PRIVACY POLICY AT IMG S.A.

In the effort to realize the principle of compliance with the law, as well as for the purpose of reliability and transparency of personal data processing of the clients of IMG S.A., with its registered seat in Gdynia, the following Privacy Policy has been accepted.

The Privacy Policy specifies the principles according to which IMG S.A., with its registered seat in Gdynia, collects and processes personal data of its clients and which rights these clients are entitled to in relation to the processing of their personal data.

Bearing in mind that as of 25.05.208 the Regulation of European Parliament and Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC (general regulation on protection of personal data-specified as “GDPR”), IMG S.A., with its registered seat in Gdynia, encourages its clients to familiarize themselves with the below information concerning the processing of their personal data.

1. Information about the Administrator of personal data.

The Administrator of your personal data is IMG S.A. with its seat in Gdynia, ul. Strzelców 40 flat 25, 81-586 Gdynia.

With regards to all matters related to the processing of your personal data you may contact the Administrator by sending him traditional correspondence to the following correspondence address of the administrator: IMG S.A., ul. Kowalska 8-9/7, 82-300 Elbląg, or to the email address: info@imgfitness.pl

2. The Personal Data Protection Inspector.

With regards to matters concerning the protection of your personal data and execution of the rights you are entitled to, you may at any time contact our Personal Data Protection Inspector, appointed by the group of enterprises to which the Administrator belongs, under the email address: iod@imgfitness.pl.

3. The purpose of processing of personal data

Your personal data are processed by the Administrator for multiple purposes, to a varying extent and pursuant to different legal bases, as stipulated by GDPR provisions.

The information presented below concern the processing of your personal data, which have been grouped in accordance with the purposes for which these data are processed by the Administrator.

1. Performance of agreement.

Processing of your personal data by the Administrator is necessary for the performance of the agreement of sale of accessories and fitness equipment, including:

1. for the servicing of the process of realization of your orders for fitness products available within the offer of the Administrator,

2. for enabling your set up of User Account on the internet website of the Administrator, which operated under the following domains: www.sportsartfitness.pl, www.gipara.shop, www.gipara.com, www.sainstitute.pl, www.imgfitness.pl and for availing of the features available therein.

The legal basis which legalizes the processing of your personal data by the Administrator in this respect is formed by art. 6 (1) (b) of GDPR.

2. Realization of legally legitimate interests of the Administrator or third party.

The Administrator is entitled to process your personal data for the purpose of realizing of legitimate interests of the Administrator or third party.

The above signifies that the purpose in which the Administrator will process your personal data on this basis is compliant with the provisions of law.

The Administrator considers the processing of your personal data as compliant with the realization of his legitimate interests or interest of the third party for the purpose of:

1. passing of your personal data within the group of enterprises to which the Administrator belongs, for internal administration purposes,

2. absolutely indispensable for prevention of fraud and ensuring safety of information network,

3. selection of services for the needs of the clients of the Administrator,

4. optimizing products or services on the basis of your concerns and opinions on them, your interest, technical logs in the application,

5. optimizing the processes of sales or post-sale servicing,

6. handling complaints,

7. archiving (evidence related) for securing information in case of legal necessity of indicating specific facts (i.e. before fiscal authority),

8. potential finding, investigation or protection against claims,

9. research on customer satisfaction and specifying the quality of services provided by the Administrator,

10. offering you products or services (direct marketing) by the Administrator, including tailoring to your needs through profiling (which has been explained in the subsequent part of the Privacy Policy),

11. offering you directly (direct marketing) the products or services by entities cooperating with the Administrator (Administrator's partners), i.e. In the form of discount vouchers/rebates, including tailoring them to your specific needs by means of profiling (which has been explained in the subsequent part of the Privacy Policy) in the scope specified by the carried out and documented by the Administrator analysis of legally justified interests.

The Administrator processes your personal data solely in precisely-specified and legally justified purposes and your personal data are not processed further on in a manner non-compliant with these purposes.

The possibility of processing of your personal data for the purpose of realization of legally justified interests of the Administrator or third party has been specified in art. 6 (1) (f) GDPR.

3. Protection of vital interests of person whose personal data are in focus or another natural person.

The Administrator is entitled to process your personal data for the purpose of protection of your vital interests or vital interests of another natural person that is interests which are of significant meaning for your life or the life of another natural person.

The above stated catalogue contains, above all, humanitarian purposes and in particular natural disasters and catastrophes caused by men, as well as purposes related to the necessity of saving life, health or protecting the property.

The legal basis for the processing of personal data for the purpose of protection of your vital interests or vital interests of another natural person is formed by art. 6 (1) (d) of GDPR.

The Administrator will not however process on this basis any of your personal data belonging to special categories (including data concerning health), unless you have expressed a clear consent for the processing of your personal data for such purpose or you will be physically or legally unable to grant such a consent and the processing of your personal data will be absolutely necessary for the protection of your vital interests or the vital interests of another natural person (art. 9 (2) (a) or (c) GDPR.

4. Processing of personal data in one or more purposes in case of which the consent of person concerned is required.

In case when the processing of your personal data does not have its legal basis under one of the purposes specified in points 1-3 above, the Administrator will be able to process your personal data for one or more other purposes explicitly specified by the Administrator, solely in the situation when you have expressed a prior consent and the processing of your personal data for this purpose will not be forbidden by the binding provisions of law.

Separate consent is required in case of processing by the Administrator of your personal data for the direct marketing purpose of products or services provided by the Administrator or entities cooperating with the Administrator (Administrator's partners), realized through:

1. sending you commercial information by electronic means (i.e. Through sending you a commercial offer to the email address indicated by you during submission of an order-requirement of obtaining your consent is envisaged by art. 10 of the Act of 18 July 2002 on provision of services via electronic means (Journal of Laws 2002, no. 144, item 1204 as amended),

2. contacting with you with the use of telecommunication end recipient devices and automated calling systems (i.e. Through presenting a commercial offer to you during a telephone conversation) - a requirement of obtaining your consent has been envisaged by art. 172 of the Act from 16 July 2004 on Telecommunications Law (Journal of Laws from 2004, no. 171, item 1800 as amended),

The Administrator will be able also to process personal data in one or more purposes specified by the Administrator, which have not been specified in the hereby point solely in the situation when you have been informed of this fact in advance and expressed consent for the processing of your personal data for another (new) purpose.

4. Information on recipients of personal data.

You belong to the recipients or the category of recipients of your personal data as well as:

1. Processing entities:

1. Entities from the group of enterprises which includes the Administrator,

2. Entities cooperating with the Administrator (administrator's partners),

3. Entities providing IT technology services,

4. Entities providing accounting-HR services,

5. Entities providing services for the Administrator related to marketing (including marketing agencies),

6. Entities involved in claim collection,

7. Entities providing legal services,

8. Liquidators of damages from insurance firms,

9. Paying agents dealing with servicing non-cash payments on the internet,

10. Courier and post agencies,

11. Other providers of services cooperating with the Administrator with regards to technical or organizational solutions enabling realization of your agreement,

2. Independent recipients:

1. Entities from capital group of the Administrator whose offer supplements the offer of the Administrator,

2. Commercial partners whose offer supplements the offer of the Administrator,

3. Commercial partners who are members of the loyalty programme realized by the Administrator,

3. Other recipients, who have been previously authorized by you explicitly for the processing of your personal data.

5. Handover of personal data to third counties or international organizations.

The Administrator does not hand over your personal data outside the borders of Poland, European Union or the European Economic Areas.

6. Period of storing personal data

Your personal data are stored by the Administrator for the period no longer than one necessary for the purposes for which such data will be processed in line with point III of the Privacy Policy, including:

1. Your personal data obtained for the purpose of conclusion and execution of agreement and realization of legally justified interests of the Administrator will be stored for the period of the agreement validity and after its expiry, for the period necessary for:

1. post-sale service of clients (i.e. handling complaints)-until the time of expiry of your claims stemming from the agreement,

2. Securing or seeking claims to which the Administrator is entitled-until the time of the expiry of claims of the Administrator,

3. Fulfilling the legal obligation by the Administrator, whilst data processed for the needs of accounting and due to tax reasons will be processed by the Administrator for the period of 5 years, counted from the end of the calendar year in which the fiscal obligation has occurred,

2. Your personal data obtained by the Administrator for direct marketing purposes of products or services of the Administrator will be stored until the time of your submission of objection towards the processing of your personal data for this purpose or withdrawal of consent, should the Administrator process these data pursuant to the so called marketing consent or if the Administrator establishes that such personal data indicated by you for this purpose are outdated.

7. Rights of persons concerned with personal data.

With regards to the processing of your personal data you are entitled to the following rights, the execution of which shall be ensured by the Administrator:

1. Right of access to your personal data, that is obtaining from the Administrator of confirmation that your personal data are processed and information concerning the processing, as well as obtaining copies of such data,

2. Right to amend (correct) your personal data, if data processed by the Administrator are incorrect or incomplete,

3. Right to demand removal of data (including “right to be forgotten”),

4. right to demand from the Administrator of limiting the processing of your personal data,

5. Right to submit objection against the processing of data,

6. Right to transfer personal data-you have the right to obtain from the Administrator in a structured, generally applicable format, machine-readable your personal data which you have obtained from the Administrator pursuant to the agreement or your consent; you may also order that the Administrator send your personal data directly to another-indicated by you-entity (data recipient),

7. Right to submit a complaint to the supervisory body,

8. Right to withdraw consent for the processing of personal data-at any time you have the right to withdraw your consent for the processing by the Administrator of your personal data which the Administrator processes pursuant to your consent; withdrawal by you of the consent has no impact on the compliance with the law of the so far processing of your personal data by the Administrator for the purpose covered by the granted consent.

The Administrator reminds you that prior to realization of your entitlements he has the right to identify you for the purpose of ensuring that you are who you claim to be-this is targeted at preventing a situation of passing over information concerning clients by the Administrator to unauthorized persons.

In case of you submission of demand related to realization of the above specified entitlements, the Administrator will fulfil this demand without the undue delay, no later however than within a month from the date of obtaining your demand, subject to the point below.

If the matter is complex (i.e. due to the nature of your demand or a large number of demands) the monthly term for realization of your demand may be prolonged by additional two subsequent months, of which fact the Administrator will inform you in the initial-month's-term, as specified above.

The Administrator informs you that he is entitled to refuse to fulfil your demand in a situation when:

1. He will not be able in a unambiguous manner to identify your identity,

2. Your demand is unjustified or excessive in nature.

Refusal to fulfil your demand by the Administrator ought to be justified by one of the above indicated reasons.

8. Information on the requirement/ voluntariness of submission of personal data

Personal data indicated by you for the purpose of:

1. Performance of agreement-is a condition for conclusion and realization of such agreement by the Administrator; if you do not submit your personal data to the Administrator for this purpose, he may refuse to conclude an agreement with you,

2. Direct marketing realized by sending you commercial information by means of electronic means of communication or contacting with your through the means of telecommunications and automated calling systems- this is voluntary and requires your consent; non-submission of consent by your for the processing by the Administrator of your personal data for this purpose will have no impact on the possibility of conclusion of agreement, nonetheless, the Administrator will not be able to pass the indicated channels of communication or marketing information, in particular about the offers of new products and services, promotions or loyalty programmes,

9. Information about an automated decision making, including profiling

The Administrator informs that the only method by which he may process your personal data is the so called profiling. This means that the Administrator, on the basis of information concerning you may create profiles of your preferences (i.e. Define which products you buy most often, which events organized by the Administrator are interesting for you etc.) and on the basis of such profiles-adjust the services and contents you will be obtaining in the future from the Administrator.

During the profiling the Administrator-as a standard-does not process your personal data in a fully automated manner, thus without human intervention. The exception being a situation in which decisions made in an automated way will be designated for the realisation of agreement-in this case you are entitled to be excluded from this decision and demand human intervention in your case, which the Administrator must ensure. For the realization of this entitlement you may contact the Administrator in one of the ways specified in title I or II of this Privacy Policy.

Decisions made in this way may have an impact on whether you will/will not be offered a specific product, service, offer, discount or participation in the loyalty programme.

10. Safety of personal data

The Administrator informs that the implemented by him or by his processing entities technical and organizational means ensure sufficient guarantees for the processing of your personal data, in line with the requirements specified in GDPR, and that he properly protects your rights in this scope.

11. Manner of using “cookies” files

The Administrator informs that on his www website he applies the mechanism of “cookies” files which during the use by you from the internet website are saved by the Administrator’s server on your hard drive of your end device (i.e. Computer, smartphone, tablet).

Applying “cookies” files is targeted at correct operations of the www website of the Administrator on final devices of clients. This mechanism does not damage your end device and does not cause any changes in the settings of your device, nor does it install any software on it. “Cookies” files do not have a feature of identifying you by the Administrator.

The Administrator applies “cookies” files in order to:

1. Remember information about your end device,

2. Verify and develop its offer,

3. Run statistical controls.

You may at any time switch of the mechanism of “cookies” files in your internet browser of your end device. The Administrator however informs that switching off “cookies” may cause difficulties or prevent the use of internet website of the Administrator.

12. Final Provisions

This Privacy Policy shall come in force as of 25 May 2018.

The Administrator may amend and supplement the provisions of the Privacy Policy adequately to the needs stemming from the change of conditions of processing of your personal data (i.e. stemming from a change to the binding provisions of law). Any changes or supplementations of the Privacy Policy will be reported to you through placing of adequate information on general websites of the Administrator and in case of significant changes, you may be informed of this fact separately through sending of adequate notification to the email address indicated by you or through text message or another available channel of communication.

The hereby Privacy Policy does not limit not exclude your entitlements in line with the agreement and the Terms and Conditions of sale of products/provision of services by the Administrator.