Privacy Policy

1. DEFINITIONS

1.1. Controller – The personal data controller is F.P. LEATHER FRANCISZEK PĘKSA, registered office: Ul. Podtatrzańska 46, 34-431 Waksmund, NIP: 7351003915 REGON: 492036258.

1.2. Personal Data – all information about an identified or identifiable natural person by reference to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, including the device’s IP address, location data, online identifier, and information collected through cookies and similar technologies.

1.3. Policy – this Privacy Policy.

1.4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. To the extent not regulated by the Regulation, the processing of personal data is governed by the Personal Data Protection Act of 10 May 2018.

1.5. Service – the website operated by the Controller at www.fpkozuchy.pl.

1.6. User – any natural person visiting the Service or using one or more services or functionalities described in the Policy.

2. DATA PROCESSING IN CONNECTION WITH THE USE OF THE SERVICE

2.1. In connection with the User’s use of the Service, the Controller collects data to the extent necessary to provide specific services offered, as well as information about the User’s activity within the Service. The detailed rules and purposes of processing personal data collected during the User’s use of the Service are described below.

3. PURPOSES AND LEGAL BASES FOR DATA PROCESSING IN THE SERVICE

USE OF THE SERVICE www.fpkozuchy.pl

3.1. Personal data of all persons using the Service (including IP address or other identifiers and information collected through cookies or other similar technologies), who are not registered Users (i.e., persons without a profile in the Service) are processed by the Controller for the following purposes:

3.1.1. to provide electronic services by making available to Users the content collected in the Service and providing contact forms – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR);

3.1.2. to handle purchases made without registration in the Service – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR);

3.1.3. to handle complaints – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR);

3.1.4. for analytical and statistical purposes – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of analyzing Users’ activity and preferences in order to improve the functionalities used and the services provided;

3.1.5. to establish and pursue possible claims or defend against them – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of protecting its rights;

3.1.6. for the Controller’s and other entities’ marketing purposes, in particular related to the presentation of behavioral advertising – the rules for processing personal data for marketing purposes are described in the “MARKETING” section.

The User’s activity in the Service, including their personal data, is recorded in system logs (a special computer program used to store a chronological record containing information on events and actions related to the IT system used to provide services by the Controller). The information collected in the logs is processed in connection with the provision of services. The Controller also processes it for technical purposes; in particular, data may be temporarily stored and processed to ensure the security and correct functioning of IT systems, e.g., in connection with making backups, testing changes in IT systems, detecting irregularities, or protection against abuse and attacks.

REGISTRATION IN THE SERVICE www.fpkozuchy.pl

3.2. Persons who register in the Service are asked to provide data necessary to create and manage an account. To facilitate service, the User may provide additional data, thereby giving consent to its processing. Such data may be deleted at any time. Providing data marked as mandatory is required to create and manage the account, and failure to provide it will result in the inability to create an account. Providing other data is optional.

3.3. Personal data is processed:

3.3.1. to provide services related to maintaining and operating the account in the Service – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR), and with respect to data provided optionally – the legal basis is consent (Article 6(1)(a) GDPR);

3.3.2. for analytical and statistical purposes – the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of analyzing Users’ activity in the Service and their use of the account, as well as their preferences, in order to improve the functionalities used;

3.3.3. to establish and pursue possible claims or defend against them – the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of protecting its rights;

3.3.4. for the Controller’s and other entities’ marketing purposes – the rules for processing personal data for marketing purposes are described in the “MARKETING” section.

3.4. If the User places any personal data of other persons in the Service (including their name and surname, address, telephone number, or e-mail address), this may be done only on condition that the applicable law and the personal rights of those persons are not violated.

PLACING ORDERS

3.5. Placing an order (purchase of goods or services) by the User of the Service involves the processing of their personal data. Providing data marked as mandatory is required to accept and process the order, and failure to provide it will result in the inability to process the order. Providing other data is optional.

3.6. Personal data is processed:

3.6.1. to perform the placed order – the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR); with respect to data provided optionally, the legal basis is consent (Article 6(1)(a) GDPR);

3.6.2. to fulfill statutory obligations incumbent on the Controller, arising in particular from tax regulations and accounting regulations – the legal basis for processing is a legal obligation (Article 6(1)(c) GDPR);

3.6.3. for analytical and statistical purposes – the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of analyzing Users’ activity in the Service, as well as their purchasing preferences, in order to improve the functionalities used;

3.6.4. to establish and pursue possible claims or defend against them – the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of protecting its rights.

CONTACT FORMS

3.7. The Controller provides the possibility of contacting them using electronic contact forms. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide other data to facilitate contact or handling of the inquiry. Providing data marked as mandatory is required to accept and handle the inquiry, and failure to provide it will result in the inability to process it. Providing other data is voluntary.

3.8. Personal data is processed:

3.8.1. to identify the sender and handle their inquiry submitted via the provided form – the legal basis for processing is the necessity of processing for the performance of a service contract (Article 6(1)(b) GDPR);

3.8.2. for analytical and statistical purposes – the legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) consisting of compiling statistics of inquiries submitted by Users through the Service to improve its functionalities.

4. MARKETING

4.1. The Controller processes Users’ personal data for the purpose of carrying out marketing activities, which may consist of:

4.1.1. displaying marketing content to the User that is not tailored to their preferences (contextual advertising);

4.1.2. displaying marketing content to the User that matches their interests (behavioral advertising);

4.1.3. sending e-mail notifications about offers or content of interest, which in some cases contain commercial information;

4.1.4. conducting other types of activities related to direct marketing of goods and services (sending commercial information by electronic means and telemarketing activities).

4.2. To carry out marketing activities, the Controller in some cases uses profiling. This means that, through automated data processing, the Controller assesses selected factors concerning natural persons in order to analyze their behavior or create forecasts for the future.

CONTEXTUAL ADVERTISING

4.3. The Controller processes Users’ personal data for marketing purposes in connection with directing contextual advertising to Users (i.e., advertising that is not tailored to the User’s preferences). The legal basis for processing personal data is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

BEHAVIORAL ADVERTISING

4.4. The Controller processes Users’ personal data, including personal data collected through cookies and other similar technologies, for marketing purposes in connection with directing behavioral advertising to Users (i.e., advertising that is tailored to the User’s preferences). The processing of personal data then also includes profiling of Users. The use of personal data collected through this technology for marketing purposes, in particular for promoting services and goods of third parties, is carried out on the basis of the Controller’s legitimate interest and only provided that the User has consented to the use of cookies. Consent to the use of cookies may be expressed through appropriate browser settings and may be withdrawn at any time, in particular by clearing the cookies history and disabling cookies in the browser settings.

4.5. This consent may be withdrawn at any time.

DIRECT MARKETING

4.6. If the User has consented to receive marketing information via e-mail, SMS and other means of electronic communication, the User’s personal data will be processed for the purpose of sending such information. The legal basis for processing is the Controller’s legitimate interest consisting of sending marketing information within the scope of the User’s consent (direct marketing). The User has the right to object to the processing of data for direct marketing purposes, including profiling. The data will be stored for this purpose for the duration of the Controller’s legitimate interest, unless the User objects to receiving marketing information.

5. COOKIES AND SIMILAR TECHNOLOGY

5.1. Cookies are small text files installed on the User’s device browsing the Service. Cookies collect information that facilitates the use of the website – e.g., by remembering the User’s visits to the Service and the actions they perform.

6. “SERVICE” COOKIES

The Controller uses so-called service cookies primarily to provide the User with electronic services and to improve the quality of those services. In connection with this, the Controller and other entities providing analytical and statistical services for the Controller use cookies by storing information or gaining access to information already stored in the User’s terminal telecommunications device (computer, phone, tablet, etc.). Cookies used for this purpose include:

6.1. cookies with data entered by the User (session identifier) for the duration of the session (user input cookies);

6.2. authentication cookies used for services requiring authentication for the duration of the session (authentication cookies);

6.3. cookies used for security purposes, e.g., used to detect authentication abuses (user-centric security cookies);

6.4. session cookies of multimedia players (e.g., flash player cookies) for the duration of the session (multimedia player session cookies);

6.5. persistent cookies used to personalize the User interface for the duration of the session or slightly longer (user interface customization cookies);

6.6. cookies used to remember the contents of the shopping cart for the duration of the session (shopping cart cookies);

6.7. cookies used to monitor website traffic, i.e., data analytics, including Google Analytics cookies (these are files used by Google to analyze how the User uses the Service, to create statistics and reports regarding the functioning of the Service). Google does not use the collected data to identify the User and does not combine this information to enable identification. Detailed information on the scope and rules of data collection in connection with this service can be found at: https://www.google.com/intl/pl/policies/privacy/partners.

7. “MARKETING” COOKIES

The Controller also uses cookies for marketing purposes, including in connection with directing behavioral advertising to Users. For this purpose, the Controller stores information or gains access to information already stored in the User’s terminal telecommunications device (computer, phone, tablet, etc.). The use of cookies and personal data collected through them for marketing purposes, in particular for promoting services and goods of third parties, requires the User’s consent. This consent may be expressed through appropriate browser settings and may be withdrawn at any time, in particular by clearing the cookies history and disabling cookies in the browser settings.

8. PERIOD OF PERSONAL DATA PROCESSING

8.1. The period of data processing by the Controller depends on the type of service provided and the purpose of processing. As a rule, data is processed for the time of providing the service or fulfilling the order, until the consent given is withdrawn, or an effective objection to data processing is lodged in cases where the legal basis for data processing is the Controller’s legitimate interest.

8.2. The period of data processing may be extended if processing is necessary to establish and pursue potential claims or defend against them, and thereafter only if and to the extent required by law. After the processing period expires, the data is irreversibly deleted or anonymized.

9. USER RIGHTS

9.1. Data subjects have the following rights:

9.1.1. Right to information on data processing – on this basis, upon such a request, the Controller provides information on the processing of personal data, including in particular the purposes and legal bases of processing, the scope of data held, the entities to which personal data is disclosed, and the planned date of their deletion;

9.1.2. Right to obtain a copy of the data – on this basis, the Controller provides a copy of the processed data relating to the person making the request;

9.1.3. Right to rectification – on this basis, the Controller removes any inconsistencies or errors concerning the processed personal data and supplements or updates it if it is incomplete or has changed;

9.1.4. Right to erasure – on this basis, one may request the deletion of data whose processing is no longer necessary for any of the purposes for which it was collected;

9.1.5. Right to restriction of processing – on this basis, the Controller ceases performing operations on personal data, except for operations to which the data subject has consented, and their storage in accordance with adopted retention rules, or until the reasons for restricting data processing cease (e.g., a decision of the supervisory authority is issued allowing further data processing);

9.1.6. Right to data portability – on this basis, insofar as data is processed in connection with a concluded contract or consent given, the Controller provides the data supplied by the data subject in a format that allows it to be read by a computer. It is also possible to request that this data be sent to another entity – however, provided that there are technical possibilities for this both on the Controller’s side and on the side of that other entity;

9.1.7. Right to object to data processing for marketing purposes – the data subject may object at any time to the processing of personal data for marketing purposes without the need to justify such objection;

9.1.8. Right to object to other purposes of data processing – the data subject may object at any time to the processing of personal data based on the Controller’s legitimate interest (e.g., for analytical or statistical purposes or for reasons related to property protection). An objection in this respect should include justification and is subject to the Controller’s assessment;

9.1.9. Right to withdraw consent – if data is processed on the basis of consent, the data subject has the right to withdraw it at any time, which does not affect the lawfulness of processing carried out before the withdrawal of that consent;

9.1.10. Right to lodge a complaint – if it is considered that the processing of personal data violates the GDPR or other data protection regulations, the data subject may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

9.2. A request regarding the exercise of data subjects’ rights may be submitted:

9.2.1. in writing to: F.P. LEATHER FRANCISZEK PĘKSA, Ul. Podtatrzańska 46, 34-431 Waksmund;

9.2.2. by e-mail to: biuro@fpkozuchy.pl.

9.3. The request should, where possible, precisely indicate what the demand concerns, in particular:

9.3.1. which right the applicant wishes to exercise (e.g., right to receive a copy of data, right to erasure, etc.);

9.3.2. which processing operation the request concerns (e.g., use of a specific service, activity on a specific website, receiving a newsletter containing commercial information at a specific e-mail address, etc.);

9.3.3. which processing purposes the request concerns (e.g., marketing purposes, analytical purposes, etc.).

9.4. If the Controller is unable to determine the content of the request or identify the applicant based on the submitted application, the Controller will ask the applicant for additional information.

9.5. A response to the application will be provided within one month of its receipt. If it is necessary to extend this period, the Controller will inform the applicant of the reasons for such an extension.

9.6. The response will be provided to the e-mail address from which the request was sent, and in the case of requests sent by post, by ordinary mail to the address indicated by the applicant, unless the content of the letter indicates a desire to receive feedback to an e-mail address (in such a case, the e-mail address should be provided).

10. DATA RECIPIENTS

10.1. In connection with the provision of services, personal data will be disclosed to external entities, in particular to providers responsible for operating IT systems, entities such as banks and payment operators, entities providing accounting, legal, audit, and consulting services, couriers (in connection with order fulfillment), marketing agencies (to the extent of marketing services), and entities affiliated with the Controller, business partners.

10.2. If the User’s consent is obtained, their data may also be made available to other entities for their own purposes, including marketing purposes.

10.3. The Controller reserves the right to disclose selected information concerning the User to competent authorities or third parties who submit a request for such information, based on an appropriate legal basis and in accordance with applicable law.

11. TRANSFER OF DATA OUTSIDE THE EEA

11.1. The level of personal data protection outside the European Economic Area (EEA) differs from that ensured by European law. For this reason, the Controller transfers personal data outside the EEA only when necessary and with an adequate level of protection ensured, primarily by:

11.1.1. cooperating with entities processing personal data in countries with respect to which an appropriate decision has been issued by the European Commission;

11.1.2. using standard contractual clauses issued by the European Commission;

11.1.3. applying binding corporate rules approved by the competent supervisory authority;

11.1.4. in the case of data transfers to the USA – cooperating with entities participating in the Privacy Shield program, approved by a decision of the European Commission.

11.2. The Controller always informs about the intention to transfer personal data outside the EEA at the stage of their collection.

12. SECURITY OF PERSONAL DATA

12.1. The Controller continuously conducts risk analysis to ensure that personal data is processed securely – ensuring in particular that only authorized persons have access to the data and only to the extent necessary for the tasks they perform. The Controller ensures that all operations on personal data are recorded and performed only by authorized employees and collaborators.

12.2. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process personal data on behalf of the Controller.

13. CONTACT DETAILS

13.1. Contact with the Controller is possible via e-mail at biuro@fpkozuchy.pl or by post at: F.P. LEATHER FRANCISZEK PĘKSA, Ul. Podtatrzańska 46, 34-431 Waksmund.

14. CHANGES TO THE PRIVACY POLICY

14.1. The Policy is continuously reviewed and updated when necessary.