PRIVACY POLICY & COOKIES Processing of personal data KUST. processes personal data in accordance with the provisions of the Regulation of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “RODO”). For the operation of the KUST. website, through which Users can make purchases from the KUST. online store (hereinafter: the “Service”), it uses the required technical measures to ensure the protection of the processed personal data and the security of personal data against unauthorized access, acquisition, processing in violation of the law, and alteration, loss, or destruction. You have the right to request from us:

1. Information about whether your data is being processed, and other information, in particular, about data protection violations of your data;
2. Access to your data;
3. Rectification of your data;
4. To be forgotten (removal of data from the Service);
5. Restrictions on the processing of your data;
6. Portability of your data;
7. Objection to the processing of your personal data, under the terms of Article 21 of the RODO;
8. Not to be subject to a decision based solely on automated processing (including profiling).

Personal data controller The administrator of the personal data is KUST. spółka z ograniczoną odpowiedzialnością with its registered office in Sopot (postal code 81-824) at ARMII KRAJOWEJ street number 116/15, KRS number 0001116978, NIP: 5851505205, REGON: 529190130, email address: contact@kust.com (hereinafter referred to as “KUST.” or “Administrator”). The processing of personal data includes activities and operations performed on the personal data of Users, including storage or analysis for the services of the website kust.com. Personal data of Users will not be sold to third parties, including for the purpose of sending third-party marketing materials. Objectives of processing KUST. processes personal data of Users to execute an order placed on the Service, which is owned by the Administrator, and possible contact regarding the placed or initiated order process, User account registration, and execution of the sales (purchase) agreement, based on Article 6(1)(b) RODO. Additionally, it processes data to fulfill legal and fiscal obligations related to completed orders, based on Article 6(1)(c) RODO. Personal data obtained may also be used in the legitimate interest of the Administrator, as per Article 6(1)(f) RODO, e.g., for claiming and defending in legal disputes and court proceedings, and direct marketing. Provision of data is voluntary but necessary to create a User account and complete the purchase. If additional consents are given, personal data will be processed by the Administrator as follows: Newsletter The newsletter is available only to persons over 16 years of age. By ordering the service, the User declares that he is over 16 years old and can give such consent on his own. The data obtained will be processed for distributing information about the Administrator’s products and promotional actions, i.e., for marketing purposes (direct marketing), which is the realization of the Administrator’s legitimate interest, in accordance with Article 6(1)(f) RODO, or based on the User’s expressed consent, in accordance with Article 6(1)(a) RODO. Provision of data is voluntary but necessary to subscribe to the newsletter. Contact Form Personal data obtained through the contact form will be used to fulfill the submitted inquiry and possible further contact, based on the consent given, in accordance with Article 6(1)(a) of the RODO. The consent granted may be withdrawn at any time, which does not affect the legality of the processing performed on the basis of consent before its withdrawal. Provision of data is voluntary but necessary to execute/respond to the submitted application/question. Contractors Personal data will be used for the proper execution of contracts concluded by the Administrator, based on Article 6(1)(b) of the RODO, or for fulfilling legal and fiscal obligations based on Article 6(1)(c) of the RODO. Additionally, based on Article 6(1)(f) of the RODO, it may be used for the legitimate interest of executing contracts and maintaining proper communication. Provision of data is necessary for the conclusion and execution of the contract. Personal data may also be used for direct marketing of the Administrator’s products and services. You have the right to object to this processing for direct marketing purposes.   In connection with pending litigation, enforcement proceedings, etc., to which the Administrator is a party, personal data of other participants in these proceedings is processed in the Administrator’s legitimate interest, in accordance with Article 6(1)(f) of the RODO.   We use Google Analytics and, if you agree, we process your data for analytical purposes. To whom do we share your personal data? Your personal data may be transferred to entities such as postal operators and courier companies for delivery of shipments, banks and entities providing payment services, entities providing legal and accounting services to the administrator, and other entities entrusted by the administrator with the processing of personal data based on Article 28 and Article 29 RODO. Data Retention Period The storage period for personal data may vary depending on the type of personal data collected and the purpose of processing. Data processing shall be carried out either for (i) the period specified by law; (ii) or until the relevant purpose applicable to the specific data ceases. For example, data relating to your orders will be processed for as long as the Data Controller may be required to retain such data under applicable law, and will be deleted once this lawful purpose ceases. Newsletter The data will be stored until you withdraw your consent to its processing and opt out of receiving the newsletter, extended by the time it takes to fulfill the request, up to a maximum of 30 days. Contact Form The data will be processed until we respond to the submitted inquiry and end the contact. User Account Personal data will be processed until an instruction to delete the User account is submitted, extended by the time it takes to fulfill the request, up to a maximum of 30 days. Further data in a limited scope may be stored until the statute of limitations for possible claims from historically made purchases. Marketing Data processed for direct marketing purposes, including profiling, will be processed until the data subject objects to further processing. Your entitlements Anyone whose data is being processed is entitled under the RODO to:

1. The right to access your data and receive a copy of it;
2. The right to rectification (correction) of your data if they are incorrect or outdated, as well as the right to erasure, when the processing of data does not take place for fulfilling an obligation under the law or in the exercise of public authority;
3. The right to restrict processing;
4. The right to object to the processing of personal data concerning him/her on the basis of the Administrator’s legitimate interest (Article 6(1)(f) RODO), including profiling under these provisions;
5. The right to object to the processing of personal data concerning him/her for direct marketing purposes, including profiling, to the extent that the processing is related to such direct marketing;
6. The right to withdraw consent, to the extent that they are processed on that basis; withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal;
7. The right to portability of personal data, i.e., to receive your personal data from the Administrator, in a structured, commonly used machine-readable format;
8. The right to lodge a complaint with the President of the Office for Personal Data Protection (to the address of the Office for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw).

To do so, contact us at: contact@kust.com or by mail to: KUST. sp. z o.o., ul. ARMII KRAJOWEJ, nr 116, lok. 15, 81-824 Sopot, Poland. Profiling To market the Administrator’s products and services with the intention of preparing an individualized commercial offer, the Administrator may use profiling. Profiling means processing personal data involving the use of your personal data to evaluate some of your characteristics, particularly to analyze or forecast aspects of your personal preferences. Data subject to profiling includes gender, first name, postal code, and date of birth, which are used to select the commercial information sent to you about products tailored to your needs. Providing the aforementioned personal data and giving your consent to the personalization of commercial information is voluntary but necessary if you wish to receive commercial information about products from us, as we only send personalized commercial information. Cookies Policy The website of the Service (KUST. online store) uses “cookies.” Cookies are small files that allow the device used to browse the Internet (e.g., computer, smartphone, etc.) to remember specific information about the device being used. The information recorded in cookies ensures the proper operation of Service and supports the use of its functionalities. Some cookies record statistical data and help to provide personalized content to users, and are used, among other things, for statistical purposes and to customize our services to your individual needs. You can change your cookie settings in your web browser. If you leave these settings unchanged, cookies will be stored in the memory of your device. Changing the settings regarding cookies may limit the