• 1 General Provisions

The personal data administrator for users of the website located at the domain www.salesmonopoly.com is SALES MONOPOLY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, based at: ul. Wagrowska 12G/3, 61-369 Poznań, registered in the Polish National Court Register (Krajowy Rejestr Przedsiębiorców) maintained by the District Court of Poznań — Nowe Miasto and Wilda in Poznań, VIII Commercial Division of the National Court Register under the number: 0001143549, with a tax identification number (NIP): 7822948680 (hereinafter referred to as the „Administrator”).
The Administrator has designated an electronic contact point intended for direct communication with the authorities of the Member States, the Commission, the Digital Services Council: info@salesmonopoly.com. This same contact point can be used by any Customer for direct and rapid communication with the Administrator. The Administrator can also be contacted in writing at its address: ul. Wagrowska 12G/3, 61-369 Poznań, or via the contact form available on the website. Communication can be conducted in Polish, Spanish, or English.The purpose of this Policy is to define the actions taken concerning personal data collected through the Administrator’s website and related services and tools used by its users, as well as within the framework of activities involving the conclusion and implementation of contracts outside the website.
If necessary, the provisions of this Policy may be amended. Changes will be communicated to users by publishing the new content of the Policy, and in the case of individuals who have consented to the processing of data via email or provided email data during contract execution, they will also be notified by email.

• 2 Basis for Processing, Objectives, and Storage of Personal Data

Users’ personal data is processed in accordance with the General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 of December 5 on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD), the Spanish Law 34/2002 of July 11 on Information Society Services and Electronic Commerce (LSSI-CE), and Law 11/2022 of June 8 — General Telecommunications Law, along with their subsequent amendments, and for the purpose of making a notification under Article 16(1) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of October 19, 2022, on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (OJ EU L 2022.277.1 as amended; „DSA”) also under Article 3(h) of the DSA.The Administrator may collect the following data for the following purposes:The Administrator may use profiling for direct marketing purposes, but decisions based on it do not concern the conclusion or refusal to conclude a contract, nor the possibility of using electronic services. The outcome of profiling may include, for example, granting a discount to a person, sending them a discount code, reminding them of unfinished purchases, sending a product proposal that may match their interests or preferences, or offering better conditions compared to the standard offer. Despite profiling, the person freely decides whether they want to take advantage of the discount received or better conditions and complete the purchase. Profiling involves the automatic analysis or prediction of a person’s behavior on the Administrator’s website, for example, by adding a specific product to the cart, browsing a specific product page, or analyzing their activity history on the website. A condition for such profiling is that the Administrator has the person’s personal data to, for instance, send them a discount code.To the extent necessary for the proper functioning of the website and its functionalities, the website may, while being used by the User, collect other information, including, among others:

• IP address;
• Information about the device, hardware, and software, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising [“IDFA”] or Android Advertising Identifier [“AAID”]);
• Platform type;
• Settings and components;
• Data concerning the internet browser, including the type of browser and preferred language.

Considering the nature, scope, context, and purposes of processing, as well as the risk of violating the rights or freedoms of natural persons with varying probabilities and severity of threats, the Administrator implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with the regulation and that it can be demonstrated. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent unauthorized persons from acquiring and modifying personal data transmitted electronically.

• 3 Data Sharing (continued)

The Administrator may share anonymized data (i.e., data that does not identify specific users) with external service providers to better understand the appeal of advertisements and services to users. In this context, due to the location of software providers, data may be transferred—while maintaining protection principles—to third countries that meet the standard contractual clauses approved by the European Commission for personal data processing or have the relevant authorization to do so under bilateral data processing agreements between the European Union and the respective third country, which is not a member of the European Economic Area. The entities involved, in the case of the Administrator, include:

• Google LLC. (Headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for tools such as Google Analytics (used for analyzing website statistics), Google Tag Manager (used for managing scripts by easily adding code snippets to the website or app and tracking user actions on the website), Google Ads (used for displaying sponsored links in Google search results and on pages that participate in the Google AdSense program), and Google Workspace (enabling comprehensive editing of the website and coordinating the work of individuals working on it, including Google Drive, Gmail, Google Sheets, Google Forms, and Google Looker Studio).
• Meta Platforms, Inc. (Headquarters: 1601 Willow Road, Menlo Park, CA 94025, USA) for Facebook Pixel, which tracks conversions from Facebook ads, optimizes them based on collected data and statistics, and builds targeted audience lists for future ads.
• Microsoft Corporation (Headquarters: One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) for analytical tools such as Microsoft Clarity, used for analyzing website statistics and tracking user activities on the website.
• Stripe, Inc. (Headquarters: 354 Oyster Point Boulevard, South San Francisco, California, 94080, USA, or 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland) for data necessary to process, authorize, and verify payments as well as parties involved in such payments.

The Administrator will always inform users about the intention to transfer personal data out