OIO LAB PRIVACY POLICY

1. General information

This Privacy Policy explains how we process the personal data of individuals who use the English-language version of the Oio Lab Online Store available at en.oiolab.co, place Orders, create an Account, contact us, subscribe to the Newsletter or use other features of the Online Store.

This Policy should be read together with the Terms and Conditions of the Online Store and the cookie settings available in the Online Store.

2. Data controller and contact details

The controller of personal data is NISHA Ryglewicz Spółka Komandytowa, with its registered office at ul. Jana Kasprowicza 4, 62-040 Puszczykowo, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000818948, tax identification number (NIP) 7831810685 and statistical number (REGON) 385083714 ("Oio Lab", "we" or the "Controller").

For matters concerning privacy and personal data, you may contact us:

3. Where we obtain personal data

We obtain personal data primarily from you when you create an Account, place an Order, make a payment, subscribe to the Newsletter, submit a review or contact us.

Some information is generated automatically when you use the Online Store, such as your IP address, device identifiers, browser information, activity in the Online Store and cookie data. We may also receive data from payment service providers, carriers, social media platforms or technology partners, solely to the extent necessary for the purposes described below.

4. Personal data we process

Depending on how you use the Online Store, we may process:

We do not ask you to provide special categories of personal data, including health data. Please do not provide such information unless it is necessary for us to handle your matter. If processing such data becomes necessary, we will inform you of the appropriate legal basis and, where required, ask for your explicit consent.

5. Purposes, legal bases and retention periods

The scope of personal data and the period for which it is retained depend on the purpose for which it is processed. The principal processing activities are described below.

5.1. Customer Account

Purpose and scope: Creating and maintaining an Account, providing access to Order history, saving information and supporting Account features.

Data: Identification and contact data, login details, Order history and Account settings.

Legal basis: Article 6(1)(b) GDPR - performance of the agreement for maintaining the Account; after that agreement ends, Article 6(1)(f) GDPR - establishing, pursuing or defending legal claims.

Retention period: For as long as the Account is maintained and, after it is deleted, for the period required by law or necessary to establish, pursue or defend legal claims.

5.2. Orders, payments and delivery

Purpose and scope: Accepting and fulfilling an Order, processing payment, delivering Products and communicating about the Order.

Data: Identification, contact and address data, and data relating to the Order, payment and delivery.

Legal basis: Article 6(1)(b) GDPR - entering into and performing the agreement; Article 6(1)(c) GDPR - compliance with accounting, tax and consumer protection obligations; Article 6(1)(f) GDPR - pursuing and defending legal claims and preventing abuse.

Retention period: For the duration of the agreement and subsequently for the period required under tax, accounting and consumer protection laws and until the applicable limitation periods for claims expire.

5.3. Returns, withdrawals and complaints

Purpose and scope: Handling returns, withdrawals from agreements, complaints and other Customer rights.

Data: Contact details, Order data, the content of the request, case documentation and settlement data.

Legal basis: Article 6(1)(c) GDPR - compliance with legal obligations; Article 6(1)(b) GDPR - performance of the agreement; Article 6(1)(f) GDPR - establishing, pursuing or defending legal claims.

Retention period: For the period required to handle the matter and subsequently for the period required by law and the applicable limitation periods for claims.

5.4. Contact and enquiries

Purpose and scope: Responding to messages, conducting correspondence and handling enquiries that are not directly related to an Order.

Data: Contact details, the content of the message and other information provided in the enquiry.

Legal basis: Article 6(1)(b) GDPR where the contact relates to entering into or performing an agreement; in other cases, Article 6(1)(f) GDPR - our legitimate interest in handling correspondence and protecting the Controller's rights.

Retention period: Until the correspondence has ended and subsequently for the period necessary to demonstrate its course and to establish, pursue or defend legal claims.

5.5. Newsletter and direct marketing

Purpose and scope: Sending the Newsletter and information about Oio Lab Products, launches, content and promotions to the email address for which consent has been given.

Data: Email address and data relating to consent, the source of subscription, preferences, opens, clicks and unsubscribing.

Legal basis: Article 6(1)(a) GDPR - consent; additionally, prior consent to receive commercial communications, including direct marketing, in accordance with Article 398 of the Polish Electronic Communications Law. Measuring opens, clicks and the effectiveness of communications through technologies that are not strictly necessary is based on consent.

Retention period: Until consent is withdrawn or an effective objection is made and subsequently, to a limited extent, for the period necessary to demonstrate compliance with the law and maintain the suppression list.

5.6. Product reviews

Purpose and scope: Publishing, verifying and moderating reviews and preventing abuse.

Data: Name or pseudonym, review content, Product rating, purchase information and technical data necessary for verification.

Legal basis: Article 6(1)(f) GDPR - our legitimate interest in presenting reliable reviews, verifying that they are linked to a purchase and protecting the credibility of the Online Store; where publication takes place as part of a separate service, also Article 6(1)(b) GDPR.

Retention period: For the period during which the review is published and the Online Store operates and, after the review is removed, for the period necessary to defend legal claims or prevent abuse.

5.7. Analytics, personalisation and advertising

Purpose and scope: Measuring use of the Online Store, improving its operation, assessing campaign effectiveness, creating audiences and tailoring content or advertising.

Data: Technical data and online identifiers, and information about the device, source of the visit, activity in the Online Store and interactions with advertising.

Legal basis: For technologies that are not strictly necessary, Article 6(1)(a) GDPR and consent in accordance with Article 399 of the Polish Electronic Communications Law. We use strictly necessary technologies to the extent required to provide a service requested by the user and to ensure the security and proper operation of the Online Store.

Retention period: For the lifetime of the relevant cookie or identifier stated in the current cookie settings panel, until consent is withdrawn, or for a shorter period agreed with the relevant service provider.

5.8. Security and protection of legal claims

Purpose and scope: Ensuring the security of the Online Store, detecting errors, fraud and abuse, and establishing, pursuing or defending legal claims.

Data: Logs, IP address, device identifiers, and data relating to activity, Orders and correspondence.

Legal basis: Article 6(1)(f) GDPR - the legitimate interests of the Controller and users in protecting the Online Store, transactions and the parties' rights.

Retention period: For the period necessary to ensure security, analyse an event or correct an error and subsequently, where justified, until the applicable limitation periods for claims expire.

6. Is providing personal data mandatory

Providing the data required when placing an Order is voluntary but necessary to enter into and perform the agreement. The data required to create an Account is necessary if you wish to use that feature; an Account is not required to place an Order. Providing data in the contact form or when subscribing to the Newsletter is voluntary, but without it we will be unable to respond to your message or send the Newsletter.

7. Recipients of personal data

We may disclose personal data to entities that support us in operating the Online Store, solely to the extent necessary for them to perform the tasks entrusted to them. These may include:

We do not sell personal data. The current list of cookie technologies and their providers is available in the cookie settings panel.

8. Transfers of personal data outside the European Economic Area

Some of our technology providers may process personal data outside the European Economic Area, in particular in the United States. In such cases, depending on the provider and the place of processing, we use the mechanisms required by the GDPR, such as a European Commission adequacy decision, the provider's participation in the EU-US Data Privacy Framework, the European Commission's standard contractual clauses and, where necessary, supplementary safeguards.

You may contact us to obtain information about the transfer mechanism used or a copy of the relevant safeguards.

9. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

If you object to the processing of personal data for direct marketing purposes, we will stop processing your data for that purpose. We will assess an objection to processing for other purposes in accordance with Article 21 GDPR.

To exercise your rights, please contact us using the details set out in Section 2. We may ask you to provide information necessary to confirm your identity and protect your personal data.

10. Marketing consents and the Newsletter

Subscription to the Newsletter is voluntary. You may withdraw consent at any time by using the unsubscribe link in a message or by contacting us. Withdrawal of consent does not affect the lawfulness of earlier processing.

We record the information necessary to demonstrate that consent was given and to process an unsubscribe request, including the date, source of subscription, wording of the applicable consent statement and information about the withdrawal of consent.

11. Cookies and similar technologies

The Online Store uses cookies and similar technologies. Some are strictly necessary for the operation of the Online Store, shopping cart, login, payments, security and remembering settings. We activate other technologies, in particular functional, analytics and advertising technologies, after obtaining consent where consent is required.

On your first visit, you may accept all optional technologies, reject them or select specific categories. You may subsequently withdraw or change your consent in the cookie settings panel. Withdrawing consent should be as easy as giving it.

The current cookie list identifies the name, provider, purpose, category and lifetime of the relevant cookie or technology. The list available in the cookie settings panel forms part of this Policy.

You may also change your browser settings. However, blocking strictly necessary cookies may prevent some Online Store features from operating correctly.

12. Profiling and automated decision-making

If you provide the relevant consent, we may analyse activity in the Online Store and interactions with marketing communications to measure effectiveness, create audiences and better tailor content and advertising.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

13. Social media

We operate Oio Lab profiles on social media platforms. When you visit or follow a profile, interact with content or contact us, we process the data made available by you and the relevant platform to operate the profile, communicate with you, promote the brand and analyse statistics. As a rule, the legal basis is our legitimate interest; where communication concerns entering into an agreement, the basis may also be taking steps at your request before entering into an agreement.

The platform operator also processes personal data under its own rules. In relation to aggregated profile statistics, we may be a joint controller with the operator of the relevant platform. Further information about the operator's processing of personal data is available in the privacy policy of that platform.

14. Data security

We use appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration or disclosure. The safeguards are adapted to the nature of the data, the manner in which it is processed and the level of risk.

15. Changes to this Policy

We may update this Policy if the law, Online Store features, tools used or our processing practices change. The current version is published in the Online Store together with its effective date. If a change is material, we will provide notice appropriate to its nature, for example in the Online Store or by email.

This Policy is effective from 11 September 2026.