Privacy policy

PRIVACY POLICY OF MARM.PL

Last updated: 1 September 2026

This Privacy Policy sets out the rules governing the processing of personal data and the use of cookies and similar technologies on the marm.pl website.

1. Personal Data Controller

The controller of personal data is:

MARM.pl Sp. z o.o.
ul. Warszawska 29
35-205 Rzeszów
Poland
KRS: 0000650893
NIP: 5170378467
REGON: 366027930
share capital: PLN 5,000, paid in full,

hereinafter referred to as the “Controller”, “MARM.pl”, “we” or “us”.

2. Contact with the Controller

For matters concerning the processing of personal data and the exercise of rights relating to data protection, you may contact the Controller:

  • in writing: MARM.pl Sp. z o.o., ul. Warsawska 29, 35-205 Rzeszów, Poland,

  • by e-mail: biuro@marm.pl.

If the Controller appoints a Data Protection Officer, the current contact details of the Data Protection Officer will be published in this Privacy Policy.

3. Legal Bases and Purposes of Personal Data Processing

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), the Polish Act of 10 May 2018 on the Protection of Personal Data, the Polish Electronic Communications Law of 12 July 2024, and other applicable laws.

Depending on the purpose, personal data may be processed on the following legal bases.

3.1. Entering into and Performance of a Contract

Pursuant to Article 6(1)(b) GDPR, we process personal data where necessary to enter into or perform a contract, including in particular for the purposes of:

  • creating and maintaining a User Account,

  • accepting and fulfilling an Order,

  • processing payments,

  • delivering purchased products,

  • communicating in relation to an Order,

  • handling returns, complaints and other requests related to a contract,

  • ensuring the proper operation of services provided electronically.

3.2. Compliance with Legal Obligations

Pursuant to Article 6(1)(c) GDPR, we process personal data where necessary to comply with legal obligations imposed on the Controller, including obligations arising from:

  • tax and accounting regulations,

  • consumer protection laws,

  • complaint-handling obligations,

  • obligations relating to transaction documentation,

  • other legal obligations imposed on the Controller.

3.3. Legitimate Interests of the Controller

Pursuant to Article 6(1)(f) GDPR, personal data may be processed in particular for the purposes of:

  • establishing, pursuing or defending legal claims,

  • ensuring the security of the website and its users,

  • preventing fraud and abuse,

  • conducting internal analyses and statistics,

  • ensuring an appropriate level of customer service,

  • handling correspondence not directly related to contract performance,

  • archiving information to the extent justified by the need to demonstrate compliance with legal obligations,

  • developing and optimising the website.

Before commencing processing based on legitimate interests, the Controller takes into account the rights, freedoms and reasonable expectations of data subjects.

3.4. Consent

Where specific processing requires consent, the legal basis is Article 6(1)(a) GDPR.

This may apply in particular to:

  • newsletters,

  • certain forms of electronic marketing,

  • marketing and analytics cookies or similar technologies,

  • other activities expressly identified in the relevant consent wording.

Consent is voluntary and may be withdrawn at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Where the Polish Electronic Communications Law also applies, the Controller obtains any consent required under those provisions for the use of specific communication channels or technologies.

4. What Personal Data Do We Process?

The scope of personal data we process depends on how you use the website.

We apply the principle of data minimisation and collect only personal data necessary for specified purposes.

4.1. Registration and User Account

In connection with the creation of a User Account, we may process, among other things:

  • first name and surname,

  • e-mail address,

  • telephone number,

  • address,

  • login credentials,

  • Order history,

  • in the case of businesses – company name, tax identification number and other information necessary for issuing sales documents.

User passwords should be stored in a manner that prevents them from being recovered in plain text.

4.2. Purchases without Registration

Placing an Order does not have to require creating a User Account if the website offers guest checkout.

In such a case, we process personal data necessary for:

  • accepting the Order,

  • processing the payment,

  • delivery,

  • issuing a sales document,

  • communication concerning the Order,

  • complying with legal obligations.

4.3. Orders Placed by Telephone or E-mail

If an Order is placed by telephone or electronically, we process the data provided by the Buyer to the extent necessary to accept and fulfil the Order.

An employee may enter the relevant data into the sales system to the extent necessary to carry out the Buyer’s request.

4.4. Payment Data

The Controller does not necessarily receive full payment instrument details if the payment is handled directly by an external payment service provider.

Depending on the selected payment method, the payment provider may process the data necessary to authorise and complete the transaction.

4.5. Contacting the Controller

If you contact us via a contact form, e-mail, telephone or another communication channel, we may process, among other things:

  • first name and surname,

  • e-mail address,

  • telephone number,

  • company name,

  • Order number,

  • correspondence content,

  • other information voluntarily provided in the message.

Such data is processed for the purposes of responding to your enquiry, handling your request, performing a contract or protecting against legal claims.

4.6. Automatically Collected Data

When using the website, certain technical information may be processed automatically, including:

  • IP address,

  • date and time of connection,

  • device information,

  • browser and operating system type,

  • session identifiers,

  • information stored in cookies or similar technologies,

  • information about how the website is used.

The scope and legal basis of processing depend on the type of technology used.

Technologies necessary for the operation of the website may be used without consent to the extent permitted by law.

Analytics, advertising and profiling technologies are activated only after the required consent has been obtained, where applicable.

5. Is Providing Personal Data Mandatory?

Providing personal data is generally voluntary.

However, certain data is necessary for:

  • entering into and performing a contract,

  • creating a User Account,

  • fulfilling an Order,

  • delivery,

  • issuing an invoice or other accounting document,

  • handling a complaint.

Failure to provide data required for a particular purpose may make it impossible to provide the relevant service.

Providing personal data for marketing purposes is voluntary and may not be made a condition of making a purchase unless otherwise permitted by applicable law in a specific situation.

6. Recipients of Personal Data

Personal data may be disclosed to entities whose services we use in connection with operating the website and fulfilling Orders, but only to the extent necessary for the relevant purpose.

Such entities may include, in particular:

  • payment service providers,

  • courier companies and carriers,

  • postal operators,

  • hosting and IT infrastructure providers,

  • IT system providers,

  • accounting, legal or technical service providers,

  • e-mail service providers,

  • mailing system providers,

  • analytics and advertising service providers – subject to obtaining any required consent,

  • public authorities entitled to obtain personal data under applicable law.

Depending on the nature of the cooperation, these entities may act as processors acting on our instructions or as independent data controllers.

The Controller does not sell users’ personal data.

Payment Service Provider

If the website continues to use Autopay services, the payment service provider is Autopay S.A. (formerly Blue Media S.A.).

Personal data may be transferred to the payment provider to the extent necessary to process the payment method selected by the user.

If PayPal is selected, data necessary to process the payment may be transferred to the relevant PayPal group entities in accordance with the rules applicable to that service.

Before publishing this Privacy Policy, the Controller should verify the current list of payment providers actually used on the website.

7. Newsletter and Direct Marketing

7.1. Newsletter

If you subscribe to the newsletter, we will use the e-mail address you provide to send you communications for which you have given consent.

Consent to receive the newsletter is:

  • voluntary,

  • specific,

  • informed,

  • capable of being withdrawn at any time.

We may use a double opt-in confirmation mechanism, whereby a message containing a confirmation link is sent to the e-mail address provided.

You may unsubscribe from the newsletter at any time, in particular:

  • by using the unsubscribe link included in the message,

  • by contacting us at biuro@marm.pl.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

7.2. E-mail, SMS and Telephone Marketing

Where required under applicable law, we obtain prior consent before sending commercial communications or conducting direct marketing using electronic communication methods, including:

  • e-mail,

  • SMS,

  • telephone calls.

Separate consent may be obtained for individual communication channels.

Withdrawal of consent is free of charge and should be as easy as giving consent.

8. Mailchimp and Other Mailing Systems

This section should be retained only if the Controller actually uses Mailchimp.

If we use Mailchimp to operate our newsletter, the e-mail address and other information required to provide the service may be processed by The Rocket Science Group LLC d/b/a Mailchimp, part of the Intuit group.

Personal data may be processed in the United States.

Any transfer of personal data is carried out using a mechanism compliant with Chapter V GDPR, including, where the relevant requirements are met:

  • the European Commission adequacy decision concerning the EU-US Data Privacy Framework, and/or

  • Standard Contractual Clauses approved by the European Commission.

Current information regarding the provider’s data processing practices is available in its privacy documentation.

9. Personal Data Retention Period

Personal data is not retained for longer than necessary for the purposes for which it was collected, taking into account legal obligations and applicable limitation periods for claims.

In particular:

9.1. User Account

Data related to a User Account is processed for as long as the Account is maintained.

After deletion of the Account, certain personal data may continue to be stored to a limited extent for the period required by law or necessary to establish, pursue or defend legal claims.

9.2. Orders and Contracts

Data relating to Orders is stored for the duration of the contract and subsequently for periods resulting from:

  • tax and accounting laws,

  • consumer protection legislation,

  • applicable limitation periods for legal claims.

9.3. Accounting and Tax Documentation

Personal data included in accounting and tax documentation is retained for the period required under applicable tax and accounting regulations.

9.4. Complaints and Claims

Personal data relating to complaints, disputes or claims may be retained until such matters are concluded and thereafter until expiry of the relevant limitation period.

9.5. Data Processed on the Basis of Consent

Personal data processed on the basis of consent is generally processed until:

  • consent is withdrawn,

  • the purpose of processing has been achieved,

  • the Controller determines that the data is no longer required.

Withdrawal of consent does not necessarily mean that all information concerning the previous consent must be immediately deleted.

The Controller may retain a minimum amount of information necessary to demonstrate that consent was previously validly obtained, where there is an appropriate legal basis for doing so.

10. Rights of Data Subjects

Subject to the conditions laid down in the GDPR, you have:

  1. the right of access to your personal data and the right to receive a copy;

  2. the right to rectification of your personal data;

  3. the right to erasure where the conditions laid down in the GDPR are met;

  4. the right to restriction of processing;

  5. the right to data portability, where applicable under the GDPR;

  6. the right to object to processing based on Article 6(1)(e) or (f) GDPR;

  7. the right to withdraw consent at any time where processing is based on consent;

  8. the right to lodge a complaint with a supervisory authority.

Requests concerning the exercise of these rights may be submitted to:

biuro@marm.pl

or sent in writing to the Controller’s registered office.

Where necessary to protect personal data against unauthorised disclosure, the Controller may request information necessary to verify the identity of the person submitting the request.

11. Right to Object

Where personal data is processed on the basis of the Controller’s legitimate interests, you may object to such processing at any time on grounds relating to your particular situation.

Where personal data is processed for direct marketing purposes, you may object at any time to processing for such marketing, including profiling related to direct marketing.

Following an objection to direct marketing, the personal data will no longer be processed for that purpose.

12. Right to Lodge a Complaint

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

In Poland, the competent authority is:

President of the Personal Data Protection Office
(President of the Office for Personal Data Protection – UODO).

Exercising the right to lodge a complaint does not affect any other administrative or judicial remedies available under applicable law.

13. Data Security

We apply appropriate technical and organisational measures taking into account the nature, scope, context and purposes of processing as well as the associated risks.

Such measures may include in particular:

  • access controls,

  • encryption of data transmission,

  • IT infrastructure security measures,

  • backups,

  • authorisation procedures for persons processing personal data,

  • security procedures,

  • periodic evaluation of security measures.

Access to personal data is granted only to persons and entities that require such access in order to perform their duties.

Although no IT system can guarantee absolute security, the Controller applies security measures required by applicable law and appropriate to the risks associated with processing.

14. Cookies and Similar Technologies

14.1. What Are Cookies?

Cookies are small pieces of information stored on, or accessed from, a user’s device when using the website.

The website may also use similar technologies, including:

  • browser local storage,

  • pixels,

  • device identifiers,

  • other technologies used to store or access information on the user’s device.

14.2. Categories of Cookies

The website may use the following categories of cookies.

a) Strictly necessary cookies

These cookies are required for the proper operation of the website, for example to:

  • maintain a session,

  • operate the shopping cart,

  • enable login functionality,

  • ensure security,

  • remember privacy preferences.

Where the conditions laid down by applicable law are met, these technologies may be used without the user’s consent.

b) Functional cookies

These cookies allow the website to remember additional user settings and preferences.

Where their use requires consent, they are activated only after such consent has been obtained.

c) Analytics cookies

These cookies enable us to analyse how the website is used, measure traffic and improve its operation.

Where storing or accessing information on the user’s device requires consent, analytics technologies are activated only after the user has provided consent.

d) Marketing and advertising cookies

These technologies may be used to:

  • measure the effectiveness of advertising campaigns,

  • create audience groups,

  • personalise advertising,

  • conduct remarketing or retargeting,

  • profile user interests.

Such technologies are activated only after the required consent has been obtained.

14.3. Consent Management

When visiting the website for the first time, the user is provided with a mechanism enabling them to make choices concerning non-essential cookies and similar technologies.

The user should be able to:

  • accept selected categories,

  • reject non-essential technologies,

  • change settings at a later date,

  • withdraw previously granted consent.

Failure to take action or merely continuing to browse the website is not treated as consent to non-essential cookies.

Withdrawing consent should be as easy as providing it.

14.4. Browser Settings

Users may additionally restrict or block cookies through their browser settings.

Blocking strictly necessary technologies may cause certain website features to operate incorrectly.

Browser settings do not replace the website’s consent mechanism in cases where applicable law requires prior consent.

15. Third-Party Analytics and Advertising Services

The website may use tools supplied by third parties, including analytics and advertising solutions.

These may include, for example:

  • Google services,

  • Meta services,

  • other analytics and advertising systems listed in the consent management panel.

Non-essential tools that store information on the user’s device or access such information are activated only after the required consent has been obtained.

Before publishing this Privacy Policy, the Controller should list only those systems that are actually installed and active on the website.

Where a consent management platform is used, the current list of technologies, providers, purposes and storage periods should be available through the cookie settings panel.

16. Profiling and Automated Decision-Making

Personal data may be used for profiling, in particular for the purposes of:

  • analysing use of the website,

  • determining user interests,

  • adapting content or advertisements,

  • preparing statistics and analyses.

Where profiling is based on technologies requiring consent, it is carried out only after the relevant consent has been obtained.

The Controller does not make decisions concerning users based solely on automated processing that produce legal effects or similarly significantly affect them, unless such processing is expressly introduced in the future together with an appropriate legal basis and the information required under the GDPR.

17. Transfers of Personal Data Outside the European Economic Area

Some service providers used by the Controller may have their registered office or infrastructure outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, the Controller ensures that a transfer mechanism permitted under Chapter V GDPR is used.

Depending on the recipient, this may include:

  • an adequacy decision issued by the European Commission,

  • the EU-US Data Privacy Framework in the case of transfers to eligible and certified organisations in the United States,

  • Standard Contractual Clauses approved by the European Commission,

  • other mechanisms permitted under the GDPR.

Where required by applicable law, the Controller also assesses risks associated with international transfers and applies appropriate supplementary safeguards.

Information concerning the legal basis for a specific transfer may be obtained by contacting the Controller.

18. Links to External Websites

The website may contain links to websites or services operated by third parties.

The Controller is not responsible for the personal data processing practices of independent controllers operating such websites or services.

Before providing personal data to an external entity, users are advised to review that entity’s privacy policy.

19. Amendments to the Privacy Policy

This Privacy Policy may be updated periodically, in particular due to:

  • changes in applicable law,

  • changes in website functionality,

  • introduction of new services or technologies,

  • changes in service providers,

  • changes in the scope or purposes of personal data processing.

The current version of the Privacy Policy will be published on the website together with the date of the most recent update.

Where required by the nature of the changes, users will be informed in an appropriate manner.

Last updated: 8 September 2026