PRIVACY POLICY

1. The controller of your personal data is:

Body Space Spółka z ograniczoną odpowiedzialnością (Body Space Limited Liability Company) Registered office: Podleska 51, 43-190 Mikołów, Poland E-mail: [email protected] Website: https://bodyspace.eu Hereinafter referred to as the “Controller”, “we”, “us” or “our”.

2. Categories of Personal Data We Collect

We collect and process the following categories of personal data:

  • Identity data: first name, last name.
  • Contact data: e-mail address, telephone number, postal address.
  • Technical data: IP address, browser type and version, operating system, device identifiers, referrer URL.
  • Usage data: pages visited, timestamps, time spent on pages, click data.
  • Marketing data: preferences, consent records, communication history.
  • Form data: any information you voluntarily submit through contact forms, registration forms, or lead generation forms (including Facebook Lead Ads).
  • Marketing identifiers: Meta browser ID (`_fbp` cookie), Meta click ID (`_fbc` cookie), and pseudonymous event identifiers used to deduplicate marketing events between client-side (Pixel) and server-side (Conversions API) channels.

We collect personal data through the following methods: data you enter voluntarily in forms on our Website; cookies and similar tracking technologies stored on your device; third-party lead generation forms, including Facebook (Meta) Lead Ads.

3. Purposes and Legal Bases for Processing

We process your personal data only where we have a valid legal basis under Article 6(1) of the GDPR. Below we set out each processing purpose together with the applicable legal basis.

  • Responding to inquiries submitted via contact forms
  • Legal basis: Legitimate interest of the Controller — maintaining business correspondence (Art. 6(1)(f) GDPR).
  • Performance of ordered services and fulfilment of contractual obligations
  • Legal basis: Performance of a contract to which you are a party (Art. 6(1)(b) GDPR).
  • Sending marketing communications (e-mail, newsletters)
  • Legal basis: Your consent (Art. 6(1)(a) GDPR).
  • Remarketing and personalised advertising (Google Ads, Meta)
  • Legal basis: Your consent (Art. 6(1)(a) GDPR).
  • Website analytics via Google Analytics
  • Legal basis: Your consent obtained through the cookie consent mechanism (Art. 6(1)(a) GDPR).
  • Operation of the Facebook (Meta) Pixel and the Conversions API (CAPI) — the Pixel collects browser-side events; the Conversions API transmits server-side events from our CRM (Bitrix24) directly to Meta to improve attribution and measurement of advertising campaigns.
  • Legal basis: Your consent obtained through the cookie consent mechanism (Art. 6(1)(a) GDPR).
  • Transfer of lead data from Facebook Lead Ads to third-party advertising systems (Google)
  • Legal basis: Your explicit consent given in the lead form via a dedicated consent checkbox (Art. 6(1)(a) GDPR).
  • Maintaining the security and proper functioning of the Website (essential cookies, server logs)
  • Legal basis: Legitimate interest of the Controller (Art. 6(1)(f) GDPR).
  • Compliance with legal obligations (e.g. accounting, tax)
  • Legal basis: Legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).

4. Recipients of Personal Data

In order to carry out the purposes described in Section 3, we may share your personal data with the following categories of recipients:

  • Hosting provider: OVH SAS (France) — on the basis of a data processing agreement, for the purpose of technically maintaining the Website and storing data.
  • Analytics provider: Google LLC (USA), operating Google Analytics — for the purpose of statistical analysis of Website traffic. We use IP anonymisation; no directly identifying data is transmitted.
  • Advertising platforms: Meta Platforms, Inc. (USA), operating the Facebook/Instagram Pixel, the Conversions API (server-to-server data transmission of conversion events from our CRM), and Lead Ads; Google LLC (USA), operating Google Ads — for remarketing and conversion tracking, based on your consent.
  • Social media: X Corp. (USA), formerly Twitter — cookies may be placed on your device when interacting with embedded content.
  • Authorised personnel: Our employees and collaborators who require access to personal data to carry out the Website’s activities, bound by confidentiality obligations.
  • Professional advisors: Accountants, legal advisors, and auditors where required by law or for the protection of our legitimate interests.

We do not sell your personal data to any third party.

5. Facebook Lead Ads and Third-Party Data Transfers

  • When you submit your data through a Facebook (Meta) Lead Ad form operated by us, we may transfer the data you provide (such as your name, e-mail address, and telephone number) to third-party advertising systems, including Google Ads, for the purposes of audience matching, conversion tracking, and personalised advertising.
  • This transfer is carried out solely on the basis of your explicit consent, which is collected within the lead form via a dedicated consent checkbox. You are informed at the point of collection that your data may be shared with Google for advertising purposes.
  • You may withdraw your consent at any time by contacting us at [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

6. International Data Transfers

Your personal data may be transferred to, and processed in, countries outside the European Economic Area (EEA), specifically the United States of America. This concerns the following service providers:

  • Google LLC (USA): EU–US Data Privacy Framework (DPF) adequacy decision; Standard Contractual Clauses (SCCs) as supplementary safeguard.
  • Meta Platforms, Inc. (USA): EU–US Data Privacy Framework (DPF); Standard Contractual Clauses (SCCs).
  • X Corp. (USA): Standard Contractual Clauses (SCCs).

Where we rely on Standard Contractual Clauses, we have conducted a Transfer Impact Assessment (TIA) to verify that the level of protection afforded to your data is essentially equivalent to that guaranteed within the EEA. You may request a copy of the applicable safeguards by contacting us at the address provided in Section 1.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows:

  • Contractual data (service delivery): Duration of the contract plus 5 years (statutory limitation period under Polish law).
  • Contact form inquiries: 12 months from the date of the last communication, unless a contractual relationship is established.
  • Marketing data and consent records: Until consent is withdrawn, but no longer than 3 years from the last interaction.
  • Accounting and tax records: 5 years from the end of the financial year in which the transaction occurred (Polish Accounting Act).
  • Server logs (hosting): Up to 12 months, for security and diagnostic purposes.
  • Cookie data: As specified for each cookie category in Section 9.
  • Meta marketing identifiers (`_fbc`, `_fbp` cookies stored in our CRM for attribution purposes): up to 90 days from collection, matching the cookie lifetime defined by Meta.
  • IP address and User Agent (when stored in our CRM for advertising attribution via the Conversions API): up to 12 months from collection, then automatically anonymised or deleted.

When personal data is no longer required, it is securely deleted or anonymised.

8. Your Rights as a Data Subject

Under the GDPR, you have the following rights in relation to your personal data:

  • Right of access (Art. 15) — You have the right to obtain confirmation of whether we process your personal data and, if so, to request a copy of that data.
  • Right to rectification (Art. 16) — You have the right to request correction of inaccurate personal data or completion of incomplete data.
  • Right to erasure (Art. 17) — You have the right to request deletion of your personal data where, among other things, the data is no longer necessary for the purposes for which it was collected, or you withdraw your consent.
  • Right to restriction of processing (Art. 18) — You have the right to request that we restrict processing of your data in certain circumstances, such as when you contest the accuracy of the data.
  • Right to data portability (Art. 20) — You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
  • Right to object (Art. 21) — You have the right to object to processing based on our legitimate interests, including profiling. We will cease processing unless we demonstrate compelling legitimate grounds.
  • Right to withdraw consent (Art. 7(3)) — Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
  • Right not to be subject to automated decision-making (Art. 22) — You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

To exercise any of these rights, please contact us at: [email protected]. We will respond to your request within 30 days. In complex cases, this period may be extended by a further 60 days, of which we will inform you.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (https://uodo.gov.pl).

9. Cookies and Tracking Technologies

What Are Cookies

  • Cookies are small text files placed on your device by the Website. They are used to ensure proper operation of the Website, analyse traffic, and deliver personalised advertising. Cookies may be placed by us (first-party cookies) or by third parties whose services we use (third-party cookies).

Cookie Consent

  • When you first visit our Website, a cookie consent banner is displayed, allowing you to accept or reject non-essential cookies. You may modify your preferences at any time through the consent management panel accessible via the cookie settings link in the Website footer.
  • Essential cookies that are strictly necessary for the operation of the Website do not require consent and cannot be disabled. All other cookies (analytics, marketing) are activated only after you have given your explicit consent.

Categories of Cookies

  • Strictly Necessary Cookies: Required for the Website to function (e.g. session management, authentication, security). These cookies cannot be disabled.
  • Analytics Cookies: Used to collect anonymised statistics about Website usage (Google Analytics). These cookies are activated only with your consent.
  • Marketing / Advertising Cookies: Used for remarketing and personalised advertising (Meta Pixel, Google Ads, X/Twitter). The Meta Pixel specifically sets `_fbc` (click identifier, lifetime up to 90 days) and `_fbp` (browser identifier, lifetime up to 90 days). These identifiers may also be transmitted to our CRM (Bitrix24) and to Meta via the Conversions API to improve advertising attribution accuracy. These cookies are activated only with your consent.

Third-Party Cookies

Cookies may also be placed on your device by the following third parties:

  • Google LLC (USA) — Google Analytics, Google Ads
  • Meta Platforms, Inc. (USA) — Facebook/Instagram Pixel
  • X Corp. (USA) — X (formerly Twitter) tracking

For information on how these providers use cookies, please refer to their respective privacy policies.

Managing Cookies in Your Browser

  • You may also control cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. Please note that disabling essential cookies may impair the functionality of the Website. Instructions for managing cookies are available in the help sections of the most common browsers: Google Chrome, Mozilla Firefox, Safari, Microsoft Edge, and Opera.

10. Automated Decision-Making and Profiling

We may use automated tools for the following limited purposes:

  • Audience segmentation for marketing communications (e.g. grouping contacts by interest or engagement level).
  • Remarketing through advertising platforms (Meta, Google), which use algorithmic profiling to display relevant ads.

These activities are based on your consent and do not produce legal effects or similarly significant effects concerning you. You are not subject to decisions based solely on automated processing that would affect your legal rights. If you believe that automated processing has affected you in a significant manner, you have the right to request human intervention, express your point of view, and contest the decision by contacting us at [email protected]. Please note: as of 2 August 2026, the EU Artificial Intelligence Act imposes additional transparency requirements for AI-powered systems. Should we deploy any AI systems that interact with you (e.g. chatbots, automated e-mail personalisation), we will update this section accordingly and inform you prior to deployment.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • SSL/TLS encryption for all data transmitted between your browser and our servers.
  • Encryption of personal data stored in our databases, accessible only with the Controller’s key.
  • Two-factor authentication (2FA) for administrative access to the Website.
  • Regular changes of administrative passwords.
  • Regular backups of all data.
  • Timely updates of all software components used in the processing of personal data.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the President of the Personal Data Protection Office within 72 hours and, where the risk is high, we will inform you without undue delay.

12. Server Logs

Our hosting provider (OVH) maintains server-level logs for technical reliability and security purposes. The following information may be recorded: requested resource URLs, request and response timestamps, client device identification (via the HTTP protocol), HTTP transaction errors, referring page URL, browser and device information, IP address, and diagnostic data related to services ordered through the Website.

Server logs are retained for up to 12 months and are used solely for Website administration and security purposes. The legal basis for this processing is our legitimate interest in ensuring the security and proper functioning of the Website (Art. 6(1)(f) GDPR).

13. Children’s Data

Our Website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will take steps to delete such data.

14. Data Protection Officer

Given the nature and scale of our processing activities, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. For all privacy-related inquiries, please contact us directly at: [email protected].

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy to reflect changes in our processing activities, applicable law, or regulatory guidance. Any material changes will be communicated to you via e-mail (where we have your contact details) and/or by a prominent notice on the Website prior to the changes taking effect. We recommend reviewing this Privacy Policy periodically.

16. Contact

If you have any questions about this Privacy Policy or wish to exercise your data subject rights, please contact us at: [email protected]

This Privacy Policy is effective as of 2 May 2026 (last updated to reflect the addition of the Meta Conversions API and CRM-side storage of marketing identifiers).