SoGlossy Website Privacy Policy

TABLE OF CONTENTS:

§ 1. INTRODUCTION (GENERAL INFORMATION)

§ 2. DEFINITIONS OF TERMS USED IN THE PRIVACY POLICY

§ 3. ENTITY RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE OPERATION OF THE SOGLOSSY WEBSITE (DATA CONTROLLER) AND CONTACT DETAILS

§ 4. SCOPE OF DATA PROCESSED IN CONNECTION WITH THE OPERATION OF THE SOGLOSSY WEBSITE, PURPOSES OF PROCESSING AND LEGAL BASES FOR PROCESSING

§ 5. DISCLOSURE OF PERSONAL DATA BY THE CONTROLLER TO OTHER ENTITIES

§ 6. RETENTION PERIODS FOR PERSONAL DATA PROCESSED BY THE CONTROLLER

§ 7. PERSONAL DATA SECURITY

§ 8. COOKIES USED BY THE CONTROLLER

§ 9. PERSONAL DATA PROFILING (ASSESSMENT OF USERS’ INTERESTS AND PREFERENCES)

§ 10. RIGHTS OF INDIVIDUALS WHOSE PERSONAL DATA IS PROCESSED BY THE CONTROLLER

§ 11. BALANCING OF INTERESTS

§ 12. AMENDMENTS TO THE PRIVACY POLICY AND NOTIFICATION OF SUCH AMENDMENTS

§ 1. INTRODUCTION (GENERAL INFORMATION)

  1. This Privacy Policy applies to the Soglossy brand website (hereinafter referred to as the “Soglossy Website”), available at [https://soglossy.pl/]. The Website is intended to present the brand, its products and product range to potential business partners. It also enables contact via a contact form and the email addresses provided on the Website. The Website does not operate as an online store, allow orders to be placed or payments to be made, or enable customers to create accounts.
  2. The Controller respects Users’ privacy and ensures that personal data is processed transparently and securely, in accordance with applicable legal requirements, in particular the GDPR and the Polish Personal Data Protection Act. This Privacy Policy describes how personal data is handled in connection with the operation of the Website and the handling of enquiries, and informs Users of their rights as data subjects. Users may read this Privacy Policy before using the Website or sending a message.
  3. This Privacy Policy applies to the processing of data in connection with the presentation of content on the Soglossy Website, the use of the contact form and correspondence conducted via the email addresses provided on the Website, particularly correspondence concerning products and potential business cooperation.
  4. Individuals using the Website may browse the offer, submit enquiries on their own behalf or contact the Controller as representatives of potential business partners. All such individuals are referred to as “Users” in this Privacy Policy.
  5. Data is obtained primarily from Users and through the technical handling of connections to the Website. If a User provides personal data relating to another individual in correspondence, the Controller processes such data only to the extent necessary to handle the matter in question and provides that individual with the information required under Article 14 of the GDPR, unless a statutory exception applies. The Controller does not collect payment, delivery or order data through the Website.
  6. The Website is primarily intended for potential business partners and is not directed at children. The Controller does not undertake activities through the Website intended to collect children’s personal data. If such data is received, the Controller assesses whether its processing is justified and deletes any unnecessary data or data processed without an appropriate legal basis.
  7. This Privacy Policy does not restrict any rights Users may have under generally applicable law.
  8. The Website may contain links to third-party websites. Once a User visits such a website, the processing of data by its operator is governed by the rules set out in that operator’s privacy policy. Users should familiarise themselves with the information provided by the operator of the website they visit.

 

§ 2. DEFINITIONS OF TERMS USED IN THE PRIVACY POLICY

  1. The terms used in this Privacy Policy have the following meanings:
  2. “Personal Data” – information relating to an identified or identifiable natural person, within the meaning of Article 4(1) of the GDPR;

GDPR;

  1. “Processing of Personal Data” – any operation or set of operations performed on personal data, including collection, recording, storage, use, disclosure or erasure, within the meaning of Article 4(2) of the GDPR;
  2. “Personal Data Profiling” or “Profiling” – any form of automated processing of personal data used to evaluate certain personal aspects of an individual, particularly their preferences, interests or behaviour, within the meaning of Article 4(4) of the GDPR;
  3. “Data Controller” – the entity that determines the purposes and means of processing personal data. In connection with the operation of the Soglossy Website, the Controller is CAT&CAT spółka z ograniczoną odpowiedzialnością, ul. Nawrot 46, 90-014 Łódź, Poland, Tax Identification Number (NIP): 7272784930, National Business Registry Number (REGON): 101317457, which operates the Soglossy brand; email: kontakt@catandcat.eu, telephone: 668443189;
  4. “Terms and Conditions” – the online store terms and conditions referred to in the original policy do not apply to the Soglossy Website. The Website does not operate as an online store, and this Privacy Policy does not refer to the terms and conditions of the CAT&CAT online store;
  5. “Privacy Settings” – a feature of a Store or Account that allows Users to manage services provided through the Store, particularly by modifying the scope of individual services and granting or withdrawing consent to the processing of personal data or the sending of marketing materials, such as newsletters;
  6. “Online Payment” – payment for products made via the Internet. This functionality is not available on the Soglossy Website and does not involve the processing of data through the Website.
  7. “Website” means the Soglossy brand website referred to in § 1(1), “User” means an individual using the Website or contacting the Controller, and “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016. Understanding these terms does not require reference to the CAT&CAT online store terms and conditions.

 

§ 3. ENTITY RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE OPERATION OF THE SOGLOSSY WEBSITE (DATA CONTROLLER) AND CONTACT DETAILS

  1. The Data Controller is CAT&CAT spółka z ograniczoną odpowiedzialnością, which operates the Soglossy brand, with its registered office at ul. Nawrot 46, 90-014 Łódź, Poland, Tax Identification Number (NIP): 7272784930, National Business Registry Number (REGON): 101317457.
  2. For matters relating to the processing of personal data and the exercise of their rights, Users may contact the Controller:
  3. a) By post: CAT&CAT spółka z ograniczoną odpowiedzialnością, ul. Nawrot 46, 90-014 Łódź, Poland; b) By email: kontakt@soglossy.pl

 

§ 4. SCOPE OF DATA PROCESSED IN CONNECTION WITH THE OPERATION OF THE SOGLOSSY WEBSITE, PURPOSES OF PROCESSING AND LEGAL BASES FOR PROCESSING

  1. The scope of data, the purpose of processing and the applicable legal basis depend on how the Website is used and the nature of the User’s contact with the Controller. The information below is organised according to the purpose of processing.
  2. With regard to the Website’s functionality:
  3. The Website presents the Soglossy brand, its products and information about its product range, allowing Users to familiarise themselves with this content;
  4. The Website does not allow users to create, maintain or access customer accounts;
  5. The Website provides a contact form for submitting enquiries, particularly those concerning products and business cooperation.

The contact form is not intended for placing orders;

  1. The Website provides email addresses for contacting the Controller. No newsletter subscription service is operated as part of the Website’s functionality described in this Privacy Policy.
  2. The Controller does not sell products through the Website, accept orders through it or process payments. Any terms of business cooperation are discussed individually, outside any online sales process. Submitting an enquiry through the contact form does not constitute placing an order.
  3. With regard to the presentation of content on the Soglossy Website:
  4. Technical data necessary to display the Website and handle the connection may be processed, particularly the IP address, date and time of the connection, the address of the requested subpage, and information about the browser and operating system;
  5. The legal basis for processing data necessary for the operation and security of the Website is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in making information about the brand available and ensuring the proper functioning of the Website.
  6. With regard to the creation, maintenance and use of accounts:
  7. Account functionality is not available on the Soglossy Website:
  8. The Controller does not collect data for account registration;
  9. The Controller does not maintain customer profiles, order histories or return histories through the Website;
  10. No personal data is processed for the purpose of providing a user account service.
  11. With regard to the contact form:
  12. The Controller processes the information entered by the User, particularly their email address, first and last name, company name, telephone number, if provided, the message content and any data contained in attachments. This data is used to handle the enquiry and provide a response. Providing data is voluntary, but failure to provide contact details may make it impossible to respond. Required fields are marked on the form. Users should provide only information necessary to handle their enquiry;
  13. The legal basis for processing is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in handling correspondence. If a User requests that steps be taken before entering into a contract to which they will be a party, the legal basis for processing to the extent necessary is Article 6(1)(b) of the GDPR. Correspondence with a company representative is handled on the basis of Article 6(1)(f) of the GDPR.
  14. With regard to newsletters:
  15. As part of the Soglossy Website’s functionality described in this Privacy Policy, the Controller does not collect email addresses for newsletter subscriptions;
  16. Submitting the contact form or sending an email does not constitute consent to receive a newsletter or marketing messages unrelated to the enquiry.
  17. With regard to product sales and deliveries:
  18. The Soglossy Website does not collect data for accepting orders, processing online sales or payments, or delivering products;
  19. If separate business cooperation is established as a result of contact, the Controller will provide information about the processing of personal data related to that cooperation, as appropriate to its nature.
  20. With regard to Website security and potential usage statistics:
  21. The Controller uses technical data to the extent necessary to detect errors, ensure security and prevent abuse.
  1. Security-related data may include the IP address, date and time of the connection, the address of the requested subpage, browser and operating system information, and error messages. Any additional analytical data should be specified according to the tools actually used;
  2. The legal basis for processing data to ensure security is Article 6(1)(f) of the GDPR. If additional analytical tools require consent to process personal data, the legal basis is Article 6(1)(a) of the GDPR. The rules governing cookies are described in § 8.
  3. With regard to feedback from Users:
  4. Users may voluntarily submit comments concerning the Website or the offer through the contact form or by email. This provision does not imply that separate surveys or customer satisfaction studies are conducted;
  5. The Controller processes the comments and contact details provided by the User to the extent necessary to consider the feedback and provide a response;
  6. The legal basis for processing is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in handling correspondence and improving the operation of the Website.
  7. With regard to reports concerning the operation of the Website, complaints, requests and questions:
  8. The Controller processes the data provided in a report, the content of the message and any attachments, as well as technical information necessary to investigate the reported issue;
  9. The legal basis is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in handling reports and ensuring the proper functioning of the Website. Where processing is necessary to comply with obligations under personal data protection legislation, the legal basis is Article 6(1)(c) of the GDPR.
  10. With regard to the establishment, exercise or defence of legal claims relating to the use of the Website or correspondence:
  11. The Controller may process identification and contact details, correspondence, attachments and necessary technical data serving as evidence in a particular matter;
  12. The legal basis is Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in protecting its rights, both before legal proceedings and during proceedings before the competent authorities.
  13. As part of the Soglossy Website’s functionality described in this Privacy Policy, no application forms are provided for competitions or marketing campaigns.
  14. The Controller does not process data submitted through the contact form as entries into competitions or marketing campaigns. If such activities are introduced, separate information about the processing of personal data will be provided.
  15. The Website does not collect data from competition winners or beneficiaries of marketing campaigns for the purpose of distributing or accounting for prizes. If an independent legal obligation requires personal data to be processed, this will take place to the extent necessary on the basis of Article 6(1)(c) of the GDPR.

 

§ 5. DISCLOSURE OF PERSONAL DATA BY THE CONTROLLER TO OTHER ENTITIES

  1. Personal data may be processed by authorised employees and associates of the Controller to the extent necessary to perform their assigned duties, subject to confidentiality requirements.
  2. Personal data may be entrusted for processing to, or disclosed to, external entities supporting the operation of the Website and the handling of correspondence, exclusively to the extent necessary to achieve these purposes.
  3. Recipients of personal data may include hosting providers, email service providers, contact form providers, IT service providers and legal advisers, where necessary in a particular matter.
  4. Depending on the actual role of a service provider, it may act as a processor handling data on behalf of the Controller or as a separate controller determining its own purposes and means of processing.
  5. Processors acting on behalf of the Controller operate under data processing agreements and follow the Controller’s documented instructions within the scope of the services provided.
  6. Separate controllers may include legal advisers or other entities that independently determine the purposes and means of processing in accordance with applicable law. The role of providers of online tools must be assessed for each specific service and cannot be determined solely by the service’s name.
  7. With regard to payment processing: the Controller does not transfer Users’ data to payment operators in connection with the use of the Soglossy Website, as the Website does not process payments;
  8. The Website does not collect payment card or bank account details required to complete purchases.
  9. With regard to disclosure of data to public authorities:
    a) Personal data may be disclosed to competent authorities, particularly courts, law enforcement authorities or the data protection supervisory authority, where disclosure is required by law or by a binding decision of a competent authority, on the basis of Article 6(1)(c) of the GDPR.

 

§ 6. RETENTION PERIODS FOR PERSONAL DATA PROCESSED BY THE CONTROLLER

  1. The retention period depends on the purpose of processing. Technical data in server logs is stored by the hosting provider in accordance with its technical policies. The duration of cookies and the storage periods for data collected through similar technologies should be specified in accordance with § 8. The period for which a file remains on a device does not automatically determine how long the Controller or the tool provider stores the associated data.
  2. The Website does not allow users to create accounts; therefore, no data relating to unconfirmed registrations or account activations is stored.
  3. Data submitted through the contact form and email correspondence is retained for the period necessary to handle the matter and conduct discussions concerning potential cooperation. Data necessary to establish, exercise or defend against legal claims may be retained for the applicable limitation period and, where proceedings are ongoing, for the period required to conclude them. Data subject to a statutory retention obligation is stored for the period specified by the relevant legislation.
  4. Where data is processed on the basis of consent, processing for that purpose ends when consent is withdrawn, or earlier if the purpose has been achieved or the established retention period has expired. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Evidence necessary to document the granting and withdrawal of consent may be retained on a separate legal basis for the period necessary to demonstrate compliance with the law or defend against legal claims.
  5. Data processed on the basis of legitimate interests is retained for as long as necessary to achieve the specified purpose, taking into account any effective objection. Objections are considered in accordance with Article 21 of the GDPR, as described in § 10. Data that is no longer necessary for a particular purpose is deleted or anonymised.

§ 7. PERSONAL DATA SECURITY

  1. The Controller implements technical and organisational measures appropriate to the nature of the data and the risks involved to protect personal data against unauthorised access, loss, alteration or disclosure. Access to data is restricted to individuals and entities that need it to perform their duties. Users should provide only the data necessary to handle their enquiry in the contact form and correspondence.

§ 8. COOKIES USED BY THE CONTROLLER

  1. The following provisions describe the rules and categories of these technologies; they do not confirm that the Website uses every category listed below.
  1. Cookies are small files that may be stored on the device used to visit the Website. Depending on their purpose, they may be used to support Website functionality or remember settings and information about how the Website is used.
  2. Tools that recognise a device based on its characteristics without using cookies must also be assessed in light of the rules governing access to information stored on devices and personal data protection.
  3. Cookies may be session cookies, which remain active for the duration of a session, or persistent cookies, which remain active for a specified period or until deleted earlier. By origin, they are divided into:
  4. First-party cookies and third-party cookies. The cookies actually used, their providers and their durations should be specified in the list referred to in paragraph 1.
  5. The following categories may be distinguished by purpose, although the actual use of each category must be verified:
  6. Strictly necessary cookies – necessary for transmitting a communication or providing a service explicitly requested by the User. They may be used without consent within the limits of the applicable statutory exemption. Merely labelling a cookie as “necessary” is not sufficient to qualify for the exemption;
  7. Functional cookies – used to provide additional functionality or remember preferences. If they do not meet the conditions for exemption applicable to strictly necessary technologies, prior consent is required.
  8. Advertising cookies – used for advertising or measuring advertising effectiveness; prior consent is required.
  9. Analytics cookies – used to measure visits and analyse Website usage beyond what is necessary for basic functionality; prior consent is required.
  10. Cookies from other services – used by external providers. Whether consent is required depends on their purpose and whether a statutory exemption applies; technologies used to track activity require prior consent.
  11. Technologies associated with plugins or embedded content – for example, social media elements. Where they collect data or access information stored on a device, the provider, purpose and legal basis must be identified, and consent must be obtained before activation where required.
  12. The information obtained through these technologies depends on the tools actually implemented. The following categories may be collected only where they are genuinely collected and an appropriate legal basis exists:
  13. The date and time of visits, visit duration and pages visited;
  14. Information about products viewed and links clicked;
  15. Activity on other services, information about the device and software, particularly the browser and operating system, and, depending on the tool, identifiers or the IP address;
  16. Data obtained through these technologies may be accessible to service providers only to the extent resulting from the services actually provided and in accordance with an appropriate legal basis. Information about recipients and any transfers outside the European Economic Area (EEA) is provided in § 5.
  17. If the Website uses technologies that require consent, Users will be informed before those technologies are activated and may accept or reject them. Withdrawing consent should be as easy as giving it.
  18. Refusing consent to optional technologies does not prevent Users from browsing the Website’s basic offer or contacting the Controller. It may affect additional functions that require those technologies, if such functions are actually available. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
  19. Users may also manage cookies through their browser settings, including blocking cookies or receiving notifications when cookies are stored. The details depend on the browser used. Blocking strictly necessary cookies may affect Website functionality.
  20. Users may delete cookies stored on their devices through their browser settings. Deleting cookies does not replace withdrawing consent through the tool used to grant it, nor does it automatically delete data previously stored by a service provider.

 

§ 9. PERSONAL DATA PROFILING (ASSESSMENT OF USERS’ INTERESTS AND PREFERENCES)

  1. The Soglossy Website is intended to present products and facilitate contact with potential business partners. These functions do not, in themselves, require profiling.
  2. With regard to the profiling purposes described in the original online store policy:
  3. Presenting a product catalogue does not mean that products are automatically recommended based on a User profile;
  4. Handling the contact form does not require the creation of a preference profile or the automatic completion of data based on such a profile;
  5. Responding to an enquiry does not constitute a basis for creating a marketing profile of the User.
  6. If processing, including profiling, is based on consent, Users may withdraw that consent. If processing is based on legitimate interests, Users may object under the conditions set out in Article 21 of the GDPR. An objection to processing for direct marketing purposes, including related profiling, is effective without the need to demonstrate a particular personal situation. The Controller’s contact details are provided in § 3(2).

§ 10. RIGHTS OF INDIVIDUALS WHOSE PERSONAL DATA IS PROCESSED BY THE CONTROLLER

  1. Users have the rights provided for under the GDPR, subject to the conditions set out in that Regulation. To exercise these rights, they may contact the Controller using the channels specified in § 3(2). Creating an account on the Website is neither required nor possible.
  2. Users have the following rights:
  3. The right to withdraw consent (Article 7(3) of the GDPR), where data is processed on the basis of consent. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. This does not affect processing based on other applicable legal grounds;
  4. The right of access and to obtain a copy of personal data (Article 15 of the GDPR), including information about the purposes of processing, categories of data, recipients, retention periods, rights, data sources and, where applicable, transfers and automated decision-making;
  5. The right to rectification (Article 16 of the GDPR), allowing Users to request the correction of inaccurate data or the completion of incomplete data by contacting the Controller;
  6. The right to erasure (Article 17 of the GDPR), in the cases provided for by law, particularly where:
  7. The User has withdrawn consent and no other legal basis for processing exists; the data is no longer necessary for the purposes for which it was collected; or the User has successfully objected to the processing;
  8. The data has been processed unlawfully. The right to erasure is subject to the exceptions provided for under the GDPR, particularly where further processing is necessary to comply with a legal obligation or to establish, exercise or defend against legal claims. The mere existence of an unresolved enquiry does not automatically exclude the right to erasure;
  9. The right to restriction of processing (Article 18 of the GDPR), where:
  10. The User contests the accuracy of the data, for a period enabling the Controller to verify its accuracy;
  11. The processing is unlawful, but the User opposes erasure and requests restriction of use instead;
  • The Controller no longer needs the data for its purposes, but the User requires it to establish, exercise or defend against legal claims;
  1. The User has objected to processing under Article 21(1) of the GDPR, pending verification of whether the Controller’s legitimate grounds override those of the User. During the restriction period, data may be processed, apart from storage, only in the circumstances provided for in Article 18(2) of the GDPR, particularly with the User’s consent or for the establishment, exercise or defence of legal claims. The Controller will inform the User before the restriction is lifted;
  2. The right to data portability (Article 20 of the GDPR), where processing is carried out by automated means on the basis of consent or a contract and concerns data provided by the User. This right includes receiving the data in a structured, commonly used and machine-readable format and, where technically feasible, having it transmitted to another controller;
  3. The right to object (Article 21 of the GDPR) to processing based on legitimate interests, on grounds relating to the User’s particular situation. The Controller will cease such processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the User, or grounds for establishing, exercising or defending against legal claims.
  4. Where personal data is processed for direct marketing purposes, an objection to that purpose results in the cessation of such processing, including related profiling. The objection does not need to be justified by the User’s particular situation. Data may continue to be processed for another purpose only where a separate and appropriate legal basis exists.
  5. Users may submit requests, questions and complaints concerning the processing of personal data to the Controller. The Controller will provide information about the action taken in response to a request without undue delay and, in principle, within one month of receiving it. This period may be extended by a further two months due to the complexity or number of requests. The Controller will inform the User of any extension and the reasons for it within the first month. If a request is refused, the Controller will explain the reasons and inform the User of the possibility of lodging a complaint and seeking judicial protection.
  6. Users have the right to lodge a complaint with the President of the Polish Personal Data Protection Office if they believe that the processing of their personal data infringes applicable law. Information about how to submit a complaint is available at https://uodo.gov.pl.

§ 11. BALANCING OF INTERESTS

  1. Processing based on Article 6(1)(f) of the GDPR requires consideration of the interests, rights and freedoms of the User. The Controller limits such processing to the data necessary for the specified purpose. When assessing whether processing is justified, the Controller takes into account, in particular, the following circumstances:
  2. Users are informed about the scope, purposes and legal bases of personal data processing;
  3. Handling enquiries and reports enables the Controller to provide information about products, answer questions concerning potential cooperation and resolve reported issues;
  4. Processing necessary technical data supports the efficient and secure operation of the Website; additional tracking of activity is not automatically justified solely by the purpose of presenting the offer;
  5. Individuals submitting enquiries may reasonably expect to receive a response relating to the subject of their enquiry. This does not mean that they should expect to receive marketing messages unrelated to that enquiry;
  6. Expressing an interest in the Soglossy offer does not, in itself, authorise the disclosure of personal data to other partners for their marketing purposes;
  7. Users may contact the Controller to exercise their rights, particularly the right to object. Where processing is based on consent, Users may withdraw it. Exercising these rights does not require an account on the Website.

§ 12. AMENDMENTS TO THE PRIVACY POLICY AND NOTIFICATION OF SUCH AMENDMENTS

  1. The Controller may update this Privacy Policy in connection with changes to the operation of the Website, the tools used, personal data processing practices or applicable law. The current version will be published on the Website. Where changes require additional notification to data subjects, the Controller will provide the relevant information through an appropriate channel.

Effective date of this version: 14 October 2026

  1. Matters not covered by this Privacy Policy are governed by the GDPR and other applicable laws, particularly the Polish Personal Data Protection Act and, with regard to cookies and similar technologies, the Polish Electronic Communications Law.