PRIVACY POLICY FOR THE SHOP.CH24.PL ONLINE SHOP

§ 1
GENERAL PROVISIONS

1. The Data Controller for the processing of data collected through the shop.ch24.pl online Shop is Tomasz Kiełtyka trading as GTK TOMASZ KIEŁTYKA entered into the Central Registration and Information on Business (CEIDG) kept by the minister in charge of economy, principal place of business: ul. Zygmunta Starego 24A/8, 44-100 Gliwice, Poland, tax identification number NIP: 6311898710, statistical number REGON: 276751175, email address: [email protected], telephone number: +48 32 7500816, hereinafter referred to as “Data Controller” or Service Provider.
2. Personal data collected by the Data Controller via the website are processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/WE (General Data Protection Regulation), hereinafter referred to as the GDPR.
3. Capitalised terms used in this Privacy Policy shall have the meaning set forth in the “Definitions” section of the shop.ch24.pl Terms and Conditions.

§ 2
TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

1. PURPOSE AND LEGAL BASIS OF PROCESSING. The Data Controller shall process a User’s personal data in the following circumstances:
   a) Account registration with shop.ch24.pl, for the purpose of creation and management of an individual User account, as set forth in Article 6 (1) (b) of the GDPR (performance of the electronic services agreement in accordance with the Terms and Conditions for shop.ch24.pl).
   b) Order placement with shop.ch24.pl, for the purpose of performance of the sales agreement as prescribed under Article 6 (1) (b) of the GDPR (performance of the sales agreement),
   c) subscribing to the Newsletter to send commercial information by electronic means. Personal data is processed after expressing separate consent, based on under Article 6 (1) (a) of the GDPR (performance of the sales agreement).
2. TYPE OF THE PERSONALL DATA PROCESSED. In order to:
   a) register an account with shop.ch24.pl the User submits:
   – Name and surname,
   – Login,
   – Address,
   – E-mail address.
   b) place an Order with shop.ch24.pl the User submits:
   – Name and surname,
   – Address,
   – NIP,
   – E-mail address,
   – Telephone number,
   c) subscribe Newsletter the User submits:
   – Name and surname
   – E-mail address
   In order to manage the list of Newsletter users, the Service Provider uses the Mailchimp website, which stores some of the data of the Customers. Mailchimp is a mailing list management and email service provided by Mailchimp Inc. based in the USA. Mailchimp has its own privacy policy: https://mailchimp.com/legal/privacy/.
3. PERSONAL DATA STORAGE PERIOD. Personal data submitted by Users are retained by the Data Controller for the following retention periods:
   a) If the lawful basis is agreement performance: personal data are stored for as long as necessary for the performance of an agreement, and thereafter until the expiry of any statutory period of prescription or limitation. Unless a specific regulation provides otherwise the limitation period is six years, whereas for claims concerning periodical performances and claims connected with conducting business activity – three years.
   b) If the lawful basis is consent: personal data are stored until withdrawal of consent, and thereafter until the expiry of any statutory period of prescription or limitation for claims that may be raised by the Data Controller or that may be brought against the Data Controller. Unless a specific regulation provides otherwise the limitation period is six years, whereas for claims concerning periodical performances and claims connected with conducting business activity – three years.
4. The Data Controller may collect additional User information, including, in particular: a User’s computer IP address, the IP address of the internet provider, domain name, browser type, duration of a visit, operating system.
5. If the Data Subject has given a separate consent to such processing (Article 6 (1) (a) GDPR) their personal data may be processed for the purpose of sending electronic marketing messages or for direct marketing via telephone – in accordance with Article 10 section 2 of the Act on the Provision of Electronic Services of 18 July 2002 or Article 172, section 1 of the Telecommunications Law Act of 16 July 2004, including profiled marketing communications if the Data Subject has consented to receive such communications.
6. The Data Controller may collect navigational data, including links and references followed by the User or information about the User’s activity on the Website. The legal basis for such processing is the legitimate interest of the Data Controller (Article 6 (1) (f) of the GDPR), insofar as this data is used to provide an easier access to the electronic services rendered via the Website and to facilitate the functionality of these services.
7. Submitting personal data to shop.ch24.pl is voluntary.
8. The personal data collected via the Website is subject to automatic processing through profiling if the data subject has consented to such processing (Article 6 (1) (a) of the GDPR). As a result of profiling a profile is built of each data subject which enables the Data Controller to take decisions concerning Users as well as to analyse or predict their personal preferences, behaviours and attitudes.
9. The Data Controller shall take all reasonable steps to protect the interests of data subjects and ensure that all data is:
   a) lawfully processed,
   b) obtained only for specified, lawful purposes, and not further processed in any manner incompatible with those purposes,
   c) factually correct, adequate and relevant in relation to the purposes for which it is processed; stored in a form that permits identification of the data subject, for no longer than is necessary for those purposes.

§ 3
THIRD PARTY ACCESS TO PERSONAL INFORMATION

1. 1. Users’ personal information is shared with third party services providers to enable the Service Provider to run his business via icoalyou.com. Depending on contractual arrangements and circumstances, those third-party services providers either process personal data on the Data Controller’s instructions (processors) or themselves determine the purposes for which and the manner in which personal data is processed (controllers).
2. The Users’ personal data is stored only within the European Economic Area (EEA).

§ 4
RIGHT OF CONTROLL, ACCESS AND RECTIFICATION

1. Every User has a right to access and/or rectify his personal data as well as the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
2. Legal basis for data subjects’ rights:
   a) Access to personal data – Article 15 of the GDPR
   b) Rectification of personal data – Article 16 of the GDPR,
   c) Erasure of personal data (right to be forgotten) – Article 17 of the GDPR,
   d) Restriction of data processing – Article 18 of the GDPR,
   e) Data portability – Article 20 of the GDPR,
   f) Objection to processing – Article 21 of the GDPR,
   g) Withdrawal of consent to processing – Article 7 (3) of the GDPR.
3. The User may exercise his rights under point 2 by sending an email message to: [email protected].
4. If any request is received in relation to a data subject’s rights, the Data Controller must comply with or refuse to act on a User’s request without delay but not later than within a month of receiving the request. However, if a request is complex or if the Data Controller receives more requests, the Data Controller may extend the time to respond by a further two months. If this is the case the Data Controller shall inform the User within one month of receiving their request and explain why the extension is necessary.
5. If the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the GDPR, the data subject may make a complaint to the President of the Personal Data Protection Office.

§ 5
COOKIE POLICY

1. Shop.ch24.pl uses cookies.
2. Cookies are essential for the provision of electronic services via the Shop. Cookies, contain information that is necessary for the proper functioning of the Shop and for the statistical analysis of website traffic.
3. The website uses two types of cookies: “session” cookies and “persistent” cookies.
   a) “Session” cookies are temporary files which are stored on the User’s end-device until they log out (leave the website).
   b) “Persistent” cookies remain stored on the User’s device until deleted manually or automatically after a set period of time.
4. The Data Controller uses their own cookies to provide information on how individual Users interact with the Website. These files collect information about how Users use the website, what type of website referred the User to icoalyou.com, the frequency of visits and the time of each visit. This information does not register the Users’ personal data and is used solely for statistical analysis of website traffic.
5. The Data Controller uses third party cookies for the purpose of collecting general and anonymous static data by means of Google Analytics, a web analysis tool (Data controller for third party cookies: Google Inc. based in USA).
6. Cookies may also be used by advertising networks, in particular the Google network, to display ads tailored to the manner in which the Service Recipient uses the Store. For this purpose, they may keep information about the Service Recipient’s navigation path or time spent on a given page.
7. The User can adjust cookie permissions via options in their browser settings. More detailed information about cookie management with specific web browsers can be found in the browsers’ respective settings.

§ 6
ADDITIONAL SERVICES RELATED TO THE USER’S ACTIVITY IN THE STORE

1. The Store uses so-called social plugins (“plugins”) of social networking sites. By displaying the website www.shop.ch24.pl containing such a plug-in, the Service Recipient’s browser will establish a direct connection with the servers Facebook, Pinterest and Twitter.
2. The content of the plug-in is forwarded by the given service provider directly to the Service Recipient’s browser and integrated with the website. Thanks to this integration, service providers receive information that the Service Recipient’s browser has displayed the website www.shop.ch24.pl, even if the Service Recipient does not have a profile with the given service provider or is not currently logged in to him. Such information (together with the Service Recipient’s IP address) is sent by the browser directly to the server of the given service provider (some servers are located in the USA) and stored there.
3. If the Service Recipient logs in to one of the above social networking sites, the service provider will be able to directly assign the visit to www.shop.ch24.pl to the Service Recipient’s profile on the given social networking site.
4. If the Service Recipient uses a given plug-in, e.g. by clicking on the “Like” button or the “Share” button, the relevant information will also be sent directly to the server of the given service provider and stored there.
5. The purpose and scope of data collection and their further processing and use by service providers, as well as the possibility of contact and the Service Recipient’s rights in this regard and the possibility of making settings that ensure the protection of the Service Recipient’s privacy are described in the privacy policy of service providers:
   https://www.facebook.com/policy.php
   https://policy.pinterest.com/pl/privacy-policy
   https://help.twitter.com/en/rules-and-policies
   https://policies.google.com/privacy?hl=pl&gl=ZZ.
6. If the Service Recipient does not want social networking services to assign data collected during visits to www.shop.ch24.pl directly to his profile on a given website, he must log out of this website before visiting www.shop.ch24.pl. The Service Recipient may also completely prevent the plugins from loading on the page by using the appropriate browser extensions, e.g. blocking scripts using “NoScript”.

§ 7
FINAL PROVISIONS

1. The Data Controller shall implement all necessary technical and organisational security measures to safeguard the data during processing ensuring a level of security appropriate to the nature of the data to be protected and, in particular, protect the data against unauthorised access, takeover, processing in violation of law, alteration, loss, damage or destruction.
2. The Service Provider shall take appropriate technical measures to safeguard the electronic personal data against unauthorised interception or modification.
3. In cases not provided for in this Privacy Policy the relevant provisions of the GDPR shall apply as well as applicable provisions of Polish law.