In force from 28 July 2026.<\/strong><\/p>\n On the www.ova.com.pl website there are two separate entities<\/strong>. Below we explain who is responsible for what \u2014 this matters, because it determines who you address your questions and requests to.<\/p>\n The controller of your personal data processed in connection with purchases in the Store \u2014 orders, payments, delivery, complaints, the customer account and customer service \u2014 is:<\/p>\n LAYAR Konrad Grochulski<\/strong> e-mail: hello@layarpmu.com<\/strong> For matters concerning data related to the fulfilment of orders you may contact LAYAR directly at hello@layarpmu.com<\/strong>. The joint point of contact for all other matters concerning your data \u2014 including changes to your account and deletion of data \u2014 is office@ova.com.pl<\/strong>.<\/p>\n Administrator has not appointed a data protection officer<\/strong>. The person responsible for matters relating to personal data protection on the Controller's side is Konrad Grochulski<\/strong> \u2014 kontakt: hello@layarpmu.com, tel. +48 510 113 730.<\/p>\n The owner of the website www.ova.com.pl and of the OVA brand is:<\/p>\n OVA Magdalena Mazurek<\/strong> e-mail: office@ova.com.pl<\/strong> This entity has likewise not appointed a data protection officer. The person responsible for matters relating to personal data protection is Magdalena Mazurek<\/strong> \u2014 kontakt: office@ova.com.pl, tel. +48 883 773 111.<\/p>\n This entity is the controller of data in respect of:<\/p>\n Both entities are JOINT CONTROLLERS of your data<\/strong> within the meaning of Article 26 GDPR. Below \u2014 in accordance with Article 26(2) GDPR \u2014 we make available the essence of the arrangement between them.<\/p>\n Division of responsibilities:<\/strong><\/p>\n Point of contact<\/strong> in all matters concerning your data \u2014 including changes to your account, rectifications and deletion of data: office@ova.com.pl<\/strong>, tel. +48 883 773 111 (OVA Magdalena Mazurek).<\/p>\n Matters concerning solely the fulfilment of orders, invoices and complaints may be addressed directly to the Seller: hello@layarpmu.com<\/strong>, tel. +48 510 113 730.<\/p>\n Important:<\/strong> irrespective of the above division you may exercise all your rights against each of the joint controllers<\/strong> \u2014 both against LAYAR and against OVA (Article 26(3) GDPR). Neither will refuse to consider your request by invoking the internal division of responsibilities.<\/p>\n<\/blockquote>\n Time limit of joint controllership.<\/strong> The above applies to orders placed from 28 July 2026<\/strong> Data concerning orders placed earlier remains under the sole administration of OVA Magdalena Mazurek<\/strong> \u2014 LAYAR Konrad Grochulski has no access to them and has never been their controller. This data is stored for the period required by tax and accounting regulations and until the limitation periods for claims expire.<\/p>\n Joint controllership does not cover:<\/strong><\/p>\n The data comes directly from you<\/strong> \u2014 you provide them when placing an order, creating an account, subscribing to the newsletter, completing the contact form, submitting a complaint or contacting us. Some data is collected automatically while you use the site (see the section on cookies).<\/p>\n Providing the data is voluntary but necessary<\/strong> to conclude a contract, create an account or receive the newsletter. Without them we cannot fulfil an order.<\/p>\n We do not process<\/strong> special categories of data (so-called sensitive data) \u2014 unless you yourself provide them to us in the content of a report concerning an adverse effect of a cosmetic product. In that case the basis for processing is Article 9(2)(i) GDPR (public interest in the area of public health).<\/p>\n Your data may be shared with the following categories of recipients:<\/p>\n Recipients process the data solely to the extent necessary to perform the tasks entrusted to them, on the basis of data processing agreements concluded with them \u2014 with the exception of the payment operator and the courier company, which are separate controllers.<\/p>\n Some of the tools used (for example analytics or marketing service providers) may transfer data outside the EEA. In such a case the transfer takes place on the basis of standardowych klauzul umownych<\/strong> approved by the European Commission, or of a decision finding an adequate level of protection.<\/p>\n You can obtain a copy of the safeguards by contacting us at office@ova.com.pl<\/strong>.<\/p>\n At present such a transfer may occur in connection with the use of the service Google reCAPTCHA<\/strong> (Google Ireland Limited, established in Ireland, with the possibility of transferring data to Google LLC in the United States) and from the newsletter sending tool MailerLite<\/strong>. Transfers take place on the basis of standard contractual clauses and of the European Commission decision finding an adequate level of data protection under the EU\u2013US Data Privacy Framework.<\/p>\n You have the right to:<\/p>\n the President of the Personal Data Protection Office<\/strong> To exercise these rights, write to office@ova.com.pl<\/strong>. We respond without delay and no later than within month<\/strong> from receipt of the request.<\/p>\n Twoje dane are not used for automated decision-making<\/strong>, including profiling which produces legal effects concerning you or similarly significantly affects you.<\/p>\n Cookies are small text files saved on your device while you use the site.<\/p>\n Necessary \u2014 no consent required:<\/strong><\/p>\n Security:<\/strong><\/p>\n The list reflects the configuration of the site as at 28 July 2026 and is updated whenever the tools used change.<\/em><\/p>\n The forms on the site (including the newsletter sign-up and the contact form) are protected by the service Google reCAPTCHA<\/strong>, supplied by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.<\/p>\n The service analyses the way the site is used in order to distinguish a human from a machine. For this purpose, information including your IP address, details of your browser and device, and data about your behaviour on the site is transmitted to Google. reCAPTCHA sets its own cookies.<\/p>\n The basis for processing is the Controller's legitimate interest (Article 6(1)(f) GDPR) in protecting the site against spam and abuse. Using the forms without this protection is not possible.<\/p>\n The rules on how Google processes data are set out in its privacy policy: https:\/\/policies.google.com\/privacy<\/p>\n You give consent to cookies other than the necessary ones through the cookie banner on your first visit. You may change or withdraw it at any time in the cookie settings on the site and in your browser settings.<\/p>\n Restricting cookies may affect the operation of some features of the site \u2014 in particular the basket and logging in.<\/p>\n
\n1. Who processes your data<\/h2>\n
1.1. Controller of Store Customers' data<\/h3>\n
\n
\nul. Gruszkowa 13
\n72-003 Wo\u0142czkowo, Poland
\nNIP: 8512979959
\nREGON: 320482385<\/p>\n
\ntel.: +48 510 113 730<\/p>\n<\/blockquote>\n1.2. Controller of data relating to the brand and the website<\/h3>\n
\n
\nul. Katowicka 11\/B2
\n61-131 Pozna\u0144, Poland
\nNIP: PL9482480309
\nREGON: 141307060<\/p>\n
\ntel.: +48 883 773 111<\/p>\n<\/blockquote>\n\n
\n\n
\n \nZa co odpowiada<\/th>\n Kto<\/th>\n<\/tr>\n<\/thead>\n \n Sales, order fulfilment, payments, delivery<\/td>\n LAYAR<\/td>\n<\/tr>\n \n Complaints, returns, withdrawals from the contract<\/td>\n LAYAR<\/td>\n<\/tr>\n \n Accounting and tax documentation<\/td>\n LAYAR<\/td>\n<\/tr>\n \n Information obligation when placing an order<\/td>\n LAYAR<\/td>\n<\/tr>\n \n Technical maintenance of the site, security, access management<\/td>\n OVA<\/td>\n<\/tr>\n \n Analysis of sales and product range for the development of the brand<\/td>\n oba podmioty<\/td>\n<\/tr>\n \n Reporting any personal data breach to the President of the UODO<\/td>\n LAYAR<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \n
\n
\n2. Where we get your data from<\/h2>\n
\n3. Why and on what basis we process data<\/h2>\n
\n\n
\n \nCel przetwarzania<\/th>\n Podstawa prawna<\/th>\n Okres przechowywania<\/th>\n<\/tr>\n<\/thead>\n \n Conclusion and performance of the sales contract, order fulfilment, delivery<\/td>\n Article 6(1)(b) GDPR \u2014 necessary for the performance of a contract<\/td>\n For the duration of the contract, and thereafter until the limitation periods for claims expire<\/td>\n<\/tr>\n \n Prowadzenie konta klienta<\/td>\n art. 6 ust. 1 lit. b RODO<\/td>\n Until the account is deleted<\/td>\n<\/tr>\n \n Issuing and storing accounting documents<\/td>\n Article 6(1)(c) GDPR \u2014 legal obligation (the Accounting Act, the Tax Ordinance)<\/td>\n 5 years from the end of the tax year<\/td>\n<\/tr>\n \n Handling complaints and withdrawals from the contract<\/td>\n Article 6(1)(c) GDPR \u2014 legal obligation<\/td>\n Until the limitation periods expire<\/td>\n<\/tr>\n \n Defence against claims and the pursuit of claims<\/td>\n art. 6 ust. 1 lit. f RODO \u2014 prawnie uzasadniony interes<\/td>\n Until the limitation periods expire<\/td>\n<\/tr>\n \n Sending the OVA brand newsletter (administrator: OVA Magdalena Mazurek)<\/em><\/td>\n art. 6 ust. 1 lit. a RODO \u2014 zgoda<\/td>\n Do wycofania zgody<\/td>\n<\/tr>\n \n Marketing of our own products<\/td>\n art. 6 ust. 1 lit. f RODO \u2014 prawnie uzasadniony interes<\/td>\n Do wniesienia sprzeciwu<\/td>\n<\/tr>\n \n Handling enquiries through the contact form<\/td>\n art. 6 ust. 1 lit. f RODO \u2014 prawnie uzasadniony interes (udzielenie odpowiedzi)<\/td>\n Until the correspondence is concluded, then for up to 12 months<\/td>\n<\/tr>\n \n Publikacja opinii o produktach<\/td>\n art. 6 ust. 1 lit. a RODO \u2014 zgoda<\/td>\n Until consent is withdrawn or the review is deleted<\/td>\n<\/tr>\n \n Verifying that a review comes from a Customer who purchased the Goods \u2014 cross-checking reviews against the order history on the Account<\/td>\n Article 6(1)(c) GDPR \u2014 legal obligation (ensuring the reliability of the reviews presented)<\/td>\n Until the review is deleted<\/td>\n<\/tr>\n \n Sending a request to leave a review of purchased Goods<\/td>\n art. 6 ust. 1 lit. f RODO \u2014 prawnie uzasadniony interes<\/td>\n Up to 6 months after the order is completed<\/td>\n<\/tr>\n \n Analityka i statystyka odwiedzin<\/td>\n art. 6 ust. 1 lit. a RODO \u2014 zgoda (cookies analityczne)<\/td>\n Zgodnie z okresami cookies \u2014 patrz sekcja 9<\/td>\n<\/tr>\n \n Ensuring the security of the site and preventing abuse<\/td>\n art. 6 ust. 1 lit. f RODO<\/td>\n Up to 12 months<\/td>\n<\/tr>\n \n Handling reports of adverse effects of cosmetics<\/td>\n Article 6(1)(c) GDPR \u2014 obligation under Regulation 1223\/2009<\/td>\n In accordance with the requirements of the Regulation<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n4. What data we process<\/h2>\n
\n
\n5. Who we share data with<\/h2>\n
\n
\n6. Transfers of data outside the European Economic Area<\/h2>\n
\n7. Your rights<\/h2>\n
\n
\n
\nul. Stawki 2, 00-193 Warszawa
\nwww.uodo.gov.pl<\/p>\n<\/blockquote>\n
\n8. Automated decision-making<\/h2>\n
\n9. Cookies<\/h2>\n
9.1. What they are<\/h3>\n
9.2. Which ones we use<\/h3>\n
\n\n
\n \nTYPE<\/th>\n What they are for<\/th>\n Podstawa<\/th>\n<\/tr>\n<\/thead>\n \n Necessary<\/strong><\/td>\n Basket functionality, logging in, session, security, remembering the choice of language and currency<\/td>\n No consent required \u2014 Article 173(3) of the Telecommunications Act<\/td>\n<\/tr>\n \n Functional<\/strong><\/td>\n Remembering the user's preferences<\/td>\n Agreement<\/td>\n<\/tr>\n \n Analytics<\/strong><\/td>\n Visit statistics, how the site is used<\/td>\n Agreement<\/td>\n<\/tr>\n \n Marketing<\/strong><\/td>\n Dopasowanie reklam, remarketing<\/td>\n Agreement<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 9.2b. Detailed list of cookies<\/h3>\n
\n\n
\n \nNazwa<\/th>\n Pochodzenie<\/th>\n Do czego<\/th>\n Czas<\/th>\n<\/tr>\n<\/thead>\n \n woocommerce_cart_hash<\/code>, woocommerce_items_in_cart<\/code><\/td>\nWooCommerce<\/td>\n basket contents<\/td>\n sesja<\/td>\n<\/tr>\n \n wp_woocommerce_session_*<\/code><\/td>\nWooCommerce<\/td>\n linking the basket to the session<\/td>\n 2 dni<\/td>\n<\/tr>\n \n woocommerce_recently_viewed<\/code><\/td>\nWooCommerce<\/td>\n recently viewed products<\/td>\n sesja<\/td>\n<\/tr>\n \n wordpress_logged_in_*<\/code>, wp-settings-*<\/code>, wp-settings-time-*<\/code><\/td>\nWordPress<\/td>\n maintaining the logged-in user's session<\/td>\n do 1 roku<\/td>\n<\/tr>\n \n trp_language<\/code><\/td>\nTranslatePress<\/td>\n remembering the chosen language<\/td>\n 1 rok<\/td>\n<\/tr>\n \n woocommerce_currency<\/code><\/td>\ncurrency switcher<\/td>\n remembering the chosen currency<\/td>\n 1 month<\/td>\n<\/tr>\n \n wfwaf-authcookie-*<\/code><\/td>\nWordfence<\/td>\n protection against unauthorised access<\/td>\n sesja<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n \n\n
\n \nNazwa<\/th>\n Pochodzenie<\/th>\n Do czego<\/th>\n Czas<\/th>\n<\/tr>\n<\/thead>\n \n _GRECAPTCHA<\/code><\/td>\nGoogle reCAPTCHA<\/td>\n ochrona formularzy przed automatami<\/td>\n approx. 6 months<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n 9.3. Google reCAPTCHA<\/h3>\n
9.4. Managing cookies<\/h3>\n
9.5. Country detection (currency)<\/h3>\n