PRIVACY AND COOKIE POLICY

PRIVACY AND COOKIE POLICY

Effective from: 1 September 2026

TABLE OF CONTENTS

  1. General provisions
  2. Legal bases for processing
  3. Purposes, legal bases and retention periods
  4. Voluntary provision of data
  5. Recipients of data
  6. Transfers outside the European Economic Area
  7. Profiling and automated decision-making
  8. Rights of data subjects
  9. Cookies
  10. Analytics and marketing tools
  11. Data security
  12. Final provisions

1. GENERAL PROVISIONS

  1. This Privacy and Cookie Policy (the "Policy") is informative in nature – it does not impose obligations on persons using the Website. It describes how the Controller processes personal data, including the purposes, legal bases and retention periods, the rights of data subjects, and the use of cookies and analytics and marketing tools on the websites available at https://starmax.eu and https://starmax.com.pl (jointly the "Website"), as well as in connection with contacting the Controller by e-mail, telephone or through social media.
  2. The controller of your personal data is Marek Starczewski, conducting business under the name STARMAX Marek Starczewski, registered in the Polish Central Register and Information on Economic Activity (CEIDG), business and correspondence address: ul. Rycerska 3, 83-050 Bąkowo, Poland, Tax ID (NIP): PL 562-160-28-50, REGON 320587109 (the "Controller" or "STARMAX").
  3. You can contact the Controller regarding personal data:
    • by e-mail: info@starmax.eu (international customers) / sprzedaz@starmax.com.pl (Poland),
    • by post: STARMAX Marek Starczewski, ul. Rycerska 3, 83-050 Bąkowo, Poland,
    • via the contact form available on the Website.
  4. The Controller has not appointed a Data Protection Officer. For all matters relating to personal data please contact the Controller directly.
  5. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR"), the Polish Personal Data Protection Act of 10 May 2018 and – as regards cookies – the Polish Electronic Communications Law of 12 July 2024 (the "ECL"). Official text of the GDPR: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679.
  6. A "User" is any person using the Website or contacting the Controller.
  7. The Controller takes particular care to protect the interests of data subjects and ensures that the data it collects is: (1) processed lawfully, fairly and transparently; (2) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; (3) adequate, relevant and limited to what is necessary; (4) accurate and, where necessary, kept up to date; (5) kept no longer than necessary; (6) processed in a manner that ensures appropriate security.

2. LEGAL BASES FOR PROCESSING

  1. The Controller processes personal data only where at least one of the conditions set out in Art. 6(1) GDPR is met, in particular where:
    1. the data subject has given consent to the processing of their personal data for one or more specific purposes (Art. 6(1)(a) GDPR);
    2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR);
    3. processing is necessary for compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR);
    4. processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject (Art. 6(1)(f) GDPR).
  2. The specific legal bases for each purpose of processing are set out in Section 3 of the Policy.

3. PURPOSES, LEGAL BASES AND RETENTION PERIODS

The purpose, legal basis and retention period depend on the actions taken by the User (e.g. sending an enquiry, subscribing to the newsletter, creating an account) or on the Controller's obligations. The Controller may process personal data for the following purposes:

Purpose of processing and scope of data Legal basis Retention period
Handling enquiries – contact form, e-mail, telephone.
Data: name, e-mail, telephone, company or institution name, content of the message and any other data provided by the User.		 Art. 6(1)(f) GDPR – the Controller's legitimate interest in handling enquiries and correspondence; where the enquiry is aimed at concluding a contract – Art. 6(1)(b) GDPR (pre-contractual steps at the data subject's request). For the duration of handling the matter and then until the limitation period for potential claims expires (as a rule 3 years; 6 years in relations with consumers) – for archiving and evidence purposes.
Requests for quotes, designs and estimates.
Data: identification and contact details of the person making the request, company or institution details (name, address, VAT number), project location, project description and parameters, attached documents.		 Art. 6(1)(b) GDPR – pre-contractual steps; for contact persons acting on behalf of a company or institution – Art. 6(1)(f) GDPR (legitimate interest in conducting business and commercial contacts). For the validity period of the offer and the negotiations, and then until the limitation period for claims expires.
Conclusion and performance of contracts – orders, delivery, installation, service, warranty, complaints.
Data: details of the contracting parties and their representatives, contact persons (name, position, e-mail, telephone), delivery and installation address, invoicing details, data relating to performance, complaints and servicing.		 Art. 6(1)(b) GDPR – performance of a contract (contracting party who is a natural person); Art. 6(1)(f) GDPR – contact persons and representatives of contracting parties (legitimate interest in performing the contract with the entity they represent); Art. 6(1)(c) GDPR – statutory obligations (statutory warranty, guarantee). For the term of the contract and the warranty period, and then until the limitation period for claims expires.
Invoicing, accounting, taxes.
Data: invoicing and accounting data, payment data.		 Art. 6(1)(c) GDPR in connection with Art. 74 of the Polish Accounting Act and Art. 86 § 1 of the Polish Tax Ordinance. 5 years from the end of the calendar year in which the tax payment deadline expired, unless the law provides for a longer period.
Establishing, exercising or defending legal claims – debt recovery, court and administrative proceedings. Art. 6(1)(f) GDPR – the Controller's legitimate interest. Until the limitation period for claims expires or, where proceedings are initiated, until they are finally concluded.
Newsletter.
Data: e-mail address, optionally first name and language version.		 Art. 6(1)(a) GDPR – consent given by subscribing to the newsletter (via the form on the Website or when registering an account); commercial communications are sent in accordance with the ECL. Until consent is withdrawn (unsubscription). An unsubscribe link is included in the footer of every message. After withdrawal the Controller may keep a record of that fact to demonstrate that the mailing was lawful (Art. 6(1)(f) GDPR).
User account on the Website.
Data: name, e-mail, password (encrypted), company details, addresses, account activity history.		 Art. 6(1)(b) GDPR – provision of an electronic service (maintaining the account) under the Website's terms of use. Until the account is deleted by the User, or by the Controller after a prolonged period of inactivity, and then until the limitation period for claims expires.
STARMAX social media profiles (Facebook, Instagram, YouTube, LinkedIn).
Data: identifier, username, profile picture, content of activity (comments, reactions, messages).		 Art. 6(1)(f) GDPR – legitimate interest in promoting the brand and communicating with Users. As regards profile statistics (e.g. Facebook Page Insights) the Controller and Meta Platforms Ireland Limited are joint controllers. For as long as the profile is maintained or until the User deletes their activity; data processed by the platform operators – in accordance with their privacy policies.
Statistics, analytics and marketing on the Website (Google Analytics 4, Meta Pixel).
Data: cookie identifiers, IP address, device and browser data, pages visited, time of visit, traffic source, approximate location, events on the Website.		 Art. 6(1)(a) GDPR – consent given in the cookie banner (in connection with Art. 399 ECL). Consent can be withdrawn or changed at any time – see Section 9. According to the lifetime of the individual cookies (Section 9) and the retention periods of the tool providers (Section 10).
Website security, server logs.
Data: IP address, date and time of the request, URL, response code, browser and system information.		 Art. 6(1)(f) GDPR – legitimate interest in the security and proper functioning of the Website, detecting abuse and error diagnostics. 30 days.

4. VOLUNTARY PROVISION OF DATA

  1. Using the Website and contacting the Controller is voluntary. Likewise, providing personal data is voluntary, subject to three exceptions:
    1. concluding contracts with the Controller – failure to provide data necessary to prepare an offer or to conclude or perform a contract (including the contract for maintaining an account on the Website) makes it impossible to conclude or perform it; providing data is then a contractual requirement, and the scope of required data is indicated each time in the form or during negotiations;
    2. the Controller's statutory obligations – providing data necessary to issue an invoice and keep tax and accounting records is a statutory requirement;
    3. handling enquiries – failure to provide contact details marked as required in the form makes it impossible to reply.
  2. Consent to the newsletter and to analytics and marketing cookies is entirely voluntary; refusing consent does not affect your ability to use the Website or to have your enquiries handled.

5. RECIPIENTS OF DATA

  1. To operate the Website and conduct its business, the Controller uses the services of third parties. The Controller uses only processors that provide sufficient guarantees of implementing appropriate technical and organisational measures so that processing meets the requirements of the GDPR.
  2. Personal data may be transferred to the following recipients or categories of recipients:
    1. hosting and e-mail provider – SERWIS HOSTLINE.PL PUH Karolina Fiuk, ul. Wojska Polskiego 34D/4, 84-300 Lębork, Poland, Tax ID (NIP) 841-173-03-94;
    2. IT service and software providers enabling the operation of the Website and the Controller's business (website platform, technical support, business management systems);
    3. accounting, legal and advisory service providers (accounting firm, tax advisers, law firm, debt collection agency);
    4. carriers, freight forwarders and transport companies – for product delivery;
    5. subcontractors carrying out installation, servicing and assembly works;
    6. cookie consent management provider – CookieYes Limited, 3 Warren Yard, Warren Farm Office Village, Milton Keynes MK12 5NW, United Kingdom (storage of proof of consent: consent ID, date, selected categories);
    7. providers of analytics and marketing tools – Google Ireland Limited (Google Analytics 4) and Meta Platforms Ireland Limited (Meta Pixel) – to the extent described in Section 10, as separate or joint controllers;
    8. social media platform operators (Meta, Google/YouTube, LinkedIn) – as regards STARMAX profiles.
  3. Data may be disclosed to public authorities (courts, law enforcement, tax authorities) where required by law.
  4. Data is not transferred in every case and not to all listed recipients – the Controller transfers data only where necessary for the given purpose and only to the extent necessary. For example, data of a person who merely sent an enquiry via the form is not transferred to a carrier or an installation subcontractor.

6. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

  1. As a rule, personal data is processed within the European Economic Area (EEA).
  2. In connection with the use of Google Analytics 4 and Meta Pixel (Section 10), data may be transferred to the United States. Such transfers are based on the European Commission's implementing decision of 10 July 2023 on the adequate level of protection under the EU-US Data Privacy Framework (DPF) – Google LLC and Meta Platforms, Inc. are certified under the DPF – and otherwise on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR) together with supplementary safeguards.
  3. Proof of cookie consent is stored by CookieYes Limited in the United Kingdom – on the basis of the European Commission's adequacy decision for the United Kingdom.
  4. You may obtain a copy of the safeguards applied by contacting the Controller.

7. PROFILING AND AUTOMATED DECISION-MAKING

  1. The GDPR requires the Controller to provide information about automated decision-making, including profiling referred to in Art. 22(1) and (4) GDPR, and about the logic involved, as well as the significance and envisaged consequences of such processing.
  2. The Controller does not make decisions concerning Users based solely on automated processing which would produce legal effects or similarly significantly affect them. Decisions regarding the preparation of an offer, the conclusion of a contract or its terms are made by the Controller's staff.
  3. Profiling within the meaning of the GDPR may take place only within the analytics and marketing tools (Section 10) and only after the User gives consent in the cookie banner. It consists of the automated analysis of activity on the Website (pages visited, products viewed, time of visit, traffic source) in order to:
    1. compile aggregate statistics on the use of the Website (Google Analytics 4),
    2. build audiences and display STARMAX ads matched to the User's likely interests on Facebook and Instagram, and measure the effectiveness of those ads (Meta Pixel).
  4. This profiling has no legal effects on the User – its only result may be that a STARMAX ad is displayed instead of another ad. You can opt out at any time by changing your consent settings (Section 9) or through the ad settings of your Google and Meta accounts.
  5. The newsletter is sent with identical content to all subscribers of a given language version and is not personalised on the basis of profiling.
  6. The data subject has the right to object at any time to profiling for direct marketing purposes (Art. 21(2) GDPR).

8. RIGHTS OF DATA SUBJECTS

  1. Right of access, rectification, erasure, restriction and portability – you have the right to request from the Controller access to your data and a copy of it (Art. 15 GDPR), its rectification (Art. 16), erasure – the "right to be forgotten" (Art. 17), restriction of processing (Art. 18) and – for data processed by automated means on the basis of consent or a contract – data portability (Art. 20).
  2. Right to object – you have the right to object at any time, on grounds relating to your particular situation, to processing based on the Controller's legitimate interest (Art. 6(1)(f) GDPR), including profiling. The Controller may then no longer process the data unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims (Art. 21(1) GDPR).
  3. Right to object to direct marketing – where data is processed for direct marketing purposes, you have the right to object at any time and without giving reasons; after an objection the data may no longer be processed for that purpose (Art. 21(2) and (3) GDPR).
  4. Right to withdraw consent – where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. Newsletter consent is withdrawn via the link in the footer of each message or by contacting the Controller; cookie consent – in the cookie settings on the Website (Section 9).
  5. Right to lodge a complaint with a supervisory authority – the supervisory authority in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl/en. If you reside in another EU Member State you may lodge a complaint with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR).
  6. To exercise the above rights, contact the Controller as indicated in Section 1. The Controller will respond without undue delay and no later than one month after receiving the request; in justified cases this period may be extended by a further two months, of which you will be informed. The Controller may request additional information necessary to confirm the identity of the person making the request.

9. COOKIES

  1. Cookies are small text files sent by the server and stored on the User's end device (computer, tablet, smartphone) while using the Website. Cookies do not change the configuration of the device and are not used to install software.
  2. Cookies used on the Website can be classified according to the following criteria:
    By provider:
    1) first-party – set by the Controller's Website;
    2) third-party – belonging to third parties (Google, Meta).    		 By storage period:
    1) session – deleted when the browser is closed;
    2) persistent – stored for the period defined in the file's parameters or until manually deleted.    		 By purpose:
    1) necessary;
    2) functional;
    3) analytics;
    4) marketing.
  3. Cookie categories by purpose:
    1. Necessary – required for the Website to function properly: maintaining the session, identifying the logged-in User, language, currency and store selection, remembering the cart, form security, remembering the cookie decision. They do not require consent (Art. 6(1)(f) GDPR; Art. 399(3) ECL).
    2. Functional – remember the User's preferences (e.g. page layout, recently viewed products). They require consent.
    3. Analytics – measure traffic and how the Website is used, in the form of aggregate statistics (Google Analytics 4). They require consent.
    4. Marketing – used to measure ad effectiveness and for remarketing on Facebook and Instagram (Meta Pixel). They require consent.
  4. Cookie banner. On your first visit a cookie management tool (CookieYes) is displayed in which you can accept all cookies, reject all cookies other than necessary ones or select individual categories. Until you make a decision, only necessary cookies are stored on your device and the Google Analytics 4 and Meta Pixel scripts are not run. The Website uses Google Consent Mode v2, through which Google tools adjust their behaviour to the User's decision. The User's decision (consent ID, date, selected categories) is recorded in order to demonstrate that consent was given (Art. 7(1) GDPR).
  5. Changing or withdrawing consent. You can change your settings at any time by clicking the "Cookie settings" link in the footer of the Website. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
  6. Browser settings. You can also manage cookies through your browser – restrict or completely disable their storage and delete cookies already stored. Disabling necessary cookies may prevent the use of some Website features (e.g. logging in to your account). Instructions for popular browsers:
  7. List of cookies used on the Website:
    Name Provider Category Purpose Lifetime
    PrestaShop-[hash] STARMAX (first-party) Necessary User session, login, selected language, currency, store, cart, form security 20 days
    PHPSESSID STARMAX (first-party) Necessary Server session identifier session
    cookieyes-consent CookieYes (on the Website domain) Necessary Remembering your cookie decision and consent ID 12 months
    _ga Google Analytics Distinguishing users (Google Analytics 4) 2 years
    _ga_[ID] Google Analytics Maintaining session state (Google Analytics 4) 2 years
    _fbp Meta Marketing Browser identification for Meta Pixel (conversion measurement, remarketing) 90 days
    fr Meta (facebook.com) Marketing Ad delivery and measurement (set when the User is logged in to Meta services) 90 days
  8. The current list of cookies stored at any given time can be checked in the cookie management tool on the Website and in your browser's developer tools.

10. ANALYTICS AND MARKETING TOOLS

  1. Google Analytics 4. The Website uses Google Analytics 4 provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The tool collects information on how the Website is used – traffic source and medium, pages visited, time of visit, events (e.g. form submission), device and browser type, approximate location determined from the IP address – and compiles aggregate statistics that help administer the Website. Google Analytics 4 does not store full IP addresses. The tool runs only after you consent to analytics cookies. Data may be transferred to Google LLC in the USA under the rules described in Section 6. Event data retention in Google Analytics: 14 months. More information on how Google processes data on partner sites: https://policies.google.com/technologies/partner-sites; Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout.
  2. Meta Pixel (Facebook and Instagram). The Website uses the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) to measure the effectiveness of STARMAX ads displayed on Facebook and Instagram and for remarketing. After you consent to marketing cookies, the Pixel sends information about visits and events on the Website together with a browser identifier to Meta; if you have an account with Meta services and are logged in, this data may be linked to your account. As regards the collection and transmission of data via the Pixel, the Controller and Meta are joint controllers; Meta is solely responsible for any further processing as an independent controller. Data may be transferred to Meta Platforms, Inc. in the USA under the rules described in Section 6. Ad settings: https://www.facebook.com/ads/preferences; Meta privacy policy: https://www.facebook.com/privacy/policy.
  3. Social media links. The Website contains links to STARMAX profiles on Facebook, Instagram, YouTube and LinkedIn. These are ordinary links – the Website does not load active social plugins (e.g. the "Like" button), and merely displaying the Website does not transmit data to those platforms. After clicking a link you are taken to the relevant platform, which processes data under its own privacy policy.

11. DATA SECURITY

  1. Taking into account the nature, scope, context and purposes of processing and the risk to the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures, in particular: encrypted transmission (HTTPS/TLS), access control to systems and data, backups, software updates, processing authorisations for staff and data processing agreements with providers. These measures are reviewed and updated where necessary.
  2. The Controller applies technical measures to prevent unauthorised persons from obtaining and modifying personal data transmitted electronically.

12. FINAL PROVISIONS

  1. The Website may contain links to other websites. The Controller encourages you to read the privacy policy of any website you visit. This Policy applies only to the Controller's Website.
  2. The Policy is available in Polish (starmax.com.pl) and English (starmax.eu). In the event of any discrepancy, the Polish version prevails.
  3. The Controller may update the Policy, in particular in the event of changes to the law, the tools used or the scope of its business (e.g. the launch of online sales). The current version is always published on the Website together with its effective date.
  4. Matters not covered by the Policy are governed by the GDPR and the applicable provisions of Polish law.