PRIVACY POLICY OF GESCHÄFT

 

Version 1.0 · effective from: 11.09.2026

 

This Policy describes the rules for processing personal data in connection with the use of the Geschäft online store,
the Account, purchases, GSFT DOERS CLUB, the “Build the Set” discount system, marketing communications, analytics and
advertising tools, and the BASEIG AI system. If a particular technology requires consent, it is activated only after
such consent has been given through the appropriate consent management mechanism.

§ 1. Controller and contact details

1. The controller of personal data is BASEIG S.A., with its registered office in Poznań, ul. Święty Marcin 28/41,
   61-805 Poznań, KRS 0001161462, NIP 7831877465, REGON 524870296 (“BASEIG”, the “Controller”, “we”).
2. For matters concerning personal data, you can contact us at:
   shop@geschaft.gmbh.
3. Geschäft is the trade name of the Store operated by BASEIG S.A. The BASEIG AI system is the Controller’s own system
   used, among other things, for analytics, advertising optimisation and the development of BASEIG tools. The mere
   transfer of data between the Geschäft Store and the internal BASEIG AI system does not constitute a transfer of data
   to another controller.

§ 2. What data we may process

Depending on how you use the Store, we may process in particular:

• identification and contact data, e.g. first name, last name, e-mail address, delivery address and billing details;
• Account data, including the Account ID, login data, order history, settings and membership status;
• order and transaction data, including Products, prices, discounts, currency, payment method, delivery, returns, complaints and Product modifications;
• data relating to the acceptance of terms and conditions and consents: the version of the document or wording of the consent, date and time, source of consent, current status and withdrawal history;
• data relating to GSFT DOERS CLUB and the “Build the Set” system, including membership status, benefits used, threshold reached and settlement rules;
• data relating to communications with us, requests, complaints, returns and forms;
• technical and internet data, e.g. IP address, cookie and similar technology identifiers, device type, operating system, browser, website events, traffic source and information about interactions with the Store;
• analytics and advertising data relating to campaigns, e.g. impressions, clicks, conversions, cost, campaign source, advertising parameters and aggregated information about audience behaviour;
• data received from Meta, Google and other providers’ advertising and analytics tools to the extent resulting from the configuration of those tools and the consents given.

§ 3. Purposes, legal bases and retention periods

The table below presents the main processing activities. The periods may be extended as appropriate if the data is
required for the establishment, exercise or defence of legal claims or if this is required by law.

§ 4. GSFT DOERS CLUB, consents and club benefits

1. Joining GSFT DOERS CLUB requires acceptance of the Club Terms and Conditions. Acceptance of the Club Terms and Conditions
   does not constitute marketing consent.
2. Consent to e-mail marketing communications is voluntary, separate and may be withdrawn at any time. Withdrawal of consent
   does not terminate Club membership.
3. Some club benefits are, however, provided exclusively through e-mail communications covered by the relevant active consent.
   This applies in particular to sending early access to drops, information about new collections and advance information about
   restocks. A Member without active marketing consent will not receive such messages or the early-access links resulting from them.
4. The absence or withdrawal of marketing consent does not deprive a Member of benefits that can be provided without such
   communications, e.g. access to the applicable discount tier or to products available to active Members after logging in,
   in accordance with the relevant specific terms and conditions.
5. Communications necessary for managing membership, e.g. confirmation of joining, Account security information or information
   about changes to the Club Terms and Conditions, are separate from marketing communications.

§ 5. “Build the Set” discount system

In connection with the Discount System, we record information necessary to correctly calculate and subsequently settle the
benefits, including the qualifying value, the threshold reached, the discount applied to Products and the delivery discount,
as well as the version of the Discount System Terms and Conditions accepted for a given Order. This data may also be required
in the event of a partial withdrawal from the contract and in determining the correct refund amount.

§ 6. BASEIG AI – analytics, advertising optimisation and system development

1. Geschäft is integrated with its own BASEIG AI system. The system is used to combine and analyse information about the
   operation of the Store, sales and the results of advertising activities in order to better understand audience behaviour
   and the effectiveness of individual creatives, channels and campaigns.
2. The analyses may include in particular:
   • Product sales, the value and structure of shopping carts, conversions, returns and the use of discounts;
   • aggregated or appropriately prepared information about how the Store is used and about purchase journeys;
   • campaign and advertising data from Meta Ads (including Facebook and Instagram), Google Ads and other advertising channels used, e.g. impressions, clicks, cost, conversions, creatives and audience results;
   • information from measurement tools, pixels and advertising tags, where the user has given the required consent to their use;
   • the creation of statistical audience segments and models, evaluation of which content, Products and advertisements perform better for particular groups, and generation of proposals and recommendations concerning campaigns and advertising creatives;
   • training, testing and improving BASEIG AI models, algorithms and functions using aggregated or anonymous data and, where personal data is used in a particular process, data that has been appropriately minimised or pseudonymised according to the purpose of that process;
3. BASEIG AI is not used by Geschäft to make decisions concerning a specific customer based solely on automated processing
   that would produce legal effects concerning that customer or similarly significantly affect them.
4. The purpose of BASEIG AI analyses is not to create an individual assessment of a specific customer based on their personal
   data. We primarily analyse behaviour and results at the level of groups, statistical segments, campaigns and datasets.
5. If personal data must be processed before an anonymous dataset is created, the operations leading to anonymisation remain
   processing of personal data. Data is considered anonymous only when it can no longer be attributed to an identified or
   identifiable person using means that can reasonably be expected to be used.
6. Pseudonymisation is not treated as anonymisation. Pseudonymised data remains subject to personal data protection rules.
7. Anonymous and aggregated data may subsequently be used for analyses, statistics, research, training and development of
   BASEIG AI and other BASEIG tools because it no longer relates to an identified or identifiable person.
8. BASEIG AI may use external artificial intelligence models and services, including language and multimodal models provided
   by specialised technology providers. They may support, in particular, the analysis of data and campaign results, the creation
   and evaluation of content and advertising creative proposals, the generation of recommendations and the development of BASEIG AI functions.
9. When using external AI models and services, the Controller limits the scope of information transferred to the data necessary
   to perform the particular task. Where identification of a specific person is not necessary, appropriate minimisation measures
   are applied before data is transferred, in particular aggregation, pseudonymisation or removal of direct identifiers.
   Wherever possible, anonymous or aggregated data that does not allow a specific person to be identified is used for such tasks.
10. External providers of AI models and services may process the data provided to them as processors acting on behalf of the
    Controller or, to the extent resulting from the terms of a particular service, as independent controllers. The use of such
    providers is assessed each time with regard to the scope of data transferred, the terms of service, security and the rules
    governing transfers of data outside the EEA.

§ 7. Google, Meta, pixels, tags and advertising

1. The Store may use, among other things, Google services (e.g. Google Analytics, Google Ads and relevant tags) and Meta services
   (e.g. Meta Pixel and Meta Ads for Facebook and Instagram), as well as other analytics and advertising tools implemented in the Store.
2. Analytics and advertising technologies that are not necessary for the operation of the Store and require consent are activated
   in accordance with the user’s choice made through the consent management platform (CMP).
3. Depending on the configuration of the tool, providers may receive, among other things, online identifiers, device and browser
   information, IP address, information about page views and events, traffic source, interactions with the Store and conversion events.
   The scope is limited in accordance with the configuration of the tools and the principle of data minimisation.
4. Information about advertising and campaign results received from Meta, Google and other platforms may subsequently be analysed
   in BASEIG AI together with Geschäft sales data in order to assess advertising effectiveness at the level of audiences, campaigns,
   creatives and channels.
5. If an advertising platform independently determines the purposes and means of processing data within its own services, it may
   act as an independent controller or, depending on the particular function, as a joint controller. Details are set out in the
   documentation and terms of the relevant provider.
6. Consent to cookies and advertising technologies can be changed or withdrawn at any time through the cookie settings available
   in the Store. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

§ 8. Newsletter, marketing and notifications

1. We send e-mail marketing only to the extent covered by an appropriate legal basis and the required consents. Consent is not
   a condition for making a purchase, creating an Account or membership in the Club itself.
2. Marketing consent may cover, among other things, information about drops, launches, restocks, club products and colourways,
   collections, offers and other Geschäft news.
3. The user may withdraw consent via a link in the message or through the “My Account → Consents and communication” function.
   The system retains the history of giving and withdrawing consent to the extent necessary to demonstrate compliance.
4. The “notify me when available” function for a specific Product is a separate service activated at the user’s request.
   Using this function does not in itself mean subscribing to the general newsletter.

§ 9. Payments, invoices, fulfilment and delivery

1. Data necessary to process payments is transferred to the payment service providers available at checkout, in particular
   Stripe and PayPal, to the extent necessary to carry out the transaction. As a rule, the Controller does not receive full
   payment instrument details where they are processed directly by the payment service provider.
2. Data relating to sales and sales documents may be processed using BaseLinker and invoicing functions integrated with the Store.
3. Data necessary for order fulfilment, returns handling and logistics may be transferred to the fulfilment/returns operator,
   including the Stripe Pack logistics point, and to carriers selected to perform delivery.
4. Individual providers may act as processors acting on our behalf or as independent controllers to the extent that they
   independently determine the purposes and means of processing, e.g. in connection with payment obligations, security or legal obligations.

§ 10. Recipients of data

Data may be disclosed or entrusted to other entities only to the extent necessary to achieve specific processing purposes,
in particular to:

• providers of hosting, IT infrastructure, cloud services, content delivery networks (CDNs), security services and solutions used to protect the Store against abuse and automated traffic, including Cloudflare and providers of reCAPTCHA solutions, as well as providers of WooCommerce, plugins and other technical components used to maintain, secure and develop the Store;
• providers of mailing and communication systems, as well as platforms and tools used to manage consents and preferences relating to cookies and similar technologies, including Cookiebot, to the extent necessary to record, read and document the user’s choices;
• payment service providers, banks and other entities involved in processing and settling payments;
• BaseLinker and providers of systems used to issue sales documents, provide accounting services and perform settlements;
• fulfilment operators, entities handling warehousing and returns, and carriers performing deliveries;
• Trustpilot and other providers of systems used to collect, verify, display or manage reviews of the Store, Products or purchases – to the extent necessary to provide the relevant functionality, including, where applicable, sending an invitation to submit a review and linking a review to an actual purchase experience;
• Google, Meta and other providers of analytics, advertising, measurement and marketing tools – to the extent resulting from the functionalities used, the configuration of those tools and the consents given by the user, where such consents are required;
• providers of infrastructure, models and artificial intelligence services used by BASEIG AI, including providers of large language models (LLMs), multimodal models and other services supporting data analysis, analysis of campaign results, generation of recommendations and content, creation or evaluation of advertising creative proposals and the development of BASEIG AI functions – solely to the extent necessary to perform a specific task;
• providers of cloud services, databases, developer tools, monitoring, security and other technical infrastructure used by BASEIG or BASEIG AI;
• providers of legal, accounting, audit and security services and services related to the protection of the Controller’s rights;
• public authorities and other entities where the obligation to disclose data results from applicable law.

Depending on the nature of the service provided, individual recipients may process data as processors acting on behalf of the
Controller, independent controllers or – where this results from the nature of the relevant service – joint controllers.

When using external artificial intelligence models and services, the Controller limits the scope of information transferred
to the data necessary to perform the particular task. Where identification of a specific person is not necessary, appropriate
minimisation measures are applied before data is transferred, in particular aggregation, pseudonymisation or removal of direct
identifiers. Wherever possible, anonymous or aggregated data that does not allow a specific person to be identified is used.

§ 11. Transfers of data outside the EEA

1. Some technology providers, in particular global providers of analytics, advertising, payment, cloud and artificial
   intelligence models and services, may process data outside the European Economic Area.
2. If personal data is transferred to a third country, we apply mechanisms provided for under the GDPR, as appropriate,
   including an adequacy decision of the European Commission, Standard Contractual Clauses or other appropriate safeguards.
3. Information about the transfer mechanism used and – where applicable – the possibility of obtaining a copy of the relevant
   safeguards or information on where they are made available can be obtained by contacting us at
   shop@geschaft.gmbh.

§ 12. Cookies and similar technologies

1. The Store uses technologies necessary for its operation, e.g. to maintain sessions and the shopping cart, ensure security,
   enable login and remember settings.
2. Analytics, advertising and similar technologies that require consent are activated after the appropriate choice has been made in the CMP.
3. The user may accept or reject individual categories of optional technologies and later change their choice. Refusal to consent
   to optional technologies does not prevent basic use of the Store, although some non-essential features may be limited.
4. The current list of cookies and similar technologies used, their providers, purposes and operating periods is available in
   the CMP / cookie settings. This information may be updated as the Store configuration changes.

§ 13. Sources of data

1. We obtain personal data primarily directly from the user, in particular when the user uses the Store, creates an Account,
   places an Order, contacts us, joins GSFT DOERS CLUB or gives consent.
2. We may also receive certain information from entities involved in the provision of services and from providers of the tools
   we use, in particular payment service providers and carriers, as well as – to the extent resulting from the configuration of
   the tools and the consents given – from providers of analytics and advertising services such as Meta and Google, and providers
   of AI models and services where, as part of the functionality used, they return information that constitutes personal data.
   This may include, in particular, information concerning events, conversions, traffic source, campaigns and interactions with advertisements.

§ 14. User rights

In the cases provided for under the GDPR, the user has the right to:

• access their data and obtain a copy of it;
• rectify their data;
• erase their data;
• restrict processing;
• data portability;
• object to processing based on Article 6(1)(f) GDPR on grounds relating to the user’s particular situation;
• object at any time to the processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• lodge a complaint with the President of the Personal Data Protection Office.

If we process your data for direct marketing purposes, you may object to such processing at any time, including profiling
related to direct marketing. Once you object, we will no longer process your data for these purposes.

Requests concerning the exercise of rights may be sent to
shop@geschaft.gmbh. Before fulfilling a request, we may verify the identity of the
person making the request to the extent necessary to protect the data.

§ 15. Profiling and automated decision-making

1. In connection with the use of analytics and advertising tools, information concerning users’ activity, interests or behaviour
   may be analysed automatically, including through the creation or use of segments and audience groups. To the extent that such
   activities constitute profiling within the meaning of the GDPR and require consent, they are carried out in accordance with
   the user’s choices regarding the relevant analytics and advertising technologies.
2. Advertising tools provided by third parties, in particular Meta and Google, may, in accordance with the rules and configuration
   of their services, use data to create audiences and to personalise, select, deliver and measure advertisements. The scope of
   such processing also depends on the settings and rules applied by the relevant provider.
3. BASEIG AI uses Geschäft data primarily for statistical and group analyses, evaluation of audience behaviour and optimisation
   of campaigns, content and creatives. The purpose of BASEIG AI is not to create an individual score for a specific customer or
   to make decisions concerning that customer that produce legal effects or similarly significantly affect them.
4. Geschäft does not make decisions concerning customers based solely on automated processing of personal data, including
   profiling, that would produce legal effects concerning them or similarly significantly affect them within the meaning of
   Article 22 GDPR.

§ 16. Voluntary provision of data

Providing data is generally voluntary, but some data is necessary to perform a selected action, e.g. to fulfil an order,
create an Account, arrange delivery, issue an invoice or join the Club. Failure to provide data required for a particular
process may make it impossible to carry out that process. Marketing consents and consents to optional analytics/advertising
technologies are voluntary.

§ 17. Security

We apply appropriate technical and organisational measures taking into account the nature of the data, the scope and purposes
of processing and the associated risks. Access to data is restricted to persons and providers who need it to perform specific
tasks. In analytics processes, where appropriate, we use aggregation, minimisation, pseudonymisation or anonymisation.

§ 18. Changes to the Policy

1. The Policy may be updated, in particular in connection with changes to Store functionality, BASEIG AI, providers used,
   technologies or laws.
2. The current version of the Policy is published in the Store together with its effective date. We may additionally inform
   users of changes that materially affect the way data is processed by means of an appropriate notice.
3. A change to the Policy does not replace the need to obtain new consent where, under applicable law, a change in the purpose
   or scope of processing requires such consent.