Privacy policy

Yerba Mate 24 online shop Privacy Policy

Table of Contents:

• § 1 General Provisions

• § 2 Personal Data Controller

• § 3 Contact Details

• § 4 Principles of Personal Data Processing

• § 5 Purposes and Legal Grounds for Personal Data Processing

• § 6 Personal Data Retention Period

• § 7 Categories of Personal Data

• § 8 Cookies

• § 9 Data Sharing

• § 10 Customers' Rights

§ 1 General Provisions

1. This Privacy Policy sets out the rules for the processing and protection of personal data of Customers using the online store available at ymt24.pl (hereinafter referred to as the "Online Store").

2. This Privacy Policy fulfills the information obligation imposed on the Controller pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as "GDPR").

§ 2 Personal Data Controller

The Controller of Personal Data of the Online Store Customers is Mateusz Skotnicki conducting business under the firm Yerba Mate 24 Mateusz Skotnicki, ul. Polna 6, 33-380 Krynica-Zdrój, NIP: 5170375345, REGON: 364488749, e-mail: [email protected] (hereinafter referred to as the "Controller").

§ 3 Contact Details

The Controller can be contacted via e-mail at [email protected] or in writing at: Yerba Mate 24 Mateusz Skotnicki, ul. Polna 6, 33-380 Krynica-Zdrój, Poland.

§ 4 Principles of Personal Data Processing

1. The Controller processes Customers' personal data in accordance with the provisions of the GDPR.

2. The Controller applies technical and organizational measures required by EU legal provisions to ensure protection of the processed personal data and safeguard personal data against unauthorized disclosure, acquisition by unauthorized persons, processing in violation of regulations, as well as alteration, loss, or destruction.

3. The Controller declares that providing data marked as required in the Online Store is voluntary, but necessary to use its functionalities, including creating and maintaining a Customer account as well as placing and fulfilling an order.

4. The Customer may consent to receive commercial information from the Controller, including by electronic communication channels, and to the use of telecommunications terminal equipment for marketing purposes. Expressing the above consents is voluntary and is not a condition for fulfilling an order or maintaining a Customer account in the Online Store.

§ 5 Purposes and Legal Grounds for Personal Data Processing

Customers' personal data will be processed for the following purposes:

1. Maintaining a Customer account in the Online Store (Article 6(1)(b) GDPR),

2. Fulfilling orders placed in the Online Store (Article 6(1)(b) GDPR),

3. Direct marketing of own services and products, being a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR),

4. Replying to messages sent via the contact form and chat (Article 6(1)(a) GDPR),

5. Handling the complaint process or contract withdrawal (Article 6(1)(c) GDPR),

6. Providing the newsletter service (Article 6(1)(a) GDPR),

7. Analytical research, consisting in particular of examining and analyzing traffic on our website to maintain statistics, which is a legitimate interest of the Controller (Article 6(1)(f) GDPR),

8. Archival (evidentiary) purposes in the event of a legal need to demonstrate facts, which is a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR),

9. Establishing, investigating, or defending against potential claims, being the implementation of a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR).

§ 6 Personal Data Retention Period

Customers' data will be stored for the following period:

1. Data regarding Customer account management – for the period of its maintenance in the Online Store and no longer than until the Customer requests its deletion,

2. Data related to order fulfillment – for a period of 5 years from the end of the year in which the sale was made, unless further retention is justified by the statute of limitations for claims,

3. Data related to marketing activities – until an objection is raised,

4. Data related to answering inquiries – until the consent granted is withdrawn, unless further storage is justified by an overriding interest of the Controller, e.g., defense against potential claims,

5. Data related to complaints or contract withdrawal – for a period of 5 years from the end of the year in which the complaint was processed or the contract was withdrawn,

6. Newsletter service data – until unsubscription from the newsletter,

7. Maintaining statistics – until an objection is raised, but no longer than for a period of 26 months from the Customer's last activity on the website,

8. Archival purposes – for the period necessary to achieve this purpose,

9. Establishing, investigating, or defending against claims – for the period necessary to achieve this purpose.

§ 7 Categories of Personal Data

1. The Controller collects, processes, and stores the following Customer data:

   • In connection with creating a Customer account: e-mail address, first and last name, address, phone number, and in the case of entrepreneurs, also company name and NIP (Tax ID);

   • In connection with placing an order: e-mail address, first and last name, address, phone number, and in the case of entrepreneurs, also company name and NIP (Tax ID);

   • In connection with newsletter subscription: e-mail address;

   • In connection with sending a message via the contact form: e-mail address and first name;

2. While using the Online Store, the Controller automatically collects information such as: IP address, request URL, device ID, amount of time spent on individual pages, browser type, browser language, date and time of site usage, screen resolution, operating system type and version, and other similar information.

§ 8 Cookies

1. Personal Data will be processed in an automated manner, including profiling, using purchase information, activity in the Service Provider's sales channels (computer IP, cookies, preferred purchasing methods), and socio-demographic data (e.g. place of residence), in order to tailor marketing information to individual preferences. In any case, the User has the right to object to further profiling.

2. Cookies constitute IT data, in particular text files, stored on the Customer's terminal device and intended for using the Online Store. Cookies usually contain the website name from which they originate, their storage time on the terminal device, and a unique number.

3. Cookies are used for the following purposes:

   • Recognizing the device used by the Customer to properly display page content,

   • Creating statistics that help understand how Customers use websites, enabling improvement of their structure and content,

   • Maintaining the Customer's session so that the Customer does not have to re-enter login and password on every subpage of the Online Store,

   • Adjusting the content and functionality of the Online Store by matching an anonymous, randomly generated tracking identifier, which makes it possible, among other things, to check where the Customer came from, what search engine was used, which link was clicked, which keywords were typed, and at what point usage of the Online Store stopped,

   • Collecting general and anonymous data to run advertising campaigns via remarketing lists, allowing the display of ad content tailored to Customer preferences.

4. Internet browsers usually allow cookies to be stored on the Customer's terminal device by default. Customers can change settings in this regard. The web browser allows deleting stored cookies or automatically blocking them. Detailed information can be found in the browser's help section or documentation.

5. Information collected automatically during a Customer's visit to the Online Store is analyzed using Google Analytics provided by Google Inc. Information generated by cookies about the use of the Online Store (including IP address) will be transmitted to and stored by Google on servers in the United States. Detailed privacy rules for Google Analytics can be found at: https://www.google.com/analytics.

§ 9 Data Sharing

1. Customers' personal data may be transferred to entities to whom the Controller entrusts personal data processing under agreements, as well as entities authorized to obtain personal data under applicable law.

2. In order to perform the contract concluded through the Online Store, the Controller shares Customers' personal data with the following entities:

   • Warehouses and courier companies delivering orders,

   • Electronic payment providers,

   • Accounting service providers,

   • Hosting providers,

   • Marketing service providers supporting the online store,

   • Companies providing tools to support the sales process within the online store (marketing automation), e.g. recommendation frames, chat functionality, newsletter tools.

§ 10 Customers' Rights

1. The Customer has the right to access their data and the right to demand its rectification, erasure, or restriction of processing. To the extent that the legal basis for personal data processing is the legitimate interest of the controller, the Customer has the right to object to the processing of their personal data.

2. To the extent that the legal basis for processing the Customer's personal data is consent, the Customer has the right to withdraw consent. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

3. To the extent that the Customer's data is processed for the purpose of concluding and performing the Contract or processed based on consent, the Customer also has the right to data portability, i.e., to receive personal data from the controller in a structured, commonly used, machine-readable format. The Customer may transmit this data to another data controller.

4. The Customer also has the right to lodge a complaint with the supervisory authority dealing with personal data protection.