Privacy policy

In force from 01 August 2026.

I. WHAT IS THIS PRIVACY POLICY?

We would like to explain the details of how we process your personal data, so that you have full knowledge and peace of mind when using our websites.

Because we work in the online industry ourselves, we know how important the protection of your personal data is. That is why we take particular care to protect your privacy and the information you give us.

We carefully select and apply appropriate technical and organisational measures, in particular software-based ones, to protect the personal data we process. Our websites use encrypted data transmission (SSL), which protects data that identifies you.

This Privacy Policy contains all the key information about how we process your personal data. Please read it; we promise it will take no more than a few minutes.

This Policy applies to the online store mepmu.com, including its subdomains and language versions (the "Store"). The Store is operated by the controller named below.

a) Who is the controller of the Store?

The controller of the Store is Filip Drążkiewicz, conducting business under the business name QUANTUM Filip Drążkiewicz, entered in the Central Registration and Information on Business (CEIDG) maintained by the minister responsible for the economy, at ul. Stawy 5, 02-467 Warsaw, Poland, NIP (VAT ID): 6342370944, REGON: 146345912 (that is, "we").

b) How can you contact us?

e-mail: contact@mepmu.com;
telephone: +48 502 196 912;
post: ul. Stawy 5, 02-467 Warsaw, Poland.

For matters concerning personal data, please write to the e-mail address above.

c) Who is the Store for?

The Store is aimed at adults and at business customers, in particular permanent makeup professionals. We do not direct our offer at minors and we do not knowingly collect their personal data. If we learn that the data of such a person has reached us without the consent of their legal representative, we will delete it.

II. PERSONAL DATA

a) Which legal acts govern the processing of your personal data?

Your personal data is collected and processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, OJ L 119, p. 1), commonly known as the "GDPR". In matters not regulated by the GDPR, processing is governed by the Polish Act of 10 May 2018 on the Protection of Personal Data. For commercial information sent by electronic means, telephone marketing and cookies we also apply the Polish Act of 12 July 2024 – Electronic Communications Law.

b) Who is the controller of your personal data?

The controller of your personal data is Filip Drążkiewicz, conducting business under the business name QUANTUM Filip Drążkiewicz, entered in the Central Registration and Information on Business (CEIDG) maintained by the minister responsible for the economy, at ul. Stawy 5, 02-467 Warsaw, Poland, NIP (VAT ID): 6342370944, REGON: 146345912, BDO: 000563801. Our contact details are given in section I b).

III. HOW DO WE PROCESS THE PERSONAL DATA YOU PROVIDE TO US?

a) What personal data do we process, and for what purposes?

On our websites we offer you a range of services. For each of them we process different personal data on different legal bases. For every purpose below we state the data, the legal basis and the retention period.

Purpose	Personal data	Legal basis	Retention period
Concluding and performing a contract (orders in the Store)	First and last name, correspondence address, VAT ID (NIP), e-mail address, telephone number, company name, delivery address. We do not store payment card numbers – payments are handled by payment operators.	Article 6(1)(b) GDPR, i.e. processing to take steps at your request before entering into a contract and processing necessary to perform a contract to which you are a party.	Until the limitation period for claims relating to the performance of the contract expires.
Creating and maintaining an account	First and last name, e-mail address, telephone number, correspondence address, company name, delivery address.	Article 6(1)(b) GDPR, i.e. processing to take steps at your request before entering into a contract and processing necessary to perform a contract to which you are a party.	Until the account is deleted, and then until the limitation period for claims relating to the performance of the contract expires.
Adding reviews	First name, e-mail address.	Article 6(1)(f) GDPR, i.e. our legitimate interest in presenting on the online store's website reviews of goods and of the course of the transaction.	Until you object to the processing of your personal data.
Handling enquiries and contact (form, e-mail, telephone, messengers)	First name, e-mail address, telephone number, content of the message.	Article 6(1)(b) GDPR where the enquiry concerns the conclusion or performance of a contract; in other cases Article 6(1)(f) GDPR, i.e. our legitimate interest in answering your question.	Until the matter is resolved, and then until the limitation period for claims expires.
Chat and assistants, including those using artificial intelligence	Content of the conversation, e-mail address (if you provide it), technical identifiers.	Article 6(1)(b) GDPR (pre-contractual and contractual questions) or Article 6(1)(f) GDPR (our interest in efficient customer service).	Until the matter is resolved, and then until the limitation period for claims expires.
Contact about unfinished purchases (abandoned cart, unfinished order)	E-mail address, first name, cart contents, data on the progress of the order.	Article 6(1)(f) GDPR, i.e. our interest in reminding you of an unfinished order – for messages of a service nature; we send messages of a commercial nature only with your consent (Article 6(1)(a) GDPR).	Until you object or withdraw your consent.
Handling profiles on social media and messengers (e.g. Instagram, Facebook, WhatsApp), including automated replies to messages	Data from your public profile, content of messages and activity (comments, reactions).	Article 6(1)(f) GDPR, i.e. our interest in communicating with users, promoting the brand and answering enquiries; Article 6(1)(b) GDPR where the enquiry concerns the conclusion or performance of a contract.	Until the matter is resolved or until you object, and then until the limitation period for claims expires.
Concluding and performing a contract with a business counterparty (business customer)	First and last name, position, company name, VAT ID (NIP), e-mail address, telephone number of the representative or contact person.	Article 6(1)(b) or (c) GDPR and Article 6(1)(f) GDPR, i.e. our interest in performing a contract with the entity that you represent or that named you as a contact person.	For the duration of the contract, and then until the limitation period for claims and legal obligations expires.
Customer satisfaction surveys and feedback on our service	First name, e-mail address, content of your answers.	Article 6(1)(f) GDPR, i.e. our interest in measuring customer satisfaction and improving the quality of our service and products.	Until you object.
Recruitment (if we run it)	Data from application documents.	Article 6(1)(b) and (c) GDPR (steps before entering into a contract, legal obligations); Article 6(1)(a) GDPR – for data going beyond what the law requires and for consent to take part in future recruitment.	Until the recruitment ends, and with your consent for up to 12 months.
Newsletter and commercial information (e-mail, SMS, WhatsApp, telephone)	E-mail address, first name, telephone number (if you provide it), information about your activity in messages and on the website, and about purchases (to the extent described in section d).	Article 6(1)(a) GDPR, i.e. processing based on the consent you give, in connection with the provisions of the Electronic Communications Law on consent to commercial information and telephone marketing.	Until you withdraw your consent. After withdrawal we keep proof that consent was given and withdrawn for the limitation period for claims (Article 6(1)(f) GDPR – our interest in being able to demonstrate compliance with the law).
Creating advertising audiences (lists in advertising systems)	E-mail address and, if you provide them: first name, last name, telephone number, country, postal code.	Article 6(1)(a) GDPR, i.e. your consent.	Until you withdraw your consent.
Traffic analysis, measuring effectiveness and tailoring ads using cookies and similar technologies	Online identifiers, IP address, data on your use of the Store (e.g. pages visited, products viewed, adding to cart).	Article 6(1)(a) GDPR, i.e. your consent given in the cookie banner.	Until you withdraw your consent or the cookie expires (see part V).
Security of the Store, preventing abuse and fraud, technical administration	IP address, browser type, operating system, access time, server logs.	Article 6(1)(f) GDPR, i.e. our legitimate interest in ensuring the security and proper functioning of the Store.	For the period necessary for security purposes, but no longer than 24 months.
Establishing, pursuing and enforcing claims and defending against claims before courts and other state authorities	First and last name, residential address, VAT ID (NIP), REGON, e-mail address, telephone number, IP address, bank account number (if provided), order and correspondence data.	Article 6(1)(f) GDPR, i.e. our legitimate interest in establishing, pursuing and enforcing claims and defending against claims before courts and other state authorities.	Until the limitation period for claims relating to the performance of the contract expires.
Meeting legal obligations, in particular tax and accounting regulations	First and last name, company name, VAT ID (NIP) or REGON, e-mail address, telephone number, correspondence address.	Article 6(1)(c) GDPR, i.e. processing necessary for compliance with legal obligations to which we are subject, in particular tax and accounting regulations.	For the period required by law, in particular tax and accounting regulations (as a rule 5 years, counted from the end of the calendar year in which the tax obligation arose).

If a chat with an assistant using artificial intelligence operates in the Store, we tell you so in the chat window – you are then talking to a program, not a person. We process the content of the conversation in order to answer you and to handle your order. We do not take decisions on this basis that produce legal effects concerning you.

Contests, events and other initiatives are organised on the basis of separate rules, in which we provide information on the processing of data for those purposes.

Limitation periods for claims follow from the Civil Code – as a rule they are six years, and three years for claims for periodic performance and claims related to conducting business activity (the period ends at the end of the calendar year).

b) Voluntary provision of personal data

Providing the required personal data is voluntary, but it is a condition for providing you with our services (e.g. performing an order, sending a newsletter or creating an account). Where the provision of data results from legal provisions (e.g. invoice data), failure to provide it makes it impossible to issue the document and to perform the order. Marketing consents and consents to analytical and advertising cookies are entirely voluntary – not giving them does not affect your ability to shop in the Store.

c) Recipients of personal data

We use external service providers and disclose your personal data to them only to the extent necessary for the purposes described above. The recipients of your personal data are, in particular, the following categories of entities:

entities responsible for delivering products (courier and postal companies, parcel locker operators);
payment operators and payment system providers;
providers of online store platforms, hosting and IT infrastructure;
providers of e-mail sending and customer communication systems (including the newsletter system);
providers of SMS and messenger services (e.g. for marketing messages and order information);
providers of tools for handling social media and automating messages;
providers of recruitment services and organisers of contests or events, to the extent necessary to carry them out;
providers of advertising and analytics systems and of tools for managing tags and consents;
providers of review and survey systems;
providers of customer service tools, including chat and an assistant using artificial intelligence;
providers of warehouse, shipping, invoicing and accounting systems, and the accounting office;
providers of software supporting the running of the business;
advisers (e.g. legal), to the extent necessary to establish, pursue or defend claims;
public authorities and other entities authorised under legal provisions.

We indicate categories of recipients rather than a full list of entities, because we often change tools and, within the same categories, we use many providers. We will provide the full names of the recipients to whom your data has been disclosed on your request sent to the e-mail address given in section I b), within one month of receiving it.

Depending on the circumstances, these providers process data exclusively on our behalf and on our instructions (data processors, under a data processing agreement compliant with Article 28 GDPR) or independently determine the purposes and means of processing (independent controllers – in which case their own privacy policies apply).

d) Automated decision-making (including profiling)

We do not take decisions concerning you by automated means that would produce legal effects concerning you or similarly significantly affect you. We do, however, use profiling for marketing purposes, solely with your consent (Article 6(1)(a) GDPR) given in the cookie banner or when you sign up for commercial information. Profiling consists of automated evaluation of your interests and behaviour in the Store (e.g. products viewed, purchase history, reactions to e-mail messages) in order to select the advertising content and offers best suited to you, including the creation of advertising audiences. Profiling does not produce legal effects concerning you and does not similarly significantly affect you. You can withdraw your consent at any time (see part IV g).

e) Will we transfer your personal data outside the EEA or to an international organisation?

Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the use of providers belonging to the categories listed in section c) (e.g. advertising and analytics tools, e-mail marketing and store platforms). Transfers take place on the basis of a European Commission decision finding an adequate level of protection (EU–US Data Privacy Framework) – for recipients who have joined that programme – or on the basis of standard contractual clauses approved by the European Commission (Article 46(2)(c) GDPR). You can obtain a copy of the safeguards by writing to the e-mail address given in section I b).

f) Where do we get your data from?

We receive personal data from you (e.g. when placing an order, creating an account, signing up for the newsletter, or contacting us). Some data about your use of the Store (online identifiers, IP address, information about your device and browser) is collected automatically using cookies and similar technologies, as described in part V.

g) The controller's other store

The controller also operates the store quantumpmu.com, which is governed by its own, separate privacy policy. We keep accounts and orders in the two stores separately. We use the data of customers of one store for marketing communication about the offer of the other store only to the extent that you have given your consent. The scope of marketing consent is described each time it is given.

IV. WHAT RIGHTS DO YOU HAVE IN CONNECTION WITH THE PROCESSING OF YOUR PERSONAL DATA?

Under the GDPR you have the right to:

request access to your personal data;
request rectification of your personal data;
request erasure of your personal data;
request restriction of the processing of your personal data;
object to the processing of your personal data;
request transfer of your personal data;
withdraw consent at any time;
lodge a complaint with a supervisory authority.

If you submit any of the requests listed above, we will, without undue delay and in any event within one month of receiving the request, inform you of the action taken in response to it.

If necessary, we may extend the one-month period by a further two months, taking into account the complexity of the request or the number of requests.

In any case, we will inform you within one month of receiving the request of the extension and give the reasons for the delay.

You can submit a request to any of the e-mail addresses given in section I b). If we have doubts about your identity, we may ask for additional information confirming it.

a) Right of access to personal data (Article 15 GDPR)

You have the right to obtain information on whether we process your personal data. If we do, you have the right to:

access your personal data;
obtain information on the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of the data, the planned retention period or the criteria for determining it, the rights you have under the GDPR, the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), the source of the data, automated decision-making including profiling, and the safeguards applied in connection with transfers of the data outside the European Union;
obtain a copy of your personal data.

If you wish to request access to your personal data, send your request to the e-mail address given in section I b).

b) Right to rectification of personal data (Article 16 GDPR)

If your personal data is inaccurate, you have the right to request that we rectify it without undue delay. You also have the right to request that we complete your personal data. If you wish to request rectification or completion of your personal data, send your request to the e-mail address given in section I b).

c) Right to erasure of personal data, the "right to be forgotten" (Article 17 GDPR)

You have the right to request erasure of your personal data where:

your personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
you have withdrawn a given consent, to the extent that personal data was processed on the basis of your consent;
your personal data has been processed unlawfully;
you have objected to the processing of your personal data for direct marketing purposes, including profiling, to the extent that the processing is related to direct marketing;
you have objected to the processing of your personal data where processing is necessary for the performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by us or by a third party.

Despite a request for erasure, we may continue to process your data in order to establish, pursue or defend claims or to comply with legal obligations, and we will inform you of this. If you wish to request erasure of your personal data, send your request to the e-mail address given in section I b).

d) Right to restriction of processing (Article 18 GDPR)

You have the right to request restriction of the processing of your personal data where:

you contest the accuracy of your personal data – in which case we will restrict processing for a period enabling us to verify its accuracy;
the processing is unlawful and you oppose erasure of the data and request restriction of its use instead;
your personal data is no longer needed for the purposes of processing, but you need it for the establishment, exercise or defence of legal claims;
you have objected to the processing of your personal data – pending verification whether our legitimate interests override the grounds stated in your objection.

If you wish to request restriction of the processing of your personal data, send your request to the e-mail address given in section I b).

e) Right to object to the processing of personal data (Article 21 GDPR)

You have the right to object at any time to the processing of your personal data, including profiling, where the processing is:

necessary for the performance of a task carried out in the public interest or for the purposes of the legitimate interests pursued by the controller or by a third party;
carried out for direct marketing purposes.

If you wish to object to the processing of your personal data, send your request to the e-mail address given in section I b).

f) Right to data portability (Article 20 GDPR)

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller – insofar as we process it on the basis of your consent or a contract and by automated means.

As a standard we will provide your personal data in CSV format. If you prefer a different format, please state it in your request. Where possible, we will try to provide the data in the format you prefer.

You may also request that we transmit your personal data directly to another controller (where technically feasible). If you wish to request portability of your personal data, send your request to the e-mail address given in section I b).

g) Can you withdraw consent to the processing of personal data?

You can withdraw consent to the processing of your personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out by us on the basis of your consent before its withdrawal.

If you wish to withdraw consent to the processing of your personal data, send your request to the e-mail address given in section I b). If you wish to withdraw consent to the processing of personal data for the purpose of the "Newsletter" service, you can unsubscribe using the unsubscribe link contained in every message. You can change your cookie consent as described in part V. After you withdraw consent to the creation of advertising audiences, we will remove you from those audiences without undue delay and no later than within 30 days.

h) Complaint to a supervisory authority

If you believe that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In Poland the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office (uodo.gov.pl).

V. COOKIE POLICY

a) General information

When you browse the Store's websites, "cookies" are used – small text files that are saved on your end device in connection with your use of the Store. We also use similar technologies (e.g. tracking pixels, browser local storage), to which the same rules apply. Their purpose is the proper functioning of the websites, traffic analysis and – with your consent – tailoring and measuring the effectiveness of advertising.

These files make it possible to identify the software you use and to adapt the Store individually to your needs.

Cookies usually contain the name of the domain they come from, the time they are stored on the device and an assigned value.

b) Security

The cookies we use are safe for your devices. In particular, it is not possible for viruses or other unwanted or malicious software to get onto your devices through cookies.

c) Types of cookies

We use two types of cookies in terms of storage time:

Session cookies: stored on your device until the end of the browser session. The saved information is then permanently deleted from your device's memory.
Persistent cookies: stored on your device until they are deleted or expire. Ending the browser session or switching off the device does not remove them from your device.

In terms of origin, we distinguish first-party cookies (set by the Store) and third-party cookies (set by the providers of the tools we use). Cookies used for analytics and advertising may be used to recognise your browser or device and, to that extent, may allow the processing of personal data.

d) Purposes and categories

Without your consent we use only necessary (functional) cookies needed for the operation of the Store (e.g. handling the cart and session, logging in, language preferences, security, remembering your cookie choices, configuration of the Store). With your consent, given in the cookie banner, we additionally use:

personalisation cookies (if present in the Store) – remembering your actions in order to tailor your next visit to the Store;
analytical cookies – used to understand how you use the Store, to compile traffic statistics and, in some cases, to analyse behaviour on the website (e.g. heat maps, session recordings);
marketing (advertising) cookies – used to measure the effectiveness of ads, for remarketing and for displaying ads tailored to your interests in advertising networks and social media.

We also use third-party cookies for the following purposes:

configuration of the Store;
store platform: Shopify; analytics and advertising: Google Analytics, Google Ads, Meta Pixel; chat with an AI assistant: Zipchat;
tool for e-mail communication and sign-up forms: Klaviyo (marketing cookies).

The list of tools in this part is indicative and may change as the Store develops. You can find the current list of tools we use with your consent in the consent banner.

To learn how cookies are used by the companies listed above, we recommend reading their privacy policies.

Cookies may be used by advertising networks, in particular the Google and Meta networks, to display ads tailored to your preferences – only if you have consented to marketing cookies. For this purpose, information about how you move around the web or the time you spend on a website may be retained.

To view and edit the information about your preferences collected by the Google advertising network, you can use the tool at https://myadcenter.google.com/.

e) Consent to cookies and changing it

You can give or refuse consent to analytical and marketing cookies in the banner displayed when you enter the website. Refusing is as easy as giving consent and does not affect your ability to use the Store. You can change or withdraw your choice at any time using the "Cookie settings" link in the footer of the Store, or by deleting cookies in your browser, after which the banner will be displayed again. You can also manage cookies in your browser settings.

If you do not give consent, Google tools may receive limited technical data about visits that does not contain identifiers saved on your device and serves solely for statistical modelling.

Using your browser settings or the configuration of the service, you can at any time change your cookie settings, specifying the conditions for their storage and for cookies' access to your device. You can change these settings so as to block automatic handling of cookies in your web browser settings or to be informed each time cookies are placed on your device. Detailed information on the options and methods of handling cookies is available in the settings of your software (web browser). Blocking necessary cookies may make it impossible to use some functions of the Store (e.g. the cart).

f) Social media plugins and external services

The Store may use so-called social media plugins and embedded external content (including Facebook, Instagram, Pinterest, YouTube, Google). When you display a page containing such a plugin, your browser may establish a direct connection with the provider's servers and pass on information that you have visited the page (including your IP address), even if you do not have an account with that provider. If you are logged in to the given service, the provider may associate the visit with your profile. The purpose and scope of data collection by these providers and your rights and privacy settings are described in their own privacy policies. You can prevent plugins from loading by logging out of those services before your visit or by using script-blocking extensions. We load plugins in line with your cookie choices, to the extent required by law.

g) Links to other websites

The Store may contain links to third-party websites. We are not responsible for the privacy practices applied on those websites – please read their policies before using them.

VI. CHANGES TO THE POLICY AND FINAL PROVISIONS

a) Data security

We apply appropriate technical and organisational measures to ensure a level of security of personal data appropriate to the risk. In particular, we protect data against disclosure to unauthorised persons, acquisition by unauthorised persons, processing in violation of the law, and alteration, loss, damage or destruction.

b) Changes to the Policy

We update this Policy in connection with changes in the law or the development of our business and the tools we use. We publish information about changes on the Store's website, and for persons who use services provided on a continuous basis (an account) or who have signed up for the newsletter, we may additionally send it by e-mail. A change to the Policy does not extend the scope of the consents you have given – if a new purpose of processing requires consent, we will ask you for it separately. We will provide previous versions of the Policy on your request.

c) New purposes and tools

If we intend to process your data for a purpose other than those described in this Policy, or to start using new categories of tools, we will first update the Policy and inform you in the manner described in section b). If a new purpose requires your consent, we will ask for it separately – consent is not given "in advance".

d) Matters not regulated

In matters not regulated by this Policy, the provisions of the GDPR and other applicable provisions of Polish law apply.