Privacy Policy (EN)

1. General provisions

1.1. This Privacy Policy sets out the rules for the processing and protection of personal data of users who use the website operated by the Controller.

1.2. The controller of personal data is MF PRODUCTION SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office at Stare Miasto, ul. Chmielna 3, 37-300 Leżajsk, Poland, NIP (Tax Identification Number) 5252985601, REGON 52724872300000 (the “Controller”).

1.3. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”) and the applicable national data protection laws.

1.4. You can contact the Controller via e-mail: hello@zanzandrink.com.

1.5. The Controller has not appointed a Data Protection Officer, as there is no obligation to do so under Article 37 of the GDPR.

2. Scope of processed data

2.1. The Controller processes personal data provided voluntarily by the user via the contact form, in particular: name and surname, e-mail address, phone number, company name and the content of the message.

2.2. The Controller may also process data collected automatically when using the website, such as: IP address, device and browser data, traffic sources, cookie identifiers, and data on user activity on the website.

2.3. Data may be obtained directly from the user or collected automatically through technologies used on the website.

3. Purposes of processing and legal bases

3.1. Responding to enquiries submitted via the contact form – legal basis: Article 6(1)(a) GDPR (consent) and Article 6(1)(b) GDPR (steps taken prior to entering into a contract).

3.2. Conducting the Controller’s own marketing activities, including sending commercial information and carrying out promotional activities – legal basis: Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR (the Controller’s legitimate interests).

3.3. Website traffic analysis and statistics – legal basis: Article 6(1)(f) GDPR.

3.4. Compliance with legal obligations, including accounting and archiving obligations – legal basis: Article 6(1)(c) GDPR.

3.5. Establishing, pursuing or defending claims – legal basis: Article 6(1)(f) GDPR.

4. Data recipients

4.1. Personal data may be disclosed to entities providing hosting, IT, e-mail, accounting, marketing or other services to the Controller, where such disclosure is necessary to achieve the purposes of processing.

4.2. If external analytics or marketing services are used, data may be shared with such entities only to the extent necessary for the proper functioning of those services.

4.3. Data may be transferred outside the European Economic Area, but only in accordance with applicable law and on the basis of appropriate safeguards, such as standard contractual clauses.

5. Data retention period

5.1. Data provided via the contact form is stored for the period necessary to handle the enquiry, and then for a maximum of 24 months.

5.2. Data processed on the basis of consent for marketing purposes is stored until the consent is withdrawn.

5.3. Data related to compliance with legal obligations (e.g., accounting) is stored for the period required by law.

5.4. Technical and analytical data is stored for the lifetime of cookies or for the period required by analytics tool providers.

6. Rights of the data subject

The user has the right to:

  • access their data,
  • rectify data,
  • erase data,
  • restrict processing,
  • data portability,
  • object to processing,
  • withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The user also has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland.

7. Cookies

7.1. The website uses cookies that are necessary for its proper operation and—depending on the user’s consent—analytical and marketing cookies.

7.2. Cookies may be used in particular to:

  • ensure proper operation of the website,
  • analyze traffic statistics,
  • tailor content and advertising.

7.3. The user can manage cookie settings via their browser settings or tools provided on the website.

8. Automated decision-making and profiling

The Controller does not make decisions about users solely by automated means. Data may be used for marketing activities based on an analysis of user activity; however, such activities do not produce legal effects for the user.

9. Voluntary provision of data

Providing personal data is voluntary, but necessary to use the contact form and receive a response. Failure to provide data may make it impossible to provide these services.

10. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy. The current version of the document is published on the website together with its effective date.