PRIVACY POLICY OF THE ONLINE SHOP
WWW.CLEANCHIMNEY.EU
§ 1
GENERAL PROVISIONS
1. The data controller for the personal data collected via the online shop www.cleanchimney.eu is Firma Handlowo-Usługowa Krzysztof Burdzań, place of business and address for service: ul. Studenta Henryka Żelezika 13, 23-400 Biłgoraj, VAT ID No.: PL9181662234, REGON: 950360289, email address: info@cleanchimney.eu, telephone number: +48 506 895 758, hereinafter referred to as the "Controller" and at the same time the "Service Provider".
2. The personal data collected by the Controller via the website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR.
3. Any words or expressions written with a capital letter in the content of this Privacy Policy are to be understood in accordance with their definition in the Terms and Conditions of the online shop www.cleanchimney.eu.
§ 2
TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION
1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data of the users of the shop www.cleanchimney.eu in the case of:
1.1. registering an account in the shop, for the purpose of creating an individual account and managing this account, on the basis of Art. 6 (1) (b) GDPR (performance of a contract for the provision of electronic services in accordance with the Terms and Conditions of the shop),
1.2. placing an order in the shop, for the purpose of performing the sales contract, on the basis of Art. 6 (1) (b) GDPR (performance of the sales contract).
1.3. using the contact form, for the purpose of sending a message to the Controller, on the basis of Art. 6 (1) (f) GDPR (legitimate interest of the entrepreneur).
2. TYPE OF PERSONAL DATA PROCESSED. The user provides, in the case of:
2.1. Account: first name and surname, login, address, email address.
2.2. Order: first name and surname, address, VAT ID number, email address, telephone number.
2.3. Contact form: first name, email address.
3. RETENTION PERIOD OF PERSONAL DATA. The personal data of users will be stored by the Controller:
3.1. where the basis for data processing is the performance of a contract – for as long as is necessary for the performance of the contract, and thereafter for a period corresponding to the statute of limitations for claims. Unless a specific provision stipulates otherwise, the limitation period is six years, and for claims regarding periodic benefits and claims connected with the conduct of business activity – three years.
3.2. where the basis for data processing is consent – until consent is withdrawn, and after withdrawal of consent for a period corresponding to the statute of limitations for claims that may be asserted by the Controller or against him. Unless a specific provision stipulates otherwise, the limitation period is six years, and for claims regarding periodic benefits and claims connected with the conduct of business activity – three years.
4. While using the shop, additional information may be collected, in particular: the IP address assigned to the user's computer or the external IP address of the internet service provider, the domain name, the type of browser, the access time, and the type of operating system.
5. Following the granting of separate consent, personal data may be processed on the basis of Art. 6 (1) (a) GDPR for the purpose of sending commercial information by electronic means or for making telephone calls for direct marketing purposes, in accordance with the applicable laws regarding electronic communications and direct marketing in the respective Member State of the European Union, including on the basis of profiling, provided that the user has granted corresponding consent.
6. Navigation data may also be collected from users, including information about links and references they click on or other actions taken in the shop. The legal basis for this type of activity is the legitimate interest of the Controller (Art. 6 (1) (f) GDPR), which consists in facilitating the use of services provided by electronic means and improving the functionality of these services.
7. The provision of personal data by the user is voluntary.
8. The Controller exercises special care to protect the interests of the data subjects, and in particular ensures that the data collected by him are:
8.1. processed lawfully,
8.2. collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes,
8.3. factually correct and adequate in relation to the purposes for which they are processed, and stored in a form which permits identification of data subjects for no longer than is necessary for the purposes of the processing.
§ 3
DISCLOSURE OF PERSONAL DATA
1. The personal data of users will be transferred to service providers whose services the Controller uses in operating the shop, in particular to:
1.1. entities carrying out the delivery of products,
1.2. payment system providers,
1.3. the accounting office,
1.4. the hosting provider,
1.5. the provider of software that enables business operations,
1.6. entities providing a mailing system,
1.7. the provider of the software necessary for running the online shop.
2. The service providers referred to in point 1 of this paragraph, to whom personal data are transferred, are subject – depending on contractual arrangements and circumstances – either to the instructions of the Controller regarding the purposes and methods of processing this data (processors) or determine independently the purposes and methods of their processing (controllers).
3. The personal data of users will be stored exclusively within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.
§ 4
RIGHT OF CONTROL, ACCESS TO OWN DATA AND RECTIFICATION
1. The data subject has the right of access to the content of their personal data, as well as the right to rectification, erasure, restriction of processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
2. Legal bases for the user's requests:
2.1. Access to data – Art. 15 GDPR.
2.2. Rectification of data – Art. 16 GDPR.
2.3. Erasure of data (the so-called right to be forgotten) – Art. 17 GDPR.
2.4. Restriction of processing – Art. 18 GDPR.
2.5. Data portability – Art. 20 GDPR.
2.6. Objection – Art. 21 GDPR.
2.7. Withdrawal of consent – Art. 7 (3) GDPR.
3. In order to exercise the rights referred to in point 2, a corresponding email can be sent to the following address: info@cleanchimney.eu
4. If the user makes use of the entitlements resulting from the aforementioned rights, the Controller shall comply with the request or refuse to comply with it without delay, but no later than within one month of receiving it. However, if – due to the complexity of the request or the number of requests – the Controller is unable to comply with the request within one month, he will comply with it within the following two months and inform the user of the intended extension of the deadline and the reasons for it within one month of receiving the request.
5. If it is determined that the processing of personal data violates the provisions of the GDPR, the data subject has the right to lodge a complaint with the Data Protection Commission (DPC).
§ 5
"COOKIES"
1. The Controller's website uses "cookies".
2. The installation of necessary cookies is essential for the proper provision of services on the shop's website. Cookies contain information necessary for the proper functioning of the website; they also enable the generation of general statistics on website visits.
3. Two types of cookies are used within the website: "session cookies" and "persistent cookies".
3.1. "Session cookies" are temporary files stored on the user's terminal device until logging out (leaving the website).
3.2. "Persistent cookies" are stored on the user's terminal device for the time specified in the cookie parameters or until they are deleted by the user.
4. The Controller uses first-party cookies to better understand how users interact with the content of the website. The files collect information on the way the user uses the website, the type of website from which the user was redirected, as well as the number of visits and the duration of the user's stay on the website. This information does not record specific personal data of the user, but serves to compile statistics on the use of the website.
5. The Controller uses third-party cookies to collect general and anonymous statistical data using the analysis tools of Google Analytics (controller of third-party cookies: Google LLC based in the USA).
6. Cookies may also be used by advertising networks, in particular the Google network, to display advertisements tailored to the way the user uses the shop. For this purpose, information about the user's navigation path or the time spent on a particular page may be stored.
7. The user has the right to decide on the access of cookies to their computer by selecting them beforehand in their browser window. Detailed information on the options and methods of managing cookies is available in the settings of the software (web browser).
§ 6
ADDITIONAL SERVICES RELATED TO THE USER'S ACTIVITY IN THE SHOP
1. So-called social media plugins ("plugins") of social networks are used in the shop. When viewing the website www.cleanchimney.eu, which contains such a plugin, the user's browser establishes a direct connection to the servers of Facebook, Instagram, YouTube and Twitter. The use of social media plugins may involve the processing of personal data and the use of cookies solely on the basis of the user's consent.
2. The content of the plugin is transmitted directly by the respective service provider to the user's browser and integrated into the website. Thanks to this integration, the service providers receive information that the user's browser has displayed the website www.cleanchimney.eu, even if the user does not have a profile with the respective service provider or is not currently logged in there. This information (together with the user's IP address) is transmitted directly from the browser to the server of the respective service provider (some servers are located in the USA) and stored there.
3. If the user is logged into one of the aforementioned social networks, the respective service provider can directly assign the visit to the website www.cleanchimney.eu to the user's profile in the respective social network.
4. If the user uses a specific plugin, e.g. by clicking the "Like" button or the "Share" button, the corresponding information is also transmitted directly to the server of the respective service provider and stored there.
5. The purpose and scope of data collection, as well as its further processing and use by the service providers, along with the contact options and the user's rights in this regard and the possibility of configuring settings to protect the user's privacy, are described in the privacy policies of the service providers:
5.1. https://www.facebook.com/policy.php
5.2. https://help.instagram.com/519522125107875?helpref=page_content
5.3. https://help.twitter.com/en/rules-and-policies
6. If the user does not want social networks to assign the data collected during the visit to the website www.cleanchimney.eu directly to their profile in the respective network, they must log out of that network before visiting the website www.cleanchimney.eu. The user can also completely prevent the loading of plugins on the website by using appropriate extensions for the browser, e.g. blocking scripts using "NoScript".
7. The Controller uses remarketing tools on his website, namely Google Ads. This involves the use of cookies from Google LLC in connection with the Google Ads service. Within the mechanism for managing cookie settings, the user has the option to decide whether the service provider may use Google Ads (controller of third-party cookies: Google LLC based in the USA) in relation to them.
§ 7
FINAL PROVISIONS
1. The Controller applies technical and organisational measures ensuring protection of the processed personal data appropriate to the risks and the category of data protected. In particular, he protects the data against disclosure to unauthorised persons, removal by an unauthorised person, processing in violation of applicable regulations, as well as alteration, loss, damage or destruction.
2. The Controller provides appropriate technical measures to prevent unauthorised persons from acquiring or modifying personal data transmitted electronically.
3. In matters not regulated by this Privacy Policy, the provisions of the GDPR as well as other relevant legal provisions of the European Union and – where applicable – the national legal provisions of the Member States of the European Union shall apply.