Privacy Policy

§1. Data Controller

The controller of personal data collected through the website blackless.pl (hereinafter: the "Website") is:

(hereinafter: the "Controller").

§2. Scope and Purpose of Data Processing

The Controller processes personal data of Website Users for the following purposes:

• Waitlist management - e-mail address, first name (optional). Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract).
• Contact form / e-mail correspondence - e-mail address, first name, message content. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller - responding to inquiries).
• Analytics and Website improvement - data collected automatically: IP address, browser type, screen resolution, operating system, visit duration, pages visited. Legal basis: Art. 6(1)(a) GDPR (consent for analytical cookies) and Art. 6(1)(f) GDPR (legitimate interest - traffic analysis).
• Personalization and A/B testing - a random identifier assigned to the User's browser (UUID) that does not allow personal identification. It is used to ensure consistent display of page variants during A/B tests. The identifier is stored only after consent to statistics cookies. Legal basis: Art. 6(1)(a) GDPR (consent).
• Marketing and advertising measurement - data on activity on the Website (e.g. pages visited and interactions with the store) transmitted via Meta Pixel, only after consent to marketing cookies. Legal basis: Art. 6(1)(a) GDPR (consent).
• Handling contract withdrawals and returns - first and last name, e-mail address, order number, data of the products covered by the withdrawal, the content of the statement and the date and time of its submission. Legal basis: Art. 6(1)(c) GDPR (legal obligation under the Consumer Rights Act) and Art. 6(1)(b) GDPR (performance of a contract), and, to the extent of establishing or defending claims, Art. 6(1)(f) GDPR (legitimate interest of the Controller).

§3. Data Recipients

Users' personal data may be shared with the following categories of recipients:

• Vercel Inc. (San Francisco, USA) - Website hosting and the Vercel Analytics and Vercel Speed Insights services. Data may be transferred to the USA based on the European Commission adequacy decision for the EU-US Data Privacy Framework (Vercel Inc. is DPF-certified), and additionally on Standard Contractual Clauses (SCCs).
• Google LLC (Mountain View, USA) - Google Analytics service for Website traffic analysis, and the Google Firebase / Firestore service used to store order data and statements of withdrawal from the contract. Data may be transferred to the USA based on Standard Contractual Clauses (SCCs).
• Stripe, Inc. (San Francisco, USA) - payment processing and issuing refunds following withdrawal from the contract. Data may be transferred to the USA based on Standard Contractual Clauses (SCCs).
• Resend (Plus Five Five, Inc.) (USA) - sending e-mail messages, including confirmations of receipt of statements of withdrawal from the contract. Data may be transferred to the USA based on Standard Contractual Clauses (SCCs).
• Meta Platforms Ireland Ltd. (Dublin, Ireland) - advertising measurement and marketing (Meta Pixel), only after consent to marketing cookies. Data may be transferred to Meta Platforms, Inc. (USA) based on the European Commission adequacy decision for the EU-US Data Privacy Framework (Meta Platforms, Inc. is DPF-certified). With respect to collecting data via Meta Pixel and transmitting it to Meta, the Controller and Meta Platforms Ireland Ltd. are joint controllers (Art. 26 GDPR). The essence of the arrangement is set out in the Meta Controller Addendum. Meta is responsible for further processing in accordance with its privacy policy.

The Controller does not sell personal data. Data is shared for marketing purposes only with the entities listed above and only after the User consents to marketing cookies.

§4. Data Retention Period

• Waitlist data - until consent is withdrawn or until the launch of sales and any subsequent order placement.
• Contact form data - for the period necessary to handle the inquiry, no longer than 12 months from the last contact.
• Contract withdrawal and return data - for the period necessary to process the withdrawal and to fulfill legal obligations (including tax and accounting obligations), as well as until the limitation period for any claims arising from the contract expires (generally up to 6 years).
• Analytical data (cookies) - in accordance with the validity period of respective cookies (details in §7).

§5. User Rights

Every User has the following rights under the GDPR:

• right of access to personal data (Art. 15 GDPR),
• right to rectification of data (Art. 16 GDPR),
• right to erasure - "right to be forgotten" (Art. 17 GDPR),
• right to restriction of processing (Art. 18 GDPR),
• right to data portability (Art. 20 GDPR),
• right to object to processing (Art. 21 GDPR),
• right to withdraw consent at any time (without affecting the lawfulness of processing carried out prior to withdrawal),
• right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland).

To exercise the above rights, please contact us at: kontakt@blackless.pl.

§6. Voluntary Provision of Data

Providing personal data is voluntary but necessary to sign up for the waitlist or use the contact form. Failure to provide the required data will prevent the fulfillment of the above purposes.

§7. Cookie Policy

7.1. What are cookies?

Cookies are small text files stored on the User's device (computer, phone, tablet) while using the Website. They are used to ensure the proper functioning of the Website and to analyze how Users interact with it.

7.2. Types of cookies used on the Website

7.3. Legal basis for cookies

Essential cookies are used on the basis of Article 399 of the Polish Electronic Communications Law of 12 July 2024 (they are necessary to provide the service electronically). Analytical cookies and tools (Google Analytics, Vercel Analytics, visitor-id) are used on the basis of User consent (Article 399 of the Polish Electronic Communications Law of 12 July 2024 in conjunction with Art. 6(1)(a) GDPR). Marketing cookies (Meta Pixel) are used only on the basis of User consent to marketing cookies (Article 399 of the Polish Electronic Communications Law of 12 July 2024 in conjunction with Art. 6(1)(a) GDPR). Vercel Speed Insights stores no information on the User's device and operates on the basis of the Controller's legitimate interest in ensuring Website performance (Art. 6(1)(f) GDPR).

7.4. Managing cookies

Upon the first visit to the Website, a cookie banner is displayed allowing the User to grant or refuse consent to specific categories of cookies. Consent can be changed or withdrawn at any time using the "Cookie settings" button in the Website footer (or below). Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR). Cookies can also be deleted or blocked in the browser settings - details are available in the browser documentation.

Cookie settings

Refusing consent to analytical and marketing cookies does not affect the ability to use the Website.

§8. Data Security

The Controller applies appropriate technical and organizational measures to protect processed personal data, in particular safeguarding data against unauthorized access, loss, or destruction. The Website uses SSL/TLS encryption.

§9. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes through the publication of an updated version on the Website. The date of the last update is shown at the top of this document.

§10. Contact

For matters related to the protection of personal data, please contact us at: kontakt@blackless.pl.