PRIVACY POLICY OF THE SIZING CALCULATORS WEBSITE

This privacy policy of the Website is of an informational nature, which means that it is not a source of obligations for the Users of the Website. The privacy policy contains, above all, the rules concerning the processing of personal data by the Controller on the Website, including the bases, purposes and scope of the processing of personal data and the rights of data subjects, as well as information on the use of cookies and analytics tools on the Website.

The controller of the personal data collected through the Website is Rafał Stybliński, conducting business activity under the business name Rafał Stybliński, entered in the Central Registration and Information on Business of the Republic of Poland maintained by the minister competent for the economy, having: address for service: ul. Zwycięstwa 14/105, 44-100 Gliwice, NIP 9691497521, REGON 368648500, e-mail address: contact@rafalstyblinski.pl – hereinafter referred to as the “Controller”, who is at the same time the Service Provider of the Website.

The Controller has not appointed a data protection officer. In all matters concerning the processing of personal data, the Controller may be contacted at the e-mail address: contact@rafalstyblinski.pl or in writing at the address indicated in point 1.2 of this privacy policy.

Personal data on the Website are processed by the Controller in accordance with the applicable provisions of law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as the “GDPR” or the “GDPR Regulation”. Official text of the GDPR: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679.

Using the Website, including the Calculators, is voluntary. Using the Calculators does not require providing personal data, and the data entered into the Calculators in order to generate a Result are not stored by the Controller. Providing personal data in a message sent to the Controller is voluntary, but without providing them the Controller will not be able to reply to the message.

The Controller takes particular care to protect the interests of the persons to whom the personal data processed by the Controller relate, and in particular is responsible for and ensures that the data collected by the Controller are: (1) processed lawfully; (2) collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes; (3) factually correct and adequate in relation to the purposes for which they are processed; (4) kept in a form which permits identification of the persons to whom they relate for no longer than is necessary to achieve the purpose of processing; and (5) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

Taking into account the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure that processing is performed in accordance with the GDPR and to be able to demonstrate this. Those measures are reviewed and updated where necessary. In particular, the Controller uses an SSL certificate ensuring encrypted data transmission over the HTTPS protocol.

The Controller does not process on the Website the special categories of personal data referred to in Article 9(1) of the GDPR or data relating to criminal convictions and offences. The data entered into the Calculators, including values relating to weight, height or caffeine intake, are not stored and are not linked to any identified person.

The Website is not directed at children, and the Controller does not knowingly collect personal data of persons under the age of 16.

All words, expressions and acronyms appearing in this privacy policy and beginning with a capital letter, for example Service Provider, Website, Calculator, Result, Affiliate Link, User, should be understood in accordance with their definitions contained in the Terms of Service of the Website available on the pages of the Website.

The Controller is entitled to process personal data where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

The processing of personal data by the Controller requires, in each case, the existence of at least one of the bases indicated in point 2.1 of the privacy policy. The specific bases for the processing of personal data by the Controller are indicated in the next point of the privacy policy – in relation to a given purpose of the processing of personal data by the Controller.

In each case, the purpose, basis and period as well as the recipients of the personal data processed by the Controller result from the actions taken by a given User on the Website or by the Controller.

The Controller may process personal data within the Website for the following purposes, on the following bases and for the periods indicated in the table below.

If the same personal data are processed for more than one purpose or on more than one basis, the Controller stores them for the longest of the periods resulting from those purposes or bases. After the fulfilment of a given purpose has ended, the data necessary to establish, pursue or defend claims are stored solely for that purpose and to the extent necessary for it. After the retention period expires, personal data are irreversibly deleted or anonymised, if the provisions so permit. Anonymised data, including aggregated data used for statistical and analytical purposes, may be stored without time limit, unless the provisions require a shorter retention period. In the case of claims whose limitation period is two years or more, the retention period may be extended until the end of the calendar year in which the limitation period expires (Article 118, second sentence, of the Civil Code).

Where the Controller contacts owners and editors of other websites in order to propose cooperation (for example mutual referrals to the Calculators), the Controller obtains their contact details (first name and surname, e-mail address, name of the website) from publicly available sources, i.e. from the websites of those services. The processing takes place for the purpose indicated in the table above. In the first message, the Controller provides the information referred to in Article 14 of the GDPR or indicates where it can be found, and the data subject may object to further contact at any time.

For the proper functioning of the Website, it is necessary for the Controller to use the services of external entities, such as a hosting provider, an e-mail provider or a provider of analytics tools. The Controller uses only the services of such processors that provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing meets the requirements of the GDPR and protects the rights of data subjects.

Data are not transferred by the Controller in every case and not to all recipients or categories of recipients indicated in the privacy policy. The Controller transfers data only when this is necessary to achieve a given purpose of processing personal data and only to the extent necessary to achieve it.

The personal data of visitors to the Website may be transferred to the following recipients or categories of recipients:

1. a)service providers supplying the Controller with technical, IT and organisational solutions enabling the Controller to conduct business activity, including the Website, in particular the hosting provider (Vercel Inc. from the United States), the e-mail provider and entities providing technical support for the Website – the Controller makes the collected personal data available to a selected provider acting on its behalf only in the case of and to the extent necessary to achieve a given purpose of data processing consistent with this privacy policy;
2. b)providers of analytics tools – the Controller uses on the Website the Google Analytics 4, Google tag (gtag.js) and Google Search Console tools provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Data are transferred to Google to the extent covered by the consent given by the person visiting the Website page through the cookie management tool;
3. c)entities conducting sales to which Affiliate Links lead, in particular entities of the Amazon group – after the visitor clicks an Affiliate Link and goes to the website of such an entity, the personal data of that person are processed by that entity as a separate controller, on the terms set out in its own privacy policy; the Controller does not transfer personal data of visitors to such entities, and such an entity provides the Controller only with aggregated information on the number of clicks and purchases on the basis of which the commission is calculated;
4. d)providers of accounting, legal and advisory services providing the Controller with accounting, legal or advisory support, in particular an accounting office and a law firm – the Controller makes the collected personal data available to a selected provider acting on its behalf only in the case of and to the extent necessary to achieve a given purpose of data processing consistent with this privacy policy.

On the Website, the Controller does not use the services of payment service providers, carriers or forwarders, or the services of external review collection systems. The pages of the Website do not contain social plugins enabling content to be downloaded from the providers of such plugins, nor a function for logging in with the login credentials of a social network.

As a rule, the personal data of visitors to the Website are processed within the European Economic Area (EEA). However, personal data may be transferred outside the EEA when this is necessary to achieve the purposes indicated in this privacy policy, in particular in connection with the Controller’s use of tools and services provided by entities established or processing data outside the EEA (for example providers of analytics, cloud or communication services, including Google Ireland Ltd. and its affiliates from the United States, as well as Vercel Inc. – the hosting provider, established in the United States). The Controller transfers personal data outside the EEA only when necessary and while ensuring an adequate level of data protection, in particular by: (1) transfer to an entity in a country in respect of which the European Commission has issued a decision finding an adequate level of data protection (for example to an entity in the United States certified under the EU-U.S. Data Privacy Framework); (2) the use of standard data protection clauses adopted by the European Commission; or (3) on the basis of another instrument compliant with Chapter V of the GDPR. With regard to Vercel Inc., the basis for the transfer of data is the certification of that entity under the EU-U.S. Data Privacy Framework and standard contractual clauses. The data subject may obtain a copy of the data transferred to a third country and information on where the safeguards applied have been made available by contacting the Controller in the manner indicated in this privacy policy.

The GDPR obliges the Controller to provide information on automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR, and – at least in those cases – meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The Controller does not make on the Website any automated decisions producing legal effects concerning the data subject or similarly significantly affecting them and does not carry out profiling for direct marketing purposes. The analytics tools referred to in point 8.8 of the privacy policy are used solely to compile aggregated statistics on the use of the Website.

Right of access, rectification, restriction, erasure or portability – the data subject has the right to request from the Controller access to their personal data, their rectification, erasure (“right to be forgotten”) or restriction of processing, and has the right to object to processing, as well as the right to data portability. The detailed conditions for exercising the above rights are set out in Articles 15-21 of the GDPR.

Right to withdraw consent at any time – if personal data are processed by the Controller on the basis of consent given, pursuant to Article 6(1)(a) of the GDPR, the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Consent to cookies can be withdrawn in the cookie management tool available in the page footer.

Right to lodge a complaint with a supervisory authority – the person whose data are processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the provisions of the GDPR and of Polish law, in particular the Act on the Protection of Personal Data. The supervisory authority in Poland is the President of the Personal Data Protection Office.

Right to object – the data subject has the right to object at any time – on grounds relating to their particular situation – to the processing of personal data concerning them based on Article 6(1)(e) (public interest or tasks) or (f) (legitimate interest of the controller), including profiling based on those provisions. In such a case, the Controller may no longer process those personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for establishing, pursuing or defending claims.

In order to exercise the rights referred to in this point of the privacy policy, the Controller may be contacted by sending an appropriate message in writing or by e-mail to the address of the Controller indicated in point 1.2 of the privacy policy.

Cookie files (cookies) are small pieces of text information in the form of text files, sent by the server and stored on the side of the person visiting the Website page, for example on the hard drive of a computer or laptop or on the memory card of a smartphone – depending on the device used by the person visiting the Website. Detailed information on cookies, as well as the history of their creation, can be found, among others, here: https://en.wikipedia.org/wiki/HTTP_cookie.

The Controller provides on the Website page a tool for easy and active management of cookies – available upon the first visit to the Website page and subsequently available in the footer of the Website page. Active management makes it possible, among other things, to check which cookies are or may be stored while using the Website page, as well as to select and subsequently change the scope and purposes of the use of cookies. When starting to use the Website page, the visitor will be asked to choose cookie settings. Until a choice is made, only necessary cookies are activated. Refusing consent to cookies other than necessary cookies is as easy as accepting them and does not affect the ability to use the Calculators. The visitor’s choice is remembered for a period of 12 months, after which the visitor will be asked to choose again. The choice can be changed or withdrawn at any time.

Regardless of the web browser, it is possible to check which cookies are being sent at a given moment by the Website page using tools available, for example, at: https://www.cookiemetrix.com or https://www.cookie-checker.com.

Cookies that may be sent by the Website page can be divided into different types according to the following criteria:

1. a)by their provider: first-party cookies, created by the Controller’s Website page, and cookies belonging to third persons or entities other than the Controller;
2. b)by the storage period on the device of the person visiting the Website page: session cookies, stored until the web browser is closed, and persistent cookies, stored for a specified time defined by the parameters of each file or until manually deleted;
3. c)by the purpose of their use: necessary cookies, enabling the proper functioning of the Website page, including remembering the choice concerning cookies; functional cookies, enabling the Website page to be adapted to the preferences of the person visiting the page; analytics cookies, collecting information on how the Website page is used; marketing, advertising and social media cookies, collecting information about the person visiting the page in order to display advertisements and measure their effectiveness.

The Controller may process data contained in cookies when visitors use the Website page for the following specific purposes:

1. a)remembering the visitor’s choice concerning cookies and ensuring the proper operation of the page – necessary cookies;
2. b)adapting the content of the Website page to the individual preferences of the visitor, for example the selected units of measurement (metric or imperial) – functional cookies;
3. c)keeping statistics showing how the Website page is used – analytics cookies.

As standard, most web browsers available on the market accept the storage of cookies by default. Everyone can determine the conditions for using cookies through the settings of their own web browser. This means that it is possible, for example, to partially restrict or completely disable the storage of cookies – in the latter case, however, this may affect certain functionalities of the Website, for example remembering selected settings.

Web browser settings concerning cookies are relevant from the point of view of consent to the use of cookies by the Website. Detailed information on changing cookie settings and on deleting cookies yourself in the most popular web browsers is available in the help section of the web browser and on the following pages – just click the relevant link:

1. a)in the Chrome browser
2. b)in the Firefox browser
3. c)in the Opera browser
4. d)in the Safari browser
5. e)in the Microsoft Edge browser

The Controller uses on the Website the Google Analytics 4, Google tag (gtag.js) and Google Search Console services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Controller keep statistics and analyse traffic on the Website. The data collected are processed within the above services to generate statistics helpful in administering the Website and in analysing traffic on the Website. These data are aggregated. Using the above services, the Controller collects data such as the sources and media through which visitors to the Website are acquired and the way they behave on the Website page, information on the devices and browsers from which they visit the page, the IP address and domain, and geographical data. The analytics tools are activated only after consent to analytics cookies has been given.

A person can easily block the sharing with Google Analytics of information about their activity on the Website page – for this purpose, for example, a browser add-on provided by Google Ireland Ltd. can be installed, available here: https://tools.google.com/dlpage/gaoptout?hl=en.

In connection with the Controller’s use on the Website of analytics services provided by Google Ireland Ltd., the Controller indicates that full information on the rules for the processing by Google Ireland Ltd. of the data of visitors to the Website, including information stored in cookies, can be found in the privacy policy of Google services available at the internet address: https://policies.google.com/technologies/partner-sites.

After an Affiliate Link is clicked and the visitor goes to the website of a third party, in particular Amazon, that entity may store on the visitor’s device its own cookies used to determine that the purchase was made via the Website and to calculate the commission. These files are stored and controlled by that entity, not by the Controller, on the terms set out in its privacy policy.

The Website may contain links to other websites, including Affiliate Links. The Controller encourages visitors, after going to other websites, to read the privacy policy established there. This privacy policy applies only to the Controller’s Website.

The Controller verifies the content of this privacy policy on an ongoing basis and updates it in the event of a change in the scope of the data processed, the purposes of processing, the tools used or the applicable provisions of law. The Controller informs about significant changes to the privacy policy on the pages of the Website.