1. pl
  2. ro

PRIVACY AND COOKIES POLICY OF BROYX.COM

Last updated: July 2026

§ 1. GENERAL PROVISIONS

  1. This Privacy Policy defines the rules for processing and protecting the personal data of Users using the online store and website available at broyx.com (hereinafter referred to as the "Website"), as well as the rules for using cookies and artificial intelligence (AI) technologies.
  2. The Data Controller of the Website Users' personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is Alterson Polska Sp. z o.o. with its registered office at ul. Jagiellońska 55, 03-301 Warsaw, Poland, entered into the Register of Entrepreneurs of the National Court Register under KRS number: 00004031529, NIP (Tax ID): 5213622538, REGON: 145894500 (hereinafter referred to as the "Controller").
  3. The protection of personal data is carried out in accordance with applicable legal provisions, including the GDPR, the Polish Personal Data Protection Act of May 10, 2018, and the provisions of the EU Artificial Intelligence Act (AI Act).
  4. Contact with the Controller regarding personal data protection is possible via email at: contact@broyx.com or in writing to the Controller's registered office address.

 

§ 2. PURPOSES, LEGAL BASES, AND DATA RETENTION PERIODS

The Controller processes Users' personal data for the following purposes:

  1. Order fulfillment and sales contract performance:
    • Scope of data: first name, last name, delivery address, email address, phone number, invoicing data (NIP/Tax ID, company name).
    • Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract).
    • Retention period: period necessary to fulfill the order, and thereafter until the expiration of the statute of limitations for claims and the period required by tax and accounting regulations.
  2. User account management:
    • Scope of data: email address, first name, last name, password, order history.
    • Legal basis: Art. 6(1)(b) GDPR (provision of account management services).
    • Retention period: until the account is deleted by the User or a request for data erasure is submitted.
  3. Communication and inquiry processing (Forms, email, chat):
    • Scope of data: first name, email address, phone number, content of correspondence.
    • Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting of efficient communication and customer service).
    • Retention period: until the case is resolved or until an effective objection is submitted.
  4. Marketing, remarketing, and product review system:
    • Scope of data: email address, first name, analytical and statistical data regarding Website activity.
    • Legal basis: Art. 6(1)(a) GDPR (voluntary consent of the User) and Art. 6(1)(f) GDPR (legitimate interest consisting of marketing own products and services).
    • Retention period: until consent is withdrawn or an objection is raised.
    •  

§ 3. USE OF ARTIFICIAL INTELLIGENCE TECHNOLOGIES (AI ACT & GDPR)

1. Virtual AI Assistant (Chatbot)

  • Notice of automated nature: In order to improve customer service, assist in Website navigation, and help in selecting suitable products, we provide an automated AI Assistant on the Website. In accordance with Art. 50(1) of Regulation (EU) 2024/1689 (AI Act), we inform you that when interacting with the AI Assistant, you are conversing with an artificial intelligence system, not a human.
  • Scope and legal basis of processing: The processing of query contents entered in the chat window and necessary technical metadata is carried out pursuant to Art. 6(1)(b) GDPR (steps prior to entering into or performing a contract) and Art. 6(1)(f) GDPR (legitimate interest of the Controller consisting of improving service quality).
  • Technology provider and data transfer: The AI Assistant service is provided using the technology of Chatbase Inc., based in the USA. The transfer of data outside the European Economic Area (EEA) is based on Standard Contractual Clauses (SCCs) approved by the European Commission.
  • No model training: The Controller declares that the data entered in the AI Assistant chat window is not used by the technology provider to train external, public artificial intelligence models.
  • Confidentiality: Please do not enter special categories of data (e.g., health information) or sensitive financial data (e.g., payment card numbers) in the chat window.
  • Legal disclaimer (No commercial offer): Responses generated by the AI Assistant are for informational and auxiliary purposes only. They do not constitute a commercial offer within the meaning of Art. 66 of the Polish Civil Code. Binding prices, technical specifications, and product availability are provided directly on the official product cards on the Website. Users have the right at any time to discontinue interaction with the AI Assistant and request contact with a human representative at: contact@broyx.com.

2. AI-Generated Visuals and Graphic Materials

  • Labeling information (Art. 50(4) AI Act): On the broyx.com Website and on the official Broyx brand social media profiles, selected illustrations, visual elements, and promotional materials may be created or modified using artificial intelligence (AI) tools.
  • Illustrative nature: Generated images depicting outdoor scenery, human figures, or lifestyle visualizations serve a purely promotional, decorative, and illustrative purpose. Actual product appearances and parameters are represented in official product photographs in the online store.

§ 4. DATA RECIPIENTS AND TRANSFERS OUTSIDE THE EEA

  1. Users' personal data may be transferred to entities cooperating with the Controller solely for the purpose of proper service and order execution:
    • Entities affiliated with the Controller and subcontractors.
    • Delivery companies (courier and postal services).
    • Electronic payment operators.
    • Accounting, legal, and auditing service providers.
    • Hosting, IT, marketing, analytical, and customer service technology providers (including Chatbase Inc., Google LLC, Meta Platforms Ireland Ltd.).
  2. Due to the use of technological solutions from providers located outside the European Economic Area (EEA), Users' data may be transferred, among others, to the USA based on Standard Contractual Clauses or adequacy decisions of the European Commission (e.g., Data Privacy Framework).

 

§ 5. USER RIGHTS

Each User has the following rights under the GDPR:

  • Right of access to their personal data and to receive a copy thereof.
  • Right to rectification (correction) of inaccurate data.
  • Right to erasure ("right to be forgotten").
  • Right to restriction of processing.
  • Right to data portability to another controller.
  • Right to object to processing based on the Controller's legitimate interest (including profiling).
  • Right to withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

To exercise the above rights, please send a request to: contact@broyx.com. The Controller will fulfill the request or inform about the inability to fulfill it without delay, no later than within one month of receiving the request.

Users also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, if they consider that the processing of their personal data violates the provisions of the GDPR.

 

§ 6. COOKIES, PROFILING, AND TRACKING TECHNOLOGIES

  1. The broyx.com Website uses cookies – session, persistent, and third-party cookies.
  2. Cookies are small text files sent by the Website and saved on the User's terminal device. They serve to ensure the proper functioning of the Website, improve its efficiency, and for analytical, statistical, marketing, and remarketing purposes.
  3. Profiling: Users' data may be profiled to personalize content, adapt the website, and present personalized commercial offers only upon obtaining the User's appropriate consent. Such profiling does not produce legal effects or similarly significantly affect the User's situation (no automated decision-making producing legal effects).
  4. Cookie management: Users can change the scope of cookie usage or block their saving at any time through appropriate settings in their web browser or via the consent management panel on the Website.

 

§ 7. FINAL PROVISIONS

  1. The Controller applies appropriate technical and organizational measures to ensure the protection of processed personal data appropriate to the risks and categories of data covered by protection.
  2. The Controller reserves the right to make changes to this Privacy Policy. Information about changes will be communicated to Users in the form of a message displayed on the Website.
  3. In matters not regulated by this Privacy Policy, the relevant provisions of the GDPR, the Polish Personal Data Protection Act of May 10, 2018, the Polish Civil Code, and the EU AI Act shall apply.
  4. This version of the Privacy Policy is effective from the date of publication on the Website.

 

website design and development: agencja.energiczni