When visiting tylko.com, you may be asked to share some of your personal information. This is obtained to give you the best possible experience. Whenever you share your personal information, we make sure it's processed in accordance with applicable laws and to the highest standards of care and safety.

tylko.com processes your personal data in compliance with the provisions of the Regulation (EU) 2016/679 of the European Parliament, of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

The data controller is Tylko S.A. a joint-stock company, having its registered headquarters in Warsaw, Czerska Street 8/10, 00-732 Warsaw, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, under the number KRS 0000983931, with the share capital of PLN 783,486 contributed in full, NIP number 1132882374, REGON: 360163795 (here and after also referred to as "Controller"). The Controller can be contacted via [email protected]. You can contact the Controller on all matters relating to the processing of personal data and the use of data processing rights.

Your personal data is processed to successfully accept and fulfil your order. We may need to share your personal data with third parties to do this, such as storage and delivery companies, banks and online payment providers. Where possible, we'll provide you with information on the processing of your personal data received from a third party. In some instances, we may also be required to share your personal data with public authorities upon their substantiated, specific request.

If you have an account on tylko.com and join the Tylko Club loyalty programme, we will process your personal data so that you can take part in the programme and use the benefits it offers. For this purpose, we may process in particular the data assigned to your tylko.com account, information about your Tylko Club membership, your purchase history and your use of programme benefits, and any other information needed to determine whether you meet the conditions for receiving specific benefits.

This data may be used in particular to display prices reserved for Tylko Club members ("Club Prices"), to grant and administer other benefits available in the programme, and to determine your eligibility for benefits that depend on your purchase history or how long you have been a member. The legal basis for this processing is Article 6(1)(b) GDPR: processing necessary for the performance of the contract concerning your Tylko Club membership, or to take steps at your request before entering into it.

If you choose to provide your date of birth in order to receive the birthday gift offered in Tylko Club, we will process this information so that you can use this benefit. Providing your date of birth is voluntary and is not a condition of Tylko Club membership. Without it, however, we will not be able to grant you the birthday benefit. The legal basis for processing your date of birth is your consent under Article 6(1)(a) GDPR. We will process your date of birth until you withdraw your consent, or until you ask us to delete this information, if that happens earlier. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

When we organise events for Tylko Club members, we may process your personal data to determine whether you are eligible to receive an invitation, select event participants, handle your registration and organise your participation in the event. For this purpose, we may process in particular the data assigned to your account, your contact details, information about your registration or confirmation of attendance, your Tylko Club membership history, your purchase history, and other information related to the eligibility criteria set for a given event. Where such a criterion has been set, this includes information about your social media activity. Where places are limited, this data may be used to apply the participant selection criteria set out in the Tylko Club Regulations. The legal basis for processing data for this purpose is Article 6(1)(b) GDPR: processing necessary for the performance of the contract concerning your Tylko Club membership and for providing the benefits it includes.

Tylko Club membership does not depend on your consent to receive marketing communications. If you give the relevant consent, we may send you information about our products, offers, promotions, events or other Tylko Club benefits through the communication channel you have chosen, in particular email or push notifications. Where personal data is processed for this purpose on the basis of consent, the legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time. This does not affect the lawfulness of processing carried out before its withdrawal. Withdrawing your marketing consent does not affect your ability to remain a Tylko Club member or to use the benefits you are entitled to.

If you use the Tylko app and turn on push notifications, we may process the technical data needed to deliver these notifications. This includes in particular the device or app identifier, the token used to route push notifications, and information about your settings and your consent status for receiving notifications.

Push notifications may be used to send messages about your account or Tylko Club. If you have given the relevant marketing consent, they may also be used to send advertising and marketing content, in particular information about products, promotions, offers, events and benefits available in Tylko Club.

For messages necessary to provide the service or to administer Tylko Club, the legal basis for processing is Article 6(1)(b) GDPR. For push notifications containing marketing communications, the legal basis for processing is your consent under Article 6(1)(a) GDPR.

You may withdraw your consent to marketing via push notifications at any time in the app settings or through any other consent management tool we provide. You can also turn off notifications in your device settings.

We process the data needed for Tylko Club membership for as long as you are a member of the programme. After your membership ends, we keep it only where this is needed to meet legal obligations or to establish, pursue or defend legal claims, for the period required by the applicable laws or until the relevant limitation periods expire.

We process data based on marketing consent until you withdraw that consent, or until the purpose of processing ceases, if that happens earlier. We may keep the information needed to show that consent was given or withdrawn for as long as necessary to demonstrate that we acted lawfully. We process the technical data used to send push notifications for as long as needed to provide this feature, but no longer than until you turn off the relevant feature or the identifier or token concerned is no longer valid.

We may share your personal data, or entrust it to others for processing, only to the extent necessary to achieve the purposes described in this Policy. This includes in particular entities that provide us with IT and hosting services, services related to maintaining the website and app, Tylko Club administration, electronic communications and push notification delivery, as well as payment, logistics, accounting, legal or other services that support our business. If you use push notifications, providers of the technology used to deliver these notifications may also receive certain technical data. We may also share data with public authorities where we are required to do so by law.

We use strict technical and organisational measures to secure all personal data that is processed by tylko.com from loss, destruction or unauthorised access by third parties. We cannot, however, take responsibility for any unauthorized access to your personal data caused by security breaches that might happen in relation to your device, browser or your own negligence.

As with every website, our server automatically collects the following information and temporarily saves it in server log files that are transmitted by your browser, unless you have deactivated this function:

• IP address of the computer transmitting the request
• Client’s file request, the http response code, the volume of data transmitted
• The website from which you access our website (referrer URL)
• Type, version and language of your browser
• Operating system on the computer transmitting the request

Our server log files are not evaluated based on personal use. We cannot allocate this data to specific persons at any time. Also, we do not merge this data with data from other sources.