RB2B.PL ONLINE STORE

Update date: 6/08/2025

I. GENERAL PROVISIONS

1. This Privacy Policy sets out the rules for the processing of personal data of Customers of the platform – the online store operated at RB2B.pl (hereinafter referred to as the "Store").
2. The personal data controller is INSTA SP. Z OO with its registered office in Warsaw (ul. Instalatorów 23, 02-237 Warsaw), NIP: PL5223133060, hereinafter referred to as the "Controller".
3. The Administrator makes every effort to ensure the privacy and security of personal data provided by Customers, using carefully selected technical and organizational measures that serve the proper protection of the data being processed.
4. In matters concerning personal data protection, you can contact the Controller: a) in writing to the following address: ul. Instalatorów 23, 02-237 Warsaw, b) by e-mail: bok@rb2b.pl , c) by telephone: +48 721-399-788.

II. BASIS FOR PERSONAL DATA PROCESSING

1. Personal data are processed by the Controller in accordance with the law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter referred to as "GDPR").
2. The Controller may process personal data for the following purposes: a) establishing business relations with entrepreneurs and state organizations, including answering questions asked in connection with customer contact (pursuant to art. 6 sec. 1 letter f of the GDPR); b) concluding and performing a sales contract for cosmetic products under the terms and conditions specified in the Store Regulations (pursuant to art. 6 sec. 1 letter b of the GDPR); c) handling complaints and returns (art. 6 sec. 1 letter c and f of the GDPR); d) fulfilling the legal obligation incumbent on the Controller regarding tax and accounting obligations (pursuant to art. 6 sec. 1 letter c of the GDPR in connection with tax and accounting regulations); e) verifying the status of an entrepreneur or state organization authorized to purchase products (pursuant to art. 6 sec. 1 letter f of the GDPR); f) marketing of the Controller’s own goods or services as a legitimate interest of the Controller (pursuant to art. 6 sec. 1 letter f of the GDPR); g) pursuing or securing possible claims as a legitimate interest of the Controller (pursuant to Article 6 paragraph 1 letter f of the GDPR); h) sending the newsletter based on consent (Article 6 paragraph 1 letter a of the GDPR).
3. Providing data is voluntary; however, failure to provide data may result in the inability to establish a business relationship, verify a company account, or conclude a contract. The store provides services exclusively to entrepreneurs and state organizations in Poland.

III. SCOPE OF PROCESSED CUSTOMER PERSONAL DATA

1. The Administrator may process the following personal data of representatives of companies and organizations:
   • name and surname of the person representing the company/organization
   • e-mail address
   • contact telephone number
   • position in the company/organization
   • delivery address (street, number, postal code, city)
2. In the case of Customers who are entrepreneurs and organizations, the Administrator additionally processes:
   • name of the company/organization
   • company/organization headquarters address
   • Tax Identification Number (NIP)
   • REGON number
   • KRS number (if applicable)
   • documents confirming the status of an entrepreneur or state organization

IV. BASIC PRINCIPLES OF PERSONAL DATA PROCESSING

1. The Administrator processes personal data only to the minimum and adequate extent necessary to achieve the purposes for which it is collected. The purposes for collecting Customers' personal data are clearly defined and based on legal provisions.
2. The Administrator exercises the rights of Customers regarding their personal data in accordance with the law, including ensuring the accuracy of Customers' personal data and immediately responding to requests for rectification or updating of data.
3. The Administrator limits the storage of personal data in accordance with legal provisions, only to the period necessary to achieve the purposes for which they are collected.
4. Only individuals duly authorized by the Administrator have full access to personal databases. The Administrator protects personal data against unauthorized processing.

V. RIGHTS OF DATA SUBJECTS

1. Every customer has the right to:
   • access to the content of your data
   • data rectification
   • deletion of data
   • processing restrictions
   • data transfer
   • object to processing
   • withdrawal of consent (if processing is based on consent)
2. The rights may be exercised by sending a request to the e-mail address: bok@rb2b.pl or in writing to the address of the Controller's registered office.
3. IMPORTANT LIMITATION OF LIABILITY: The Client is fully responsible for the accuracy of the company data provided and for having the authority to represent the entity. The Administrator does not independently verify representative authority.
4. The customer has the right to lodge a complaint with the President of the Personal Data Protection Office.

VI. RECIPIENTS OF PERSONAL DATA

1. Personal data may be transferred:
   • state authorities based on legal provisions
   • courier companies (for deliveries)
   • entities providing accounting services
   • companies supporting the technical maintenance of IT systems
   • payment operators
   • debt collection companies (in the case of receivables)
2. The Administrator does not sell personal data to third parties.
3. Data may only be transferred to third countries on the basis of appropriate guarantees in accordance with the GDPR.

VII. DATA STORAGE PERIODS

Personal data will be stored for the following periods:

a) for the duration of the contract and after its termination for the period necessary for after-sales service, pursuing claims and fulfilling legal obligations;

b) accounting data: 5 years in accordance with tax regulations;

c) marketing: until an objection is raised;

d) consent to the newsletter: until the consent is withdrawn;

e) security and claims: for the period of limitation of claims.

VIII. LEGAL PROVISIONS PROTECTING THE ADMINISTRATOR

1. LIMITATION OF LIABILITY: The Administrator is responsible for data processing only within the limits specified by the GDPR and Polish law.
2. CUSTOMER LIABILITY: The customer is fully responsible for:
   • the veracity of the data provided
   • having the authority to represent the company/organization
   • securing access to your account
   • all activities performed on the account
3. INFORMED CONSENT: By using the Store, placing an order or registering an account, you consent to the processing of your data in accordance with this Policy.
4. POLICY CHANGES: The Administrator may change the Policy with 30 days' notice. Continued use of the Store after changes are made constitutes acceptance of those changes.

IX. COOKIE POLICY

1. The Store uses cookies for the following purposes: a) ensuring the proper operation of the Store b) remembering Customer preferences c) conducting statistical analyses d) marketing activities (with consent)
2. Types of cookies:
   • session - deleted after closing the browser
   • permanent – ​​stored for a specified period of time
3. The customer can manage cookies through browser settings.

X. FINAL PROVISIONS

1. GOVERNING LAW: The Policy is subject to Polish law.
2. SEVERABILITY: The invalidity of any provision does not affect the validity of the remaining provisions.
3. PRECEDENCE: In the event of any conflict with other documents, the Policy shall prevail in matters of data protection.
4. CONTACT: bok@rb2b.pl | +48 721-399-788

INSTA SP. Z OO
ul. Instalatorów 23, 02-237 Warsaw
Tax Identification Number: PL5223133060