 sec. 1 letter f) of the GDPR - in this respect, you have the right to object to the processing of your personal data for the purpose of direct marketing; filing an objection results in you not receiving marketing materials about the Administrator's own products and services.

In connection with ongoing court and enforcement proceedings, etc., to which the Administrator is a party, the personal data of other participants in the above-mentioned proceedings are processed in the legitimate interest of the Administrator, which should be considered the pursuit of rights or defense against claims, in accordance with Art. 6 sec. 1 letter f) of the GDPR.

We use Google Analytics and if you consent to this, we process your data for analytical purposes.

Who do we share your personal data with?

Your personal data may be transferred for the purpose of executing a contract, providing a service, delivering a product, collecting a fee, analyzing data and providing marketing or User service to entities such as: postal operators and courier companies in the scope of delivering parcels, banks and entities providing payment services, providing legal and accounting services to the administrator and other entities to which the administrator has entrusted the processing of personal data on the basis of Art. 28 and Art. 29 of the GDPR.

In addition, we transfer personal data to recipients in third countries (i.e. outside the European Economic Area), i.e. The Rocket Science Group LLC and Google LLC based in the United States, in relations with which we have used standard contractual clauses adopted by the European Commission and within which basic guarantees of the security of your data have been established.

Data Retention Period

The period for which personal data is stored may vary depending on the type of personal data collected and the purpose of their processing.

Data processing takes place either for (i) the period specified by law; (ii) or until the relevant purpose applicable to the specific data ceases to exist. For example, data relating to your orders will be processed for as long as the Data Controller may be required to store such data under applicable law, and will be deleted once this lawful purpose ceases to exist.

"Newsletter"

The data will be stored until you withdraw your consent to their processing and unsubscribe from the newsletter, extended by the time of fulfilling the request submitted in the above scope, up to 30 days.

"Contact form"

The data will be processed until the inquiry is answered and the contact is terminated.

"Marketing"

In the case of data processed for the purposes of direct marketing, including profiling, the data are processed for this purpose until the data subject objects to their further processing.

Your rights

Anyone whose data is processed has the right to:

• the right to access your data and receive a copy thereof;
• the right to rectify (correct) your data if it is incorrect or outdated, as well as the right to delete it if the data is not processed for the purpose of fulfilling an obligation arising from legal provisions or in the exercise of public authority;
• the right to restrict data processing;
• the right to object to the processing of his or her personal data based on the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), including profiling based on these provisions;
• the right to object to the processing of your personal data for the purposes of direct marketing, including profiling, to the extent that the processing is related to such direct marketing;
• to the extent that the data is processed on the basis of consent or as part of the service provided (the data is necessary for the provision of the service) - the right to withdraw consent to the extent that it is processed on this basis; the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal;
• the right to transfer personal data, i.e. to receive his or her personal data from the Controller in a structured, commonly used and machine-readable format;
• the right to lodge a complaint with the President of the Personal Data Protection Office (to the address of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw).

For this purpose, please contact us at: contact@serumstudios.eu or by mail to: SERUM, Wielka 23/11, 61-775 Poznań.

Profiling

In order to market the Administrator's own products and services with the intention of preparing a personalized commercial offer, the Administrator may use profiling. Profiling means the processing of personal data consisting in the use of your personal data to assess some of your characteristics, in particular to analyze or forecast aspects concerning your personal preferences. Data subject to profiling include, among others, gender, name, postal code and date of birth, which are used to select commercial information about products tailored to your needs. Providing the above-mentioned personal data and giving consent to personalize commercial information is voluntary, but their provision is necessary if you want to receive commercial information about products from us, because we only send personalized commercial information.

Cookie Policy

1. The Service (SERUM online store) uses "cookies". Cookies are small files that allow the device used to browse the Internet (e.g. computer, smartphone, etc.) to remember specific information about the device being used. Information registered in cookies ensures the proper operation of the Service and supports the use of its functionalities. Some cookies save statistical data and help provide users with personalized content, and are also used, among others, for statistical purposes and to adapt our services to your individual needs. You can change the cookie settings in your web browser. If these settings remain unchanged, cookies will be saved in the device's memory. Changing the cookie settings may limit the functionality of the Service.
2. Depending on the storage time of files, we can distinguish the following cookies:
3. Depending on the owner of the files, we can distinguish the following cookies:
4. Depending on the purpose of using cookies, we can distinguish the following cookies:
5. The website uses cookies for the following purposes:
6. You can adjust your cookie settings accordingly by selecting "Settings" in the window that appears on the website each time a user visits the site for the first time or by deactivating cookies via your web browser.
7. At any time, it is possible to block the use of cookies and delete permanent cookies using the appropriate settings available in the web browser. Detailed information about the possibilities and methods of handling cookies is usually available in the "Help" tab in the web browser menu. The configuration of settings is specific to each browser, so in the case of using multiple devices or browsers, it may turn out that it will be necessary to modify the settings on each device or in each browser. However, blocking or limiting the use of cookies may prevent the proper use of some functionalities available on the Service.
8. Cookies generally do not contain data that allows the identification of the device user's identity, however, in certain cases, when they are linked to other user data that clearly identify them as a person, they may obtain the status of personal data. The Service does not have the means or data that allows the identification of a specific person based on cookies used within the aforementioned tools, however, after they are transferred to entities offering these tools, they may be linked to other data held by the suppliers of these tools, thus obtaining the nature of personal data. In such cases, the controller of personal data will be the suppliers of the individual tools.

Information on data protection in Google Analytics

Our websites use the web service analysis mechanisms of Google Inc. ("Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA"): Google Analytics, Google Double Click and Google Tag Manger. Google Analytics, Google Double Click and Google Tag Manger use cookies that enable an analysis of how the websites are used. The information collected by cookies is transferred to Google servers located in the USA and archived.

If the IP anonymisation function is activated when using our website, the User's IP address will be shortened by Google. This applies to member states of the European Union and other countries listed in the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and shortened there. In this way, the IP anonymisation function will be activated on our website. At the request of the website operator, Google will use the information collected to analyse the use of the website, to prepare reports on website use and other services related to internet use. The IP address transmitted by the User's browser as part of Google Analytics is not stored together with other Google data. We analyse your personal data only on the basis of your consent. If you do not want information about you to be transferred to Google, simply refuse this when visiting our website.

The information contained in this Privacy and Cookies Policy is subject to change at our discretion. If we make any changes, we will notify users via email and by publishing the new Privacy and Cookies Policy on the Service.