Privacy policy

PRIVACY POLICY OF THE WEBSITE (HTTPS://WWW.AGATAGAWRYS.COM)

I. The Owner of this website places the highest importance on the protection of Users' personal data. They make every effort to ensure that Users feel safe when sharing their personal data while using the website.

II. Personal data of Users are processed only to the extent necessary to ensure the functionality of the website and its services. Personal data are processed only with the User's consent. Exceptions are cases where prior consent cannot be obtained for factual reasons and where data processing is permitted by law.

III. A User is a natural person, legal person, or an organizational unit without legal personality, granted legal capacity by law, using electronic services available on the website.

IV. This Privacy Policy explains the principles and scope of processing the User's personal data, their rights, as well as the obligations of the data administrator, and also informs about the use of cookies.

V. The Administrator applies the latest technical measures and organizational solutions to ensure a high level of protection of the processed personal data and security against unauthorized access.

I. PERSONAL DATA ADMINISTRATOR

The Administrator of personal data is Ms. Agata Gawryś, residing at: ul. Leśna 44A, 05-430, Celestynów (hereinafter referred to as "Owner").

II. PURPOSE OF PERSONAL DATA PROCESSING

The Administrator processes the User's personal data in order to:
- Execute orders in the online store.
This means that the personal data of Users are needed in particular for: a) Concluding a contract; b) Making settlements; c) Delivering the goods ordered by the User or performing services; d) Enabling the User to exercise any consumer rights (e.g., withdrawal from the contract, warranty); e) Receiving orders, handling inquiries submitted through the contact form.
The User may also consent to receiving information about new products and promotions, which will allow the Administrator to process personal data in order to send commercial information, including information about new products, services, promotions, or sales.
Personal data is also processed to fulfill legal obligations incumbent on the data administrator and to perform tasks in the public interest, including tasks related to security, defense, or storing tax documentation.
Personal data may also be processed for direct marketing of products, securing and pursuing claims, or protecting against claims from the User or third parties, as well as marketing services and products of third parties or internal marketing, which is not direct marketing.

III. TYPES OF DATA

When accessing our website, data and information are automatically collected from the computer system accessing the site, particularly regarding: a) The type and version of the browser used; b) The User’s operating system; c) The User’s Internet service provider; d) The User's IP address; e) The date and time the User accessed the website; f) The websites from which the User's system accesses the website: HTTPS://WWW.AGATAGAWRYS.COM; g) The websites to which the User's system accesses through the website: HTTPS://WWW.AGATAGAWRYS.COM; h) Log files containing IP addresses or other data that can be assigned to the User (if provided by another website through which the User accessed the website).
The Administrator processes the following personal data of the User, which is necessary for: a) Making purchases through the website:
- First and last name;
- Gender;
- Delivery address;
- Phone number;
- Email address. b) Making purchases by consumers through the website:
- First and last name;
- Gender;
- Delivery address;
- Phone number;
- Email address.
In the case of withdrawal from the contract or the acceptance of a complaint when the refund is made directly to the User’s bank account, the account number will also be processed.
The Administrator also processes optional data provided by the User:
- Date of birth;
- PESEL number (if an invoice is requested);
- NIP number (if an invoice for a business is requested).

IV. LEGAL BASIS FOR PERSONAL DATA PROCESSING

Personal data is processed in accordance with the provisions of the European Parliament and Council Regulation (EU) 2016/679 of April 27, 2016, on the protection of individuals with regard to the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), Official Journal of the EU L 119, 4.5.2016, pp. 1–88, hereinafter referred to as: "GDPR."
The Administrator processes personal data only after obtaining the User's consent at the time of confirming the transaction made on the website.
Consent to the processing of personal data is entirely voluntary; however, failure to provide consent will prevent making purchases through the website.

V. RIGHTS OF THE USER

The User may at any time request from the Administrator information about the scope of their personal data processing.
The User may at any time request correction or rectification of their personal data.
The User may at any time withdraw their consent to the processing of their personal data, without providing a reason. This request to stop processing data may apply to a specific purpose (e.g., withdrawal of consent for receiving commercial information) or all purposes of data processing. Withdrawal of consent for all purposes will result in the deletion of the User’s account from the website, along with all previously processed personal data.
The User may at any time request the deletion of their data, without providing a reason. The deletion of data will result in the simultaneous deletion of the User’s account, along with all previously processed personal data.
The User may at any time object to the processing of their personal data, either for all the data processed by the Administrator or only for specific purposes. This objection will not affect the actions already carried out.
The User may request to restrict the processing of their personal data, either for a specific period or without time limits but in a specific scope, which the Administrator is obligated to fulfill.
The User may request that the Administrator transfers their personal data to another entity. They should write a request to the Administrator, specifying which entity (name, address) should receive the personal data and which specific data the User wants to be transferred. After confirming the User’s wish, the Administrator will transfer the data electronically to the indicated entity.
The Administrator will inform the User about actions taken within one month of receiving one of the requests mentioned above.

VI. DATA RETENTION PERIOD

In principle, personal data is retained only as long as necessary to fulfill contractual or legal obligations for which it was collected. Data will be deleted immediately when its retention is no longer necessary for evidential purposes or legal requirements.
Information about the contract is stored for evidential purposes for three years, starting from the end of the year in which the business relationship with the User was concluded.
Additionally, the Administrator may retain archived information regarding transactions because it relates to claims the User may have (e.g., warranty claims).
If no contract was concluded between the User and the Owner, the User’s personal data will be retained until the User’s account on the website is deleted.

VII. DATA PROCESSING BY THIRD PARTIES

The Administrator may entrust personal data processing to cooperating entities as necessary to fulfill transactions, such as preparing ordered goods and delivering shipments.
Except for the purposes outlined in this Privacy Policy, User personal data will not be disclosed to third parties for marketing purposes.
User data is not transferred outside the European Union.
This Privacy Policy complies with the provisions of Articles 13(1) and 13(2) of the GDPR.

VIII. COOKIES

The website uses cookies (small text files) or similar technologies to collect information about the User’s access to the website and their preferences.
Cookies are pieces of information containing a unique reference code, which the website sends to the User’s device to store and sometimes track device information. They are usually not used to identify the User.
Some cookies are available only for the duration of the session and expire when the browser is closed, while others are stored for longer to recognize the User on their next visit.
Cookies used on this website:
- _stripe_mid (1 year), _stripe_sid (30 minutes), _paymentSuccess (30 minutes), etc.
All cookies on the website are set by the Administrator.
All cookies used by this website comply with EU law.
Most Users and mobile browsers automatically accept cookies. If the User does not change the settings, cookies will be stored on their device.
Users can change cookie preferences in their browser settings.
Blocking or deleting cookies may limit full use of the website.
Cookies are used to manage sessions, recognize return visitors, and improve the website's functionality and user experience.