MOGANS WEBSITE PRIVACY POLICY

The controller of personal data is:

My Asia A&K Beauty Krzysztof Chwesiuk
ul. Przedsiębiorców 10
43-392 Międzyrzecze Dolne
Polska

Contact for matters concerning privacy and personal data:

Contact form

Depending on how you use the Website, we may process:

• data provided voluntarily through the contact form or in correspondence, in particular your name, email address, company details and message;
• technical data relating to use of the Website, such as information about the device, browser, operating system, IP address, request time, URLs visited and information recorded in technical logs;
• data relating to form security and protection against automated abuse;
• information about analytics and marketing consent settings;
• information stored locally in the browser in connection with Website features, including language or market selection;
• following the appropriate consent — analytics data processed using Google Analytics and data relating to marketing activities processed using Meta Pixel.

We do not require data that is unnecessary for the operation of the relevant Website feature.

Data submitted through the contact form or by email is used to:

• reply to messages;
• conduct further correspondence;
• handle enquiries about products, the brand or cooperation;
• take steps at the contacting person's request before potentially entering into a contract;
• establish, exercise or defend legal claims where necessary.

The legal basis for processing may be:

• Article 6(1)(b) GDPR — where contact concerns steps prior to entering into a contract or performance of a contract;
• Article 6(1)(f) GDPR — the controller's legitimate interest in handling correspondence, answering enquiries, maintaining business relationships and protecting against claims.

Where certain data is necessary to submit the form, not providing it may prevent submission or a reply.

Data is not used to send marketing information by email solely because someone has used the contact form.

The Website uses technical mechanisms to ensure its proper and secure operation, including in particular:

• a PHP session;
• CSRF mechanisms protecting the form against unauthorised submission;
• technical and security logs;
• Google reCAPTCHA to detect automated traffic, spam, abuse and attempted attacks.

Processing for these purposes is necessary to ensure the security of the Website and form and is based on the controller's legitimate interest under Article 6(1)(f) GDPR.

Technical mechanisms necessary for the operation or security of a service requested by the user may operate without optional analytics or marketing consent.

Google reCAPTCHA

The contact form is protected using Google reCAPTCHA.

reCAPTCHA analyses technical signals and how people interact with the form to assess the risk of abuse. For this purpose it may process, among other things, information about the device, browser, IP address and user behaviour and use necessary mechanisms for storing information on the device, such as the _GRECAPTCHA cookie.

reCAPTCHA is used exclusively for security and the detection of fraud and abuse, not for behavioural advertising by MOGANS.

The detailed rules for data processing within reCAPTCHA are set out in Google's applicable terms and privacy documentation.

The Website may use cookies and similar technologies, including local browser storage.

We use the following categories of mechanisms:

Necessary and security — enable the Website to operate, secure the form, maintain the session and prevent abuse.

Functional — may remember settings chosen by the user, such as the current language or market. These mechanisms are not used for advertising profiling.

Analytics — may be used only after analytics consent is given.

Marketing — may be used only after marketing consent is given.

The Website also stores information necessary to remember the user's consent choices. This is necessary for the Website to respect the choice made.

Users can change or withdraw optional consent at any time using the consent-management mechanism available on the Website.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Clearing browser data or using another browser or device may make it necessary to choose again.

The Website uses Google Tag Manager (GTM) for technical management of selected scripts and integrations.

GTM does not automatically activate optional analytics or marketing tools. The Website uses a consent mechanism that controls the activation of such services.

Google Analytics 4

Following analytics consent, the Website uses Google Analytics 4 (GA4).

Google Analytics helps us understand statistically how users use the Website, for example which pages are visited, what types of devices users use and how they navigate the site.

The legal basis for processing data for this purpose is the user's consent — Article 6(1)(a) GDPR.

Without analytics consent, the Google Analytics tag is not activated by the Website's consent mechanism.

The service provider is Google. For Google Analytics, Google processes data in accordance with the terms applicable to that service and the relevant data protection rules.

Following marketing consent, the Website may use Meta Pixel provided by Meta Platforms Ireland Limited.

Meta Pixel is used to measure the effectiveness of marketing and advertising activities and analyse how users interact with the Website after contact with content or advertisements relating to MOGANS.

When Meta Pixel operates, the data processed may include:

• browser and device information;
• IP address;
• the URL visited;
• event time;
• identifiers associated with cookies or the device;
• information about events occurring on the Website to the extent actually configured by the controller.

The legal basis for processing by the controller for this purpose is the user's consent — Article 6(1)(a) GDPR.

The Website does not activate Meta Pixel as an optional marketing tool before marketing consent is given.

For the collection and transmission of certain data using Meta tools, the controller and Meta Platforms Ireland Limited may act as joint controllers under Meta's terms. Further processing by Meta takes place under the rules set out by Meta.

The controller does not make decisions concerning users that produce legal effects or similarly significantly affect them solely by automated means.

Personal data may be disclosed to entities that support the controller in running the Website and handling correspondence, in particular:

• hosting and technical infrastructure providers;
• email service providers;
• security service providers;
• Google — in connection with reCAPTCHA, Google Tag Manager and, following analytics consent, Google Analytics;
• Meta Platforms Ireland Limited — following marketing consent and activation of Meta Pixel;
• entities providing IT, maintenance or advisory services to the controller, where access to data is necessary to perform those services;
• public authorities where disclosure is required by law.

Entities processing data on the controller's behalf receive access only to the extent necessary to perform the tasks entrusted to them.

The controller does not sell users' personal data.

Using global providers' services, particularly Google and Meta, may result in processing or onward transfer of data outside the European Economic Area, including to the United States.

Depending on the recipient and circumstances, data may be transferred on the basis of:

• a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified entities;
• standard contractual clauses approved by the European Commission;
• other mechanisms provided for by the GDPR.

Detailed information about the current transfer mechanisms used by Google and Meta is available in those providers' privacy documentation.

We apply the principle of limiting data retention periods.

Correspondence and contact form — data is retained for the time needed to conduct and conclude correspondence. After it ends, data may be retained for the period necessary to establish, exercise or defend legal claims or comply with legal obligations.

Contract-related data — where correspondence leads to entering into or performing a contract, data may be retained for the period required for contract performance, settlements and legal obligations and until the applicable limitation periods for claims expire.

Sessions and technical data — for the time necessary to ensure operation, security, diagnostics and incident handling, after which it is deleted or overwritten in accordance with the systems' operating cycles.

Consent settings and functional browser data — until it is deleted, settings are changed, the technical storage period expires or it is replaced by a new user choice.

Google Analytics and Meta data — for the period resulting from the relevant account configuration and provider's retention rules. Withdrawing consent stops future optional activation of the relevant integration by the Website, but does not in itself automatically erase data previously lawfully supplied to the provider.

Backups — if personal data is included in system backups, it remains there until standard rotation or deletion of the backup and is not used for purposes other than restoring the system or ensuring its security.

Under the conditions set out in the GDPR, a data subject may have the right to:

• access their data;
• obtain a copy of their data;
• rectify inaccurate data;
• erase data;
• restrict processing;
• data portability — in the cases provided for by law;
• object to processing based on the controller's legitimate interest;
• withdraw consent at any time where processing is based on consent.

To exercise these rights, you can contact the controller at:

Contact form

Before fulfilling a request, the controller may ask for information necessary to confirm the applicant's identity where justified.

Anyone who believes their data is processed in breach of the law has the right to lodge a complaint with the competent supervisory authority.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

This Privacy Policy may be updated, particularly when the Website's operation, technologies used, service providers or applicable laws change.

The current version of the Privacy Policy is published on the Website together with its last-updated date.

For matters concerning privacy, you can contact the controller at:

Contact form