PRIVACY POLICY

TOWARY ORLA LIMITED

Website: www.towaryorla.pl

Date of preparation: September 16, 2026

1. Introduction

This Privacy Policy sets out the principles for collecting, using, storing, and protecting the personal data of users of the Towary Orla online store, available at www.towaryorla.pl.

The personal data controller is Towary Orla Limited, a company registered in Hong Kong.

The Controller undertakes to process personal data in accordance with applicable laws, in particular:

• Personal Data (Privacy) Ordinance (Cap. 486), applicable in Hong Kong;

• Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), to the extent it applies;

• the relevant provisions of Polish law regarding personal data protection and electronic communications.

The Controller takes reasonable care to ensure that personal data is collected lawfully, used for specified purposes, and appropriately secured.

When using the Store, the user may read this Privacy Policy before submitting their personal data.

Simply using the Store does not constitute consent to the processing of data for purposes for which applicable laws require separate consent.

2. Personal Data Controller

The personal data controller is:

Company name: Towary Orla Limited

Registration number: 79778773

Registered address:

RM 1911A, UNIT F, 19/F,

GOLDEN BEAR CENTRE,

66 CHAI WANKOK STREET,

TSUEN WAN, HONG KONG

Email address: info@towaryorla.pl

Website: www.towaryorla.pl

The Controller is responsible for determining the purposes and means of processing personal data and for complying with applicable laws regarding its protection.

In matters related to personal data, including to obtain access to data, correct it, or submit a request for erasure, you may contact the Controller at:

info@towaryorla.pl

The Controller considers requests regarding personal data in accordance with the relevant laws.

3. Scope of Personal Data Collected

In connection with using the Store, the Controller may collect and process the following categories of personal data:

3.1. Identification data

• first and last name;

• company name, if the Customer makes a purchase as an entrepreneur;

• other data necessary to identify the Customer, if required by law.

3.2. Contact data

• email address;

• phone number;

• delivery address;

• billing address.

3.3. Order and Payment Data

• order number;

• purchase history;

• purchased products;

• order value;

• selected payment method;

• payment status;

• transaction identifier;

• information regarding delivery, returns, and complaints.

Payment card data may be processed by third-party payment processors in accordance with their own security standards and privacy policies. The scope of data received by the Controller depends on the payment method used.

3.4. Technical Data

When using the Store, the following may be collected:

• IP address;

• web browser information;

• device type and operating system;

• date and time of visit;

• information about how the website is used;

• cookie identifiers, if used.

3.5. Data Provided Voluntarily

The Controller may also process data provided voluntarily when contacting us by email, submitting a complaint, sending a contact form, or signing up for the newsletter.

The Controller does not require special categories of personal data, such as health data, religious beliefs, or political views, to make a standard purchase.

Users are asked not to provide such data unless it is genuinely necessary to consider a specific matter.

4. Purposes of Processing Personal Data

The Controller processes personal data solely for specified, lawful purposes.

4.1. Order Fulfillment

Personal data is processed for the following purposes:

• receiving and confirming orders;

• concluding and performing sales contracts;

• preparing and shipping products;

• processing payments;

• informing about order status;

• handling returns and complaints.

4.2. Customer Service

Data may be processed to answer questions, resolve order-related issues, and correspond with Customers.

4.3. Customer Account Management

If the Store allows users to create an account, data is processed to create and maintain the account and provide access to order history.

4.4. Legal and Tax Obligations

The Controller may process data to fulfill obligations arising from applicable laws, including provisions on accounting, taxes, and sales documentation.

4.5. Store Security

Data may be used for the following purposes:

• protection against unauthorized access;

• detecting and preventing fraud;

• securing transactions;

• protecting IT infrastructure;

• establishing, investigating, or defending claims.

4.6. Marketing and Newsletter

Personal data may be used to send commercial information, promotional offers, and newsletters only after meeting the conditions specified in applicable laws, in particular after obtaining the required consent.

Users may opt out of receiving marketing communications at any time.

4.7. Store Analytics and Optimization

If the Controller uses analytical tools, data may be processed to analyze how the website is used, identify technical issues, and improve Store functionality.

Analytical tools requiring user consent are only activated after such consent is obtained.

5. Legal Bases for Processing Data

To the extent that the GDPR applies, personal data is processed on the following legal bases:

To the extent that the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486) applies, the Data Controller complies with the principles of lawful and fair collection, purpose limitation, data accuracy, retention period, security, transparency, access to data, and correction of data.

Personal data will not be used for new purposes unrelated to the original purpose for which it was collected without meeting the conditions set out in applicable laws, including obtaining the required consent.

 

6. Voluntary provision of data

The provision of data is generally voluntary.

However, some data is necessary to enter into and perform the sales contract, in particular:

• first and last name;

• delivery address;

• email address;

• data necessary to process payment;

• data required to issue appropriate sales documents.

Failure to provide this data may prevent the order from being placed or fulfilled.

Providing data for marketing purposes, including signing up for the newsletter, is voluntary and is not a condition of making a purchase.

The user may refuse consent for marketing without affecting their ability to use the basic functions of the Store.

7. Data recipients

The Data Controller may only share personal data with entities that need it to achieve specified purposes or to whom the data must be transferred under applicable laws.

Such entities may include:

7.1. Transport and courier companies

Entities responsible for delivering the ordered products, to the extent necessary to fulfill the delivery.

7.2. Payment operators

Payment service providers supporting the payment methods available in the Store.

7.3. IT service providers

Entities providing hosting, website maintenance, sales system support, and IT infrastructure security services.

7.4. Accounting and legal service providers

Entities assisting the Data Controller in fulfilling tax and accounting obligations, and in pursuing or defending claims.

7.5. Communication and marketing service providers

Newsletter service providers and analytics or advertising tool providers, where the Data Controller uses such services and the relevant legal requirements have been met.

7.6. Public authorities

Data may be disclosed to authorized state authorities, courts, or other institutions if such an obligation arises from applicable laws.

The Data Controller does not sell Customers' personal data to third parties.

When using data processors acting on behalf of the Data Controller, appropriate contractual and organizational measures are taken to ensure data protection.

8. International transfer of personal data

Towary Orla Limited is headquartered in Hong Kong and operates through an online store aimed at Customers in Poland, among others.

Consequently, personal data may be processed in Hong Kong and other countries where the service providers used by the Data Controller operate.

Data may be transferred outside the European Economic Area if this is necessary to fulfill the order or perform other lawful activities.

The Data Controller takes into account the requirements of the Personal Data (Privacy) Ordinance and the GDPR to the extent they apply.

If a specified data transfer is subject to Chapter V of the GDPR, the Data Controller ensures an appropriate transfer basis, in particular by applying the appropriate safeguards provided for by the GDPR, such as standard contractual clauses, where required and appropriate.

If necessary, the Data Controller will implement additional data protection measures.

Information about the data transfer mechanisms used and the ability to obtain a copy of the appropriate safeguards can be obtained by contacting:

info@towaryorla.pl

9. Cookies and similar technologies

The Store may use cookies and similar technologies to ensure the proper functioning of the website, support the shopping cart, maintain user sessions, and perform other functions.

Depending on the actual configuration of the Store, the following categories of cookies may be used:

9.1. Strictly necessary cookies

Strictly necessary cookies are used to ensure the basic functioning of the Store.

They may enable:

• remembering the contents of the shopping cart;

• maintaining the user session;

• securing login processes;

• properly carrying out the purchasing process;

• remembering privacy setting decisions.

If they are strictly necessary to provide the service requested by the user or to transmit a message, their use does not require separate consent under the principles provided for in applicable laws.

9.2. Functional cookies

Cookies may be used to remember user preferences, such as the website language or interface settings.

Unless their use falls under an exception provided for in applicable laws, they will only be used after obtaining appropriate consent.

9.3. Analytical cookies

If the Store uses analytics tools such as Google Analytics, they may be used to collect information about how the website is used.

Analytics technologies requiring consent will only be activated after consent is obtained.

9.4. Marketing cookies

If advertising tools are used in the Store, cookies may be used to measure advertising effectiveness and personalize advertising content.

Cookies used for marketing purposes that require consent will not be activated before consent is given.

9.5. Consent management

The user should be able to:

• accept optional cookies;

• reject optional cookies;

• select individual categories;

• change previous settings;

• withdraw consent at any time.

Withdrawal of consent should be as easy as giving it.

The user can also manage cookies using their web browser settings.

Disabling strictly necessary cookies may cause some Store functions to malfunction.

Detailed information about the cookies actually used, their providers, purposes, and validity periods should be available in the Store's cookie settings.

The rules for obtaining cookie consent applied to users in Poland arise, among others, from Art. 399 of the Electronic Communications Law.

 

10. Personal data retention period

The Data Controller retains personal data only for the period necessary to achieve the purpose for which it was collected, unless a longer retention period is required by law or justified by the need to establish, exercise, or defend claims.

In particular:

10.1. Order data

Data is retained for the period necessary to fulfill the order, handle returns and complaints, and then for the period resulting from applicable laws regarding sales documentation, tax obligations, and the statute of limitations on claims.

10.2. User account data

If the Store allows users to create accounts, data is retained for the duration of the account and, after its deletion, only to the extent necessary to fulfill legal obligations or protect legitimate claims.

10.3. Marketing data

Data processed on the basis of consent is used until it is withdrawn or the specific processing purpose ends earlier.

After consent is withdrawn, the Data Controller ceases processing data for the purpose covered by the consent, unless there is a separate legal basis for continuing to retain specific information.

10.4. Technical data

Technical data and system logs are retained for the period necessary to ensure the security and proper functioning of the Store.

10.5. Cookies

The retention period of cookies depends on their type and purpose. Detailed validity periods should be indicated in the cookie list provided to the user.

After the appropriate retention period expires, data is deleted or anonymized, unless further retention is required by law.

11. Rights of data subjects

Every person whose personal data is processed may exercise the rights arising from the provisions applicable to that processing.

11.1. Rights under the GDPR

To the extent that the GDPR applies, the user may have the right to:

• access their personal data;

• receive a copy of the processed data;

• rectify incorrect data;

• delete data in cases specified by law;

• restrictions on processing;

• data transfers;

• objecting to processing;

• withdrawing consent at any time;

• not being subject to certain decisions based solely on automated processing, where provided by law;

• lodging a complaint with the relevant supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

11.2. Rights under Hong Kong law

Under the Personal Data (Privacy) Ordinance (Cap. 486), the data subject may, in particular:

• request information on whether the Data Controller holds their personal data;

• request access to their data;

• obtain a copy of the data on the terms set out in the law;

• request the correction of inaccurate data.

Requests for access to and correction of data are considered in accordance with the requirements of Hong Kong law, including within a reasonable timeframe, which is generally 40 days.

In the case of a request for access to data, Hong Kong law allows a fee to be charged, provided that it is not excessive. This does not affect the right to exercise GDPR rights free of charge, where applicable.

 

11.3. How to exercise your rights

To exercise your rights, please send a message to:

info@towaryorla.pl

The message should specify the request you wish to make.

The Data Controller may request additional information necessary to verify the identity of the person making the request, where this is justified and permitted by law.

Requests subject to the GDPR will be considered without undue delay, generally within one month of receipt. Where provided for by law, this period may be extended, and the requester will be informed accordingly.

12. Direct marketing

The Data Controller may process personal data for direct marketing purposes only in accordance with applicable law.

In particular:

1. Personal data will not be used to send marketing messages without the required consent.

2. Consent to receive the newsletter is voluntary.

3. Not consenting to marketing does not prevent you from making a purchase.

4. You may withdraw your consent to marketing or object to the continued use of your data for this purpose at any time.

5. Opting out of marketing is free of charge.

6. Personal data will not be transferred to other parties for their own marketing purposes unless appropriate legal requirements are met, including obtaining separate consent where required.

To opt out of receiving marketing messages, you can use the unsubscribe mechanism provided in the message or send a request to:

info@towaryorla.pl

Upon receipt of a valid request, the Data Controller will stop using personal data for that marketing purpose.

13. Personal data security

The Data Controller undertakes to use appropriate technical and organisational measures to protect personal data.

Security measures are selected with due regard to the nature of the data, the extent of its processing, the risks, and available technical solutions.

Data protection may include, among other things:

• encryption of data transmissions;

• access control to IT systems;

• securing administrative accounts;

• restricting data access to authorised persons only;

• software updates;

• implementing appropriate security procedures;

• protecting data against accidental loss, destruction and unauthorised disclosure.

The Data Controller takes appropriate measures to ensure that data processors acting on its behalf use the required security measures.

In the event of a personal data breach, the Data Controller takes measures to mitigate its effects and fulfils its notification and reporting obligations where provided for by law.

14. Automated decision-making and profiling

If the Data Controller uses tools that enable the personalisation of offers or the analysis of purchasing preferences, data processing is carried out in accordance with applicable law.

If automated decision-making, including profiling that produces legal or similarly significant effects concerning the user, is implemented, the Data Controller will provide the required information about the principles of such processing, its significance and the expected consequences, and ensure the user's appropriate rights.

15. Personal data protection complaints

Anyone who believes that their personal data is being processed unlawfully may contact the Data Controller directly:

info@towaryorla.pl

The Data Controller will take measures to investigate the reported matter.

To the extent that Hong Kong law applies, a complaint may be submitted to:

Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD)

Website: www.pcpd.org.hk 

To the extent that the GDPR applies, the data subject may also lodge a complaint with the relevant supervisory authority.

In Poland, such an authority is:

President of the Personal Data Protection Office (UODO)

Website: uodo.gov.pl 

Contacting the Data Controller does not affect the right to lodge a complaint with the relevant supervisory authority.

16. Privacy Policy Changes

1. The Data Controller may update this Privacy Policy in the event of changes in law, the way the Store is operated, the technologies used, or the purposes of data processing.

2. The current version of the Privacy Policy will be made available on the website www.towaryorla.pl.

3. The date of the document's last update will be indicated in its content.

4. If changes require providing additional information to users or obtaining new consent, the Data Controller will take the measures required by applicable law.

5. A change to the Privacy Policy does not in itself constitute a basis for processing data for new purposes without meeting the appropriate legal requirements.

17. Contact

If you have questions about this Privacy Policy, personal data processing, the exercise of user rights, or the use of cookies, please contact:

Towary Orla Limited

RM 1911A, UNIT F, 19/F,

GOLDEN BEAR CENTRE,

66 CHAI WANKOK STREET,

TSUEN WAN, HONG KONG

Email address: info@towaryorla.pl

Website: www.towaryorla.pl

Registration number: 79778773

Important information before publication

This document is a draft Privacy Policy prepared with due regard to Hong Kong law and the laws applicable to the Store targeting consumers in Poland.

Before publishing the document, you should:

1. Verify the actual analytics and marketing tools and cookies used in the Store and complete their detailed list, including providers and retention periods.

2. Verify the actual retention periods for each category of data and update the document with specific dates or criteria for determining them.

3. Check whether the Data Controller is required to appoint a representative in the European Union under Article 27 of the GDPR. If this obligation applies, appoint a representative and publish their contact details.

4. Verify the locations of service providers and the legal basis for any international data transfers.

5. Check whether the Store actually uses the described security measures and has a functional cookie consent management mechanism.

6. Adapt the content of the Privacy Policy to the actual operation of the Store.

The document should be reviewed before publication. Simply posting a Privacy Policy on a website does not ensure that data processing operations comply with the law.