Privacy policy

I. Service

This privacy policy applies to the website in the domain www.kosmet.com.pl.

II. Data Controller

The personal data controller is PCC Consumer Products Kosmet Sp. z o.o., with its registered office at ul. Sienkiewicza 4, 56-120 Brzeg Dolny.

For matters related to personal data, you can contact us by email at: odo.kosmet@pcc.eu

III. Purposes and legal basis for data processing

Your data may be processed for the purpose of:

1. communication and responding to your message. The legal basis for processing is the controller’s legitimate interest (Article 6(1)(f) of the GDPR) or taking steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR)—depending on the content of the message.
2. concluding and performing a contract. The basis for processing is taking steps at your request prior to entering into a contract or performing a contract that has been concluded (Article 6(1)(b) of the GDPR).
3. fulfilling the controller’s legal obligations. The basis for processing is a legal obligation to which the controller is subject (Article 6(1)(c) of the GDPR).
4. establishing, pursuing, or defending claims. The basis for processing is the controller’s legitimate interest (Article 6(1)(f) of the GDPR).
5. ensuring the security of the website. The basis for processing is the controller’s legitimate interest (Article 6(1)(f) of the GDPR).

Providing personal data is voluntary, but it may be necessary to respond to a request, conclude a contract, or fulfill a contract.

IV. Data Retention Period

We retain your data for the period necessary to achieve the purpose for which it was collected, and subsequently for the period required by law or for the limitation period of any potential claims.

We retain communication-related data until the end of the communication, and then for the period of the statute of limitations for claims. We store data related to the contract for the duration of the contract and for the period required by law. We store data processed for the purpose of fulfilling legal obligations for the period specified by law. We store data processed for the purpose of pursuing claims for the period of the statute of limitations for such claims.

V. Recipients of Personal Data

Recipients of the data may include entities supporting us in conducting our business and operating the website, in particular entities from the PCC Group, companies supporting us in communication, external consulting firms (including legal, tax, audit, and accounting firms), IT and hosting service providers, and entities handling correspondence, payments, or other services necessary for the performance of the contract—exclusively to the extent necessary to achieve these purposes.

VI. Transfer of Data Outside the European Economic Area

We use Google tools that help us analyze website traffic and ensure its proper functioning. In some cases, this may involve transferring data outside the European Economic Area, in which case we always apply appropriate safeguards in accordance with applicable laws, including the GDPR.

VII. Rights of data subjects

You have the right at any time to access your personal data and receive a copy of it, to have it corrected, deleted, or its processing restricted, to have it transferred (in cases specified by law), and to object to the processing of your data.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office.

VIII. Cookies and third-party tools

The website uses cookies, which are small text files stored on the user’s device, as well as external tools that support its operation.

Cookies and similar technologies are used to ensure the proper functioning of the website, analyze website traffic, and ensure security.

The legal basis for data processing in connection with the use of cookies is the controller’s legitimate interest (Article 6(1)(f) of the GDPR)—for necessary cookies—or the user’s consent (Article 6(1)(a) of the GDPR)—for other cookies.

Cookies other than those that are strictly necessary are used only after the user has given consent. The user may change cookie settings or withdraw consent at any time.

We use Google tools on our website to analyze website traffic (Google Analytics) and protect forms against spam and abuse (Google reCAPTCHA).

The basis for data processing in connection with Google Analytics is the user’s consent (Article 6(1)(a) of the GDPR), and data is collected only after consent is given. In the case of Google reCAPTCHA, the basis for processing is the controller’s legitimate interest (Article 6(1)(f) of the GDPR).

For more information about Google’s data processing policies, visit: https://policies.google.com/privacy?hl=pl

IX. Changes to the Privacy Policy

This Privacy Policy may be amended by publishing a new version on the Website.

This version of the Privacy Policy is effective as of April 10, 2026.