Privacy Policy

Acting pursuant to Article 13(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Data Controller informs as follows. This Privacy Policy is also intended to meet applicable requirements of U.S. privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and other similar U.S. state privacy laws, to the extent they apply.

1. This Privacy Policy sets out the rules for the processing of personal data by the Data Controller (Damian Krawczyk, conducting business as: BIOWELL Damian Krawczyk, entered into CEIDG, with registered office at ul. Krakowska 79, 00-079 Warsaw, Poland, NIP: 5272855706, REGON: 380488671), obtained via the “BioWell” online store (the “Online Store”).
2. Personal data collected via the Online Store are processed in accordance with the GDPR and the Polish Personal Data Protection Act of 10 May 2018, and in a manner designed to be consistent with applicable U.S. privacy laws.
3. The Data Controller takes particular care to respect the privacy of Customers visiting the Online Store.

1. Definitions

For the purposes of this Privacy Policy:

1. Data Controller – Damian Krawczyk, conducting business as BIOWELL Damian Krawczyk, ul. Krakowska 79, 00-079 Warsaw, Poland, NIP: 5272855706, REGON: 380488671.
2. Customer – any individual or entity purchasing via the Online Store.
3. Online Store – the store operated by the Data Controller at biowellglobal.com.
4. Distance Contract – a contract concluded with a Customer within an organized distance contracting system (via the Online Store), without the simultaneous physical presence of the parties, using only distance communication means until and including the conclusion of the contract.
5. Privacy Policy – this Privacy Policy for biowellglobal.com.
6. Order – the Customer’s declaration of intent submitted via the Order Form to conclude a Sales Agreement for a Product.
7. Account – the Customer’s account in the Online Store, containing data provided by the Customer and information about Orders.
8. Registration Form – a form in the Online Store enabling the Customer to create an Account.
9. Order Form – an interactive form in the Online Store enabling placement of an Order, in particular by adding Products to the Cart and specifying delivery and payment terms.
10. Cart – a software element of the Online Store where selected Products are visible and Order details (including quantities) can be adjusted.
11. Product – a movable item and/or service available in the Online Store and subject to a Sales Agreement.
12. Newsletter – an electronic information bulletin available on biowellglobal.com.
13. Entrepreneur – a person or entity conducting economic activity in their own name using the Online Store.
14. Contact Form – an interactive form in the Online Store enabling the Customer to contact the Data Controller.

2. Types of data, purposes, and legal bases

1. The Data Controller collects information concerning:
   • Individuals performing legal actions not directly related to their business;
   • Individuals conducting business in their own name; and
   • Individuals representing legal persons or organizational units that are granted legal capacity by law, collectively referred to as “Customers.”
2. Personal data are collected for:
   • Account registration in the Online Store – to create and administer an individual Account;
   • Placing Orders – to perform the Sales Agreement;
   • Newsletter subscription – to provide an electronic communications service;
   • Use of the Contact Form – to provide an electronic communications service.
3. Data provided during Account registration: email address. The Customer sets an individual password (changeable later as described in Section 6).
4. Legal basis (GDPR) for Account registration, Orders, Newsletter, and Contact Form: Article 6(1)(b) GDPR (performance of a contract or steps at the request of the data subject before entering into a contract). Providing data is voluntary, but necessary to use the relevant functionality.
5. Data provided when placing an Order:
   • Email address;
   • Address details: postal code and city, country, street and building/apartment number;
   • First and last name;
   • Phone number.
   For Entrepreneurs, additionally: company name and tax identification number (NIP).
6. When using the website, additional information may be collected automatically, in particular: IP address (or the external IP of the Internet provider), domain name, browser type, access time, device identifiers, and operating system type.
7. Navigational data (e.g., information about links clicked and actions within the Online Store) may be collected to facilitate the use of services and improve their functionality. Legal basis (GDPR): legitimate interests (Article 6(1)(f)).
8. For the establishment, exercise, or defense of legal claims, certain data (e.g., name, surname, service usage details, order identifiers) may be processed. Legal basis (GDPR): legitimate interests (Article 6(1)(f)).

Notice at collection for U.S. residents (CCPA/CPRA and similar laws)

Categories of personal information we may collect (as defined by CPRA), depending on how you interact with us:

• Identifiers (e.g., name, email, phone, IP address, account identifiers);
• Customer records (billing/shipping address, company details for Entrepreneurs);
• Commercial information (purchases, order history);
• Internet or other electronic network activity information (device, browser, interactions on our site);
• Geolocation data (approximate, derived from IP);
• Inferences: not routinely generated.

Purposes of use include: providing and improving the Online Store and services; account administration; order processing; customer support; security and fraud prevention; analytics and statistics; legal compliance; marketing communications (with consent where required).

Sources of personal information: directly from you; automatically from your device/browser; service providers (e.g., payment, delivery, analytics) where permitted.

Retention: we keep personal information for as long as necessary for the purposes described, including to comply with legal obligations, resolve disputes, and enforce agreements. Typical retention periods include: Orders and accounting records – up to 6 years; business-activity-related claims – 3 years; logs/analytics – up to 3 years; newsletter – until you withdraw consent.

“Selling” or “Sharing”: We do not sell personal information. We do not share personal information for cross‑context behavioral advertising without your consent via the cookie banner. You may manage preferences via cookie settings or by contacting us as described in Section 9.

3. Disclosure of data and retention

1. Customer personal data are disclosed to service providers used by the Data Controller to operate the Online Store. Depending on contractual arrangements, such providers act as:
   • Processors (acting on our instructions), e.g., hosting, accounting, delivery/courier and postal services, marketing tools, analytics tools, and campaign measurement tools; or
   • Independent controllers (determining their own purposes and means of processing), e.g., certain payment institutions and banks when you complete a transaction with them.
2. Data retention under GDPR:
   • Where processing is based on your consent – until consent is withdrawn, and thereafter for the limitation period for claims (generally 6 years, or 3 years for periodic benefits and activity‑related claims), unless a different statutory period applies.
   • Where processing is necessary for a contract – for the duration necessary to perform the contract, and thereafter for the applicable limitation period as above.
3. Marketing communications (Newsletter): if you subscribe, we will send promotional information to your email address; you can unsubscribe at any time.
4. Public authorities: upon lawful request, we may disclose data to competent authorities (e.g., data protection authority, competition and consumer authority, law enforcement, courts).
5. International data transfers: If data are transferred outside the European Economic Area, we will ensure appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and supplementary measures where necessary. You may request a copy of applicable safeguards (see Section 9).

4. Cookies and similar technologies

1. The Online Store uses cookies (small text files) placed on your device if your browser permits. Cookies typically contain the domain name, expiry, and a unique identifier. Information collected via cookies helps tailor our Products and services, and compile aggregate statistics.
2. When you visit biowellglobal.com, you will see a cookie notice. You can choose to accept or manage cookies via the settings presented there or your browser settings.
3. Types of cookies used:
   • Session cookies – deleted after the browser session; do not retrieve personal or confidential information from your device.
   • Persistent cookies – remain until deleted/expired; do not retrieve personal or confidential information from your device.
4. Own cookies are used for:
   • Authentication and session management after login (so you don’t have to re-enter credentials on each page);
   • Analytics and audience measurement to understand and improve site structure and content.
5. Third‑party cookies may be used for:
   • Analytics and performance (e.g., web analytics services);
   • Limited marketing/retargeting where permitted by your consent settings; and
   • Social media integrations (e.g., Meta platforms), if enabled.
6. Cookie safety: Cookies do not install malware. You may limit or disable cookies in your browser; some features of the Online Store may then be unavailable.
7. We may collect IP addresses for technical diagnostics, security, aggregated statistics (e.g., regions of visits), and administration of the Online Store.
8. The Online Store may contain links to third‑party sites. We are not responsible for their privacy practices.

5. Rights of data subjects (GDPR)

The Data Controller informs you of the following rights under the GDPR:

1. Right to withdraw consent (Article 7(3) GDPR):
   • You may withdraw any consent at any time; withdrawal does not affect processing lawfully carried out before withdrawal;
   • Withdrawal may limit services that require consent.
2. Right to object (Article 21 GDPR):
   • You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (including profiling), e.g., our own product/service marketing or usage statistics;
   • Unsubscribing from marketing emails constitutes an objection for those purposes;
   • If your objection is valid and we have no overriding legal basis, we will stop processing the data concerned.
3. Right to erasure (“right to be forgotten,” Article 17 GDPR), including where:
   • Data are no longer necessary for the purposes collected;
   • Consent is withdrawn and there is no other legal basis;
   • You object to marketing;
   • Processing is unlawful; or
   • Erasure is required by EU or Member State law.
   We may retain certain data to establish, exercise, or defend legal claims, or comply with legal obligations (e.g., name, email for complaint handling; address/order ID for sales/service claims).
4. Right to restriction (Article 18 GDPR), for example when:
   • Data accuracy is contested (restriction for up to 7 days or as needed for verification);
   • Processing is unlawful and you request restriction instead of erasure;
   • We no longer need the data but you require them for legal claims; or
   • Pending verification of an objection based on your particular situation.
5. Right of access (Article 15 GDPR) – to confirmation of processing and access to your data, purposes, categories, recipients, retention, rights, complaint rights, sources, automated decision‑making (including profiling), and safeguards for transfers.
6. Right to rectification (Article 16 GDPR) – to have inaccurate data corrected and incomplete data completed.
7. Right to data portability (Article 20 GDPR) – to receive your data in a commonly used, machine‑readable format (e.g., CSV) and have them transmitted to another controller where technically feasible.
8. Storage and processing method – Customer data are stored and processed in electronic systems.
9. Response times – We will fulfill or refuse requests without undue delay and within one month of receipt. If necessary due to complexity or volume, we may extend by up to two further months and will notify you within one month of receipt.
10. Complaints – You may lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO) or your local EU supervisory authority.

6. U.S. state privacy rights

Depending on your state of residence (e.g., California, Virginia, Colorado, Connecticut, Utah), you may have the following rights under applicable law:

• Right to know/access the categories and specific pieces of personal information we have collected about you;
• Right to correction of inaccurate personal information;
• Right to deletion of personal information (subject to exceptions);
• Right to opt out of the sale or sharing of personal information and of targeted advertising; we do not sell personal information and we do not share it for cross‑context behavioral advertising without your consent;
• Right to limit use of sensitive personal information (we do not intentionally collect sensitive personal information);
• Right to non‑discrimination for exercising your rights.

How to exercise U.S. rights: Email info@biowellglobal.com or write to: BioWell America LLC, 790 North Milwaukee Street, Milwaukee, WI 53202, USA. Please provide sufficient information to verify your identity. You may use an authorized agent where permitted by law.

Do Not Track (DNT): Our site does not currently respond to browser DNT signals. You may manage cookies via our cookie banner and your browser settings.

Children’s privacy: Our services are not directed to children under 13, and we do not knowingly collect their data. If you believe a child under 13 has provided data, contact us to delete it.

7. Security and passwords

1. We provide secure, encrypted connections (SSL/TLS) when transmitting personal data and when logging into Customer Accounts.
2. If you lose your password, you can generate a new one using the “Forgot password” link on the login page. We do not send password reminders. Passwords are stored in encrypted form.
3. We will never ask you to disclose your login credentials or password via email.

8. Changes to this Privacy Policy

1. We may amend this Privacy Policy. We will notify Customers at least 7 days in advance where required by law.

9. Contact

Data Controller (EU/Poland): BIOWELL Damian Krawczyk, ul. Krakowska 79, 00-079 Warsaw, Poland, NIP: 5272855706, REGON: 380488671.

Primary contact for privacy matters (global): info@biowellglobal.com

U.S. mailing address for privacy requests: BioWell America LLC, 790 North Milwaukee Street, Milwaukee, WI 53202, USA.

Effective date: June 6, 2025