Privacy and Cookies policy
ONLINE SHOP PRIVACY POLICY
ONLINE-WEDDINGDANCE.COM
TABLE OF CONTENTS:
1.
GENERAL PROVISIONS
2.
BASIS FOR THE PROCESSING OF DATA
3.
PURPOSE, BASIS AND PERIOD OF PROCESSING DATA IN THE ONLINE
SHOP
4.
DATA RECIPIENTS IN THE ONLINE SHOP
5.
PROFILING IN THE ONLINE SHOP
6.
THE RIGHTS OF THE DATA SUBJECT
7.
COOKIES IN THE ONLINE SHOP AND ANALYTICS
8.
FINAL PROVISIONS
1. GENERAL
PROVISIONS
1.1.
This Privacy Policy of the Online Shop is of informative nature, which
means that it is not a source of obligations for Service Recipients or Customers
of the Online Shop. The Privacy Policy contains, above all, the principles
concerning the processing of data by the Controller in the Online Shop,
including the basis, purpose and period of personal data processing and the rights
of data subjects as well as information regarding the use of cookies and
analytical tools in the Online Shop.
1.2.
The Controller of the personal data collected via the Online Shop shall
be the PAWEŁ STALIŃSKI, running a
business under the name „KIMI- ARTS” PAWEŁ STALIŃSKI entered into the Central
Register and Information on Economic Activity of the Republic of Poland run by
the Minister of Economy, having: the address of the business place and the
delivery address: ul. Bukowińska 12/1510A, 02-703 Warszawa, tax identification number 5291284618, REGON
369278301, e-mail address: info@pierwszytanieconline.pl, telephone number: +48
737475479.
1.3.
Personal data in the Online Shop shall be processed by the Controller in
accordance with the binding legal regulations, in particular the Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on
the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation) hereinafter referred to as “GDPR” or
“GDPR Regulation”. The official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
1.4.
Using the Online Shop, including shopping, is voluntary. Similarly,
providing personal data by the Service Recipient or the Customer using the Online
Shop is voluntary, subject to two exceptions: (1) entering into contracts
with the Controller – failure to provide the personal data necessary for
the conclusion and performance of the Sales Contract or a contract for the
provision of an Electronic Service with the Controller in the cases and within
the scope indicated on the website of the Online Shop and the Terms and Conditions
of the Online Shop and this Privacy Policy shall result in no possibility to
enter into the contract. Providing personal data is a contractual requirement
in such a case and if the data subject is willing to enter into the contract
with the Controller, they shall be obligated to provide the required data. The scope
of the data required to enter into the contract is each time specified in advance
on the website of the Online Shop and in the Terms and Conditions of the Online
Shop; (2) statutory obligations of the Controller – specifying the
personal data is a statutory requirement resulting from the commonly binding
legal regulations obligating the Controller to process the personal data (e.g.
processing data to fiscal books and ledgers) and failure to specify the data will
render it impossible for the Controller to perform the obligations.
1.5.
The Controller assures due diligence to protect the interest of persons
being data subjects, in particular being responsible and liable for and
assuring that the data collected are: (1) processed in accordance with the Act;
(2) collected for specific, legal purposes and not subject to further processing
inconsistent with the purposes; (3) correct as regards the subject matter and
adequate as regards the purpose of the processing; (4) stored in a form making
it possible to identify the people they apply to, no longer than it proves
necessary to attain the purpose of processing and (5) processed
in a manner ensuring security of the personal data, including the protection
against illicit or illegal processing or accidental loss, damage or destruction,
with the use of appropriate technical and organisational measures.
1.6.
Taking into account the nature, scope, context and purpose of processing
as well as the risk of breaching the rights or freedoms of natural persons with
varied likelihood and degree of threat, the Controller is implementing
appropriate technical and organisational measures so that the processing takes
place pursuant to the Regulation and it is possible to show it. The measures are
reviewed and updated, as necessary. The Controller applies technical measures
preventing the acquisition and modification of personal data sent electronically
by unauthorised persons.
1.7.
Any words, phrases and acronyms used in this privacy policy starting with
a capital letter (e.g. Seller, Online Shop, Electronic Service) shall be
understood in accordance with the definition contained in the Terms and
Conditions of the Online Shop available on the websites of the Online Shop.
2. BASIS
FOR THE PROCESSING OF DATA
2.1.
The Controller is authorised to process the personal data in cases, and
to the extent, when at least one of the following conditions is met: (1) the
data subject consented to the processing of their data to one or more specified
ends; (2) processing is necessary for contract performance the data subject is a
party to, or to take actions to the request of the data subject, prior to
contract conclusion; (3) processing is necessary to meet the legal obligation
of the Controller; or (4) processing is necessary for the needs resulting from
the legally justified interests of the Controller or third party, except for
situations when the interests or basic rights and freedoms of the data subject
override such interests and they require personal data protection, especially
when the data subject is a child.
2.2.
The processing of personal data by the Controller each time requires having
at least one basis indicated in item 2.1 of the privacy policy. Specific bases
for processing personal data of the Service Recipients or the Customers of the Online
Shop by the Controller are specified in the following point of the privacy
policy – as regards the specific goal of processing personal data by the
Controller.
3. PURPOSE,
BASIS AND PERIOD OF PROCESSING DATA IN THE ONLINE SHOP
3.1.
Each time, the purpose, basis and period as well as the recipients of
personal data being processed by the Controller result from actions undertaken
by a given Service Recipient or Customer in the Online Shop. For instance, in
the case the Customer decides to purchase a product in the Online Shop and
selects collecting the purchased Product personally instead of shipment, their
personal data will be processed with a view of performing the Sales Contract
entered into, but they will not be made available to the courier delivering the
shipment to the Controller’s order.
3.2.
The Controller may process the personal data in the Online Shop for the
purposes, on the bases and within the periods as follows:
|
Purpose of data processing |
Legal basis for processing data |
Period of data storage |
|
The performance of the Sales Contract or a contract
for the provision of an Electronic Service, or taking actions to the request
of the data subject, prior to entering into the above contracts. |
Article 6, par. 1, point b) of the GDPR Regulation
(contract performance) – the processing is required to perform the Sales Contract
of which the data subject is party or to take action to the request of the
data subject, prior to entering into the contract. |
The data shall be stored for the period necessary
for the performance, termination or expiry of a contract entered into in a
different manner. |
|
Direct marketing |
Article 6, par. 1, point f) of the GDPR Regulation
(legitimate interest of the controller) – the processing is required for achieving
the goals based on the legitimate interest of the Controller which includes upholding
interests and strengthening reputation of the Controller and the Online Shop as
well as his commitment for increasing sales of Products |
The data shall be stored for the period of the
legitimate interest of the Controller, however no longer than the period of
limitation of claims as regards the data subject under the business activity
of the Controller. The period of limitation shall be specified by legal provisions,
in particular the Civil Code (the basic period of limitation in the case of claims
related to business activity amounts to three years, and for a Sales Contract
two years). The Controller may not process the data for the
needs of direct marketing in the case of expressing clear objection in this field
by the data subject. |
|
Marketing |
Article 6, par. 1, point a) of the GDPR Regulation (consent)
– the data subject expressed the consent to process its personal data for purpose
of expressing an opinion |
The data are stored until the data subject withdraws
the consent to further process their data to that end. |
|
Keeping tax books |
Article 6, par. 1, point c) of the GDPR Regulation
in relation with Article 86 §1 of Tax Ordinance Act, consolidated text of 17
January 2017 (Journal of Laws of 2017 item 201) – the processing is required
for the Controller due to their statutory obligations |
The data shall be stored for the legally required
period, requesting the Controller to store tax books (till the lapse of the
period of limitation of a tax obligation, unless Acts on Tax stipulate
otherwise) |
|
Determining, pursuing or defence of claims on the side
of the Controller, or ones that may arise as regards the Controller. |
Article 6, par. 1, point f) of the GDPR Regulation (legitimate
interest of the controller) – the processing is required for the purposes
resulting from the legitimate interests of the Controller which includes determining,
pursuing or defence of claims on the side of the Controller, or ones that may
arise as regards the Controller |
The data shall be stored for the period of the
legitimate interest of the Controller, however no longer than the period of
limitation of claims against the Controller. The period of limitation shall
be specified by legal provisions, in particular the Civil Code (the basic
period of limitation in the case of claims against the Controller amounts to six
years). |
|
Use of the Online Shop website and ensuring its proper
functioning |
Article 6, par. 1, point f) of the GDPR Regulation
(legitimate interest of the controller) – the processing is required for the
purposes resulting from the legitimate interests of the Controller which
includes operating and maintenance of the Online Shop |
The data shall be stored for the period of the
legitimate interest of the Controller, however no longer than the period of
limitation of claims as regards the data subject under the business activity
of the Controller. The period of limitation shall be specified by legal
provisions, in particular the Civil Code (the basic period of limitation in
the case of claims related to business activity amounts to three years, and
for a Sales Contract two years). |
|
Preparing statistics and analysing the manner of the
data subject conduct on the website of the Online Shop |
Article 6, par. 1, point f) of the GDPR Regulation (legitimate
interest of the controller) – the processing is required for the purposes
resulting from the legitimate interests of the Controller which includes preparing
statistics and analysing the manner of the data subject conduct on the website
of the Online Shop in order to improve the functioning of the Online Shop and
increase sales of Products |
The data shall be stored for the period of the
legitimate interest of the Controller, however no longer than the period of
limitation of claims as regards the data subject under the business activity
of the Controller. The period of limitation shall be specified by legal
provisions, in particular the Civil Code (the basic period of limitation in
the case of claims related to business activity amounts to three years, and
for a Sales Contract two years). |
4. DATA
RECIPIENTS IN THE ONLINE SHOP
4.1.
For the needs of proper Online Shop functioning, inclusive of the performance
of the Contracts of Sale entered into, it shall be necessary for the Controller
to make use of external companies’ services (e.g. software provider, courier,
or payment system provider). The Controller uses solely the services of such
processing entities which ensure sufficient guarantee to implement appropriate
technical and organisational measures so that the processing meets the
requirements set out in the GDPR Regulation and protects the rights of data
subjects.
4.2.
Providing data by the Controller does not take place in every case and
not to all the recipients or categories of recipients defined in the privacy
policy – the Controller provides the data only in the case it proves necessary
to attain a given purpose of personal data processing and solely within the
necessary scope. For instance, in the case the Customer selects collecting an item
personally, their data will not be given to the carrier being the Controller’s
collaborator.
4.3.
Personal data of the Online Shop Service Recipients or Customers may be
provided to the following recipients or categories of recipients:
4.3.1.
e-payments or payment card service providers – in the case of a Customer who uses
in the Online Shop the option of e-payment or payment card, the Controller
makes the collected Customer’s personal data available to the selected payment service
provider in the Online Shop for the Controller to the extent necessary to perform
the payment of the Customer. In particular, such entities may be:
4.3.2.
service providers rendering for the Controller technical, IT or organisational
solutions, making it possible for the Controller to conduct a business,
inclusive of the Online Shop and Electronic Services provided via it (in particular computer software providers
for the Online Shop, e-mail companies and hosting providers as well as software
providers for company management and technical aid for the Controller) – the
Controller makes the collected personal data of the Customer available to the
selected provider operating to their order only in the case and to the extent
necessary for attaining a given purpose of data processing in accordance herewith.
4.3.3.
accounting, legal and counselling services providers rendering for the
Controller accounting, legal or counselling services (in particular an accounting
agency, law firm or debt collection company) – the Controller makes the
collected personal data of the Customer available to the selected provider
operating to their order only in the case and to the extent necessary for
attaining a given purpose of data processing in accordance herewith.
4.3.4.
Facebook Ireland Ltd. – the Controller uses Facebook social plugins on the Online Store website
(e.g. Like button, Share or log in using Facebook) and therefore collects and
provides personal data of the Service Recipient using the Online Store website
to Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbor, Dublin 2
Ireland) to the extent and in accordance with the privacy policy available here:
https://www.facebook.com/about/privacy/ (these data include information on
activities on the Online Store website - including information about the
device, websites visited, purchases, displayed ads and manner of using these
services - regardless of whether the Service Recipient has a Facebook account
and is logged in to Facebook).
5. PROFILING
IN THE ONLINE SHOP
5.1.
The GDPR Regulation obligates the Controller to inform about the automated
decision-making process, including profiling referred to in Article 22, par. 1
and 4 of the GDPR Regulation, and – at least in those cases – the vital information concerning the decision-making
process as well as the meaning and foreseeable consequences of processing for the
person being the data subject. Bearing in mind the above, the Controller
specifies in this point of the privacy policy the information concerning the
possible profiling.
5.2.
The Controller may use profiling in the Online Shop for direct marketing
purposes, yet the decisions made on its basis by the Controller do not concern
the conclusion or rejection to conclude the Sales Contract, or the possibility
to make use of Electronic Services in the Online Shop. The result of profiling
in the Online Shop may be e.g. discount for a given person, sending a discount
code, reminding about unfinished purchase process, sending Product offers,
which may be related to the interests or preferences of the person, or offering
better conditions as compared with the standard offer of the Online Shop. Regardless
of profiling, the person makes decisions freely, whether they want to use the
discount given, or better conditions and buy a product in the Online Shop.
5.3.
Profiling in the Online Shop consists in automatic analysis or forecast
of the conduct of a given person on the website of the Online Shop, e.g. by
adding a given Product to the cart, browsing the page of a given product in the
Online Shop, or the analysis of the history of purchase in the Online Shop. The
condition for such profiling is for the Controller to have the personal data of
the person, so that they can later send them e.g. a discount code.
5.4.
The data subject shall have the right not to depend on the decision which
is only based on automated processing, including profiling, and has some legal
effects on the person or similarly affects them.
6. THE
RIGHTS OF THE DATA SUBJECT
6.1.
The right to access, rectify, restrict, erase or transmit – the data subject shall have the right
to demand the Controller to have access to their personal data, rectify, erase
(“the right to be forgotten”) or restrict the processing and shall have the right
to object to the processing and transmit their data. Detailed conditions of the
above rights shall be indicated in Articles 1522 of the GDPR Regulation.
6.2.
The right to withdraw the consent at any time – the person whose data are being
processed by the Controller on the basis of the consent given (pursuant to Article
6, par. 1, point a) or Article 9, par. 2, point a) of the GDPR Regulation),
they shall have the right to withdraw their consent at any time without any impact
on the compatibility with the right to process made based on the consent prior
to the withdrawal.
6.3.
The right to lodge a complaint with a supervisory body – the person whose data are being
processed by the Controller shall have the right to lodge a complaint with a
supervisory body in a manner and mode specified in the provisions of the GDPR
Regulation and the Polish law, in particular the Personal Data Protection Act.
The supervisory body in Poland shall be the President of the Office for
Personal Data Protection.
6.4.
The right to object – the data subject shall have the right, at any time, to lodge a complaint
– for reasons related to their particular situation – as regards the processing
of their personal data based on Article 6, par.
1, point e) (public interest or official authority) or f) (legitimate
interest of the controller) in the case of profiling based on the provisions.
The Controller in such a case must stop processing the personal data, unless
they show the existence of legally significant and justified bases for the
processing, overriding the interests, rights and freedoms of the data subject,
or the bases for determining, pursuing or defending the claims.
6.5.
The right to object as regards direct marketing – in the case the personal data are
being processed for the needs of direct marketing, the data subject shall have
the right, at any time, to lodge a complaint as regards the processing of their
personal data for the needs of such marketing, including profiling, to the
extent to which the processing is related to direct marketing.
6.6.
To perform the rights mentioned in this point of the privacy policy, one
may contact the Controller by sending them an appropriate message in writing or
via e-mail to the address of the Controller indicated at the beginning of the
privacy policy or using the contact form available on the Online Shop’s
website.
7. COOKIES
IN THE ONLINE SHOP AND ANALYTICS
7.1.
Cookies are small pieces of text files sent by the server and saved at
the visitor’s of the Online Shop (e.g. on the hard disk of a computer, laptop,
or smartphone’s memory card – depending on the type of device used by the Online
Shop’s visitor). Detailed information on Cookies as well as the history of
their origin can be found e.g. at: http://pl.wikipedia.org/wiki/Ciasteczko (https://en.wikipedia.org/wiki/HTTP_cookie).
7.2.
The Controller may process the data contained in Cookies while the
visitors of the Online Shop use it for the following purposes:
7.2.1.
identification
of the Service Recipients being logged in the Online Shop and showing that they
are logged in;
7.2.2.
saving
Products added to the cart to place an order;
7.2.3.
saving
data from the Order Forms, polls or logging data to the Online Shop;
7.2.4.
adjusting
the content of the Online Shop to individual preferences of the Service
Recipient (e.g. concerning the colours, font size, layout) and optimising the
use of the Online Shop’s websites;
7.2.5.
preparing
anonymous statistics presenting the manner of using the Online Shop;
7.2.6.
remarketing,
namely evaluating the conduct of visitors of the Online Shop through anonymous
analysis of their activities (e.g. repeated visits on particular pages, key
words etc.) to create their profile and provide them with adverts matching
their interests, also when they visit other websites in the advertising network
of Google Ireland Ltd. and Facebook Ireland Ltd.
