Privacy Policy

Privacy and Cookies Policy for empikgroup.com

Definitions

Controller – Empik S.A., with its registered office in Warsaw (00-017), 104/122 Marszałkowska Street, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under number (KRS) 0000636785, Tax Identification Number (NIP) 526-020-74-27, REGON: 011518197, share capital of PLN 97,028,362.00, paid up in full.

Personal Data – any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Policy – this Privacy and Cookies Policy.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Website – this website operated by Empik at empikgroup.com.

User – a natural person using the Website.

I. Controller 

1. The Controller is Empik S.A., with its registered office in Warsaw.
2. The Controller can be contacted by email at: [email protected] or by post at: Empik S.A., ul. Marszałkowska 104/122, 00-017 Warsaw.
3. The Controller has appointed a Data Protection Officer, who can be contacted by email at: [email protected], regarding any matter relating to the processing of personal data.

II. Purposes and legal bases for the processing of personal data

Users’ personal data is processed by the Controller:

a) for the purpose of conducting corporate communications via the Website, including presenting information about the activities of the Controller, the Empik Group and entities and brands within the Empik Group – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in conducting corporate communications and providing information about the activities of the Empik Group;
b) to ensure the proper, stable and secure operation of the Website, its technical maintenance, troubleshooting, and the detection and prevention of abuse, automated traffic and attempted security breaches – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in ensuring the efficient and secure operation of the Website;
c) when using the search engine – to process the query and display search results – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in ensuring the functionality and usability of the Website;
d) for analytical and statistical purposes and to measure the Website’s availability and performance – to the extent necessary to ensure the proper functioning of the Website, the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), whereas, to the
extent that processing is carried out using technologies requiring the User’s consent, the legal basis is the User’s consent (Article 6(1)(a) of the GDPR);
e) for the purpose of establishing, exercising or defending legal claims – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in the protection of the Controller’s rights and interests.

Contacting the Controller

If a person contacts the Controller via the email address or postal address provided on the Website, the Controller processes the personal data provided in connection with such contact. The scope of the data processed depends on the content and nature of the enquiry.

In such cases, personal data is processed:

a) to provide a response, maintain communication and resolve the matter to which the contact relates – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) in communicating with persons who contact the Controller;
b) to establish or maintain business relationships – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in managing business relationships and business communications;
c) for the purpose of taking steps prior to entering into a contract or performing a contract – where the person making contact is a party to that contract – the legal basis for processing is Article 6(1)(b) of the GDPR;
d) for the purpose of complying with legal obligations incumbent on the Controller – where such an obligation arises from the nature of the matter; the legal basis for processing is Article 6(1)(c) of the GDPR;
e) for the purpose of establishing, exercising or defending legal claims – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in protecting its rights and interests.

III. Recipients of data

Users’ personal data may be disclosed to entities whose involvement is necessary for the operation of the Website, to ensure its security or to fulfil the processing purposes set out above, including:

a) providers of IT infrastructure and services relating to the hosting, maintenance, administration, development and security of the Website;
b) providers of analytics tools and consent management tools, as well as external content providers – to the extent resulting from the choices made by the User;
c) providers of services relating to the handling of email and correspondence;
d) entities providing legal, audit and advisory services to the Controller;
e) entities within the Empik Group – to the extent that their involvement is necessary to achieve the processing purposes set out in the Policy, in particular where the matter relates to the activities of the entity in question;
f) public authorities and other entities authorised to receive data under applicable law.

IV. Retention of Personal Data

The period for which the Controller processes Personal Data depends on the purpose and legal basis for such processing. As a general rule, Personal Data is processed for the period necessary to fulfil the
purpose for which it was collected, until consent is withdrawn – if processing is based on consent – or until an objection to the processing is effectively lodged, if the legal basis for processing is the Controller’s legitimate interest.

Personal Data processed for the purpose of complying with a legal obligation incumbent on the Controller is retained for the period required by the relevant legal provisions.

The retention period may be extended where processing is necessary to establish, exercise or defend legal claims, and after that period – only to the extent required by applicable law.

V. Transfer of Personal Data outside the European Economic Area

Personal Data may be transferred outside the European Economic Area only where necessary, provided that an appropriate level of protection is ensured.

Depending on the country to which the data is transferred and the recipient of the data, the transfer may take place, in particular, on the basis of a European Commission decision recognising an adequate level of protection or by applying appropriate safeguards as provided for in the GDPR, including standard contractual clauses approved by the European Commission.

VI. User Rights

Data subjects have the following rights:

1. Right to access – on this basis, the Controller shall provide the person making such a request with information regarding the processing of personal data, including, in particular, the purposes and legal grounds for processing, the scope of the data held, the entities to whom personal data is disclosed, and the planned date of its erasure;
2. Right to obtain a copy of the data – on this basis, the Controller shall provide a copy of the data being processed relating to the person making the request;
3. Right to rectification – on this basis, the Controller shall rectify any inaccuracies or errors in the personal data being processed and shall complete such data where it is incomplete or update it where it has changed;
4. Right to erasure – on this basis, the data subject may request the erasure of their data, in particular where the data is no longer necessary for the purposes for which it was collected;
5. Right to restriction of processing – on this basis, the Controller shall restrict the processing of personal data, with the exception of operations to which the data subject has consented and the storage of such data, in accordance with the adopted retention rules, or until the grounds for the restriction no longer apply (e.g. a decision is issued by a supervisory authority authorising further processing of the data);
6. Right to data portability – to the extent that Personal Data is processed on the basis of consent or a contract, the data subject may receive the personal data they have provided to the Controller in a structured, commonly used and machine-readable format. The data subject may also request that the Personal Data be transmitted directly to another controller, where technically feasible;
7. Right to object to the processing of personal data – where Personal Data is processed on the basis of the Controller’s legitimate interests (Article 6(1)(f) of the GDPR), the data subject may object to such processing on grounds relating to their particular situation. The Controller shall cease to process the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims;
8. Right to withdraw consent – if data is processed on the basis of consent, the data subject has the right to withdraw it at any time; however, this does not affect the lawfulness of the processing carried out prior to the withdrawal of that consent;
9. Right to lodge a complaint – if the data subject considers that the processing of personal data infringes the provisions of the GDPR or other data protection legislation, they may lodge a complaint with the President of the Personal Data Protection Office.

A request to exercise the rights of data subjects may be submitted:

a) in writing to the following address: Empik S.A., ul. Marszałkowska 104/122, 00-017 Warsaw;
b) by email to: [email protected].

VII. Cookies and similar technologies

The Website uses cookies and similar technologies that enable information to be stored on the User’s device or to access information already stored on it. These technologies may be used to ensure the proper functioning of the Website, to remember specific User preferences, to conduct analysis and compile statistics, and to provide selected content and functionality.

Types of cookies and similar technologies used

In particular, the Website may use:

a) essential cookies and similar technologies – necessary for the proper and secure functioning of the Website, to ensure its basic functionalities and to remember the User’s privacy preferences;
b) analytical and statistical cookies and similar technologies – used to analyse traffic on the Website, how Users interact with its functionalities and the Website's performance;
c) cookies and similar technologies related to external content – used in connection with the provision of content or functionalities supplied by third-party providers, in particular video content.

Essential cookies and similar technologies may be used without the User’s consent where permitted by applicable law. Other technologies are used after obtaining the required consent from the User.

Third-party technologies

In connection with the use of analytics tools or content and functionality provided by external providers, the providers of these solutions may use their own cookies or similar technologies. The extent to which such technologies are used depends on the relevant functionality and the choices made by the User.

Managing cookie settings

The User may change their settings regarding optional cookies and similar technologies at any time, or withdraw their consent, via the consent management panel available on the Website.

Detailed and up-to-date information regarding cookies and similar technologies used on the Website, including their purposes, providers and duration, is available in the consent management panel.

VIII. Changes to the Policy

This Policy is subject to periodic review and may be updated as necessary. The current version of the Policy is effective as of September 18, 2026.