I GENERAL PROVISIONS
Terms written with a capital letter and not defined below have the meaning assigned to them in the Terms of Service available at: https://bellamie-shop.pl/. This document specifies the rules for the processing and protection of personal data of the Website’s Customers available at https://bellamie-shop.pl (Privacy Policy).
The Personal Data Controller (Personal Data) of Customers – natural persons – and users (data subjects) of the Website is Bellamie Paweł Wójcik, ul. Hilarego Koprowskiego 9/1, 80-180 Gdańsk (which also serves as the address for service), NIP: 5833496944, REGON: 527234419.
Personal Data, as referred to in the Privacy Policy, are information about an identified or identifiable natural person to whom the data pertains, i.e., a person who can be directly or indirectly identified, in particular based on characteristics such as: name and surname, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of the natural person.
The Service Provider processes Personal Data of data subjects in accordance with applicable regulations, in particular Polish law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).
Processing, within the meaning of the Privacy Policy, refers to an operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, or consultation.
II SCOPE AND PURPOSE OF COLLECTED DATA
Personal Data is processed by the Controller on the Website to enable the use of the Website’s functionalities, including automatically during the use of the Website, for the purposes of:
- Registration on the Website;
- Entering into contracts through or available on the Website, in particular placing and fulfilling Orders;
- Efficient operation and functioning of the Website, including the Online Store, and ensuring the security of their use, including detecting abuses and conducting analyses;
- Fulfilling the Service Provider’s obligations, in particular those related to complaints concerning contracts concluded on or through the Website and the Website’s operation;
- Preparing and presenting advertisements and offers tailored to the interests and needs of data subjects, and receiving commercial information, in particular sending the Newsletter ordered by the Customer to the email address provided by the Customer;
- Publishing Content.
For the purpose of:
- Registration on the Website – the following Personal Data is processed: name and surname, email address, password, IP address, cookies;
- Entering into contracts through or available on the Website, in particular placing and fulfilling Orders – the following Personal Data is processed: name and surname, address (street, house number, city with postal code), contact phone number, order number, IP address, cookies, or other data provided by the Service Provider on the Website or during contact with the Customer;
- Efficient operation and functioning of the Website, including the Online Store, and ensuring the security of their use, including detecting abuses, generating reports and analyses, including statistics on the Website’s subpage views – the following Personal Data is processed: as listed in point II.2.b;
- Fulfilling the Service Provider’s obligations, in particular those related to complaints concerning contracts concluded on or through the Website and the Website’s operation – the following Personal Data is processed: name, surname, email, phone number, address (street, house number, city with postal code), IP address, cookies, bank account number;
- Publishing Content – the following Personal Data is processed: name, surname, email, nickname, IP address, cookies.
III LEGAL BASIS FOR PROCESSING PERSONAL DATA
The legal basis for processing Personal Data is:
- Consent of the data subject to the processing of their Personal Data;
- Necessity for the performance of contracts concluded on or through the Website, or to take steps at the request of the data subject prior to entering into a contract;
- Necessity to fulfill a legal obligation incumbent on the Service Provider;
- Legitimate interests pursued by the Service Provider or a third party, such as payment operators or other entities related to the Website’s functionalities, except that this basis for processing Personal Data does not apply to children.
In the case referred to in point III.1.a, Personal Data concerning children is processed only if the child is at least 16 years old.
IV PERSONAL DATA PROCESSING PERIOD
Personal Data collected on the Website will be stored for accounting purposes for a maximum period of 5 years, counting from the end of the calendar year in which the tax payment deadline related to a contract concluded on or through the Website expired. For other purposes justified by the processing objectives, Personal Data will be stored as long as there is a legal basis for their processing, unless applicable legal regulations require a longer retention period, e.g., for use in proceedings related to the Website’s operation. At the end of the retention period, Personal Data will be deleted or anonymized.
V VOLUNTARY PROVISION OF PERSONAL DATA
Providing Personal Data on the Website is voluntary but necessary to achieve one or more purposes of processing Personal Data as defined in point II.2 above, which the Service Provider will not be able to fulfill if Personal Data is not provided on the Website for one or more of the purposes defined in point II.2 above.
VI PROFILING OF PERSONAL DATA
Personal Data will be processed in an automated manner, including profiling, using information about purchases, activities in the Service Provider’s sales channels (computer IP, cookies, preferred purchase methods), and socio-demographic data (e.g., gender, age, place of residence) to tailor marketing information to individual preferences.
VII COOKIES
The Service Provider informs that during the use of the Website, Personal Data is also collected automatically in the Website’s system logs and through cookies.
The Service Provider informs that from the moment the Customer connects to the Website, information about the number (including IP) and type of the Customer’s end device used to connect to the Website is recorded in the Website’s system logs. The Service Provider processes, in accordance with the law, data concerning the number (including IP) and type of the Customer’s end device, as well as the time of connection to the Website and other operational data regarding the Customer’s activity on the Website. This data is processed for technical purposes to adapt the Website to the Customers’ needs and to collect general statistical information about the Website’s operation.
The Service Provider uses cookies to collect information related to the Customer’s use of the Website. Cookies are IT data, in particular small text files, saved and stored on devices through which the Customer uses the Website, enabling:
- Maintaining the Customer’s session (after logging in), so the Customer does not need to re-enter their login and password on every subpage of the Website;
- Adapting and optimizing the Website to the Customers’ needs;
- Personalizing marketing messages;
- Ensuring the security and reliability of the Website’s operation.
The Website uses session cookies, which are deleted after closing the browser window, and persistent cookies, which are stored for a specified period on the devices through which the Customer uses the Website.
The Customer can independently change cookie settings at any time, specifying the conditions for their storage and access to the Customer’s device. These settings can be changed, in particular, to block the automatic handling of cookies in the web browser settings or to inform about their placement on the Customer’s device. Detailed information about the possibilities and methods of handling cookies is available in the Customer’s software (web browser) settings.
The Customer can delete cookies at any time using the functions available in the web browser they use.
Restricting the use of cookies may affect some functionalities available on the Website.
The Website also uses cookies placed by the Service Provider’s partners to enable the personalization of advertising activities and the settlement of their effects. The Privacy Policy does not regulate the use of cookies by third parties. More information about them may be available on the respective websites of the Service Provider’s partners.
Some subpages of the Website and other means of communication with Customers may contain so-called “web beacons” (also known as electronic images or clear GIFs). Web beacons allow the collection of information such as the IP address of the computer on which the page with the web beacon was loaded, the URL of the page, the page load time, the browser type, and information contained in cookies to evaluate the effectiveness of advertisements.
VIII RIGHTS AND OBLIGATIONS OF THE SERVICE PROVIDER
The Service Provider reserves the right to disclose selected Personal Data to competent authorities or third parties who request such information based on an appropriate legal basis and in accordance with applicable law.
The Service Provider declares that it entrusts the processing of Personal Data, based on a written agreement concluded in accordance with applicable regulations, to entities providing hosting, administration, maintenance, and management services for the Website, as well as services related to the optimization of communication and management of promotional campaigns.
The Service Provider declares that it entrusts the processing of the Customer’s Personal Data to entities providing services necessary for the use of the Website, including the execution of contracts, in particular Orders, and handling complaints. The Customers’ Personal Data may be entrusted, in particular, to Product suppliers, banks, insurers, and financial and insurance institutions.
IX PROCESSING OF PERSONAL DATA BY PROCESSORS
Processors, within the meaning of the Privacy Policy, are the entities referred to in points VIII.2 and VIII.3, which process Personal Data on behalf of the Service Provider.
The Processor is authorized and entitled to process Personal Data only for the purposes and to the extent specified in the Privacy Policy.
Personal Data may be processed only in Poland, a Member State of the European Union (EU), or a signatory to the European Economic Area (EEA) Agreement.
The Processor processes the entrusted Personal Data in accordance with applicable legal regulations, in particular by:
- Applying legally required technical and organizational measures, particularly regarding the security of Personal Data processing;
- Applying measures ensuring: i) the ability to continuously ensure the confidentiality, integrity, availability, and resilience of processing systems and services; ii) the ability to quickly restore the availability of Personal Data and access to them in the event of a physical or technical incident; iii) regular testing, measuring, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing;
- Applying Personal Data security measures at a level not lower than that applied by the Service Provider.
The Processor may change, delete, or block processed Personal Data only upon the instruction of the Data Controller. If the data subject directly requests the Processor to change or delete their Personal Data, the Processor shall promptly, no later than within 5 working days, forward such a request to the Service Provider.
The Processor shall not process Personal Data for any purpose other than fulfilling the obligations specified in the Privacy Policy. The Processor may not disclose Personal Data to third parties.
The Processor is liable to the data subject for any damages that the data subject may incur as a result of the Processor’s actions or omissions.
X RIGHTS AND OBLIGATIONS OF THE DATA SUBJECT
Every Customer has the right to:
- Access their Personal Data, rectify it, delete it, and request the restriction of its processing;
- Object to the processing of Personal Data, withdraw consent to the processing of Personal Data for one or more purposes for which it was given, at any time without affecting the lawfulness of processing based on consent before its withdrawal, and the right to data portability.
To exercise the rights referred to in point X.1.a above, an email should be sent to: sklep@bellamie-shop.pl.
To exercise the rights referred to in point X.1.b above, an email should be sent to: sklep@bellamie-shop.pl with the subject line “objection” or “withdrawal of consent.”
If a Customer places any personal data of other persons (including their name, surname, address, phone number, or email) on the Website, they may do so only on the condition that they do not violate applicable legal regulations or the personal rights of those persons.
The Customer is entitled to use the Personal Data and content shared by other persons on the Website only in connection with the use of the Website and with their consent in a manner compliant with applicable legal regulations, unless they obtain consent from those persons to process their Personal Data and content to the extent or for purposes provided for in the Privacy Policy and beyond the use of the Website.
Every Customer has the right to lodge a complaint with the supervisory authority responsible for the protection of Personal Data.
XI PERSONAL DATA SECURITY
The Service Provider declares that it makes every effort to ensure a high level of security for Customers in the use of the Website and, to this end:
- Applies legally required technical and organizational measures, particularly regarding the security of Personal Data processing;
- Applies measures ensuring: i) the ability to continuously ensure the confidentiality, integrity, availability, and resilience of processing systems and services; ii) the ability to quickly restore the availability of Personal Data and access to them in the event of a physical or technical incident; iii) regular testing, measuring, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing.
Any incidents affecting the security of information transmission or data, including suspicions of sharing files containing viruses or other files of a similar nature or other destructive mechanisms, should be reported to the Service Provider at the email address: sklep@bellamie-shop.pl.
XII FINAL PROVISIONS
In matters not regulated by the Privacy Policy, the provisions of law regarding the processing of Personal Data, including the GDPR, shall apply.