1. Data Controller

a) The controller of personal data is:

Studio Archigrafika Wioletta Węgrzynowicz-Nowak

ul. Bolesława Chrobrego 2/15

41-219 Sosnowiec

Poland

Tax Identification Number (NIP): 9910499308

b) For matters relating to the processing of personal data, the Controller can be contacted at: linolinepl@gmail.com.

c) The Controller processes personal data in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).

2. What Data Is Processed

a) Depending on the purpose of the enquiry or cooperation, the Controller may process, in particular:

• first and last name,

• email address,

• telephone number,

• delivery address,

• details required for issuing an invoice,

• order-related information,

• data contained in correspondence.

b) The scope of processed data is limited to the information necessary to fulfil the specific purpose.

3. Purposes and Legal Bases for Processing

a) Data provided by email, through the website or via Instagram messages may be processed to respond to enquiries, prepare offers, conduct correspondence and provide customer service.

The legal basis for processing is the Controller’s legitimate interest or, where the data is necessary to take steps prior to entering into a contract, Article 6(1)(b) GDPR.

b) Data necessary to fulfil an order is processed for the purpose of entering into and performing a contract, including preparing the work, communicating with the client, arranging delivery and fulfilling other arrangements related to the order.

The legal basis for processing is Article 6(1)(b) GDPR.

c) Data contained in invoices and accounting records is processed to comply with obligations arising from tax and accounting regulations.

The legal basis for processing is Article 6(1)(c) GDPR.

d) Data may also be processed to establish, pursue or defend against potential claims related to the business.

The legal basis for processing is Article 6(1)(f) GDPR.

4. Recipients of Data

a) Personal data may be shared with entities cooperating with the Controller where necessary to fulfil a specific purpose.

b) These may include, in particular:

• courier companies and delivery operators,

• accounting service providers,

• the provider of hosting and services related to the operation of the website,

• the email service provider,

• IT service providers,

• entities legally entitled to receive the data.

c) The Controller does not sell personal data to third parties.

5. Data Retention Period

a) Data related to orders and concluded contracts is retained for the period necessary to perform the contract and subsequently for the period required by law, in particular tax and accounting regulations.

b) Data provided in connection with an enquiry is retained for the time necessary to handle the matter and may subsequently be retained for the period required to protect against potential claims.

c) Data processed on the basis of legitimate interest is retained until the relevant purpose has been fulfilled, a valid objection has been made or the legal basis for processing ceases to exist.

6. Rights of Data Subjects

a) Subject to the conditions set out in the GDPR, data subjects have the right to:

• access their personal data,

• rectify their data,

• request erasure of their data,

• restrict processing,

• data portability, where applicable,

• object to processing based on the Controller’s legitimate interest,

• withdraw consent to data processing where consent is the legal basis for processing.

b) Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

c) The right to erasure is not absolute. In particular, the Controller may be required to retain data under applicable laws or for the establishment, pursuit or defence of claims.

d) If a data subject believes that their personal data is being processed in violation of applicable laws, they have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

7. Cookies

a) The Linoline website uses cookies and similar technologies to the extent necessary for its proper operation and, depending on the website’s settings and features, to remember user preferences and collect statistics.

b) Users can manage cookies through their web browser settings and, where available, the website’s consent management mechanism.

c) Restricting the use of certain cookies may affect selected website features.

8. Social Media

a) Linoline operates an Instagram profile: @linolinepl.

b) Contact via Instagram may involve the processing of personal data by the Controller and, independently, by the operator of Instagram, in accordance with its own privacy policies.

c) Data provided to the Controller through direct messages, comments or other forms of contact is processed to the extent necessary to handle an enquiry, maintain contact or fulfil an order.

9. Automated Decision-Making

a) The Controller does not use personal data to make decisions based on automated processing that produce legal effects concerning an individual or similarly significantly affect them.

b) The Controller does not use personal data for profiling for the purpose of making such decisions.

10. Data Security

a) The Controller implements appropriate technical and organisational measures to protect personal data against loss, destruction, unauthorised access, alteration or disclosure to unauthorised persons.

11. Changes to the Privacy Policy

a) The Controller may update this Privacy Policy if there are changes to applicable laws, the operation of the website or the scope of business activities.

b) The current version of the Privacy Policy is published on the Linoline website.

c) This Privacy Policy is effective from 7 October 2026.

Effective from 7 October 2026

PRIVACY POLICY