Privacy policy

1
GENERAL PROVISIONS

  1. The controller of personal data collected through the online Store at www.carlamoreno.pl is Michał Ławecki, conducting business under the name Michał Ławecki CARLA MORENO, entered in the Central Registration and Information on Business of the Republic of Poland, maintained by the minister responsible for economic affairs. The place of business and address for correspondence is ul. Bursaki 6, 20-150 Lublin; tax identification number (NIP): 9462672827; business registration number (REGON): 368177041; email address: carlamorenocollection@gmail.com. Hereinafter referred to as the “Controller”, this entity is also the “Service Provider”.
  2. Personal data collected by the Controller through the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
  3. All capitalised words and expressions in this Privacy Policy have the meanings given to them in the Terms and Conditions of the online Store at www.carlamoreno.pl.

2
TYPES OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

  1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes the personal data of Service Users of the Store at www.carlamoreno.pl when they:
    1. register an Account in the Store, for the purpose of creating and managing an individual Account, pursuant to Article 6(1)(b) GDPR (performance of a contract for the provision of electronic services in accordance with the Store Terms and Conditions);
    2. place an order in the Store, for the purpose of performing the sales contract, pursuant to Article 6(1)(b) GDPR (performance of the sales contract).
  2. TYPES OF PERSONAL DATA PROCESSED. In the case of:
    1. an Account, the Service User provides:
      • first name and surname;
      • username;
      • address;
      • email address.
    2. an Order, the Service User provides:
      • first name and surname;
      • residential address;
      • tax identification number (NIP);
      • email address;
      • telephone number.
  3. PERSONAL DATA RETENTION PERIOD. The Controller retains Service Users' personal data:
    1. where the basis for processing is the performance of a contract, for as long as necessary to perform that contract and subsequently for a period corresponding to the limitation period for claims. Unless a specific provision states otherwise, the limitation period is six years, or three years for claims concerning recurring payments and claims connected with conducting business;
    2. where the basis for processing is consent, until that consent is withdrawn and, following withdrawal, for a period corresponding to the limitation period for claims that may be brought by or against the Controller. Unless a specific provision states otherwise, the limitation period is six years, or three years for claims concerning recurring payments and claims connected with conducting business.
  4. Additional information may be collected when the Store is used, including in particular the IP address assigned to the Service User's computer or the external IP address of the internet service provider, domain name, browser type, access time and operating system type.
  5. Following separate consent, data may also be processed pursuant to Article 6(1)(a) GDPR for sending commercial information electronically or making telephone calls for direct marketing purposes, in connection respectively with Article 10(2) of the Act of 18 July 2002 on the Provision of Electronic Services or Article 172(1) of the Telecommunications Law Act of 16 July 2004. This includes communications targeted as a result of profiling, provided that the Service User has given the appropriate consent.
  6. Navigation data may also be collected from Service Users, including information about links they choose to click and other actions taken in the Store. The legal basis for these activities is the Controller's legitimate interest under Article 6(1)(f) GDPR in facilitating the use of electronic services and improving their functionality.
  7. Providing personal data is voluntary for the Service User.
  8. The Controller takes particular care to protect the interests of data subjects and, in particular, ensures that the data collected is:
    1. processed lawfully;
    2. collected for specified, lawful purposes and not subsequently processed in a manner incompatible with those purposes;
    3. accurate and adequate in relation to the purposes for which it is processed, and stored in a form permitting identification of the persons concerned for no longer than necessary to achieve the purpose of processing.

3
DISCLOSURE OF PERSONAL DATA

  1. Service Users' personal data is disclosed to service providers used by the Controller in operating the Store, in particular:
    1. entities delivering Products;
    2. payment system providers;
    3. the accounting firm;
    4. the hosting provider;
    5. providers of software used to conduct business, such as accounting software;
    6. entities providing the mailing system;
    7. the provider of software required to operate the online Store.
  2. Depending on the contractual arrangements and circumstances, the service providers referred to in clause 1 of this section that receive personal data either act on the Controller's instructions concerning the purposes and means of processing that data (processors) or determine those purposes and means independently (controllers).
  3. Service Users' personal data is stored exclusively within the European Economic Area (EEA), subject to §5 clause 5 and §6 of this Privacy Policy.

4
RIGHTS TO CONTROL, ACCESS AND RECTIFY PERSONAL DATA

  1. Data subjects have the right to access their personal data and the rights to rectification, erasure, restriction of processing, data portability and objection. They also have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  2. The legal bases for a Service User's requests are:
    1. Access to data — Article 15 GDPR.
    2. Rectification of data — Article 16 GDPR.
    3. Erasure of data, also known as the right to be forgotten — Article 17 GDPR.
    4. Restriction of processing — Article 18 GDPR.
    5. Data portability — Article 20 GDPR.
    6. Objection — Article 21 GDPR.
    7. Withdrawal of consent — Article 7(3) GDPR.
  3. To exercise the rights referred to in clause 2, an appropriate email may be sent to carlamorenocollection@gmail.com.
  4. When a Service User requests to exercise any of the rights above, the Controller will comply with the request or refuse to comply without delay and no later than one month after receiving it. If, because of the complexity or number of requests, the Controller cannot comply within one month, it will do so within the following two months, having informed the Service User within one month of receiving the request of the intended extension and its reasons.
  5. If a data subject considers that the processing of personal data infringes the GDPR, they have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.

5
COOKIES

  1. The Controller's website uses cookies.
  2. The installation of cookies is necessary for the proper provision of services on the Store's website. Cookies contain information needed for the website to function correctly and also enable general website visit statistics to be compiled.
  3. Two types of cookies are used on the website: session cookies and persistent cookies.
    1. Session cookies are temporary files stored on the Service User's device until they log out or leave the website.
    2. Persistent cookies are stored on the Service User's device for the period specified in the cookie parameters or until deleted by the Service User.
  4. The Controller uses its own cookies to better understand how Service Users interact with the website's content. These files collect information about how a Service User uses the website, the type of page from which they were redirected, and the number and duration of their visits. This information does not record specific personal data of the Service User but is used to compile website usage statistics.
  5. The Controller uses third-party cookies to collect general, anonymous statistical data through Google Analytics tools. The controller of these third-party cookies is Google Inc., based in the USA.
  6. Cookies may also be used by advertising networks, particularly Google's network, to display advertisements tailored to how the Service User uses the Store. For this purpose, they may retain information about the Service User's navigation path or the time spent on a particular page.
  7. The Service User has the right to decide whether cookies may access their computer by selecting the relevant options in their browser beforehand. Detailed information about cookie management options and methods is available in the software settings of the web browser.

6
ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

  1. The Store uses social media plugins. When displaying a page at www.carlamoreno.pl that contains such a plugin, the Service User's browser establishes a direct connection with the servers of Facebook, Instagram, Pinterest, Twitter or YouTube.
  2. The plugin content is sent by the relevant service provider directly to the Service User's browser and integrated into the page. Through this integration, service providers receive information that the Service User's browser has displayed a page at www.carlamoreno.pl, even if the Service User does not have a profile with that provider or is not currently logged in. This information, together with the Service User's IP address, is transmitted by the browser directly to the relevant provider's server, some of which are located in the USA, and stored there.
  3. If the Service User logs in to one of these social networks, the provider can associate the visit to www.carlamoreno.pl directly with the Service User's profile on that network.
  4. If the Service User interacts with a plugin, for example by clicking the Like or Share button, the relevant information is also transmitted directly to the provider's server and stored there.
  5. The purposes and scope of data collection, subsequent processing and use by providers, contact options, the Service User's rights and the settings available to protect their privacy are described in the providers' privacy policies:
  6. If the Service User does not want social networks to associate data collected during a visit to www.carlamoreno.pl directly with their profile, they must log out of the relevant network before visiting the website. The Service User may also prevent plugins from loading altogether by using appropriate browser extensions, for example by blocking scripts with NoScript.
  7. The Controller uses remarketing tools on its website, namely Google AdWords, which involves the use of Google LLC cookies relating to the Google AdWords service. Within the cookie settings management mechanism, the Service User may decide whether the Service Provider may use Google AdWords in relation to them. The controller of these third-party cookies is Google Inc., based in the USA.

7
FINAL PROVISIONS

  1. The Controller applies technical and organisational measures to protect the personal data it processes in a manner appropriate to the risks and the categories of data concerned. In particular, it protects data against disclosure to unauthorised persons, removal by an unauthorised person, processing in breach of applicable law, and alteration, loss, damage or destruction.
  2. The Controller provides appropriate technical measures to prevent unauthorised persons from obtaining or modifying personal data transmitted electronically.
  3. Matters not governed by this Privacy Policy are subject, as appropriate, to the GDPR and other applicable provisions of Polish law.