Table of Contents
– I. Personal data administrator
– II. Scope of the Regulations, Seller’s identification data
– III. Purpose and basis of personal data processing
– IV. Data recipients. Transfer of data to third countries
– V. Retention period of personal data
– VI. Rights of the data subject
– VII. Automated Decision Making. Profiling
– VIII. Cookie Policy
I. Administrator of personal data
1. The Administrator informs that he entrusts the processing of personal data to the following entities:
a) Edrone Sp. z o.o., ul. Lekarska 1, 31-203 Kraków, NIP: 676-248-20-64, KRS: 0000537197 – in order to use the edrone.me mailing system for sending newsletters,
b) USER.COM Sp. z o.o., ul. Grzybowska 87, 00-844 Warsaw, NIP: 5272791969, KRS: 0000654981 – for the purpose of using the marketing automation and mailing system user.com, used for sending the newsletter, handling brand communication via e-mail and SMS, tracking user activity on the website
c) GRUPA ALTER REMIGIUSZ ŚLIWKA ul. Dębowa 6A 56-400 Spalice NIP: PL9111078576 (e-mail: [email protected], tel. +48 571 201 007, URL: www.weblo.pl) – site support, responsible for store security, data processing for the purposes of operation and administration of the online store
(2) The Administrator informs that it uses the following technologies to track the actions taken by the user/customer within the Store website:
a) user.com tracking code – for the purpose of analyzing the statistics of the Store website, as well as for marketing purposes only for the purposes of an e-mail campaign launched or indicated by the Administrator using the user.com system.
3. The Administrator in accordance with Art. 32 paragraph. 1 of the RODO observes the principle of personal data protection and applies appropriate technical and organizational measures to prevent accidental or unlawful destruction, loss, modification, unauthorized disclosure or unauthorized access to personal data processed in connection with its operations.
(4) Providing personal data is voluntary, but necessary in order to execute the Agreement in accordance with the Rules and Regulations of the MED&BEAUTY GROCHOLEWSKI SPÓŁKA JAWNA. online store, which can be found at the following link: www.medandbeauty/regulaminy (hereinafter, Rules and Regulations).
(5) Customer of the Store is understood as any person who uses the Store in the manner and to the extent indicated in the Regulations.
6 The Data Controller processes the following personal data of Customers:
a) name,
b) residential address,
c) delivery address,
d) e-mail address,
e) telephone number.
II. Scope of the Regulations, identification data of the Seller
1. These Regulations define the rules of using the Internet Shop www.medandbeauty.com and placing and processing orders placed within the scope of MED&BEAUTY GROCHOLEWSKI SPÓŁKA JAWNA Internet Shop MED&BEAUTY GROCHOLEWSKI SPÓŁKA JAWNA. functions at: www.medandbeauty.com
2. The seller and the operator of the Med&Beauty Internet Shop is MED&BEAUTY – GROCHOLEWSKI SPÓŁKA JAWNA KRS 0001071883 NIP 7882040978 REGON 527048220, contact e-mail address: [email protected], contact phone no: 736 630 825
III. Purpose and basis for processing of personal data
1. The Administrator processes personal data for the following purposes:
a) for the purpose of enabling Customers to place Orders in accordance with the Regulations,
b) for the purpose of executing Orders in accordance with the Regulations,
c) for the purpose of fulfilling Customers’ claims,
d) for tax purposes – only for the purpose of making accounting settlements in accordance with binding legal regulations,
e) for marketing purposes, i.e. in order to send customers current information about the Store’s activities. Marketing consent is given voluntarily and does not constitute a condition for the Customer’s use of the Store.
2. The Administrator processes the Customers’ personal data on the basis of their voluntary consent (Article 6(1)(a) RODO), in order to fulfill the sales contract for certain items (Article 6(1)(b) RODO), and in terms of tax obligations – in order to fulfill the obligations of the Administrator (Article 6(1)(c) RODO). In terms of marketing consent, the Administrator processes data only on the basis of the Customer’s voluntary consent (Article 6(1)(a) of the RODO).
IV. Data recipients. Transfer of data to third countries
1. Recipients of personal data processed by the Data Controller may be entities cooperating with the Data Controller when it is necessary for the performance of the contract concluded with the data subject in accordance with the Regulations.
(2) Recipients of personal data processed by the data controller may also be subcontractors – entities whose services are used by the data controller for data processing, e.g. accounting offices, law firms, IT service providers (including hosting services).
(3) The data controller may be obliged to make personal data available on the basis of applicable laws, in particular to make personal data available to authorized state authorities or institutions.
4. personal data will not be transferred to entities located outside the European Economic Area
V. Period of storage of personal data
1. The Administrator shall store personal data for the duration of the contract concluded with the data subject and after its termination for purposes related to the assertion of claims related to the contract, performance of obligations under applicable laws, but for a period not exceeding the statute of limitations under the provisions of the Civil Code. In the case of a Customer who has a Customer Account within the meaning of the Regulations, the Administrator shall store his/her data for the period indicated in the preceding sentence, or for the period of existence of the Account, whichever is later.
2. the Administrator shall store personal data contained in billing documents (e.g. invoices) for the period indicated by the provisions of the Law on Value Added Tax and the Law on Accounting.
3. The Administrator shall store personal data processed for marketing purposes for a period of 10 years, but not longer than until you withdraw your consent to the processing of data or object to the processing of data.
VI. Rights of the data subject
1. Every data subject has the right:
a) to access the data- to obtain confirmation from the controller as to whether his/her personal data is being processed. If data about a person is processed, he or she is entitled to access it and obtain the following information: the purposes of the processing, the categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, the period for which the data are kept or the criteria for determining them, the data subject’s right to request rectification, erasure, or restriction of the processing of personal data, and to object to such processing (Article 15 RODO);
(b) to obtain a copy of the data – to obtain a copy of the data being processed, with the first copy being free of charge, and for subsequent copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) RODO);
(c) to rectify – to request the rectification of personal data concerning him that is incorrect or the completion of incomplete data (Article 16 of the RODO);
(d) to erasure – to request the deletion of her personal data if the controller no longer has a legal basis for processing or the data are no longer necessary for the purposes of processing (Article 17 of the DPA);
(e) to restrict processing – to request the restriction of the processing of personal data (Article 18 RODO) when:
the data subject questions the accuracy of the personal data – for a period that allows the Administrator to verify the accuracy of the data,
processing is unlawful, and the data subject objects to the erasure of the data by requesting restriction of its use,
The controller no longer needs the data, but it is needed by the data subject to establish, assert or defend a claim,
the data subject has objected to the processing – until it is determined whether the legitimate grounds on the part of the controller override the grounds of the data subject’s objection;
(f) to object – to object to the processing of her personal data for the legitimate purposes of the controller, on grounds related to her particular situation, including profiling. Then the Administrator shall assess the existence of valid legitimate grounds for the processing, overriding the interests, rights and freedoms of the data subjects, or grounds for establishing, asserting or defending claims. If, according to the assessment, the interests of the data subject override the interests of the Controller, the Controller will be obliged to cease processing the data for those purposes (Article 21 RODO).
2. In order to exercise the aforementioned rights, the data subject should contact, using the contact details provided, the Controller and inform the Controller of which right and to what extent the data subject wishes to exercise.
3. The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection, 2 Stawki Street, Warsaw.
VII. Automated Decision Making. Profiling
– Personal data will not be processed by automated means, including profiling.
VIII. Cookie Policy
1. The Store does not automatically collect any information, except for the information contained in cookies.
2. Cookies (so-called “cookies”) are computer data, in particular text files, which are stored on the Customer’s terminal device and are intended for use on the Store’s websites. Cookies usually contain the name of the website they come from, the time they are stored on the end device and a unique number.
(3) The entity placing cookies on the Customer’s end device and accessing them is the Administrator of the Store.
4 Cookies are used for:
a) adapting the content of the Store’s websites to the Customer’s preferences and optimizing the use of the websites; in particular, these files allow for the recognition of the Customer’s device and appropriate display of the website, tailored to his/her individual needs;
b) creating statistics that help understand how the Customers use the websites, which allows to improve their structure and content;
c) maintaining the Customer’s session.
5 The following types of cookies are used within the Shop:
a) “sessioncookies” (sessioncookies) and “permanent” (persistentcookies). “Session” cookies are temporary files that are stored on the customer’s terminal device until the customer logs out, leaves the website or shuts down the software (web browser). “Permanent” cookies are stored on the Client’s terminal device for the time specified in the parameters of the cookies or until they are deleted by the Client;
b) “indispensable” cookies, enabling the use of the services available within the Store, e.g. authentication cookies used for services requiring authentication within the Store;
c) cookies used to ensure security, e.g. used to detect misuse of authentication within the Store;
d) “performance” cookies, enabling collection of information on the manner of use of the Store’s websites;
e) “functional” cookies, enabling “remembering” the Customer’s selected settings and personalizing the Customer’s interface, e.g. with respect to the selected language or region of the Customer’s origin, font size, website layout, etc.;
f) “advertising” cookies, enabling provision of advertising content more tailored to the Customer’s interests.
(6) In many cases, web browsing software (web browser) allows cookies to be stored on the Client’s terminal device by default. Customers can change their cookie settings at any time. These settings can be changed, in particular, in such a way as to block the automatic handling of cookies in the settings of the Internet browser or inform about their placement on the Client’s device each time. Detailed information about the possibility and methods of handling cookies is available in the settings of your software (web browser).
7. The Administrator informs that restrictions on the use of cookies may affect some of the functionality available on the Store.