Before you start shopping, please read this Privacy Policy, which sets out the most important rules for the processing of your personal data.

The owner of the store and also the Personal Data Administrator is Nutraway sp.z o.o. with its registered office in Łódź, ul. Prezydenta Gabriela Narutowicza 40/1, 90-135 Łódź, NIP: PL7252316522.

If you want to contact us about any matter, write to: kontakt@ollywell.pl or call +48 22 506 40 59

For the purposes described below, we collect and process the following personal data:

1. Identification data. Data such as: First name, Last name, residential address are necessary to place an order, conduct the sales process, provide after-sales service, and create a user account in our store.
2. Contact data. An e-mail address is essential for placing an order and registering an account in our store. An e-mail address may also be used to provide certain functionalities of our store. For contact with the user, we may also process the phone number of our customers.
3. Sales data. In order to fulfill our obligations to our customers and in connection with legal obligations, we may process sales data such as order number, payment data, delivery data, etc.
4. Information about browsing the store's website. Data such as: access time, number of access attempts, IP address and event information (such as errors, suspensions, restarts and updates to new versions) and other diagnostic, technical data, error and usage information, e.g. time and duration of use of services, search terms entered by the User on the device, and any information stored in cookies placed on the User's device.
5. Cookies. We use Cookies on our store's website. These are IT data, most often text files, which are stored on the end device. They usually contain the name of the website they come from, their storage time, and number.

Your personal data is processed for the following purposes:

1. conducting the sales process — identification data, contact data - on the basis of Article 6(1)(b) of the GDPR (necessity for the conclusion and/or performance of a contract);
2. creating and maintaining a customer account — identification data, contact data, sales data - on the basis of Article 6(1)(a) of the GDPR (consent) and on the basis of Article 6(1)(b) of the GDPR (necessity for the conclusion and/or performance of a contract regarding the maintenance of a user account);
3. considering complaints — identification data, contact data, sales data - on the basis of Article 6(1)(b) of the GDPR (necessity for the conclusion and/or performance of a contract);
4. contact regarding the performance of the contract or the Administrator's offer — identification data, contact data, sales data - on the basis of Article 6(1)(b) of the GDPR (necessity for the conclusion and/or performance of a contract);
5. issuing an invoice and fulfilling other obligations resulting from tax law provisions — identification data, contact data, sales data - on the basis of Article 6(1)(c) of the GDPR (necessity for the Company to fulfill a legal obligation);
6. storing unpaid inquiries - sales data — on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the Personal Data Administrator); the Company's legitimate interest is to keep statistics of unfulfilled orders in order to improve the quality of services provided.
7. direct marketing — contact data - on the basis of Article 6(1)(a) of the GDPR (consent);
8. establishing, pursuing or defending against claims, identification data, contact data, sales data — on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the Personal Data Administrator); the Company's legitimate interest is to protect the financial interests of the Company and users;
9. archival and evidentiary purposes, for the purpose of securing information that may serve as proof of facts - identification data, contact data, sales data — on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the Personal Data Administrator); the Company's legitimate interest is to have information needed, e.g. by state authorities;
10. analytical, consisting, among other things, of analyzing data collected automatically when using the website, Information about browsing the store's website, cookies — on the basis of Article 6(1)(a) (consent) and Article 6(1)(f) of the GDPR (legitimate interest of the Personal Data Administrator); the Company's legitimate interest is to know user activity;
11. website administration - Information about browsing the store's website — on the basis of Article 6(1)(f) of the GDPR (legitimate interest of the Personal Data Administrator); the Company's legitimate interest is efficient management of the service;
12. posting a comment on the website - identification data, contact data — on the basis of Article 6(1)(a) of the GDPR (consent);
13. You can withdraw your consent at any time, but the withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
14. Providing all personal data is voluntary, however:
15. providing data such as name and e-mail address is necessary for service valuation and contract conclusion (without this data, the service will be impossible to perform);
16. providing data such as name, e-mail address, order number is necessary for considering a complaint, and in the case of a refund — also providing a residential address and bank account number (without this data, considering a complaint or refund will not be possible);
17. providing data such as first name and last name or company name, registered office address, VAT identification number is necessary for issuing an invoice for services and results from legal provisions (without this data, issuing an invoice will not be possible);

1. Your personal data may be disclosed to our couriers, lawyers, payment processing companies, hosting company, accounting firm, insurance company, company responsible for the ERP system, company responsible for customer service management, software providers, as well as entities supporting us in collecting feedback about our products and services. In addition, we may be obliged, for example, on the basis of legal provisions, to provide your personal data to private and public entities.

Transfer of personal data to a third country or an international organization takes place in accordance with the following rules.

1. The Personal Data Administrator does not transfer your personal data to international organizations.
2. If personal data is transferred to entities outside the EEA, this will take place on the basis of expressed consent or to the extent necessary for the performance of the concluded contract.
3. Please be advised that in the case of transferring your personal data to entities outside the EEA, there is a risk that the countries where these entities are located may not provide a level of protection for your personal data equivalent to that resulting from the GDPR.

Your personal data will be stored:

1. for the duration of the contract — in the case of personal data processed for the purpose of concluding and performing the contract;
2. for a period of 3 years or 6 years + 1 year — in relation to personal data processed for the purpose of establishing, pursuing and defending claims (the length of the period depends on whether both parties are entrepreneurs or not);
3. for a period of 6 months — in relation to personal data collected during the service valuation, and at the same time no immediate conclusion of the contract took place, i.e., processed for the purpose of a possible conclusion of the contract;
4. for a period of 5 years — in relation to personal data processed for the purpose of fulfilling tax obligations;
5. until consent is withdrawn or the processing purpose is achieved, but no longer than 5 years — in relation to personal data processed on the basis of consent;
6. until a valid objection is raised or the processing purpose is achieved, but no longer than 5 years — in relation to personal data processed on the basis of the legitimate interest of the Personal Data Administrator or for marketing purposes;
7. until obsolescence or loss of usefulness, but no longer than 3 years — in relation to personal data processed mainly for analytical purposes, the use of cookies and website administration.

Information about your rights regarding the processing of personal data

You have the right to: access your data, request its rectification, erasure, restriction of processing, the right to data portability, and the right to object to data processing.

You can submit a request to exercise your rights:

1. to the email address - kontakt@ollywell.pl
2. by post to the address – ul. Prezydenta Gabriela Narutowicza 40/1, 90-135 Łódź

In the application, you should provide data that will allow us to unequivocally identify you.

You also have the right to lodge a complaint with the supervisory authority responsible for personal data protection - the President of the Personal Data Protection Office - if you believe that the processing of your personal data is unlawful.

1. We make every possible effort to secure your personal data and protect it from the actions of third parties. We apply all necessary security measures for servers, connections, and the website to protect data, in particular SSL encryption. All connections related to payments made by our customers will take place via a secure encrypted connection. We inform you that the measures we have taken may, however, prove insufficient if our customers do not comply with security rules themselves. In particular, each user should keep their login and password to their account on the website confidential and not disclose them to third parties. We inform you that we never ask our customers for their login details.