Privacy policy

1. Introduction

   1. “OLEKSY” CO. PAWEŁ & WITOLD OLEKSY with its registered office in Stanisław Dolny 274; 34-130 Kalwaria Zebrzydowska as an entity providing electronic services attaches particular importance to the security of collected personal data of its customers and users.

   2. This document was created as a realization of the principle of transparency defined and introduced by Regulation 2016/679 of the European Parliament and Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR. Its purpose is to ensure that data subjects are provided at all times with clear, comprehensible and easily accessible information on among others the purposes and legal basis of processing, data retention periods and their rights.

   3. This Privacy Policy applies to all situations in which it is the administrator of personal data and processes personal data.

   Definitions

   4. In order to explain the terms that appear in this document, we explain:

      1. Personal data – all information on an identifiable or identified natural person, such data include: name and surname, e-mail address, delivery address, location data, Internet ID;

      2. Processing – every activity performed on personal data, regardless of whether it is performed automatically or not, we consider as processing, among others: collection of data, storage, modification, browsing, use, removal.

   Administrator, Contact details

   5. The administrator of personal data of the entities referred to in point II – is “OLEKSY” CO. PAWEŁ & WITOLD OLEKSY with its registered office in Stanisław Dolny 274; 34-130 Kalwaria Zebrzydowska entered into the register kept by the District Court for Cracow- Śródmieście in Cracow, XII Commercial Division of the National Court Register under National Court Register number: 0000418516, Tax Identification Number: 5512615121, Business Registration Number: 122561511, hereinafter called the Administrator.

   6. The Administrator may be contacted in all matters related to personal data protection by post, at the address indicated in point 5 above, and within the electronic communication to the following e-mail address: sklep@oleksy.pl

   Principles

   7. The Administrator processes personal data taking into account the following principles:

      1. Data shall be processed only if there are grounds for processing,

      2. Data are collected only for specified, communicated purposes and not further processed in a way contrary to these purposes,

      3. The scope of data collected is limited to the minimum necessary to achieve the intended purpose,

      4. Data shall be kept only for the time necessary to achieve the purpose, except where required by law or where there are other grounds for further processing,

      5. Data processed are kept up to date,

      6. Technical and organizational measures are taken to ensure adequate security of the personal data processed, including protection against unauthorized and unlawful processing and accidental loss, damage or destruction,

      7. Data may be transferred to entities with whom we cooperate, such as: suppliers responsible for operating IT systems, banks, payment operators, entities providing accounting, legal, tax, audit, courier services and entities related by capital.

   8. Regardless of this Privacy Policy, which is available on the Administrator’s websites, the Administrator fulfills the informational obligation – in accordance with Articles 13 and 14 of the GDPR by providing the data subjects with relevant information before collecting data from them, e.g. at the time of placing an order or opening an account in the Online Shop, or within appropriate deadlines – in case that the data are not collected directly from the data subjects.

   9. This Privacy Policy contains detailed information on the Administrator’s processing of personal data of particular categories of persons: customers with an account in the online shop, customers without an account in the online shop, newsletter subscribers, persons contacting the Administrator (by phone, e-mail) and persons with whom the Administrator contacts (by e-mail and telephone).

   10. Information on the processing of personal data of persons visiting websites operated by the Administrator in connection with data collected via cookies can be found in the Cookie Policy document.

1. Purposes for the processing of personal data

The Administrator processes the provided personal data for the following purposes:

1. conclusion and performance of an agreement for the provision of electronic services in a form of account in the Administrator’s online shop;

2. conclusion and performance of a product sale agreement;

3. alternatively, pursuing claims related to concluded sales agreement / services provided

4. issuing a VAT invoice for the customer

5. sending a newsletter with information about the Administrator’s products and services

6. ensure contact with the Administrator, including by means of a contact form placed on the Administrator’s website or in a form of e-mail or telephone communication;

7. conducting the recruitment process and selection of a person among the candidates who meets the position requirements;

8. performance of activities related to the establishment, negotiation and performance of agreements with contractors

2. Legal grounds for the processing of personal data

The Administrator processes personal data on the basis of the following legal grounds:

1. necessity of data processing in order to conclude and perform the agreement for provision of an electronic service in a form of holding registered account in the Administrator’s online shop (Article 6(1)(b) of the GDPR)

2. necessity of data processing for conclusion and performance of sales agreement (Article 6(1)(b) of the GDPR)

3. necessity of the processing to meet the legitimate interest of Administrator; the legitimate interest of Administrator is possibility to assert claims (Article 6(1)(f) of the GDPR)

4. necessity of data processing in order to meet the obligation resulting from the legal provision, i.e. issuing a purchase document (VAT invoice) – (Article 6(1)(c) of the GDPR)

5. consent to receive information about the Administrator’s products and services – newsletter (Article 6(1)(a) of the GDPR, which may be withdrawn at any time, provided that the withdrawal of consent does not affect the lawfulness of processing performed on the basis of consent before its withdrawal

6. compliance with the Administrator’s legitimate interest (Article 6(1)(f))

7. fulfillment of a legal obligation and consent of the person taking part in the recruitment process (Article 6(1)(a) and/or (c) of the GDPR)

8. as regards contacts with counterparties, the need for processing in connection with conclusion and performance of agreements (Article 6(1)(b) of the GDPR)

3. Sources of personal data collection

The Administrator collects personal data:

1. Directly from the data subjects;

2. From third parties – contractors with whom agreements are concluded and designated contact persons/responsible for their implementation or persons who act as bodies of legal persons.

4. Period of processing personal data

Personal data shall be processed by the Administrator for the period necessary to achieve the purpose, and longer if required by law or if it is justified due to the legitimate interest of the Administrator. In particular, the data will be processed for the following periods:

1. remain a registered customer of the online shop, and then until the expiry of claims related to this agreement;

2. performance of the sales agreement of goods, and later until the expiry of claims related to this agreement (2 years) or until the expiry of obligation to keep data resulting from the provisions of law, in particular the obligation to keep accounting documents related to the agreement (5 years)

3. data provided for the purpose of sending information about products and services offered by the Administrator – until the moment of consent withdrawal;

4. recruitment process, and after its completion, immediately removed not later than within 30 days after the completion of recruitment process;

5. performance of agreements concluded with contractors, and later until the expiry of claims related to their performance;

6. in case of contact with the Administrator in order to conduct communications/correspondence with the Administrator’s activity, for a period of 30 days from the receipt of the inquiry, or 30 days from the last contact made in the continuation of correspondence.

5. Recipients of personal data

The Administrator shall transfer personal data to entities processing personal data on behalf of the Administrator, including IT service providers, accounting services – such entities process data on the basis of an agreement with the Administrator and exclusively in accordance with the Administrator’s instructions. Personal data shall be processed by the Administrator’s employees and persons authorized by the Administrator, who have undergone appropriate training in the principles of personal data protection. Personal data in certain cases will be provided to debt collection companies, banks, bank payment service providers, postal operators.

6. Transfer of personal data outside the European Economic Area

Personal data will not be transferred to recipients located in countries outside the European Economic Area.

7. Rights of data subjects

Persons whose data are processed shall have the following rights:

1. right of access to data and right to demand their rectification, removal, restriction of processing;

2. to the extent that processing of personal data is based on a legitimate interest of the Administrator, has the right to object to their processing.

3. to the extent that data are processed for the purpose of concluding and performing an agreement / provision of services and the data are processed on the basis of consent, and the processing is automated – has the right to transfer personal data, i.e. to receive personal data from the Administrator, in a structured, commonly used machine-readable format; these data may be sent to another data administrator.

4. to the extent that data are processed for the purpose of sending information about products and services offered by the Administrator, has the right to withdraw consent at any time; withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

5. right to lodge a complaint to the supervisory authority dealing with personal data protection – the President of the Office for Personal Data Protection.

In order to exercise the rights described in points a) – d), please contact the Administrator – contact details indicated in point I (general part), sub-points 5 and 6 above.

8. Voluntary disclosure of personal data

1. Providing personal data in relation to concluded agreements is voluntary, but without providing personal data, it is not possible to conclude and perform the agreement.

2. Providing personal data for the purpose of sending information about products and services offered by the Administrator is voluntary.

3. Providing personal data for the purpose of contacting/correspondence with the Administrator is voluntary, but failure to provide such data will make it impossible for the Administrator to contact, correspond with the Administrator and provide information on the question asked.

4. Providing personal data in relation to the recruitment process is voluntary, but without them participation in the recruitment process is impossible.

10. Profiling and automatic decision making

The Administrator shall not use the personal data provided for automated decision making, including profiling as referred to in Article 22(1) and (4) of the GDPR.

1. In case of any questions, doubts, reservations related to the content of this Privacy Policy or the way, in which we process personal data, we remain at your disposal and please send an e-mail in this matter to: sklep@oleksy.pl or contact us by letter to the address indicated in point I. 5.

2. The Privacy Policy will be subject to constant review and possible changes in the situation when it proves necessary in relation to new legal regulations, new guidelines of authorities responsible for the supervision of personal data protection. We also reserve the right to change this Privacy Policy in case of changes in the ways, purposes or legal basis of processed personal data.

3. The latest version of this document dated 25.05.2018.