1. The controller of your personal data provided in connection with your registration on the website is KAN Sp. z o.o. with its registered office in Łódź (92-760), ul. Wiączyńska 8A, for which the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, maintains registration files with KRS No. 0000119998, NIP No. 7251019880. The Controller may be contacted by [email protected]. 2. In matters relating to personal data processing, in particular to exercise your rights connected with personal data processing, you can contact the Data Protection Officer designated by the Controller, at the following e-mail address: [email protected]. 3. Your personal data will be processed for the purpose of: • providing the service of opening and maintaining your account on the Controller’s website, on the basis of the provisions of the accepted Terms of Use (Article 6(1)(b) of the GDPR), for the entire period of service provision, until the User’s account on the website is de-registered, and thereafter for the purposes connected with establishment, exercise or defence of mutual legal claims. Provision of data for this purpose is voluntary, but necessary for achievement of the above-mentioned purposes; • enabling an order to be placed and executed and enabling a distance contract of sale to be entered into, via Tatuum store (Article 6(1)(b) of the GDPR), for the entire period of order execution, and thereafter for the purposes connected with establishment, exercise or defence of mutual legal claims. Provision of data for this purpose is voluntary, but necessary for achievement of the above-mentioned purposes; • exercising your right to have a complaint handled on the basis of Article 6(1)(b) and Article 6(1)(c) of the GDPR – Civil Code of 23 April 1964 (“Dziennik Ustaw” [Journal of Laws] of 2019, item 1145, consolidated text). Your personal data will be processed for a period required for a complaint to be handled, for a period of 1 year – after expiration of commercial warranty or after settlement of complaint, in accordance with Section 74(2)(6) of the Accounting Act of 29 September 1994 (“Dziennik Ustaw” [Journal of Laws] of 2019, item 351, consolidated text), and thereafter for the purposes, for the period and within the scope required by the provisions of law or for securing any legal claims until they become time-barred. Provision of data for this purpose is voluntary, but necessary for achievement of the above-mentioned purposes; • ensuring compliance with obligations to which the Controller is subject, arising primarily from the provisions of tax and accounting law (Article 6(1)(c) of the GDPR), for a period specified in those provisions of law; • sending to you information about products and offers of Kan Sp. z o.o., as part of direct marketing – for the purpose of pursuing legitimate interests of the Controller in the form of direct marketing of its own products and services, i.e. Article 6(1)(f) of the GDPR; however, in accordance with the provisions of the Act on Provision of Services by Electronic Means and of the Telecommunications Law Act, we need additional consent to using provided communication channels (e-mail address, telephone number) for marketing activities. In this case, your data will be processed until you object to processing of such data or until you withdraw your consents to receiving information about products and offers by electronic means; • sending out information about products and offers of the Controller by e-mail in the form of a newsletter – the legal basis for personal data processing are legitimate interests of the Controller (Article 6(1)(f) of the GDPR) in connection with your consent to receiving newsletters. The Controller sends out information about its products and offers to persons who provided their e-mail addresses for that purpose. The Controller sends out such information only if you expressed your consent, which may be withdrawn at any time – without affecting the lawfulness of processing based on consent before its withdrawal. Your personal data will be processed until you withdraw your consent or make an effective objection to processing of your personal data. Provision of data for this purpose is voluntary, but necessary to receive newsletters; • establishing, exercising or defending any legal claims which may arise in connection with the above-mentioned purposes, activities of the Controller and provision of services – for the purpose of pursuing legitimate interests of the Controller in the form of securing legal claims, i.e. on the basis of Article 6(1)(f) of the GDPR, for a period specified in the provisions of law relating to time bars on legal claims. In some cases, the Controller uses profiling for its marketing activities. It means that on the basis of your personal data held by the Controller and information about products purchased by you the Controller will draw conclusions about your preferences and interests which may be used by us to better align our marketing messages with your expectations. Therefore, profiling will include aligning displayed advertisements, products presented at the time of order placement, sent information about products and services and about promotions and discounts offered by the Controller, on the basis of purchases and products browsed in the brick-and-mortar and online store. You have the right to object to such activities at any time. 4. Recipients of your personal data will be: • entities cooperating with the Controller under franchise agreements; • third parties providing services connected with on-going operations of the Controller; • third parties providing and supporting IT systems of the Controller for the purpose of maintenance of www.tatuum.com website; • online payment providers; • entities providing delivery services; • entities collaborating in respect of provision of newsletter, text message service; • other entities entitled to receive them under applicable provisions of law. 5. Personal data will not be transferred to third countries or international organisations, outside the European Economic Area. In connection with pursuit of the above-mentioned purposes, personal data may be transferred to a third country (outside the European Economic Area). 6. You have the right to request access to and rectification, erasure or restriction of processing of your personal data, the right to data portability and the right to object to processing. Furthermore, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection, if you think that your data are processed in breach of the provisions on personal data protection. In addition, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

1. The Controller of your personal data provided via the contact form (e-mail address, data included in the body of the message) is KAN Sp. z o.o. with its registered office in Łódź (92-760), ul. Wiączyńska 8A, for which the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, maintains registration files with KRS No. 0000119998, NIP No. 7251019880. The Controller may be contacted by [email protected]. 2. In matters relating to personal data processing, in particular to exercise your rights connected with personal data processing, you can contact the Data Protection Officer designated by the Controller, at the following e-mail address: [email protected]. 3. Your personal data will be processed exclusively for the purpose of answering queries submitted via the contact form, i.e. for the purpose of pursing legitimate interests of the Controller in the form of communication with website users, and answering queries submitted to the Controller as well as for the purpose of securing, exercising or defending any legal claims connected with answering queries – i.e. on the basis of Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Personal data processed for the above-mentioned purposes will be stored for a period required for answering a query submitted via the contact form, and thereafter for the purposes, for the period and within the scope required by the provisions of law or for securing any legal claims until they become time-barred, or until objection to data processing is effectively made. Personal data are not subject to automated processing, including profiling. Provision of your personal data is voluntary but necessary to receive an answer to a query submitted via the contact form. 4. Recipients of your personal data may be entities processing personal data to the order of the Controller, i.e. third parties providing and supporting IT systems used to perform this agreement, and other parties providing services connected with on-going operations of the Controller, exclusively under appropriate data processing agreements and ensuring that the above-mentioned parties apply adequate technical and organisational measures to protect personal data. Personal data may also be shared with entities authorised to receive them under applicable provisions of law. Personal data will not be transferred to a third country or an international organisation, unless required by the applicable provisions of law. 5. You have the right to request access to and rectification, erasure or restriction of processing of your personal data or to object to processing. Furthermore, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection, if you think that your data are processed in breach of the provisions on personal data protection.