Cookie Policy

This Policy explains which cookies and similar technologies are used on www.etnika.com.pl, for what purpose, on what legal basis, and how you can manage them. The Website uses only necessary items and — solely with your consent — one marketing tool (Meta Pixel). You can change or withdraw your consent at any time in Cookie settings.

Controller

ETNIKA Sp. z o.o.

Document version

POL-COOKIES 1.0

Effective date

22 September 2026

Date of the last scan of the Website

22 September 2026 — browser developer tools (Chrome DevTools), two runs: without interacting with the banner, and after accepting all categories

1. General information

1.1. The controller of the website available at www.etnika.com.pl (together with its English version at www.etnika.com.pl/en and the subdomain join.etnika.com.pl, which hosts enrolment in the Loyalty Programme), hereinafter the “Website”, is ETNIKA Sp. z o.o. with its registered office in Warsaw, ul. Złota 59, 00-120 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0001001367, NIP 7011114082, REGON 523638999, hereinafter the “Controller”.

1.2. Contact with the Controller in matters covered by this Policy: e-mail [email protected]; postal address: ETNIKA Sp. z o.o., ul. Złota 59, 00-120 Warsaw, Poland (marked “GDPR”). The Controller has appointed a Data Protection Officer, who can be contacted at [email protected].

1.3. This Policy implements the information obligation under Article 399(1)(1) of the Polish Electronic Communications Act of 12 July 2024 (“PKE”) and — to the extent that cookies and similar technologies involve the processing of personal data — Article 13 GDPR. It supplements the information notices published on the Website: the Loyalty Programme privacy notice and the CCTV privacy notice.

1.4. The Policy covers all technologies that store information on the User’s terminal device or access information already stored there, in particular: cookies (first-party and third-party), local storage and session storage, tracking pixels and tags, and embedded scripts of external providers — to the extent they are used on the Website.

2. Definitions

• Cookies — IT data, in particular small text files, saved and stored on the User’s terminal device when using the Website, generally containing the name of the domain they originate from, their storage time and a unique identifier.
• Similar technologies — tools other than cookies that store information on, or access information stored on, a terminal device (e.g. local storage, pixels, embedded scripts). The provisions of this Policy apply to them accordingly.
• First-party cookies — saved by the Website’s domain; third-party cookies — saved or read by the domains of the third parties listed in section 7.
• Session cookies — deleted when the browser is closed; persistent cookies — stored for the period indicated in section 5 or until deleted by the User.
• Terminal device — a telecommunications terminal device within the meaning of the PKE that the User uses to access the Website (computer, smartphone, tablet, other).
• User — any natural person using the Website.
• Consent — a freely given, specific, informed and unambiguous indication of the User’s wishes by a clear affirmative action, meeting the requirements of Article 4(11) and Article 7 GDPR.
• Consent panel (CMP) — the Controller’s own tool (“Cookie settings”) used to obtain, record and enforce the User’s decisions about cookies and similar technologies. No external CMP provider is used.
• Personal data — information about an identified or identifiable natural person; identifiers stored in cookies, IP addresses and device identifiers may constitute personal data.

3. Legal basis

3.1. Cookies and similar technologies are used on the Website on the basis of Article 399(1)–(3) PKE (storing information on the User’s terminal device and accessing it) and Article 6(1) GDPR (to the extent that such information constitutes personal data or leads to its processing).

3.2. Necessary cookies (section 4, category A) are used without the User’s consent, under the exception in Article 399(3) PKE. The related processing of personal data is based on Article 6(1)(f) GDPR (the Controller’s legitimate interest in the operation and security of the Website).

3.3. Marketing cookies (section 4, category D) are used only after the User’s prior consent given in the consent panel, under Article 399(1)(2) in conjunction with Article 400 PKE. The related processing of personal data is based on Article 6(1)(a) GDPR.

3.4. The Website currently uses no analytics tools and no functional cookies. Audience measurement and usage statistics are not covered by the exception in Article 399(3) PKE; if they were introduced, they would require separate consent and this Policy and the banner would be updated.

3.5. Refusing or withdrawing consent does not limit access to the Website or impair its basic functions.

4. Categories of cookies and similar technologies

4.2. The Website does not use functional cookies (category B) or analytical/statistical cookies (category C). The language version is selected through the page address (/en) and is not stored on the device.

5. List of cookies and similar technologies

5.1. The lists were prepared on the basis of a scan of the Website performed on 22 September 2026 using browser developer tools, twice: without interacting with the banner (verifying prior blocking) and after accepting all categories (full list). The lists are updated every 6 months and whenever the Website or the providers’ configuration changes. The current list is also available in the consent panel (“Cookie settings”).

5.2. Category A — Necessary (without consent)

5.3. Category D — Marketing (with consent)

6. Consent and consent management

6.1. On the first visit to the Website, once the page’s intro animation has finished, the User is shown the consent panel banner (first layer) in the corner of the screen containing information on the purposes of cookies and similar technologies, the categories and the main partner (Meta), a link to this Policy and three equivalent buttons: “Accept all”, “Reject all” and “Settings”. The banner content is set out in section 11.

6.2. Until consent is given, the Website neither stores category D cookies on the User’s device nor runs scripts of that category (Google Tag Manager and Meta Pixel are not loaded); they are run only after the consent is recorded in the consent panel (prior blocking).

6.3. In the second layer of the panel (“Settings”) the User can consent separately to the marketing category. The category requiring consent is switched off by default.

6.4. The User may at any time change or withdraw consent using the “Cookie settings” link in the footer of every page of the Website. Withdrawing consent is as easy as giving it and does not affect the lawfulness of processing carried out before withdrawal. After withdrawal the Controller stops using cookies of that category and removes from the device the _fbp cookie and the Meta Pixel local-storage entries stored in the Website’s domain; deleting data stored in other domains may require action in the browser settings (section 8).

6.5. The User’s decision (consent, refusal, change of scope) is recorded together with a timestamp, the Policy version and the scope of consent in the etnika_consent cookie on the User’s device and is shown in the consent panel. The Controller keeps no separate server-side register of consents; the record on the device, together with the banner and Policy versions, which are versioned jointly, is the evidence of the decision.

6.6. Consent is valid for 12 months from the time it is given. After that period, and after any significant change in the scope of cookies used, their purposes or providers, the banner is displayed again. A refusal is respected for 6 months; during that time the banner is not shown again.

6.7. The banner uses no solution that makes refusal or withdrawal harder than consent, in particular no unequal display of buttons, pre-ticked boxes, misleading labels or unnecessary steps. Scrolling, continuing to use the Website or closing the banner does not constitute consent.

7. Third parties and data transfers

7.2. Data may be transferred to third countries (outside the European Economic Area), in particular the USA, only on the basis of a European Commission adequacy decision (including under the EU-US Data Privacy Framework, for entities holding a current certification) or Standard Contractual Clauses together with a transfer impact assessment. A copy of the safeguards applied can be obtained by contacting the Controller (section 1.2).

7.3. The detailed rules of data processing by third parties, including for their own purposes, are set out in those parties’ privacy policies indicated in the table.

8. Browser and device settings

8.1. Regardless of the consent panel, the User may set the conditions for storing and accessing cookies in the settings of the software installed on the terminal device, including blocking cookies, deleting stored cookies or enabling a notification each time a cookie is stored. Manufacturers’ instructions:

8.2. Blocking necessary cookies may prevent the use of some functions of the Website. Browser settings do not replace the consent panel; a default browser configuration that allows cookies is not treated by the Controller as consent to cookies that require consent.

9. User rights

9.1. To the extent that cookies and similar technologies involve the processing of personal data, the User has the right of access, rectification, erasure, restriction of processing, data portability, objection (including an unconditional objection to direct marketing and to profiling for that purpose) and the right to withdraw consent at any time. Requests may be sent to the contact details in section 1.2 or — as regards consent — handled directly in the consent panel.

9.2. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw; uodo.gov.pl). In matters concerning infringements of Article 399 PKE, the competent authority is the President of the Office of Electronic Communications.

9.3. Detailed information on the processing of personal data of Loyalty Programme members and of persons covered by video surveillance, including retention periods, recipients and sources of data, is provided in the Loyalty Programme privacy notice and the CCTV privacy notice respectively.

10. Changes to the Policy

10.1. The Controller may amend this Policy when the cookies and similar technologies used, the providers, the purposes or the law change. The User will be informed of significant changes by the consent panel banner being displayed again, and, where purposes or providers are extended, will be asked for consent again. Previous versions of the Policy are archived and available on request.

10.2. Version record

11. Consent panel banner content

First layer (shown on the first visit)

We respect your privacy

We use cookies necessary for the site to work (no consent needed) and — only with your consent — marketing cookies: the Meta Pixel of our partner Meta (Facebook, Instagram). You can change or withdraw your consent at any time in “Cookie settings” in the footer. Cookie Policy.

Accept all  |  Reject all  |  Settings

The buttons are equivalent: the same size, contrast, style and order; none is highlighted in colour at the expense of the others.

Second layer (“Settings”)

Second-layer buttons: Save selection | Accept all | Reject all. The banner’s language matches the language of the page; the banner and the Policy are versioned together. Google Consent Mode v2 signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) default to “denied” and are updated according to the selected categories.

ETNIKA Sp. z o.o. · ul. Złota 59, 00-120 Warsaw, Poland · KRS 0001001367 · NIP 7011114082 · REGON 523638999 · Cookie Policy, version 1.0 of 22 September 2026