Privacy policy

Privacy Policy

§1 Personal Data Administration

The Personal Data Administrator is VERY YOU SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in NOWOGARD, WOJCIESZYN 32, entered into the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court SZCZECIN-CENTRUM, XIII Commercial Division of the National Court Register under KRS number 0001141560, NIP: 8561938185, REGON: 540306962, with a share capital of 48,000.00 PLN.

Contact with the person supervising the processing of personal data in the organization is possible electronically at the e-mail address: contact@veryyou.pl, in writing to the Administrator's address, or by telephone at +48 880 589 060.

This Policy contains rules regarding the processing of personal data by the Administrator within the Website, including the grounds, purposes, and scope of data processing and the rights of the data subjects. Personal data is processed in accordance with applicable laws, specifically Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR). Official GDPR text: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679.

User rights are not absolute and do not apply to all personal data processing activities.

§2 Definitions

• Administrator – VERY YOU SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (as defined in §1).

• Personal Data – Information about an identified or identifiable natural person through factors such as physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, internet identifiers, and information collected via cookies.

• Policy – This Privacy Policy.

• Cookie Policy – The document specifying rules for using cookies on the Website, available at: https://www.veryyou.pl/pages/polityka-cookies.

• Profiling – Automated processing of personal data to analyze and predict user behavior.

• GDPR – Regulation (EU) 2016/679 regarding the protection of natural persons with regard to the processing of personal data.

• Website – The internet service operated by the Administrator at www.veryyou.pl.

• User – Any natural person visiting the Website or using its services/functionalities.

§3 Security

The Administrator has implemented appropriate technical and organizational measures to ensure the security of data processing. The Administrator ensures that data is:

• Processed lawfully;

• Collected for specified, lawful purposes;

• Factually correct and adequate for the purposes of processing;

• Stored in a form that permits identification for no longer than necessary;

• Processed in a manner ensuring appropriate security, including protection against unauthorized processing, accidental loss, or destruction.

§4 Purposes and Legal Grounds for Processing

Based on Article 6(1)(a) GDPR (Consent):

• Retargeting and behavioral advertising (based on cookie consent).

• Newsletter distribution.

• Publication of reviews.

• Cookie data storage.

• Managing user accounts.

• Contact via remote communication (phone, email, apps).

• Content moderation and personalization.

• Marketing of products/services from the Administrator and partners.

• Participation in webinars, contests, and loyalty programs.

Based on Article 6(1)(b) GDPR (Performance of a Contract):

• Managing user accounts.

• Execution of sales contracts or service agreements (including warranties and complaints).

• Handling withdrawals from distance contracts.

Based on Article 6(1)(c) GDPR (Legal Obligation):

• Issuing and storing invoices/tax records.

• Cooperation with law enforcement and public institutions.

• Creating mandatory GDPR documentation.

Based on Article 6(1)(f) GDPR (Legitimate Interest):

• Website operation and technical cookie management.

• Social media interaction (Facebook, Instagram, TikTok, etc.).

• Website security and traffic analysis.

• Direct marketing and establishing/defending claims.

§5 Profiling

The Administrator uses profiling for marketing purposes to analyze User activity via cookies. This includes ad personalization and content adjustment on external sites (Google Ads, Meta). Profiling is based solely on User consent, which can be withdrawn at any time.

§6 Data Retention Period

Data is processed for the duration of the service, until consent is withdrawn, or until a valid objection is filed.

• Contractual data: For the duration of the contract plus the statute of limitations for claims (3 or 6 years).

• Tax/Accounting data: As required by law (currently 5 years).

• Consent-based data: Until consent is withdrawn.

• Inquiries: Up to 12 months after the end of correspondence.

§7 User Rights

Users have the right to: access, rectify, delete, receive a copy, restrict processing, object to processing, data portability, and withdraw consent. Users also have the right to lodge a complaint with a supervisory authority. Requests are processed within 30 days.

§8 Data Recipients

Data may be transferred to external entities: hosting providers, couriers, payment operators, legal/accounting firms, marketing agencies, CRM/ERP providers, and public authorities if required by law.

§9 Data Security

The Administrator conducts ongoing risk analysis and ensures that only authorized personnel have access to data. Technical protections include SSL/TLS encryption and restricted system access.

§10 Changes to the Privacy Policy

The Policy is regularly reviewed. The current version was adopted and is effective as of September 12, 2025. Legal compliance of this document is guaranteed by Doneta.