1. GENERAL PROVISIONS
1.1. The administrator of personal data is Tojs SP. Z OO Pana Tadeusza 42, 80-123 Gdańsk entered into the National Court Register, DISTRICT COURT FOR GDAŃSK-PÓŁNOC FOR GDAŃSKU, VII ECONOMIC DIVISION OF THE NATIONAL COURT REGISTER, VAT ID: 5833290183 , REGON NUMBER: 369655554 , KRS 0000722197 ; hereinafter referred to as the "Administrator", which is simultaneously the service provider of the online store and the Seller.
1.2. The personal data of the service recipient (customer) are processed in accordance with the Personal Data Protection Act of 29 August 1997 (Journal of Laws No. 133, item 883, as amended), the Act on the provision of electronic services of 18 July 2002 (Journal of Laws No. 144, item 1204, as amended) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
1.2.1. For the provision of services electronically and the conclusion of sales contracts, the legal basis for the processing of personal data is Art. 6 (1) lit. a and b) GDPR.
1.2.2. For the purpose of fulfilling the Administrator's legal obligations based on generally applicable laws, including tax and accounting laws, the legal basis for processing personal data is Art. 6 (1) (c) GDPR
1.2.3. For analytical and statistical purposes, the legal basis for processing personal data is the legitimate interest of the Administrator (Article 6 (1) (f) GDPR), and the legitimate interest of the Administrator is the analysis of the results of commercial activity.
1.2.4. For the purpose of implementing the legitimate interest of the Administrator in relation to possible determination or investigation of legal claims or protection against legal claims, the legal basis for the processing of personal data is the legitimate interest of the Administrator (Article 6 (1) (f) GDPR).
1.3. The Administrator attaches great importance to the protection of the interests of persons to whom the data refer, in particular, it ensures that the data collected by it are processed lawfully, collected for specified and legitimate purposes and are not subjected to further processing that is contrary to those purposes; are technically correct and adequate for the purposes for which they are processed, stored in a form that allows the identification of the persons concerned and for no longer than is necessary for the purpose of processing.
1.4. All words, expressions and acronyms used on this Site beginning with capital letters (e.g. Seller, Online Store, Electronic Service) should be understood as defined in the General Terms and Conditions of the Online Store, available at: https://francescopetroni.pl/content/6-regulamin and in section 2.4 of this Privacy Policy.
1.5. The provision of personal data by the service recipient/customer is voluntary, however, if the personal data specified in the Terms and Conditions and necessary for concluding the purchase contract or the contract for the provision of Electronic Services are not provided, the conclusion of the above-mentioned contract will be refused. The data necessary for concluding the purchase contract or the contract for the provision of Electronic Services are also stated each time on the website of the online store.
1.6. The basis for processing the personal data of the Service Recipient/Customer is the need to perform the contract to which the Service Recipient/Customer is one of the parties or to start activities on his behalf prior to its conclusion.
2. PURPOSE AND SCOPE OF DATA STORAGE
2.1. The purpose of storing personal data by the Administrator is:
2.1.1. the recording, creation of content, modification, execution or termination of the contractual relationship between the service provider (seller) and the service recipient (customer), consisting in the provision of Electronic Services through the Internet store or the conclusion or execution of the contract for the sale of products and their delivery to the customer.
2.2. In the case of Customers who use the services of delivery of Products to the Customer, the Administrator transmits the collected personal data of the Customers to the selected delivery service in the scope necessary for delivery:
2.2.1. General Logistics Systems Poland Sp. z oo, ul. Tęczowa 10, Głuchowo,62-052 Komorniki. KRS 0000005009, VAT ID: PL-785-15-61-831
2.2.2. Inpost SA, Malborska 130, 30-624 Kraków, KRS 0000536554
2.2.3. Poczta Polska SA, ul. Rodziny Hiszpańskich 8, 00-940 Warszawa, KRS 0000334972
2.2.4. Furgonetka Spółka z ograniczoną odpowiedzialnością Sp. k., ul. Inżynierska 8, 03-422 Warszawa, KRS 0000694708
2.2.5. INPOST EXPRESS SPÓŁKA Z OO, ul. Malborska 130.30-624 KRAKÓW, KRS 0000543759
2.2.6. INPOST PACZKOMATY SP.Z OO, ul, KRS 0000418380
2.2.7. "RUCH" SA, ul. Chłodna 52, 00-872 Warsaw; KRS 0000020446
2.3. In the case of Customers using electronic payment methods or card payments, the Administrator transfers the collected personal data of Customers exclusively to the intermediary chosen by the Customer and only to the extent necessary for the Customer to make the payment mediated by them. The payment service provider available in the online store is:
2.3.1. Grupa DialCom24 - operator of the PRZELEWY24 online payment system. The payment service provider operates the authorization and settlement system on the basis of the Decision of the President of the National Bank of Poland No. 1/2011 of 1 April 2011 and provides payment services as a national financial institution on the basis of the Decision of the Financial Supervision Commission of 10 June 2014, entered in the Register of Payment Services together with DialCom24 Sp. z oo - the payment service provider under the number IP24/2014 (available at https://erup.knf.gov.pl/View/). Address: ul. Kanclerska 15, 60-327 Poznań. VAT ID: 781-173-38-52, REGON 634509164. District Court in Poznań, 8th Commercial Division of the National Court Register No. KRS 0000306513, amount of working capital: PLN 1,697,000
2.4. The Administrator processes the following personal data of the Service Recipients (Customers): first and last name; e-mail address; contact telephone number; address (street, house number, apartment number, postal code, city). In the case of Service Recipients (Customers) who are not Consumers, the Administrator additionally processes
the name of the company and the tax identification number (VAT ID).
2.5. Providing the personal data referred to in point 2.4 is necessary for the provision of Electronic Services related to the Online Store by the Service Provider and for concluding the contract for the sale of Products. In addition, the scope of the required data is specified each time in the Terms and Conditions of the Online Store, before the start of the provision of the relevant Electronic Service or before concluding the Sales Agreement on the Online Store website.
2.6. The recipients of the personal data may be:
2.6.1. the providers of the information systems IT services.
2.6.2. On the basis of appropriate agreements for the transfer of personal data processing to entities providing the Administrator with services in the field of accounting, service quality control, debt collection, legal advice, analysis and marketing.
2.6.3 Authorities that are legally entitled to receive your personal data.
2.7. The Administrator processes the personal data of persons who have "liked" our social media profiles on popular social media portals. The data is processed to operate and continuously manage our profiles, including for the purpose of communicating with the community and organizing events or competitions, under conditions regulated by the functioning of the respective social media portals and their terms and conditions. The data of community members is also processed for statistical and analytical purposes and may be processed for the purpose of determining legal claims and protecting against legal claims. The basis for processing your personal data is our legally justified interest (Art. 6 para. 1 lit. f GDPR).
2.8. When contacting the Administrator by telephone, in cases not related to the concluded contract or the services provided, we may require the provision of personal data only if it is necessary to process the case to which the contact relates. The legal basis in this case is the legitimate interest of the Administrator (Article 6 paragraph 1 letter f of the GDPR), in connection with the need to successfully process the reported case in connection with business activity.
2.9. In the case of written contacts with the Administrator by e-mail or by traditional means, which are not related to the services provided to the Service Recipient or the contract concluded with him, the personal data contained in such correspondence will be processed solely for the purpose of communication and successful handling of the case to which this correspondence relates.
2.10. In cases not regulated by the Terms and Conditions, the provisions of the Polish Civil Code and the relevant acts of Polish law and European Union law shall apply, in particular the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).
2.11. The online store also processes your personal data for the following purposes:
a) Transfer of your personal data to Santander SA (“Bank”) in connection with:
a. the provision by the bank for the internet shop of the service of providing the infrastructure for processing online payments (legal basis: Art. 6 para. 1 lit. f) Regulation).
b. Management and settlement by the bank of online payments made by customers of the Internet store using payment tools (legal basis: art. 6 para. 1 lit. f) of the Regulation).
c. Verification by the bank of the correct implementation of the contracts concluded with the online store, in particular to ensure the protection of the interests of payers in connection with the complaints raised by them (legal basis: Article 6 paragraph 1 letter f) of the Regulation).
b) transfer of your personal data to Twisto Polska sp. z oo in connection with the possibility of offering payment for the purchased goods or services through Twisto Polska sp. z oo, within the framework of the service contract covering the “Buy with Twisto” form of purchase and the provision of this form of purchase through the online store, as well as for the purpose of verification by Twisto Polska Sp. z oo of the correct execution of such service contracts (legal basis: Article 6 paragraph 1 letter f) of the Regulation).
2.12. In connection with the processing of personal data for the purposes set out in paragraphs 3 and 4, your personal data may be transferred by the online store to other recipients or categories of recipients, including:
a) Santander SA
b) Twisto Polska sp. z oo
2.13. In the event that your personal data is provided for the purpose of concluding a contract with the online store, the provision of your personal data is a condition for concluding this contract. In this case, the provision of personal data is voluntary, but if it is not provided, there is no possibility of concluding a contract with the online store.
In the event that the purpose of providing your personal data is to provide your personal data to Twisto Polska sp. z oo prior to concluding a contract for the purchase of goods (or services) on the Internet, the provision of such data shall be considered a condition for concluding the purchase contract in connection with the model of business activity adopted by the online store.
In the event that your personal data is transferred to the bank in connection with the administration and settlement of the online payments you make for the online store using payment tools, the provision of the data is necessary in order to be able to carry out the payments and to transmit the bank's confirmation to the online store.
In the event that your personal data is transferred to the Bank for the purpose of verifying the correct performance of the contracts concluded with the Online Store, in particular to ensure the protection of the interests of payers in connection with the complaints raised by them, the provision of these data is necessary to enable the performance of the contract between the Online Store and the Bank.
In the event that your personal data is provided to Twisto Polska sp. z oo in connection with the possibility of offering payment for the purchased goods or services through Twisto Polska sp. z oo, within the framework of the service agreement covering the “Buy with Twisto” form of purchase and the provision of this form of purchase by the online store, the provision of these data and their processing for this purpose is necessary in connection with the business model adopted by the online store and for the performance of the contract concluded between the online store and Twisto Polska Sp. z oo.
The legal basis for the processing is the legitimate interest of the administrator (Article 6 (1) (f) GDPR), in the form of maintaining correspondence addressed to him in connection with the business activity carried out.
The Administrator processes only personal data relevant to the correspondence concerning the case. All correspondence will be stored in a manner that ensures the security of the personal data and other information contained therein and will be accessible only to authorized persons.
3. OPERATING DATA
3.1. The Service Provider also collects operational data (so-called log files - IP address, domain), which are collected for an indefinite period and used to generate statistics useful in managing the online store. These data are collective and anonymous in nature, i.e. they do not contain any properties that allow identifying visitors to the online store's website. The log files are not transferred to third parties.
The online store does not automatically collect any data, except for data contained in cookies when using the portal itself. Cookies are small text files sent by the online store and stored on your computer, containing certain information related to your use of the portal and the online store. The cookies used by the online store can be temporary or permanent. Temporary cookies are deleted after the browser is closed, while permanent cookies are stored even after the end of the use of the portal and are used to store information such as your password or login, which speeds up and facilitates the use of the portal. The online store uses the cookies listed below for the following purposes:
In any case, you can block the installation of cookies or delete old cookies using the appropriate settings in your Internet browser. If you have any problems, we recommend that you use the browser's help file or contact the manufacturer of the browser you are using.
4. PERIOD OF DATA PROCESSING
4.1. For personal data processed for the purpose of concluding and executing sales contracts – for a period necessary to fulfil all obligations arising from the sales contracts.
4.2. In the case of personal data processed for the purpose of providing services electronically to the service recipient – for the period of providing services electronically to the service recipient.
4.3. In the case of personal data processed by the Administrator for the purpose of providing marketing content to the Service Recipient – until the Service Recipient objects to the processing of personal data to this extent.
4.4. For personal data processed for analytical and statistical purposes – for the entire period of provision of services by electronic means.
4.5. In the case of personal data processed for the purpose of implementing the legitimate interests of the Administrator in relation to possible establishment or investigation of legal claims or protection against legal claims - until the expiry of the limitation period for the claims. After this period, personal data will be processed only to the extent and for the period prescribed by law, including accounting laws.
5. RIGHTS RELATED TO THE PROCESSING OF PERSONAL DATA
5.1 The Service Recipient has the right to access the content of his personal data and to correct them.
5.2. Each person has the right to control the processing of data relating to him or her and contained in the Administrator’s database.
5.2.1 You can obtain information about how and to what extent your data is processed.
5.2.2 She can obtain a copy of her data.
5.2.2.1. If your request is to create a copy of the data, we ask you to specify exactly which copy of the data you would like to receive.
5.2.2.2 In the case of a second or third copy, the Administrator may charge fees, of which you will be notified.
5.2.2.3. The amount of the fee will correspond to the cost of preparing another copy of the personal data;
5.2.3. You can request the correction of your data (if it has been incorrectly written or changed)
5.2.4. You may request the erasure of your personal data (if there is no basis for their processing by the Administrator); 5.2.5. You may request the restriction of processing (if you want the Administrator to process your data only to a limited extent, pending the processing of your objection or request for rectification of the data, or if you want the data to be stored in connection with your legal claims);
5.2.5. You may request the transfer of your data that you have made available to the Administrator in a structured, commonly used and machine-readable format. You may independently transfer the received data to an administrator of your choice. In addition, if it is technically possible and in compliance with the appropriate security standards, we may transfer the data to another administrator on your behalf.
5.3.6. In the event that the processing of your data by the Administrator is based on legitimate interest, you may object to this type of processing;
5.3.7. Every person also has the right to lodge a complaint with a supervisory authority [in Poland – President of the Office for Personal Data Protection (until 25 May 2018 referred to as the Inspector General for Personal Data Protection)].
If you believe that our processing of your personal data violates your rights, please notify us by email at my smell.berlin@gmail.com . We strive to respond to all comments and suggestions from our users and, above all, to respect their rights.
5.3. To exercise the above rights, you can use the appropriate option in your account (this option is valid only for registered service recipients) or send an appropriate message by e-mail to the address: mysmell.berlin@gmail.com or in writing to the Administrator's address.
5.3.1. The request relates to the implementation of the rights of the data subjects and can be submitted in the following ways:
- in writing to the address: Tojs SP. Z OO Pana Tadeusza 42, 80-123 Gdansk
- by email to the address: contact@my-smell.de
The application should set out as precisely as possible what the requirement relates to, in particular:
- what rights the applicant wishes to exercise (e.g. the right to receive copies of the data, the right to delete the data, etc.);
- to which processing operation the claim refers (e.g. use of a specific service, receipt of the newsletter with commercial information to a specific e-mail address, etc.);
- the purposes of processing to which the request relates (e.g. marketing purposes, analytical purposes, etc.).
5.3.2. The application will be answered within one month of receipt. If this period is extended, the Administrator will inform the applicant of the reason for this extension.
5.3.3. The reply will be sent to the same email address used to submit the application, or, in the case of applications submitted in writing, by standard letter to the address provided by the applicant, unless the request for a reply by email is mentioned in the content of the letter (in which case the email address should be mentioned).
5.4 The Service Recipient has the right to lodge a complaint with a supervisory authority [in Poland – President of the Office for Personal Data Protection (until 25 May 2018 referred to as the General Inspector for Personal Data Protection)].
6. SECURITY OF PERSONAL DATA
6.1. The online store may contain links to other websites. When visiting other websites, the Administrator recommends that you familiarize yourself with the privacy policies of these websites. This privacy policy applies only to this online store.
6.2. The Administrator uses technical and organizational means to ensure the protection of the personal data processed, appropriate to the data being protected, in particular, it protects the data against access by unauthorized third parties, against removal by unauthorized persons, against processing in violation of applicable laws, as well as against modification, loss, damage or destruction.
6.3. The Administrator provides the following technical means to prevent access and modification of data transmitted electronically by unauthorized persons:
6.3.1. Protection of data collection from unauthorized access.
6.3.2. SSL certificate.
6.3.3. Access to the account only after entering the individual login and password data.
6.3.4. In order to ensure the integrity and confidentiality of data, the Administrator has implemented measures that allow access to personal data only to authorized persons and only to the extent necessary to perform their duties.
6.3.5 The Administrator implements organizational and technical solutions to ensure that all operations on personal data are recorded and performed only by authorized persons.
6.3.6 The Administrator shall also take all necessary measures to ensure that subcontractors and other entities cooperating with it can guarantee that they comply with the necessary security measures in all cases when processing data on behalf of the Administrator.
6.3.6. The Administrator shall continuously conduct risk analyses and monitor the adaptation of the security measures applied to the identified threats. If necessary, the Administrator shall introduce additional means to increase data security.
6.4. The Administrator will not transfer the personal data of the Service Recipient to third countries.
I consent to the processing of my personal data (name, e-mail address) by the seller Tojs SP. Z OO for marketing purposes. Consent is voluntary. I have the right to withdraw my consent at any time, without affecting the compliance with the right to processing based on the consent before its withdrawal. I have the right to access the content of my data, their correction, deletion, restriction of processing and the right to transfer data under the terms of the privacy policy of the online store. Personal data in the online store is processed in accordance with the privacy policy. We recommend that you familiarize yourself with the privacy policy before giving your consent.