Privacy Policy

PRIVACY POLICY OF THE ONLINE STORE

WWW.DENORA.PL

§ 1

GENERAL PROVISIONS

1. The controller of personal data collected via the online store www.denora.pl is Angelika Anna Michalska-Staniszewska, conducting business under the business name ASW Projekty ANGELIKA MICHALSKA-STANISZEWSKA, entered into the Central Registration and Information on Business of the Republic of Poland maintained by the minister responsible for the economy, place of business and service address: ul. Powstańców 24T/1, 05-091 Ząbki, Poland, Tax Identification Number (NIP): 1251703544, Business Registry Number (REGON): 385650811, e-mail address: hello@denora.pl, phone number: +48 513 281 705, hereinafter referred to as the "Controller" and simultaneously being the "Service Provider".
2. Personal data collected by the Controller via the website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
3. Any words or expressions written with a capital letter in this Privacy Policy shall be understood in accordance with their definition contained in the Terms and Conditions of the online store www.denora.pl.

§ 2

TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes the personal data of Service Users of the www.denora.pl store in the event of:
1.1. Account registration in the Store, for the purpose of creating an individual account and managing this Account, pursuant to Article 6(1)(b) of the GDPR (performance of a contract for the provision of services by electronic means in accordance with the Store Regulations),
1.2. placing an order in the Store, for the purpose of performing a sales contract, pursuant to Article 6(1)(b) of the GDPR (performance of a sales contract),
1.3. using the Contact Form, for the purpose of sending a message to the Controller, pursuant to Article 6(1)(f) of the GDPR (legitimate interest of the entrepreneur).
2. TYPE OF PERSONAL DATA PROCESSED. The Service User provides, in the case of:
2.1. Account: first and last name, date of birth, login, residential address, e-mail address.
2.2. Order: first and last name, date of birth, address, NIP (Tax ID), e-mail address, phone number.
2.3. Contact Form: first and last name, e-mail address, phone number.
3. PERSONAL DATA ARCHIVING PERIOD. The personal data of Service Users are stored by the Controller:
3.1. where the basis for processing is the performance of a contract, for as long as is necessary for the performance of the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a special provision states otherwise, the limitation period is six years, and for claims for periodic payments and claims related to the conduct of business activity - three years.
3.2. where the basis for processing is consent, for as long as the consent is not withdrawn, and after the withdrawal of consent for a period corresponding to the limitation period for claims that the Controller may raise or that may be raised against the Controller. Unless a special provision states otherwise, the limitation period is six years, and for claims for periodic payments and claims related to the conduct of business activity - three years.
4. While using the Store, additional information may be collected, in particular: the IP address assigned to the Service User's computer or the external IP address of the Internet provider, domain name, browser type, access time, type of operating system.
5. After giving separate consent, pursuant to Article 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial information by electronic means or making phone calls for direct marketing purposes – in accordance with Article 398(1) and (2) of the Act of 12 July 2024 - Electronic Communications Law, including those resulting from profiling, provided that the Service User has given their consent.
6. As part of the User's activity in the Store, profiling may occur, which aims to select appropriate advertising content to be directed to the User.
7. Profiling means any form of automated processing of personal data which consists of the use of personal data to evaluate certain personal factors of a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements. Profiling does not produce legal effects on the Service User nor does it significantly affect their situation in any other way. Its purpose is solely to better tailor marketing content and offers.
8. Navigation data may also be collected from Service Users, including information about links and references they decide to click or other actions taken in the Store. The legal basis for this type of activity is the Controller's legitimate interest (Article 6(1)(f) of the GDPR), consisting in facilitating the use of services provided by electronic means and improving the functionality of these services.
9. The provision of personal data by the Service User is voluntary.
10. The Controller exercises special care to protect the interests of the data subjects, and in particular ensures that the data collected by them are:
10.1. processed in accordance with the law,
10.2. collected for specified, lawful purposes and not subjected to further processing inconsistent with these purposes,
10.3. factually correct and adequate in relation to the purposes for which they are processed and stored in a form that allows for the identification of the data subjects for no longer than is necessary to achieve the purpose of processing.

§ 3

SHARING OF PERSONAL DATA

1. The personal data of Service Users are transferred to service providers used by the Controller in operating the Store, in particular to:
1.1. entities delivering the Products,

1.2. payment system providers,
1.3. the accounting office,
1.4. the hosting provider,
1.5. the provider of software necessary for conducting business activity,
1.6. entities providing the mailing system,
1.7. the provider of software needed for running the online store.
2. Service providers referred to in point 1 of this paragraph, to whom personal data is transferred, depending on contractual arrangements and circumstances, either act under the Controller's instructions as to the purposes and methods of processing this data (processors) or independently determine the purposes and methods of their processing (controllers).
3. The personal data of Service Users are stored exclusively within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.
4. Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the Controller's use of services from providers of analytical and marketing tools (e.g., Google LLC, Meta Platforms Inc.). The transfer of data takes place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Article 46(2)(c) of the GDPR.

§ 4

RIGHT TO CONTROL, ACCESS AND RECTIFY OWN DATA

1. The data subject has the right to access the content of their personal data and the right to rectify, erase, restrict processing, the right to data portability, the right to object, the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
2. Legal bases for the Service User's request:
2.1. Data access – Article 15 GDPR.
2.2. Rectification of data – Article 16 GDPR.
2.3. Erasure of data (the so-called right to be forgotten) – Article 17 GDPR.
2.4. Restriction of processing – Article 18 GDPR.
2.5. Data portability – Article 20 GDPR.
2.6. Objection – Article 21 GDPR.
2.7. Withdrawal of consent – Article 7(3) GDPR.
3. In order to exercise the rights referred to in point 2, a relevant e-mail message can be sent to the address: hello@denora.pl.
4. In the event of a Service User exercising a right resulting from the above, the Controller shall fulfill the request or refuse to fulfill it immediately, but no later than one month after its receipt. However, if – due to the complex nature of the request or the number of requests – the Controller is unable to fulfill the request within one month, they will fulfill it within the next two months, informing the Service User in advance – within one month of receiving the request – of the intended extension and the reasons for it.
5. In the event of a finding that the processing of personal data violates the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

§ 5
"COOKIES"

1. The Controller's website uses "cookies".
2. The installation of "cookies" is necessary for the proper provision of services on the Store's website. The "cookies" contain information necessary for the proper functioning of the website and also provide the ability to develop general statistics on website visits.
3. Two types of "cookies" are used on the website: "session" and "persistent".
3.1. "Session" "cookies" are temporary files that are stored on the Service User's terminal device until logging out (leaving the website).
3.2. "Persistent" "cookies" are stored on the Service User's terminal device for the time specified in the "cookies" parameters or until they are deleted by the Service User.
4. The Controller uses their own cookies to better understand how Service Users interact with the website content. The files collect information on how the Service User uses the website, the type of site from which the Service User was redirected, and the number of visits and time spent by the Service User on the website. This information does not record specific personal data of the Service User but is used to compile statistics on website usage.
5. The Controller also uses external cookies to collect general and anonymous static data via analytical tools Google Analytics (external cookie controller: Google LLC based in the USA).
6. Cookies may also be used by advertising networks, in particular the Google network, to display advertisements tailored to the way in which the Service User uses the Store. For this purpose, they may keep information about the Service User's navigation path or time spent on a given page.
7. The Service User has the right to decide on the access of "cookies" to their computer by:
7.1. selecting the types of cookies they consent to being collected immediately after entering the Store's page and the appearance of the cookie notice,
7.2. changing settings in their browser window. Detailed information on the possibilities and methods of handling "cookies" is also available in the software settings (web browser).

§ 6

ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

1. The Store uses so-called social plugins ("plugins") of social networking sites. By displaying the website www.denora.pl, which contains such a plugin, the Service User's browser will establish a direct connection with the Instagram server.
2. The content of the plugin is transmitted by the respective service provider directly to the Service User's browser and integrated with the website. Through this integration, service providers receive information that the Service User's browser has displayed the website www.denora.pl, even if the User does not have a profile with the service provider or is not currently logged in. Such information (including the Service User's IP address) is transmitted by the browser directly to the server of the service provider (some servers are located in the USA) and stored there.

3. If the Service User logs into one of the above social networking sites, this service provider will be able to directly assign the visit to the website www.denora.pl to the User's profile on that social networking site.
4. If the Service User uses a given plugin, e.g., by clicking the "Like" button or the "Share" button, the relevant information will also be sent directly to the service provider's server and saved there.
5. The purpose and scope of data collection and their further processing and use by service providers, as well as the possibility of contact and the Service User's rights in this regard and the possibility of making settings ensuring the protection of the Service User's privacy, are described in the service providers' privacy policies:
5.1. https://help.instagram.com/519522125107875?helpref=page_content
6. If the Service User does not want social networking sites to assign data collected during visits to the website www.denora.pl directly to their profile on a given site, they must log out of that site before visiting the website www.denora.pl. The Service User may also completely prevent the loading of plugins on the website by using appropriate browser extensions, e.g., blocking scripts with "NoScript".
7. The Controller uses remarketing tools on their website, i.e., Google AdWords; this involves the use of cookies from Google LLC regarding the Google AdWords service. Within the mechanism for managing cookie settings, the Service User has the possibility to decide whether the Service Provider will be able to use Google AdWords (external cookie controller: Google Inc. based in the USA) in relation to them.

§ 7

FINAL PROVISIONS

1. The Controller applies technical and organizational measures ensuring the protection of the processed personal data appropriate to the risks and categories of data covered by protection, and in particular secures data against access by unauthorized persons, removal by an unauthorized person, processing in violation of applicable regulations, and alteration, loss, damage, or destruction.
2. The Controller provides appropriate technical measures to prevent the acquisition and modification by unauthorized persons of personal data transmitted by electronic means.
3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply accordingly.
4. The Controller updates this Privacy Policy in connection with legal changes or the development of business activities. Information about the modification of the Privacy Policy will be posted at least 7 days before its entry into force on the Store's website or sent via e-mail to the Service User who uses the Electronic Services provided on a continuous basis (Account).