adeldeflores.pl

§ 1. General provisions

1. The data controller for personal data collected via the adeldeflores.pl online shop is Anastasiia Kopaihora, Tax Identification Number (NIP): 5862402271, email address: kwiaciarnia.adeldeflores@gmail.com, telephone number: 570924949, address for service: Aleja Niepodległości 683, 81-854 Gdańsk, hereinafter referred to as the „Controller” and also acting as the „Service Provider”.

2. Personal data collected by the Controller via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.

3. Any words or phrases appearing in capital letters in this Privacy Policy shall be understood in accordance with their definitions set out in the Terms and Conditions of the online shop at www.adeldeflores.pl

§ 2. The type of personal data processed, the purpose and scope of data collection

1. Purpose of processing and legal basis. The Data Controller processes the personal data of customers of the adeldeflores.pl online shop in the following circumstances:

1) placing an Order in the Shop for the purpose of performing the Sales Contract pursuant to Article 6(1)(b) of the GDPR (performance of the sales contract),

2) the provision by the Customer of the details of the person to whom the Product is to be delivered (the recipient), for the purpose of fulfilling the delivery in accordance with Article 6(1)(f) of the GDPR (the Controller’s legitimate interest in delivering the Product to the person specified by the Customer),

3) contacting the Controller by email or telephone in order to reply to a message pursuant to Article 6(1)(f) of the GDPR (the Controller’s legitimate interest),

4) issuing sales documents and carrying out accounting procedures in order to fulfil obligations arising from tax and accounting legislation, pursuant to Article 6(1)(c) of the GDPR.

2. The type of personal data processed. The service user shall provide the following information in the event of:

1) Orders: full name, address, tax registration number (if purchasing on behalf of a company), email address, telephone number,

2) the recipient’s details: full name, delivery address, telephone number,

3) contact via email or telephone: full name, email address, telephone number and any details provided in the message.

3. Retention period for personal data. The personal data of Service Users is stored by the Controller:

1) where the basis for data processing is the performance of a contract, for as long as is necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless otherwise provided for by a specific provision, the limitation period is six years, and for claims relating to periodic payments and claims arising from the conduct of business – three years,

2) where the basis for data processing is consent, for as long as the consent remains in force, and, following the withdrawal of consent, for a period corresponding to the limitation period for claims which the Controller may bring and which may be brought against the Controller. Unless otherwise provided for by a specific provision, the limitation period is six years, and for claims relating to periodic payments and claims arising from the conduct of business activities – three years,

3) The data contained in the accounting records is retained for the period required by tax legislation, i.e. 5 years from the end of the calendar year in which the tax payment deadline expired.

4. When using the Shop, additional information may be collected, in particular: the IP address assigned to the Customer’s computer or the external IP address of their internet service provider, the domain name, the browser type, the time of access and the type of operating system.

5. Following the provision of separate consent pursuant to Article 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial communications by electronic means or making telephone calls for the purposes of direct marketing – in accordance with Article 10(2) of the Act of 18 July 2002 on the provision of electronic services or Article 398(1) of the Act of 12 July 2024, as applicable – Electronic Communications Act, including communications resulting from profiling, provided that the Service User has given their consent.

6. Navigation data may also be collected from Users, including information about the links and hyperlinks they choose to click on or other actions they undertake within the Shop. The legal basis for such activities is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in facilitating the use of services provided electronically and in improving the functionality of those services.

7. The provision of personal data by the Service User is voluntary.

8. The data controller takes particular care to protect the interests of data subjects and, in particular, ensures that the data it collects is:

1) processed in accordance with the law,

2) collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes,

3) factually accurate and relevant to the purposes for which they are processed, and stored in a form that allows the data subjects to be identified for no longer than is necessary to fulfil the purpose of the processing.

§ 3. Disclosure of personal data

1. The personal data of Service Users is transferred to the service providers used by the Controller in the operation of the Shop, and in particular to:

1) entities responsible for the delivery of the Products,

2) payment system providers,

3) providers of feedback survey systems,

4) an accountancy firm,

5) web hosting providers,

6) suppliers of software enabling the conduct of business,

7) organisations providing an email system,

8) suppliers of the software required to run an online shop.

2. Service providers (referred to in point 1 of this paragraph) to whom personal data is disclosed – depending on contractual arrangements and circumstances – are either subject to the Controller’s instructions regarding the purposes and means of processing such data (processors) or independently determine the purposes and means of processing (controllers).

3. Service Users’ personal data is stored exclusively within the European Economic Area (EEA), subject to § 5(5) and § 6 of the Privacy Policy. The transfer of data to entities based in the USA (Google LLC, Meta Platforms Inc.) takes place on the basis of a decision by the European Commission confirming an adequate level of data protection (the EU-US Data Privacy Framework) or standard contractual clauses approved by the European Commission.

§ 4. The right to check, access and correct one’s own data

1. The data subject has the right to access their personal data, as well as the right to rectify, erase or restrict the processing of such data, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

2. Legal basis for the Customer’s request:

1) access to data – Article 15 of the GDPR,

2) rectification of data – Article 16 of the GDPR,

3) erasure of data (the so-called ‘right to be forgotten’) – Article 17 of the GDPR,

4) restriction of processing – Article 18 of the GDPR,

5) data portability – Article 20 of the GDPR,

6) objection – Article 21 of the GDPR,

7) withdrawal of consent – Article 7(3) of the GDPR.

3. In order to exercise the rights referred to in point 2, you may send an email to the following address: kwiaciarnia.adeldeflores@gmail.com

4. Where a Data Subject exercises a right arising from the above provisions, the Data Controller shall comply with the request or refuse to comply with it without delay, but no later than within one month of receiving it. However, if – due to the complex nature of the request or the number of requests – the Controller is unable to comply with the request within one month, they shall comply with it within the following two months, having first informed the Service User, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.

5. If it is found that the processing of personal data infringes the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl).

§ 5. Cookies„

1. The Administrator’s website uses „cookies”.

2. The use of cookies is necessary for the proper provision of services on the Shop’s website. Cookies contain information essential for the website to function correctly, and they also enable us to compile general statistics on website visits.

3. This website uses two types of „cookies”: „session” and „persistent” cookies.

1) „session cookies” are temporary files that are stored on the Service User’s device until they leave the website or close their browser,

2) „Persistent” cookies are stored on the Service User’s device for the period specified in the cookie settings or until they are deleted by the Service User.

4. The Administrator uses its own cookies to gain a better understanding of how Service Users interact with the website’s content. These cookies collect information on how the User uses the website, the type of website from which the User was redirected, and the number of visits and the duration of the User’s visit to the website. This information does not record any specific personal data of the User, but is used to compile statistics on website usage.

5. The website operator also uses third-party cookies to collect general and anonymous statistical data via the Google Analytics analytics tool (third-party cookie provider: Google LLC, based in the USA).

6. Cookies may also be used by advertising networks (in particular the Google network) to display adverts tailored to the way in which the User uses the Shop. To this end, they may store information about the User’s navigation path or the length of time spent on a particular page.

7. The user has the right to decide whether to allow „cookies” to access their computer by:

1) selecting the types of cookies that you consent to having collected immediately upon entering the Shop’s website and when the cookie notice appears,

2) changing the settings in your browser window. Detailed information on the options and methods for managing „cookies” is also available in the software settings (web browser).

§ 6. Additional services relating to the user’s activity in the shop

1. The Shop uses so-called social media plugins („plugins“) from social media platforms. When viewing the website www.adeldeflores.pl, which contains such a plug-in, the Customer’s browser will establish a direct connection with the Facebook and Instagram servers.

2. The content of the plug-in is transmitted by the relevant service provider directly to the Service User’s browser and integrated into the webpage. Through this integration, service providers are informed that the User’s browser has displayed the page www.adeldeflores.pl, even if the User does not have a profile with the relevant service provider or is not currently logged in to their account. This information (together with the User’s IP address) is transmitted by the browser directly to the relevant service provider’s server (some of which are located in the USA) and stored there.

3. If the User logs in to one of the above social media platforms, that service provider will be able to directly link the visit to www.adeldeflores.pl to the User’s profile on that social media platform.

4. If the User utilises a particular plug-in, for example by clicking the „Like” or „Share” button, the relevant information will also be sent directly to the service provider’s server and stored there.

5. The purpose and scope of data collection, as well as the subsequent processing and use of such data by service providers, together with the means of contacting them, the Service User’s rights in this regard, and the option to configure settings to ensure the protection of the Service User’s privacy, are set out in the service providers’ privacy policies:

1) https://www.facebook.com/policy.php

2) https://help.instagram.com/519522125107875?helpref=page_content

6. If the User does not wish social media platforms to link the data collected whilst visiting the website www.adeldeflores.pl directly to their profile on that platform, they must log out of that platform before visiting the website www.adeldeflores.pl. The User may also completely prevent plugins from loading on the website by using appropriate browser extensions, e.g. blocking scripts using „NoScript“.

7. The Controller uses remarketing tools on its website, namely Google Ads. The use of these tools involves the use of cookies from Google LLC relating to the Google Ads service. As part of the mechanism for managing cookie settings, the User may decide whether the Service Provider may use Google Ads (third-party cookie controller: Google LLC, based in the USA) in relation to them.

§ 7. Final provisions

1. The controller shall implement technical and organisational measures to ensure that the personal data being processed are protected in a manner appropriate to the risks and the categories of data concerned, and, in particular, shall safeguard the data against unauthorised access, unauthorised removal, processing in breach of applicable legislation, and alteration, loss, damage or destruction.

2. The data controller shall implement appropriate technical measures to prevent unauthorised persons from accessing or altering personal data transmitted electronically.

3. In matters not covered by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply mutatis mutandis.