PRIVACY POLICY

1. Data controller and contact

The controller of your personal data is Belina sp. z o.o. with its registered office at ul. gen. Józefa Bema 5/3, 31-517 Kraków, Polish tax ID (NIP): 9451414151, National Court Register (KRS): 0000190706, referred to below as the ‘Controller’.

For privacy matters, to exercise your rights or withdraw consent, you can write to Marouane@ummbadrink.com or send a letter to the address above. Please indicate that your enquiry concerns the UMMBA! website.

2. What data do we process?

Please do not include special categories of personal data, such as health information, in your messages unless necessary to deal with your enquiry.

• Contact form: your full name, email address, message and any additional data you choose to provide.
• Newsletter: your email address and a record of your consent and submission date.
• Security and technical support: connection information such as IP address, request date and time, page visited, browser information and any errors. To limit misuse of forms, we also use a temporary identifier based on the IP address.
• Administration panel: authorised users’ account data and information needed to authenticate them and maintain their sessions. You do not need an account to visit public pages.

3. Purposes and legal bases

• Replying to a voluntary enquiry submitted through a form: on the basis of the consent given when submitting it — Article 6(1)(a) GDPR. Consent to contact does not constitute a newsletter subscription.
• Steps prior to entering into a contract: if you ask us for an offer or to take steps towards entering into a contract with you, we process data necessary for those steps at your request — Article 6(1)(b) GDPR.
• Business correspondence with representatives of business partners: on the basis of the Controller’s legitimate interest in maintaining business contacts and cooperation — Article 6(1)(f) GDPR.
• UMMBA! newsletter and marketing information: on the basis of separate consent — Article 6(1)(a) GDPR. Sending commercial information by email also requires prior consent under Article 398 of the Polish Electronic Communications Law.
• Website security, spam prevention and resolving technical issues: on the basis of the Controller’s legitimate interest in protecting the website and ensuring its smooth operation — Article 6(1)(f) GDPR.
• Demonstrating consent and establishing, pursuing or defending claims: to the extent necessary, on the basis of the Controller’s legitimate interest — Article 6(1)(f) GDPR; compliance with legal obligations — Article 6(1)(c) GDPR.

4. Providing data is voluntary

Providing data is voluntary. However, fields marked as required are needed to accept a form and reply to you or subscribe your address to the newsletter. Without this data or the required consent, the relevant function cannot be used. You may browse public pages without completing any forms.

5. How long do we keep data?

The retention criterion is the purpose for which data was collected. We do not retain data indefinitely solely because it was previously provided.

• Enquiries and correspondence: for the time needed to deal with the matter and any necessary follow-up correspondence; once it is closed, only to the extent justified by legal obligations or the need to establish, pursue or defend claims, until the applicable limitation periods expire.
• Newsletter: until consent is withdrawn or the newsletter is discontinued. We may retain information necessary to demonstrate earlier consent or handle claims for a period justified by that purpose.
• Temporary identifier used to limit misuse of forms: for one hour after the last submission, after which it expires.
• Technical logs and administration account data: for the period necessary to ensure security, investigate incidents and maintain access for authorised persons; longer only when necessary for a legal obligation or claims.

6. Who can access data?

Authorised persons acting on behalf of the Controller have access to data to the extent needed to handle enquiries, the newsletter or the website. If we use infrastructure providers, technical support or IT service providers, they may process data to the extent necessary, on an appropriate basis and in accordance with the Controller’s instructions. Data may also be disclosed to authorities entitled to receive it by law.

Forms store submissions in the website database. The current version does not automatically transfer them to an external newsletter or advertising platform. Data from forms is not published on the website.

The content of submissions remains in the website database. If optional Google reCAPTCHA protection is enabled, activating it transfers the technical data described in section 9 to Google. Due to the global nature of Google’s services, this data may also be processed outside the European Economic Area, in accordance with the information and transfer mechanisms described in Google’s Privacy Policy.

7. Your rights

Subject to the conditions and limits set out in the GDPR, you have the right to:

• access your data and receive a copy;
• rectify inaccurate data or complete incomplete data;
• have your data erased where the conditions for this right are met;
• restrict processing;
• data portability — for data processed by automated means on the basis of consent or a contract;
• object to processing based on legitimate interests on grounds relating to your particular situation; you may object to direct marketing at any time;
• withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal;
• lodge a complaint with the President of the Polish Personal Data Protection Officeif you believe processing infringes applicable rules. Information about complaints is available at uodo.gov.pl.

To exercise your rights or unsubscribe from the newsletter, write to Marouane@ummbadrink.com. We may request information necessary to confirm your identity if needed to handle your request securely. We reply without undue delay, generally within one month; if an extension permitted by law is necessary, we will inform you of it and the reasons within that period.

8. Cookies and technical data

Cookies are small files stored by your browser on your device. They can help maintain sessions and ensure the website works correctly. Some expire when you close your browser, while others remain for the period specified in their settings or until deleted.

The current website uses technical WordPress mechanisms primarily related to authorised user login, session security and remembering administration panel settings. Examples of these cookies include wordpress_test_cookie, wordpress_logged_in_*, wordpress_sec_*, wp-settings-* and wp-settings-time-*. Their presence depends on use of the administration panel and login options.

The current version contains no analytics tools, advertising pixels or embedded social media widgets. Subscribing through the newsletter form does not activate marketing tracking. Fonts are served from this website, without downloading them from the external Google Fonts service. Google reCAPTCHA is a separate, optional mechanism described in section 9; its script is not downloaded before the user activates verification.

Essential mechanisms used to deliver a function requested by the user may operate without separate consent where permitted by law. If we introduce analytics or advertising cookies requiring consent, we will inform you and let you choose before activating them.

You can delete and block cookies in your browser settings. Restricting essential cookies may prevent login or some administration panel functions. Blocking cookies does not delete submissions previously stored through forms; contact the Controller to request their deletion.

9. Google reCAPTCHA — optional form protection

Forms may use Google reCAPTCHA v2 to reduce automated spam. If this feature is enabled, the form displays information about Google and a button to activate verification before it starts. The Google script is downloaded only after that button is selected. The basis for voluntarily activating the connection to Google is user consent — Article 6(1)(a) GDPR, taking account of rules on accessing information on a device.

When you use reCAPTCHA, Google may receive your IP address, browser and device information, and data related to use of verification; the service may also use cookies. The processing of this information is described in Google’s Privacy Policy and Google’s Terms of Service. Information about Google’s data retention periods and international transfers is available in its policy.

We send the verification token for server-side reCAPTCHA verification. We do not send your message, name or the email address entered in the form for this purpose. The token is not stored as part of your submission.

You can choose not to activate reCAPTCHA, but a form protected by it cannot then be submitted. You can still contact us directly by email using the details on the Contact page. You can withdraw consent for future connections by not activating the tool again; cookies can be deleted in your browser settings.

10. Profiling and automated decisions

The website does not use marketing profiling or decisions based solely on automated processing that produce legal effects or similarly significantly affect users. Technical limits on spam and submission counts protect the forms.

11. External links and policy changes

The website may contain links to other websites, including the brand’s social media profile. After you visit an external website, data processing is governed by its operator’s rules. A link alone is not a tracking tool embedded in our website.

We update this policy when website functions, data processing practices or legal requirements change. The current version and update date are available on this page. A policy change does not replace consent where a new processing activity requires it.