Privacy Policy

1. BASIC CONCEPTS AND DEFINITIONS

1.1 The FleeCozy Store is operated by GEX STORE sp. z o.o., with its registered office at pl. gen. Walerego Wróblewskiego 3A/7, 50-413 Wrocław, Poland, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division, under KRS number 0001018317, NIP: 7011128517, REGON: 524426242, hereinafter referred to as the “Controller”.

1.2 Personal Data means any information relating to an identified or identifiable natural person, including information that may identify a person directly or indirectly, such as name, contact details, order data, device IP address, online identifiers, location data, and information collected through cookies or similar technologies.

1.3 Policy - this Privacy Policy, which sets out the principles of processing Personal Data and the use of cookies and similar tracking technologies within the Website.

1.4 GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC.

1.5 Website - the website operated by the Controller under the domain https://fleecozy.com, accessible via web browsers.

1.6 Store - the FleeCozy online store available via the Website, through which the Controller conducts distance selling of goods to selected countries made available in the Store or during the checkout process.

1.7 User - any person visiting the Website or using one or more services or functions described in this Policy.

1.8 Device - an electronic device through which the User gains access to the Website.

2. GENERAL INFORMATION

2.1 In connection with your use of the Website, we collect data necessary to provide the services offered, process orders, handle customer service, manage returns and complaints, ensure the proper operation of the Website, and, where applicable and subject to your consent, conduct marketing and analytical activities. We are the Controller of your Personal Data and attach great importance to its proper protection.

2.2 We process Personal Data in accordance with applicable law, in particular the GDPR. Our goal is to provide clear information on how we process your Personal Data and how you can exercise your rights.

2.3 Where necessary to provide services, process orders, comply with legal obligations, or maintain accurate account information, we may ask you to update your data, for example by sending a message to the email address you provided or by displaying a notification in your Customer Account, where such functionality is available.

3. HOW TO CONTACT THE DATA CONTROLLER?

3.1 If you have any questions regarding our processing of your Personal Data or wish to exercise your rights, you may contact us:
a) by email at: info@fleecozy.com;
b) by traditional mail at our registered office address: GEX STORE sp. z o.o., pl. gen. Walerego Wróblewskiego 3A/7, 50-413 Wrocław, Poland;
c) via the contact form available on the Website, where such form is available.

3.2 The Data Controller is GEX STORE sp. z o.o.

3.3 The Controller has not appointed a Data Protection Officer because it is not obliged to do so under Article 37 of the GDPR.

4. HOW DO WE COLLECT YOUR PERSONAL DATA?

4.1 We collect your Personal Data directly from you, as well as automatically through the technologies used on the Website, to properly provide our services and ensure the smooth operation of the Website.

4.2 You provide us with your data primarily when placing orders in the Store, creating or using a Customer Account, subscribing to a newsletter, submitting a return or complaint, contacting us through forms, email, or other communication channels, or otherwise using services available on the Website.

4.3 We may also collect technical data and information about your activity on the Website, including through cookies or similar technologies, as described in the cookies section of this Policy.

5. IS PROVIDING PERSONAL DATA MANDATORY?

5.1 You decide whether to provide us with Personal Data. However, in some cases providing certain data is necessary to use a specific service, place and process an order, create a Customer Account, submit a return or complaint, issue a sales document, or respond to your inquiry.

5.2 If the provision of specific data is required for a particular purpose, failure to provide such data may make it impossible to perform that purpose, for example to process an order, deliver the Goods, issue an invoice, handle a return, or respond to your message.

6. HOW DO WE PROCESS YOUR PERSONAL DATA?

USE OF THE WEBSITE

6.1 If you use the Website without registering or logging into a Customer Account, we may process your Personal Data, including IP address, online identifiers, technical data, and information collected through cookies or similar technologies:

6.1.1 to display the Website content and provide electronic services consisting in making the Website available to you - the legal basis for processing is the necessity of processing for the performance of a contract or taking steps at your request before entering into a contract (Article 6, paragraph 1, letter b of the GDPR), or the legitimate interest of the Controller consisting in making the Website available and ensuring its proper operation (Article 6, paragraph 1, letter f of the GDPR), depending on the specific service used;

6.1.2 for technical, analytical and statistical purposes based on server logs and aggregated information necessary to maintain, secure and improve the Website - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR). Where analytical cookies or similar tracking technologies are used, they are used only after obtaining the User’s consent, as described in the cookies section of this Policy;

6.1.3 to establish, pursue or defend against possible claims - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in the protection of its rights and property interests;

6.1.4 for marketing purposes, including remarketing and behavioral advertising - only where you have given the required consent, as described in the marketing and cookies sections of this Policy.

6.2 Your activity on the Website may be recorded in system logs. The information collected in logs is processed primarily for purposes related to providing services, ensuring the security of the Website, diagnosing errors, protecting the IT system, and managing the Website. The legal basis for such processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR).

REGISTERING AND MAINTAINING YOUR CUSTOMER ACCOUNT

6.3 When registering on the Website, we ask you to provide the data necessary to create and maintain your Customer Account. Providing the data marked as mandatory is necessary to create and maintain the Customer Account; failure to provide it will prevent you from creating an Account. Providing any remaining data is voluntary.

6.4 Your Personal Data connected with the Customer Account is processed:

6.4.1 to provide services related to creating, maintaining and using the Customer Account - the legal basis for processing is the necessity of processing for the performance of the contract (Article 6, paragraph 1, letter b of the GDPR), and, in the scope of data provided optionally, your consent (Article 6, paragraph 1, letter a of the GDPR);

6.4.2 for technical, analytical and statistical purposes related to the operation and improvement of the Customer Account and Website - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR). Where analytical cookies or similar tracking technologies are used, they are used only after obtaining the User’s consent;

6.4.3 to establish, pursue or defend against possible claims - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR);

6.4.4 for marketing purposes - only where you have given the required consent, as described in the marketing and cookies sections of this Policy.

6.5 If the User provides Personal Data of other people on the Website, for example delivery details of another recipient, the User should do so only where they are entitled to provide such data and where this does not violate applicable law or the rights of such persons.

PLACING ORDERS

6.6 If you place an order for Goods offered in the Store, your Personal Data will be processed. Providing data marked as mandatory is necessary to accept, verify and process the order, deliver the Goods, issue sales documents where required, and handle communication related to the order. Failure to provide such data may prevent us from processing the order. Providing any remaining data is optional.

6.7 Your Personal Data related to orders is processed:

6.7.1 to accept, verify and fulfil the order, including delivery to the country and address selected by you where such delivery is available in the Store or during checkout - the legal basis for processing is the necessity of processing for the performance of the contract or taking steps at your request before entering into a contract (Article 6, paragraph 1, letter b of the GDPR);

6.7.2 to fulfil legal obligations incumbent on the Controller, resulting in particular from tax, accounting, consumer protection and sales documentation regulations - the legal basis for processing is the legal obligation of the Controller (Article 6, paragraph 1, letter c of the GDPR);

6.7.3 for technical, analytical and statistical purposes related to order handling and improvement of the Store - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR). Where analytical cookies or similar tracking technologies are used, they are used only after obtaining the User’s consent;

6.7.4 to establish, pursue or defend against possible claims - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR).

COMPLAINTS AND RETURNS

6.8 If you submit a complaint, return request or declaration of withdrawal from the contract, we process your Personal Data. Providing data in a complaint or return form is voluntary, but necessary for us to process the request submitted through that form. This does not limit your right to submit a complaint or a declaration of withdrawal from the contract by other means provided for in the Terms and Conditions or by applicable law.

6.9 Your Personal Data related to complaints and returns is processed:

6.9.1 to consider and handle a submitted complaint concerning the Goods - the legal basis for processing is the Controller’s legal obligation arising from applicable consumer protection laws and provisions concerning the conformity of goods with the sales contract (Article 6, paragraph 1, letter c of the GDPR);

6.9.2 to process a return, withdrawal from the contract or refund - the legal basis for processing is, depending on the situation, the Controller’s legal obligation arising from consumer protection laws (Article 6, paragraph 1, letter c of the GDPR) or the necessity of processing for the performance or settlement of the contract (Article 6, paragraph 1, letter b of the GDPR);

6.9.3 to fulfil legal obligations incumbent on the Controller, resulting in particular from tax, accounting and consumer protection regulations - the legal basis for processing is the legal obligation of the Controller (Article 6, paragraph 1, letter c of the GDPR);

6.9.4 for technical, analytical and statistical purposes related to customer service, returns and complaints - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR);

6.9.5 to establish, pursue or defend against possible claims - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR).

CONTACT FORM AND CUSTOMER COMMUNICATION

6.10 We allow you to contact us via a contact form, email, or other communication channels made available on the Website. Using a contact form may require you to provide Personal Data necessary to contact you and respond to your inquiry. Providing the data marked as mandatory is necessary to accept and process your inquiry through that form. Providing other data, for example in the body of your inquiry, is voluntary. Please do not submit special categories of data referred to in Article 9 of the GDPR unless this is strictly necessary for your inquiry.

6.11 Your Personal Data related to contact and correspondence is processed:

6.11.1 to identify and process your inquiry and conduct correspondence with you - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in the need to respond to inquiries and conduct communication in connection with the Controller’s business activities;

6.11.2 for statistical and organizational purposes related to customer service and improvement of communication processes - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR);

6.11.3 to establish, pursue or defend against possible claims - the legal basis for processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR).

COUNTERACTING ABUSE AND PROTECTING THE STORE

6.12 To ensure the proper functioning of the Store, protect Customers, protect the ordering process, and prevent fraud or abuse, we may analyze order, payment, account and return history, as well as technical information related to the use of the Website.

This may apply in particular to repeated or unusual activity that may indicate fraud, abuse of the ordering process, abuse of returns, unauthorized resale while declaring consumer status, or actions that may threaten the security or proper functioning of the Store.

The legal basis for this processing is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in protecting the Store, Customers, the ordering process and the Controller’s rights against fraud, abuse and unlawful activity.

This analysis may involve automated data processing. However, decisions concerning refusal to accept an order, restriction of selected Customer Account functionalities, or other similar measures are not made solely by automated means. Any such decision is preceded by an assessment by an authorized person acting on behalf of the Controller, who verifies the analysis results and takes into account the circumstances of the case.

Where required or appropriate in the circumstances, we inform the User of the reasons for the planned or applied measures and allow the User to present their position, challenge the analysis results, request re-verification, or appeal the decision by contacting us as described in section 3.

The described activities are not intended to lead to decisions based solely on automated processing that produce legal effects concerning the User or similarly significantly affect the User within the meaning of Article 22 of the GDPR.

GEOLOCATION AND DELIVERY OPTIONS

6.13 If the Store makes a pickup point search, map-based delivery selection, or similar delivery functionality available, location data may be processed only to the extent necessary to display nearby pickup points or available delivery options. Use of precise location data is optional and requires the User’s consent through browser, device, application, or Website settings.

The legal basis for processing precise location data is your consent (Article 6, paragraph 1, letter a of the GDPR). You can withdraw this consent at any time by changing your browser, device, application, or Website settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Location data may include approximate location based on IP address or precise GPS/location data, depending on the permissions granted by the User and the functionality used. We do not use location data for purposes other than displaying available delivery or pickup options, unless you have separately consented to another use.

7. MARKETING

7.1 Where you have given the required consent (Article 6, paragraph 1, letter a of the GDPR), which you can withdraw at any time, we may process your Personal Data for marketing purposes, including:

7.1.1 sending commercial information electronically, in particular by email newsletter;

7.1.2 displaying marketing content that may match your interests, including remarketing and behavioral advertising;

7.1.3 measuring the effectiveness of marketing activities, including conversion measurement and aggregated campaign statistics.

7.2 Sending commercial information electronically requires your separate consent in accordance with applicable laws. You can withdraw this consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, by clicking the unsubscribe link in each email, where available, or by contacting us at info@fleecozy.com.

7.3 We may use profiling for marketing purposes only where permitted by law and, where required, based on your consent. Profiling may include automated analysis of your activity on the Website, viewed products, clicks, approximate location, device information, or shopping preferences in order to display more relevant advertising or content. Such profiling is not intended to produce legal effects concerning you or similarly significantly affect you.

REMARKETING AND BEHAVIORAL ADVERTISING

7.4 Together with our trusted partners, including advertising and analytics providers, we may process Personal Data collected through cookies and similar technologies for marketing purposes related to remarketing, behavioral advertising, conversion measurement and advertising analytics. This may include data about your activity on the Website, products viewed, clicks, device information, cookie identifiers, and approximate location.

Such processing takes place only where the required consent has been obtained (Article 6, paragraph 1, letter a of the GDPR), including consent to advertising or analytical cookies where applicable. You can withdraw your consent at any time, as described in the cookies section of this Policy.

7.5 The current list of partners used for analytics, personalization and marketing purposes is provided in the cookies section of this Policy.

8. PROCESSING OF DATA OF PERSONS VISITING THE CONTROLLER'S PROFILES ON SOCIAL MEDIA

8.1 The Controller may maintain public profiles on social media platforms, including Facebook, Instagram and Pinterest. Therefore, the Controller may process data left by visitors to these profiles, including comments, reactions, messages, public profile information, preferences and online identifiers.

Data may also be processed by the operators of these social media platforms in accordance with their own privacy policies.

In relation to data processed in connection with the Page Insights function on Meta platforms, the Controller may act as a joint controller with Meta Platforms Ireland Limited. The principles of joint controllership are set out in the relevant Meta documentation.

8.2 The Personal Data of persons visiting or interacting with the Controller’s social media profiles may be processed:

8.2.1 to enable interaction, including commenting, liking, reacting, sharing or sending messages;

8.2.2 to manage the Controller’s profiles and provide users of social media platforms with information about the Controller’s activities, goods and services;

8.2.3 for statistical and analytical purposes;

8.2.4 to establish, pursue or defend against possible claims.

8.3 The legal basis for processing Personal Data in connection with the Controller’s social media profiles is the legitimate interest of the Controller (Article 6, paragraph 1, letter f of the GDPR), consisting in promoting its own brand, communicating with users, managing social media profiles, conducting activity and preference analysis, and, where necessary, pursuing or defending against claims.

NOTE: The above information does not replace the privacy policies of social media platform operators and does not apply to Personal Data processed independently by those operators.

9. INFORMATION ABOUT THE USE OF COOKIES

WHAT ARE COOKIES?

9.1 Cookies are small text files stored on the Device used when visiting the Website. Cookies enable the Website to function properly, facilitate the use of its features, remember selected settings, support checkout and cart functionality, and, where consent has been given, help analyze Website traffic or personalize advertising content.

TYPES OF COOKIES USED BY THE CONTROLLER

9.2 We may use the following types of cookies or similar technologies:

9.2.1 Necessary cookies are required for the proper functioning of the Website and the Store. These cookies enable the Controller to ensure the secure and reliable operation of the Website, support checkout and order processes, remember the contents of the cart, maintain the User’s session, remember cookie preferences, and correctly display the Website. These cookies are necessary for the operation of the Website and can only be disabled by changing browser settings, which may result in the Website not functioning properly.

Specific purposes of using necessary and technical cookies include, in particular:

a) ensuring the security and reliability of the Website;

b) remembering the contents of the cart and supporting the checkout process;

c) maintaining the User’s session and enabling secure use of the Store;

d) remembering selected settings, such as language, region, currency or cookie preferences, where such options are available;

e) ensuring the technical stability and proper display of the Website.

9.2.2 Analytical cookies are used to understand how Users use the Website, measure traffic, create statistics, test and improve Website functionality, and evaluate the effectiveness of our activities. Analytical cookies are used only after obtaining the User’s consent, unless a given tool or activity is strictly necessary and does not require consent under applicable law.

9.2.3 Personalization cookies may be used to remember preferences and tailor Website content or functionality to the User’s choices and interests. Personalization cookies are used only after obtaining the User’s consent, where such consent is required.

9.2.4 Advertising cookies allow the Controller and its partners to tailor advertisements to Users’ preferences and interests, conduct remarketing, measure advertising effectiveness, and display advertising content on external platforms. Advertising cookies are used only after obtaining the User’s consent.

COOKIE STORAGE PERIOD

9.3 Cookies may be divided according to their storage period into:

9.3.1 Session cookies - stored on the Device only until the end of the browser session and automatically deleted when the browser is closed.

9.3.2 Persistent cookies - stored on the Device after the browser session ends for the period specified in their parameters, unless the User deletes them earlier or withdraws consent where consent is required.

Some persistent cookies are set by external partners, such as Google, Meta or Pinterest, who define their own retention periods in accordance with their privacy policies.

MANAGING COOKIES ON THE WEBSITE

9.4 Only necessary cookies are required for the Website to function properly. Other types of cookies, including analytical, personalization and advertising cookies, are used only with your consent, where such consent is required. You can grant, restrict or withdraw your consent at any time using the cookie settings panel available on the Website, where such panel is available.

Withdrawal of consent does not affect the lawfulness of processing that took place before its withdrawal. You can also manage cookies directly through your browser settings, where you can block, restrict or delete them.

PARTNERS

9.5 Some cookies used on the Website may be placed by external partners with whom we cooperate in the areas of analytics, personalization, marketing, technical operation of the Store, payments, delivery, and customer service.

These partners may use their own cookies and process data in accordance with their privacy policies. Depending on the tool, data may also be transferred to third countries, such as the USA, on the basis of appropriate legal mechanisms, such as the EU-US Data Privacy Framework, standard contractual clauses, or other safeguards required by the GDPR.

Current list of selected partners used for analytics, personalization and marketing purposes:

The above list may be updated if the set of tools used on the Website changes.

10. WHO WILL WE SHARE YOUR PERSONAL DATA WITH?

10.1 We may transfer your Personal Data to entities cooperating with us in providing services, to the extent necessary to perform specific activities. Depending on the type of service, these entities may act as separate data controllers or as processors processing data on our behalf under a data processing agreement (Article 28 of the GDPR).

10.2 The Store is operated using the Shopify e-commerce platform. In connection with the operation of the Store, order handling, checkout, customer accounts, technical maintenance, security, analytics, and related services, Personal Data may be processed by Shopify acting as a service provider or data processor and, in certain cases, as an independent controller, in accordance with Shopify’s own terms and privacy documentation.

10.3 Depending on the selected delivery method and delivery country, your data, including name, surname, delivery address, telephone number, email address and order information, may be transferred to carriers, fulfillment providers, logistics operators, pickup point operators or delivery service providers to the extent necessary to deliver the Goods or provide delivery-related services.

10.4 If you choose a specific payment method, your data may be transferred to a payment operator, bank, payment system or payment service provider, which may act as an independent data controller or processor, depending on the payment method and applicable arrangements.

10.5 Your data may also be transferred to entities providing accounting, legal, consulting, IT, hosting, server, technical, marketing, analytical, customer service, fulfillment, logistics or similar services to us. Where these entities act as processors, they process data only on our instructions and under a data processing agreement.

10.6 We may disclose your data to competent public authorities or third parties if there is an appropriate legal basis for doing so, in particular resulting from mandatory provisions of law or legally binding requests from such authorities.

10.7 If Personal Data is transferred to third countries, the Controller applies appropriate safeguards required by the GDPR, such as an adequacy decision, the EU-US Data Privacy Framework, standard contractual clauses, or other mechanisms provided for under the GDPR.

11. HOW LONG WILL WE PROCESS YOUR PERSONAL DATA?

11.1 The period for which your Personal Data is processed depends on the type of service provided and the purpose for which the data is processed. Generally, we process data for the duration of the service provision, order fulfillment, account maintenance, correspondence, return or complaint handling, or until consent is withdrawn, where consent is the basis for processing.

11.2 Where processing is based on the Controller’s legitimate interest, Personal Data is processed until an effective objection is raised, unless the Controller demonstrates compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject or grounds for establishing, pursuing or defending claims.

11.3 Some data must be stored for the period required by law, in particular tax, accounting, consumer protection and sales documentation regulations.

11.4 The data processing period may be extended for the time necessary to establish, pursue or defend against legal claims, but no longer than the limitation periods under applicable law. After the necessary processing periods have elapsed, the data will be deleted or anonymized, unless further processing is permitted or required by law.

12. HOW DO WE PROTECT YOUR DATA?

12.1 We use appropriate technical and organisational measures to protect Personal Data and reduce the risk of loss, unauthorized access, unauthorized disclosure, unlawful processing or accidental destruction. These measures may include, depending on the context, access control, encrypted HTTPS/SSL connections, security monitoring, protection against unauthorized access, backup procedures, and cooperation with reputable service providers supporting the operation of the Store.

12.2 Using the internet involves certain inherent risks. We take reasonable steps to minimize these risks, monitor the operation of the Website, and maintain security measures appropriate to the nature, scope, context and purposes of processing.

12.3 In the event of a personal data breach that is likely to result in a high risk to your rights or freedoms, we will inform you in accordance with applicable law.

13. WHAT ARE YOUR RIGHTS IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA?

13.1 In connection with the processing of your Personal Data, you have the following rights, subject to the conditions set out in the GDPR:

13.1.1 the right of access to data - you have the right to obtain information as to whether we process your data and, if so, to access it and receive information about the purposes, legal basis, processing period, data recipients and your rights;

13.1.2 the right to receive a copy of the data processed by the Controller;

13.1.3 the right to rectification of data - you may request that incorrect data be corrected and incomplete data be supplemented;

13.1.4 the right to erasure of data (“right to be forgotten”) - you may request deletion of data in the cases provided for in Article 17 of the GDPR;

13.1.5 the right to restriction of processing - in the cases provided for in Article 18 of the GDPR, you may request restriction of processing;

13.1.6 the right to data portability - to the extent that data is processed on the basis of consent or a contract and in an automated manner, you have the right to receive data in a structured, commonly used and machine-readable format or request that it be transmitted to another controller, where technically feasible;

13.1.7 the right to object to the processing of data for direct marketing purposes - you can object at any time and we will stop processing your data for this purpose;

13.1.8 the right to object to processing based on legitimate interest - you may object to processing for reasons relating to your particular situation. Your objection will be upheld unless we demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms or grounds for establishing, pursuing or defending claims;

13.1.9 the right to withdraw consent - if processing is based on consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal;

13.1.10 the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except in cases permitted by law;

13.1.11 the right to lodge a complaint with a supervisory authority if you believe that the processing of your Personal Data infringes data protection regulations. You may lodge a complaint with the supervisory authority competent for your place of residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office.

SUBMITTING A REQUEST TO EXERCISE YOUR RIGHTS

13.2 You may exercise some rights yourself, in particular by editing your data in the Customer Account panel, where such functionality is available. For other rights, you may submit a request to the Controller.

13.3 You may submit a declaration or request regarding the exercise of rights arising from the GDPR by contacting the Controller at info@fleecozy.com, in writing to the registered office address indicated in section 3, or via the contact form available on the Website.

13.4 We will respond to your request without undue delay, no later than one month after receiving it. If, due to the complexity of the request or the number of requests, we are unable to meet this deadline, we may extend the response period by up to two further months, informing you of the extension and the reasons for it.

13.5 To ensure data security, we may request additional information necessary to confirm your identity. If we are unable to identify you, we may not be able to fulfil your request in accordance with Article 12(6) of the GDPR.

13.6 You may submit your request personally or through a representative. If you act through a representative, we may ask you to provide authorization confirming the representative’s authority.

13.7 If you submit your request electronically, we will respond electronically unless you request otherwise, where this is possible and safe. In other cases, we will respond in writing or electronically, depending on the circumstances and applicable law.

13.8 We retain information regarding submitted requests and their processing to the extent necessary to demonstrate compliance with GDPR obligations and to establish, pursue or defend legal claims. This data is retained for the period required by law and the applicable limitation periods for claims, with due regard for confidentiality and data integrity.

14. CHANGES TO THE PRIVACY POLICY

14.1 This Policy is reviewed and updated as necessary, in particular in the event of changes in applicable law, Website functionality, tools used, processing purposes, service providers, or the manner in which the Store operates.

14.2 The current version of the Policy is published on the Website.

Last updated: May 24, 2026