Privacy policy

Privacy Policy

The Data Controller responsible for data processing is:

Action Gear Brands Sp. z o.o.

Niciarniana 2/6, 92-208 Łódź

Email: kontakt@movino.com

Thank you for your interest in our online store. Protecting your privacy is very important to us. Below you will find detailed information on how we handle your data.

1. Access Data and Hosting

You can visit our websites without providing personal data. Each time a web page is accessed, the web server automatically saves only standard server log files—such as the name of the requested file, your IP address, the date and time of the request, the volume of data transferred, and the requesting internet service provider (so-called access logs)—and documents the page retrieval. This data is analysed solely to ensure the proper operation of our website and to improve our service offerings. Pursuant to Art. 6(1)(f) of the GDPR, this serves to safeguard our legitimate interest in the optimal, correct presentation of our website and products.

1.1 Hosting

All access data will be deleted no later than fourteen days after your visit to our website ends.

Web hosting and display services are partly provided on our behalf by service providers acting under data processing agreements. Unless otherwise specified in this privacy policy, all access data and any data collected via forms provided on our website will be processed on their servers. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. Our contact details can be found under "Our Contact Details and Your Rights".

1.2 Content Delivery Network (CDN)

To reduce load times on our website, we use a Content Delivery Network ("CDN"). As part of these CDN services, web content (such as large multimedia files) is delivered via regional servers operated by third-party CDN providers. Consequently, access data is also processed on the servers of these CDN providers. Services provided to us in this regard are carried out under data processing agreements entered into with the respective providers.

Our service providers are based in and/or use servers located in countries outside the EU and EEA. For these countries, the European Commission has not issued an adequacy decision. Our cooperation relies on Standard Contractual Clauses (SCCs) adopted by the European Commission. If you have questions regarding our service providers and the basis of our cooperation with them, please contact us using the details in "Our Contact Details and Your Rights".

Merchandise Management System

To handle orders and perform contractual obligations, we also use an external merchandise management system. Our service providers perform these services on our behalf under data processing agreements. If you have questions regarding these providers or our cooperation, please reach out via the contact information provided below.

2. Data Collection and Processing for Contract Performance and Communication

2.1 Data Processing for Contract Performance

We process personal data that you voluntarily provide when placing an order for the purpose of executing the contract (including handling statutory warranty claims, commercial warranty claims, and complying with statutory obligations to notify you about necessary updates). The legal basis for this is Art. 6(1)(b) GDPR. Mandatory fields are marked as such because they contain data strictly necessary to fulfill your order; without them, we cannot process it. The specific data collected is apparent from the respective input forms.

Further details on data processing—particularly regarding the transmission of data to our service providers for order fulfillment, payment processing, and shipping—are set out in the subsequent sections of this privacy policy. Once the contract has been fully performed, processing of your data will be restricted. Upon expiry of statutory retention periods under tax and accounting laws, this data will be deleted (Art. 6(1)(c) GDPR), unless you have given your explicit consent (Art. 6(1)(a) GDPR) to its further use for other purposes, or we reserve the right to further use permitted by law, of which you are informed in this policy.

2.2 Customer Account

If you give your consent pursuant to Art. 6(1)(a) GDPR to create a customer account, we will process the personal data required for this purpose. This data will also be retained for your future orders on our website. You may delete your customer account at any time by sending a message to our contact address listed under "Our Contact Details and Your Rights" or by using the corresponding function in your customer account settings. Following account deletion, processing of your data will be restricted, and the data will be deleted after the retention periods prescribed by tax and accounting legislation have elapsed (Art. 6(1)(c) GDPR), unless you have explicitly consented to its continued use (Art. 6(1)(a) GDPR) or we reserve the right to continue using it in legally permissible cases.

2.3 Data Processing for Contact Purposes

As part of our customer communications, we process personal data to handle your enquiries (Art. 6(1)(b) GDPR). You provide this data voluntarily when contacting us (e.g., via our contact form or email). Mandatory fields are marked as such because they are required to respond to your request. What data is collected is apparent from the relevant input forms. Once your enquiry has been fully resolved, your data will be deleted, unless you have explicitly consented to its continued use (Art. 6(1)(a) GDPR) or we reserve the right to further legally permissible use.

3. Data Processing for Delivery Purposes

To execute the contract (Art. 6(1)(b) GDPR), we pass your data on to the shipping/courier service selected by you during the ordering process and commissioned to deliver the purchased goods.

4. Data Processing for Payment Purposes

To process payments in our online shop, we cooperate with external online payment providers and forward your transaction details to the payment service provider you selected during checkout. This is done to fulfill the contract (Art. 6(1)(b) GDPR).

Fraud Prevention and Payment Optimization

In certain cases, we may transmit additional data to our payment service providers, which they may use alongside transaction data. These providers act on our behalf as data processors, providing services aimed at fraud prevention and the optimization of payment processes (e.g., invoicing, failed payment analysis, accounting support). Pursuant to Art. 6(1)(f) GDPR, this serves our legitimate interest in safeguarding against fraud and abuse and ensuring efficient payment management.

Installment Purchases

If you choose the "installment purchase" option and grant your consent (Art. 6(1)(a) GDPR), your personal data (first name, surname, address, email, phone number, date of birth, IP address, gender) together with transaction details (item purchased, invoice amount, due date, total amount, invoice number, tax, currency, order date and time) will be transmitted to our partner PayU S.A. (ul. Grunwaldzka 186, 60-166 Poznań, Poland) for payment execution.

To verify creditworthiness for installment purchases, our partner checks and collects information from public databases and credit reference agencies. A full list of credit agencies used—including details on mathematical-statistical credit scoring and information on how PayU S.A. processes data—is available in PayU's privacy policy at: https://poland.payu.com/politykacookies-payu/.

PayU S.A. uses the calculated statistical probability of default to make decisions regarding the establishment, execution, or termination of the contractual relationship. You have the right to present your point of view and challenge the automated decision by contacting PayU S.A. directly. Consent granted during the order process to transfer this data may be revoked at any time without stating grounds, with future effect.

5. Marketing Channels: Email

5.1 Newsletter Distribution

If you subscribe to our newsletter, we will use the data you provided based on your consent (Art. 6(1)(a) GDPR) to regularly send you our electronic newsletter.

You can unsubscribe at any time by sending a message to our contact address specified under "Our Contact Details and Your Rights" or by clicking the unsubscribe link included in every newsletter. Upon unsubscribing, we will delete your email address, unless you have expressly consented to its further use (Art. 6(1)(a) GDPR) or statutory permissions apply.

5.2 Review Invitations

If you granted your consent during or after placing an order (Art. 6(1)(a) GDPR), we will use your email address to send you an invitation to review your purchase in our store via our review system. You may withdraw your consent at any time by contacting us or by using the unsubscribe link provided in the review invitation email.

Review invitations are dispatched by our service provider, Ringier Axel Springer Polska Sp. z o.o. (ul. Domaniewska 49, 02-672 Warsaw, Poland) (Opineo.pl). In connection with dispatching invitations, we receive delivery and status reports from Opineo.pl (e.g., whether the review invitation was sent and delivered). This is conducted in accordance with Art. 6(1)(f) GDPR to pursue our legitimate interest in monitoring review requests to optimize our processes, as well as Opineo.pl's legitimate interest in offering this service.

We and Opineo.pl act as joint controllers for the dispatch of review invitations and the collection and display of review and status data. For inquiries concerning your data or to exercise your rights regarding joint processing, please contact Opineo.pl (contact details are available on their website). You may also contact us directly at any time, and we will forward your request to Opineo.pl if required.

6. Cookies and Similar Technologies

General Information

To make visiting our website attractive and enable the use of essential features, we use technical tools, including cookies. Cookies are small text files automatically saved on your end device. Some cookies are deleted after your browser session ends (session cookies). Others remain stored on your device and enable us to recognize your browser on your next visit (persistent cookies).

End-Device Privacy Protection

When using our online services, we deploy technologies that are strictly necessary to provide the core functions of our website. In this respect, storing information on your end device or accessing information already stored on your end device does not require consent.

For non-essential features, storing information on your device or accessing existing data requires your consent. Please note that if you decline consent, certain website features may not be fully functional. Any consent granted remains valid until revoked, modified via site settings, or reset within your browser settings.

Further Data Processing via Cookies and Technologies

Essential technologies process data such as your IP address, visit timestamp, device and browser information, and website usage data (e.g., shopping cart contents). Pursuant to Art. 6(1)(f) GDPR, this serves our legitimate interest in the proper presentation of our store.

Additionally, we use technologies to comply with legal obligations (e.g., maintaining proof of consent) and for web analytics and online marketing. Further details and legal bases are specified below.

You can manage cookie settings in your browser help menu:

Where processing is based on consent (Art. 6(1)(a) GDPR), you may withdraw it at any time by contacting us.

7. Use of Cookies and Similar Technological Tools

Where you have granted your consent (Art. 6(1)(a) GDPR), we use third-party cookies and tracking technologies listed below. Once the processing purpose has been fulfilled and the tool is no longer in use, data collected through these tools will be deleted. You can withdraw consent at any time.

7.1 Google Services

We use technologies provided by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Information automatically gathered by Google regarding website use is generally transmitted to and stored on servers of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The European Commission has not issued an adequacy decision for the USA; our cooperation is grounded on Standard Contractual Clauses (SCCs). Where IP addresses are processed, IP anonymization is enabled so that your IP address is truncated prior to storage. Only in exceptional cases will a full IP address be sent to a US Google server and truncated there. Unless otherwise specified, processing is based on a Joint Controllership agreement pursuant to Art. 26 GDPR. Detailed information is available in Google's privacy policy.

Google Analytics: Analyzes website use by processing data (IP address, time of visit, device/browser details, website interactions) to generate pseudonymized usage profiles. Cookies may be deployed. Your IP address is not merged with other Google data. Processing is governed by a data processing agreement with Google. We have enabled data sharing for "Google products and services" to help improve Google products, governed by a controller-to-controller agreement.
Google Ads: We use Google Ads to display ads in search results and on third-party sites. A remarketing cookie is placed on your device to show interest-based ads via a pseudonymous ID. Extended data processing occurs only if ad personalization is activated in your Google account.
- Google Ads Conversion Tracking: Measures and analyzes user actions after clicking an ad (e.g., website visit, newsletter signup) to build pseudonymized profiles.
- Enhanced Conversions: Enhances conversion measurement accuracy. Conversion data is hashed using SHA256 before transmission to Google.
Google Maps: Visually displays geographic information. Google Maps processes your IP address and location data. We have no influence over Google’s processing.
Google reCAPTCHA: Protects our web forms against spam and malicious bots by analyzing your interaction using JavaScript and cookies (processing IP address, visit time, device data). Form input values are not read or saved.
Google Fonts: Integrates web fonts uniformly across our pages, processing your IP address, visit duration, and browser/device metadata.
YouTube Video Plugin: When playing embedded YouTube videos, Google processes your IP address, visit timestamp, and device/browser details.

7.2 Facebook Services

Facebook Pixel: Provided by Facebook Ireland Ltd, 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"). It automatically collects and records data (IP address, visit time, device/browser details, user actions like site visits or newsletter signups) to build pseudonymized user profiles. A cookie stores a pseudonymous Cookie-ID to identify your browser across other websites. Facebook combines this data with your Facebook account details for website activity reporting and ad personalization. Data is typically transferred to Facebook, Inc., 1601 Willow Road, Menlo Park, CA 94025, USA, based on Standard Contractual Clauses.
Facebook Business Analytics: Generates user activity statistics on our website based on Pixel data under a data processing agreement to optimize our web services.
Facebook Ads & Custom Audience: Enables targeted advertising on Facebook and affiliate platforms. Joint controllership under Art. 26 GDPR applies exclusively to the collection and transmission of data to Facebook Ireland; subsequent processing is Facebook Ireland’s sole responsibility. We use Custom Audiences to serve targeted ads to specific customer segments and Pixel Remarketing for personalized ads.
Facebook Pixel Conversions: Analyzes user behavior following ad clicks to optimize our marketing campaigns under a data processing agreement.

7.3 Other Analytics and Marketing Providers

Adobe Fonts: We use "Adobe Fonts" by Adobe, Inc., 345 Park Avenue, San Jose, CA 95110-2704, USA, to ensure consistent typography. Adobe processes your IP address, visit time, and device/browser data under Standard Contractual Clauses and an Art. 26 GDPR Joint Controllership arrangement.
Vimeo Video Plugin: When playing embedded videos from Vimeo LLC, 555 West 18th Street, New York, NY 10011, USA, Vimeo processes your IP address, visit time, and device/browser information under Art. 26 GDPR joint arrangements.
- Google Analytics within Vimeo: Vimeo embeds Google Analytics automatically. Vimeo is responsible for this processing, which is conducted under SCCs with Google.

8. Integration with Opineo.pl and External Widgets

To display the Opineo.pl trust badge, customer reviews, and post-order service offerings, widgets from Opineo.pl are integrated into our website.

Pursuant to Art. 6(1)(f) GDPR, this serves our legitimate interest in optimal marketing and providing a safe online shopping experience. These widgets are operated by Ringier Axel Springer Polska Sp. z o.o. (ul. Domaniewska 49, 02-672 Warsaw, Poland), with whom we act as joint data controllers under Art. 26 GDPR. For any questions regarding your data or to exercise your rights, please contact Opineo.pl directly via their privacy policy page. Inquiries sent to us can also be forwarded to Opineo.pl if necessary.

8.1 Data Processing within Widgets

When a Trustbadge or widget is loaded, the server automatically saves server log files (IP address, timestamp, transferred data volume, requesting provider). IP addresses are anonymized immediately upon collection so they cannot be linked to individual visitors. Anonymized data is used strictly for statistical and error-analysis purposes.

8.2 Data Processing Following Order Placement

After you place an order, your email address—encrypted via a one-way cryptographic hash—is transmitted to Opineo.pl (Art. 6(1)(f) GDPR). This verifies whether you are already registered in the Opineo.pl system, serving our mutual legitimate interest in providing buyer protection and transaction evaluation services. If you are registered, subsequent processing follows your agreement with Opineo.pl; if not, you will have the opportunity to register. If you choose not to register, Opineo.pl automatically deletes all transmitted data.

Opineo.pl uses external providers for hosting, monitoring, and logging under Art. 6(1)(f) GDPR. Data may be processed in third countries (USA and Israel). For the USA, safeguards are established via Standard Contractual Clauses; for Israel, an official EU adequacy decision applies.

9. Social Media

9.1 Social Media Plugins: Facebook (Meta), Instagram (Meta), WhatsApp

We use social media buttons/links. These are integrated as simple HTML links, ensuring that no direct connection is made to social network servers when you browse our site. Clicking a button opens a new window directly on the provider's platform, where you can interact (e.g., click "Like" or "Share").

9.2 Our Social Media Presence: Facebook, Instagram, YouTube, LinkedIn

If you have given consent to the respective platform (Art. 6(1)(a) GDPR), your data is automatically gathered and stored for analytics and advertising purposes when you visit our profiles. Pseudonymized usage profiles are created to deliver targeted ads both inside and outside the networks, typically using cookies. For full details on data usage, privacy configurations, and your rights, please review each platform's privacy policy:

Facebook (by Meta): Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Data is typically transferred to Meta Platforms, Inc. in the USA under Standard Contractual Clauses and an Art. 26 GDPR joint controllership agreement regarding page insights.
Instagram (by Meta): Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. Transferred to US servers under Standard Contractual Clauses and Art. 26 GDPR joint controllership arrangements.
YouTube: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Processed on US servers under Standard Contractual Clauses.
LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. Transferred to LinkedIn Corporation (USA) under Standard Contractual Clauses.

10. Our Contact Details and Your Rights

10.1 Your Rights

Under the GDPR, you are entitled to the following rights regarding your personal data:

Art. 15 GDPR: The right to obtain information and access to your personal data being processed.
Art. 16 GDPR: The right to rectification of inaccurate or incomplete personal data.
Art. 17 GDPR: The right to erasure ("right to be forgotten") of your stored personal data, unless further processing is necessary:
- to exercise the right of freedom of expression and information;
- for compliance with a legal obligation;
- for reasons of public interest;
- for the establishment, exercise, or defence of legal claims.
Art. 18 GDPR: The right to restriction of processing if:
- you contest the accuracy of the data;
- the processing is unlawful and you oppose erasure;
- we no longer need the data, but you require it for legal claims;
- you have objected to processing pursuant to Art. 21 GDPR.
Art. 20 GDPR: The right to data portability—to receive your data in a structured, commonly used, and machine-readable format, or have it transmitted to another controller.
Art. 77 GDPR: The right to lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office – Prezes Urzędu Ochrony Danych Osobowych, "UODO").

Right to Object

Where we process personal data to safeguard our legitimate interests (Art. 6(1)(f) GDPR) as outlined above, you have the right to object to this processing with future effect.

If processing is conducted for direct marketing, you may exercise your right to object at any time without providing specific grounds; we will immediately cease processing your data for these purposes.
If processing serves other purposes, you may object only on grounds relating to your particular situation.

Upon receiving your objection, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds for processing that override your interests, rights, and freedoms, or where processing is necessary to establish, exercise, or defend legal claims.

10.2 Contacting Us

For questions regarding the collection, processing, or use of your personal data, or to request access, rectification, restriction, or erasure, or to withdraw consent or object to specific processing, please contact the Data Controller directly using the details provided at the beginning of this policy:

Action Gear Brands Sp. z o.o.