Privacy Policy of CardHorizon.com Online Store

Effective as of 6 November 2025

This document is a translation of the original Privacy Policy in Polish. In the event of any discrepancies or legal disputes, the Polish version shall prevail.

This Privacy Policy explains what information we collect when you use the services offered by the CardHorizon.com online store. It details how we collect your data, the purposes and methods of its use, where it is stored, and how we protect it. We also inform you about your rights under applicable law.

If you have any questions that are not answered here, please contact us at [email protected] or at our mailing address: Card Horizon Sp. z o.o., Pruszkowska 17, 02-119 Warsaw, Poland.

The purpose of this Privacy Policy is to fulfill the information obligation specified in Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").

1. Data Controller

Card Horizon Sp. z o.o., a limited liability company based in Warsaw, Poland (the "Store"), manages the online store and provides all Electronic Services offered through it. The controller of your personal data processed for the purposes related to the provision of electronic services (e.g., Contact Form, Newsletter) and data processed in the legitimate interests of the controller (e.g., marketing) is:

Card Horizon Spółka z ograniczoną odpowiedzialnością
Registered office: Pruszkowska 17, 02-119 Warsaw, Poland
KRS: 0001175729
NIP: 7011262782
REGON: 541888854

2. Data Processing

A) Creating a User Account

To create a user account, you must provide an email address and a password (which is encrypted, so we do not have access to it). Without this information, we cannot provide the User Account service. You are responsible for the security of your password — do not share it with others.

B) Data Collected While Using Our Services

(a) Technical data about your devices: internet/network connection details (including IP address), mobile device identifier, operating system, browser type, hardware information, and other technical details provided by your browser.

(b) Usage details: when and how you use CardHorizon.com, traffic data, location data, purchase history and selected links, your preferences and language, communications via chat.

(c) Support-related information needed to assist you with inquiries or reports.

(d) Additional information you provide while using our services.

C) Payment Data Processing

Payment data processing depends on the payment method/platform/operator. The Store only processes limited, encrypted/anonymized payment data. After completing a transaction, we receive a notification from the payment operator confirming receipt of the purchased goods. We do not access actual payment details.

D) Profiling

Based on your activity in our online store, we may use profiling — an automated analysis of certain user characteristics, using data such as browsing history, interaction history, purchase history, and location data. Profiling does not significantly affect decisions, has no legal consequences, and does not otherwise substantially impact users.

E) Purpose of Profiling

Profiling helps us create, present, and execute offers tailored to specific users, potentially influencing purchasing decisions (e.g., personalized, time-limited offers). You retain the right to human intervention from the Administrator, the right to express your viewpoint, and the right to challenge decisions made through profiling.

F) Contact for Marketing and Support

We may use your personal data to contact you by phone, email, or other electronic means for marketing and support purposes.

G) Order Processing

When placing an order, we may process: first and last name, login and password, email address, phone number, Tax ID (NIP) / REGON (for businesses), company name, and address.

H) Voluntary Data Provision

You are not obligated to provide us with data. Refusal may result in: inability to process your order, inability to use the User Account service, inability to receive the Newsletter, inability to issue an invoice, or generic (non-personalised) presentation of offers.

3. Purposes of Processing and Legal Basis

• Facilitating and fulfilling contracts (processing orders, payment, shipment, order-related communication) — Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: for the time necessary to fulfill the order.
• Fulfilling tax and accounting obligations (issuing and archiving invoices) — Legal basis: legal obligation (Art. 6(1)(c) GDPR, Art. 74 Polish Accounting Act). Retention: 5 years from the end of the calendar year of the relevant event.
• Anti-money laundering / counter-terrorist financing compliance — Legal basis: legal obligation (Art. 6(1)(c) GDPR, Art. 33(1) AML Act). Retention: 5 years from the end of the business relationship or occasional transaction.
• Handling returns or withdrawals from contracts — Legal basis: legal obligation (Art. 6(1)(c) GDPR, Art. 27 et seq. Consumer Rights Act). Retention: for the time necessary to complete the process.
• Providing access to the online store — Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Retention: for the duration of using the store's services.
• Providing, maintaining, and servicing User Accounts — Legal basis: performance of a contract (Art. 6(1)(b) GDPR); consent for non-essential data (Art. 6(1)(a) GDPR). Retention: for the duration of service usage or until consent is withdrawn.
• Analyses and statistics on user activity — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: until an objection is raised.
• Analyzing user activity and store security — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: until an objection is raised.
• Marketing without profiling (newsletters, surveys, telemarketing) — Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Retention: until an objection is raised.
• Marketing with profiling — Legal basis: consent (Art. 6(1)(a) GDPR). Retention: until consent is withdrawn.
• Handling inquiries and submissions to the Store — Legal basis: pre-contractual steps (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f) GDPR). Retention: until the communication is completed.
• Handling complaints; establishing, pursuing, and defending claims — Legal basis: consent (Art. 6(1)(a) GDPR) and legitimate interest (Art. 6(1)(f) GDPR). Retention: until the statute of limitations expires, max. 6 years from the end of the relevant calendar year.
• Handling requests from authorized bodies (courts, law enforcement) — Legal basis: legal obligation (Art. 6(1)(c) GDPR). Retention: for the time necessary to fulfill the request.
• Handling requests related to exercising data subject rights — Legal basis: legal obligation (Art. 6(1)(c) GDPR, Art. 15–22 GDPR). Retention: 5 years from fulfilling the request.

4. Cookies

Our Store may collect data using cookies or similar technologies — small text files stored on your device that let websites recognize your device and remember information (e.g., settings, cart contents), improving functionality and performance.

Types of cookies used:

• Essential cookies — necessary for the proper functioning of our services (e.g., secure areas, preventing unauthorized use of login credentials). Disabling them may significantly affect how we provide our services.
• Preference cookies — remember your choices (e.g., customization, whether you've already been asked about promotions). You can disable or reject these.
• Statistics cookies — help us understand how you use the Store, detect issues, and measure the effectiveness of features and advertisements. You can disable or reject these.
• Marketing cookies — targeting and advertising cookies, potentially used by our service providers, to deliver more relevant ads and measure campaign effectiveness. You can disable or reject these.
• Unclassified cookies — cookies we have not yet categorized.

We may collaborate with third parties who use their own cookies to collect information about your use of our services and the ads you click on, which may be used to deliver more relevant ads or measure their effectiveness. You can choose to disable or reject these.

You can disable cookies at any time via your browser settings. Please note that disabling cookies may prevent some features of our services from functioning as intended.

5. Data Storage

All information you provide is stored on secure servers, ours or those of our trusted partners. We implement technical and organizational security measures appropriate to the risks involved to protect your personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy. Longer retention periods may apply where required by tax, accounting, or other legal obligations. If your data is no longer necessary, we will promptly delete or anonymize it.

The Terms and Conditions of the CardHorizon.com online store may separately describe data-processing rules; in such cases, those detailed terms may take precedence over or supplement this Policy.

6. Sharing Information

As a general rule, we do not share your data externally. The exception is our Trusted Partners, who help us deliver CardHorizon.com's services and functionalities, and who receive only the minimum information necessary. These include (as Data Processors):

• providers of internal communication tools and data-sharing platforms;
• providers of data analysis tools;
• providers of email marketing tools;
• providers of error tracking and reporting tools;
• customer support system providers;
• our professional advisors (legal, tax, accounting, audit);
• social media platforms, for personalized and targeted communication;
• providers who help us deliver the products you have purchased.

We use the Shopify platform to provide our online store services. Shopify processes users' personal data on our behalf and in accordance with our guidelines and GDPR; Shopify does not have the right to use users' personal data for its own marketing or other purposes inconsistent with this Policy. More information is available in Shopify's Terms of Service.

During the payment process, we may also share information with trusted partners who process it independently as data controllers: payment processors, banks and financial institutions, and providers verifying payment fraud.

Where required by law, we may share your data with the police or other authorities (e.g., IP address and details of suspicious activity such as unauthorized use of a payment method).

As a general rule, we do not process, store, or transfer your personal data outside the European Economic Area (EEA). In exceptional cases, data may be transferred outside the EEA and Switzerland (e.g., to the United States or Canada); in such cases we ensure an adequate level of protection, relying on legally recognized bases such as the EU Standard Contractual Clauses.

7. User Rights

You have the right to object at any time to the processing of your personal data in certain situations (e.g., marketing), by contacting us, changing your account settings, or using the subscribe/unsubscribe option in our messages.

Under EU law, you also have the right to: access your data; request deletion of your data; correct your data; restrict processing; transfer your data to another entity; and file a complaint with a data protection authority. You can exercise these rights by contacting us at [email protected]. For verification purposes, we may ask for additional information to confirm your identity.

Right to Data Deletion

You have the right to request immediate deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you have withdrawn consent; you object to the processing; or the data was processed unlawfully. Requests can be sent to [email protected].

For data collected through analytical and advertising tools integrated with our website (e.g., Meta Pixel, Google tracking codes, YouTube plugins), you can also manage your data directly in the privacy settings of those external platforms.

These rights may be limited by other legal provisions — for example, the right to erasure may be restricted where processing is necessary to fulfill a legal obligation, such as our duty under Art. 74(2)(1) of the Polish Accounting Act to retain accounting records for 5 years from the end of the fiscal year to which they pertain.

If you believe we have not handled your request properly, you may report this to the President of the Personal Data Protection Office (PUODO) in Poland, or to your local data protection authority.

8. Changes to This Privacy Policy

This Privacy Policy may change due to changes in legal regulations or in the services of the CardHorizon.com online store. Any changes will be made in a way that does not restrict your rights; the updated Policy will be published online and you will be notified. Changes take effect 14 days after publication. During this period, you may contact us with any questions.

If you do not agree to changes, we may ask you to discontinue using CardHorizon.com's services, to maintain uniform rules for all users.

9. Contact and Data Protection Officer

Card Horizon Spółka z ograniczoną odpowiedzialnością
Pruszkowska 17, 02-119 Warsaw, Poland
Email: [email protected]
Data Protection Officer: Michał Matusiewicz — [email protected]

10. Rights of the Data Subjects (Summary)

• Right of access to your data, free of charge (Art. 15(1) GDPR).
• Right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), and restriction of processing (Art. 18 GDPR).
• Right to object where processing is based on Art. 6(1)(e) or (f) GDPR (Art. 21 GDPR); processing will stop unless we demonstrate compelling legitimate grounds that override your interests.
• Right to data portability, where you provided the data yourself (Art. 20 GDPR).
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (where processing is based on consent).

You also have the right to lodge a complaint with the supervisory authority responsible for data protection. In Poland, the competent authority is the President of the Personal Data Protection Office (Stawki 2, 00-193 Warsaw, phone: +48 22 531-03-00, email: [email protected]).

---

Card Horizon Sp. z o.o. · Pruszkowska 17, 02-119 Warsaw, Poland · [email protected]