PRIVACY POLICY
STORE rosalikwiaty.pl

1 General Provisions

1. The administrator of personal data collected through the online store www.rosalikwiaty.pl is Alena Klimovich, conducting business under the name Alena Klimovich, registered in the Central Registration and Information on Business of the Republic of Poland, maintained by the minister competent for economic affairs, with the business address and correspondence address: ul. Łódzka 62, 80-180 Gdańsk, NIP: 5833524936, REGON: 540306086, email: rosalikwiaty@gmail.com, phone: +48 536 080 933, hereinafter referred to as the “Administrator” and also as the “Service Provider.”

2. The personal data collected by the Administrator via the website are processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”).

3. Any words or expressions written with capital letters in this Privacy Policy shall be understood according to their definitions provided in the Terms and Conditions of the online store www.rosalikwiaty.pl.

 

2 Type of Processed Personal Data, Purpose and Scope of Data Collection

1. PURPOSE AND LEGAL BASIS OF DATA PROCESSING. The Administrator processes the personal data of Users of the online store www.rosalikwiaty.pl in the following cases:

   • Account registration in the Store – in order to create an individual account and manage it, pursuant to Article 6(1)(b) of the RODO (performance of a contract for the provision of electronic services in accordance with the Store’s Policy),

   • Placing an Order in the Store – in order to perform the Sales Agreement, pursuant to Article 6(1)(b) of the RODO (performance of a sales contract),

   • Using the Contact Form – in order to send a message to the Administrator, pursuant to Article 6(1)(f) of the RODO (legitimate interest of the business entity).

2. TYPE OF PROCESSED PERSONAL DATA. The User provides the following data:

   • For Account registration: email address,

   • For Order placement: name and surname, address, tax identification number (NIP), email address, phone number,

   • For Contact Form: name and surname, email address, phone number.

3. DATA RETENTION PERIOD. Personal data of Users are stored by the Administrator:

   • when the basis for data processing is the performance of a contract – for as long as it is necessary to perform the contract, and thereafter for the period corresponding to the statute of limitations for claims. Unless a specific provision provides otherwise, the limitation period is six years, and for periodic performance claims and claims related to business activity – three years.

   • when the basis for data processing is consent – until the consent is withdrawn, and after withdrawal, for the period corresponding to the statute of limitations for claims that may be raised by or against the Administrator. Unless a specific provision provides otherwise, the limitation period is six years, and for periodic performance claims and claims related to business activity – three years.

4. While using the Store, additional information may be collected, in particular: the IP address assigned to the User’s computer or the external IP address of the Internet provider, domain name, browser type, access time, and operating system type.

5. Upon separate consent based on Article 6(1)(a) of the RODO, data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for direct marketing purposes — in accordance with Article 10(2) of the Act of 18 July 2002 on the provision of electronic services or Article 172(1) of the Telecommunications Law of 16 July 2004 — including profiling, if the User has given appropriate consent.

6. The Administrator may also collect navigational data from Users, including information about links and references they choose to click or other activities undertaken within the Store. The legal basis for such processing is the legitimate interest of the Administrator (Article 6(1)(f) of the RODO), consisting of facilitating the use of electronic services and improving their functionality.

7. Providing personal data by the User is voluntary.

8. The Administrator exercises special care to protect the interests of persons whose data are processed, and in particular ensures that the data collected:

   • are processed lawfully,

   • are collected for specified, lawful purposes and are not further processed in a manner incompatible with those purposes,

   • are factually correct and adequate in relation to the purposes for which they are processed, and are stored in a form that permits identification of the persons concerned for no longer than is necessary to achieve the purpose of processing.

 

3 Disclosure of Personal Data

1. Personal data of Users are transferred to service providers used by the Administrator in the operation of the Store, in particular to:

   • entities responsible for the delivery of Products,

   • payment system providers,

   • customer feedback and survey system providers,

   • accounting office,

   • hosting provider,

   • software providers supporting business operations,

   • mailing system providers,

   • software providers necessary for running the online store.

2. The service providers referred to in paragraph 1 above, to whom personal data are transferred — depending on the contractual arrangements and circumstances — either follow the Administrator’s instructions regarding the purposes and methods of processing such data (acting as data processors) or independently determine the purposes and methods of their processing (acting as data controllers).

3. Personal data of Users are stored exclusively within the territory of the European Economic Area (EEA), subject to §5 point 5 and §6 of this Privacy Policy.

 

4 The Right to Control, Access, and Rectify Personal Data

1. The data subject has the right to access their personal data, as well as the right to rectify, delete, restrict processing, transfer data, object to processing, and withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

2. Legal grounds for the User’s requests:

   • access to data – art. 15 RODO,

   • rectification of data – art. 16 RODO,

   • erasure of data (the so-called “right to be forgotten”) – art. 17 RODO,

   • restriction of processing – art. 18 RODO,

   • data portability – art. 20 RODO,

   • objection – art. 21 RODO,

   • withdrawal of consent – art. 7 ust. 3 RODO.

3. To exercise the rights referred to above, an appropriate request may be sent by e-mail to: rosalikwiaty@gmail.com.

4. When a User exercises any of the rights mentioned above, the Administrator shall comply with or refuse to comply with the request without undue delay, but no later than within one month of receiving it. However, if—due to the complexity of the request or the number of requests—the Administrator is unable to comply within one month, the deadline may be extended by a further two months. In such a case, the Administrator shall inform the User within one month of receiving the request about the extension and its reasons.

5. If the data subject considers that the processing of their personal data violates the provisions of the GDPR, they have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

 

5 Cookies

1. The Administrator’s website uses “cookies.”

2. The installation of cookies is necessary for the proper provision of services on the online store’s website. Cookies contain information essential for the correct functioning of the website and enable the preparation of general statistics regarding website visits.

3. Two types of cookies are used within the website: “session” and “persistent” cookies.

   • Session cookies are temporary files stored on the User’s device until logging out (leaving the website).

   • Persistent cookies are stored on the User’s device for the period specified in the parameters of the cookies or until they are deleted by the User.

4. The Administrator uses own cookies to better understand how Users interact with the website’s content. These files collect information about how Users use the website, the type of website from which the User was redirected, the number of visits, and the time spent on the website. This information does not record specific personal data of the User but is used to compile statistics on the use of the website.

5. The Administrator also uses external cookies to collect general and anonymous statistical data through analytical tools such as Google Analytics (external cookies administrator: Google LLC, based in the USA).

6. Cookies may also be used by advertising networks (in particular, the Google network) to display advertisements tailored to the manner in which the User uses the Store. For this purpose, they may store information about the User’s navigation path or time spent on a given page.

7. The User has the right to determine the extent to which cookies have access to their computer by:

   • selecting the types of cookies they consent to immediately after entering the Store’s website when the cookie consent banner appears,

   • changing the settings in their web browser window. Detailed information on the possibilities and ways of handling cookies is also available in the software (web browser) settings.

​

6 Additional Services Related to User Activity in the Store

1. The Store uses so-called social media plug-ins (“plug-ins”) from social networking sites. When viewing the website www.rosalikwiaty.pl containing such a plug-in, the User’s browser establishes a direct connection to the servers of Facebook and Instagram.

2. The content of the plug-in is transmitted by the respective service provider directly to the User’s browser and integrated into the website. Through this integration, the service providers receive information that the User’s browser has displayed the page www.rosalikwiaty.pl, even if the User does not have a profile with the respective provider or is not currently logged in. This information (including the User’s IP address) is sent by the browser directly to the provider’s server (some of which are located in the USA) and stored there.

3. If the User is logged into one of the aforementioned social media services, the service provider may directly associate the visit to the www.rosalikwiaty.pl website with the User’s profile in that social media network.

4. If the User interacts with the plug-in, for example by clicking the “Like” or “Share” button, the corresponding information will also be transmitted directly to the provider’s server and stored there.

5. The purpose and scope of data collection, as well as their further processing and use by the providers, along with the User’s rights in this regard and the available privacy protection settings, are described in the providers’ privacy policies:

   • https://www.facebook.com/policy.php

   • https://help.instagram.com/519522125107875?helpref=page_content

6. If the User does not wish social media networks to associate data collected during visits to the www.rosalikwiaty.pl website directly with their profile in a given social media service, they must log out of that service before visiting the website. The User can also completely block the loading of plug-ins on the website by using appropriate browser extensions, such as script blockers (e.g., “NoScript”).

7. The Administrator also uses remarketing tools, such as Google Ads, on the website. The use of these tools involves the application of cookies provided by Google LLC related to the Google Ads service. Through the cookie management mechanism, the User can decide whether the Administrator may use Google Ads (external cookies administrator: Google LLC, based in the USA) in relation to them.

 

7 Final Provisions

1. The Administrator applies technical and organizational measures that ensure the protection of processed personal data appropriate to the risks and the category of data being protected. In particular, the Administrator safeguards the data against unauthorized access, acquisition by an unauthorized person, processing in violation of applicable laws, as well as alteration, loss, damage, or destruction.

2. The Administrator provides appropriate technical measures to prevent unauthorized persons from acquiring or modifying personal data transmitted electronically.

3. In matters not regulated by this Privacy Policy, the provisions of the RODO and other applicable provisions of Polish law shall apply accordingly.