PRIVACY POLICY OF THE WWW.KRAKOWSKIKREDNES.PL WEBSITE
§ 1 General provisions
1. The controller of personal data of users of the krakowskikredens.pl website (hereinafter also referred to as the "Website") is SC PREMIUM spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw at ul. rtm. Witolda Pileckiego 67 lok. 200, 02-781 Warsaw, entered in the Register of Entrepreneurs kept by the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under KRS number: 0001065700, NIP: 9512580962, REGON: 526759433, share capital: PLN 5,000.00 (hereinafter referred to as the "Controller").
2. The Controller can be contacted:
1) via e-mail: zamowienia@krakowskikredens.pl;
2) in writing, at the Controller's address: SC Premium, ul. rtm. Witolda Pileckiego 67 lok. 200, 02-781 Warsaw
3. The purpose of the Policy is to define the actions taken regarding personal data collected via the Website and related services and tools used by its users, as well as in the scope of concluding and executing contracts in contact outside the website.
4. If necessary, the provisions of this Policy may change. The change will be communicated to users by announcing the new content of the Privacy Policy. In the case of a database of persons who have consented to data processing by e-mail or provided e-mail data during the performance of contracts, they will also be notified of the change via e-mail.
5. Personal data collected by the Controller via the Website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter also referred to as "GDPR".
6. Taking into account the nature, scope, context and purposes of the processing of personal data as well as the risk of violating the rights of Customers with varying probability and severity of the threat, the Controller implements appropriate technical and organizational measures so that the processing takes place in accordance with the regulation. The Controller uses technical measures to prevent unauthorized persons from obtaining and modifying personal data transmitted electronically.
§ 2 Information on processed personal data
Your personal data will be processed:
1) for the purpose of concluding and executing the Agreement for the provision of the Account Service on the terms set out in the Terms and Conditions, including for the purpose of creating a Customer account pursuant to Article 6(1)(b) of the GDPR.
In the case of Account Registration, the User provides an e-mail address,
Providing the above personal data is a condition for concluding and executing the agreement for the provision of the Account Service (providing them is voluntary, but the consequence of failing to provide them will be the inability to conclude and execute the aforementioned agreement, including the creation of an Account).
2) for the purpose of concluding and executing a Sales Agreement or taking steps to conclude one on the terms set out in the Terms and Conditions pursuant to Article 6(1)(b) of the GDPR.
In the case of placing an Order, the Buyer provides the following data:
a) name and surname,
b) e-mail address,
c) phone number,
d) residential/business address (street, house number, apartment number, city, postal code, country),
e) delivery address (if different from the residential/business address)
f) optionally - company name and NIP (if the Buyer is an Entrepreneur or a Sole Proprietor with consumer rights)
Providing the above personal data is a condition for concluding and executing the Sales Agreement (providing them is voluntary, but the consequence of failing to provide them will be the inability to conclude and execute the Sales Agreement).
3) for the purpose of newsletter subscription (Newsletter) in order to send the Krakowski Kredens online store bulletin, including for the purpose of sending commercial information by electronic means on the terms set out in the Terms and Conditions pursuant to Article 6(1)(b) and (f) of the GDPR.
In the case of subscribing to the Newsletter, the User provides an e-mail address.
Providing the above personal data is voluntary, but necessary to receive the Newsletter.
4) for the purpose of processing personal data to consider and respond to a complaint – Art. 7a of the Act on Consumer Rights; exercising the Customer's rights resulting from the provisions on the Controller's liability in the event of non-compliance of a physical Good with the Sales Agreement or digital service with the relevant Agreement, informing Customers about actions taken in connection with the performance of Agreements concluded with Customers on the terms set out in the Terms and Conditions pursuant to Article 6(1)(c) of the GDPR.
In the case of complaint proceedings, the Customer provides the following data:
a) name and surname,
b) correspondence address to which a response can be sent,
c) e-mail address
Providing the above personal data is a condition for receiving a response to a complaint or exercising the Customer's rights resulting from the provisions on the Controller's liability in the event of non-compliance of a Good with the Sales Agreement or digital service with the Agreement. Providing is voluntary, but the consequence of failing to provide them will be the inability to receive a response to a complaint and exercise the aforementioned rights
5) for the purpose of sending notifications in the event of informing Customers about actions taken in connection with the performance of concluded Agreements and handling inquiries submitted on the terms set out in the Terms and Conditions pursuant to Article 6(1)(f) of the GDPR.
In the case of sending notifications, the following personal data are processed:
a) name and surname
b) e-mail address
c) other data contained in messages to the Controller.
Providing the above personal data is voluntary, but necessary to receive information about actions related to the performance of concluded Agreements (the consequence of failing to provide them will be the inability to receive the aforementioned information).
6) for the purpose of fulfilling the Controller's accounting obligations, including inter alia issuing VAT invoices, keeping accounting documentation on the terms set out in the Terms and Conditions pursuant to Article 6(1)(c) of the GDPR.
For this purpose, the following personal data are processed:
a) name and surname or company name,
b) residential or registered office address,
c) NIP (Tax Identification Number)
Providing the above personal data is voluntary, but necessary for the Controller to fulfill its tax obligations (the consequence of failing to provide them will be the inability for the Controller to fulfill the aforementioned obligations).
7) for the purpose of establishing or pursuing possible claims or defending against such claims by the Controller in connection with the performance of Agreements concluded with the Controller pursuant to Article 6(1)(f) of the GDPR.
For this purpose, the following personal data may be processed:
a) name and surname or company name,
b) e-mail address,
c) residential or registered office address,
d) PESEL number or NIP.
Providing the above personal data is voluntary, but necessary to establish, pursue or defend against claims that may arise in connection with the performance of Agreements concluded with the Controller (the consequence of failing to provide the aforementioned data will be the inability for the Controller to take the aforementioned actions)
8) for the purpose of ensuring the proper functioning of the Website and its features pursuant to Article 6(1)(f) of the GDPR.
For this purpose, the following personal data may be processed:
a) IP address,
b) information about the device, hardware and software, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising ["IDFA"] or advertising identifier on an Android device ["AAID"]),
c) platform type,
d) data regarding the web browser, including browser type and preferred language.
The above data are saved automatically in so-called server logs every time the Website is used (administering it without the use of server logs and automatic saving would not be possible). Providing them is voluntary, but necessary to ensure the proper operation of the Website (the consequence of failing to provide them will be the inability to ensure that the Website operates correctly).
9) For the purpose of analyzing Customer activity on the Website pursuant to Article 6(1)(f) of the GDPR.
For this purpose, the following Customer data may be processed:
a) IP address,
b) information about the device, hardware and software, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising ["IDFA"] or advertising identifier on an Android device ["AAID"]),
c) platform type,
d) data regarding the web browser, including browser type and preferred language,
e) date and time of visits,
f) approximate location,
g) time spent on the Website,
h) viewed Goods,
i) visited subpages.
Providing the aforementioned personal data is voluntary but necessary for the Controller to obtain information about the Client's activity on the Website (the consequence of failure to provide it will be the impossibility for the Controller to obtain the aforementioned information).
10) The Controller may use profiling for direct marketing purposes, but decisions made by the Controller on this basis do not concern the conclusion or refusal to conclude a Sales Agreement, or the possibility of using electronic services. The effect of profiling may be, for example, granting a discount, sending a discount code, a reminder about unfinished purchases, or sending suggestions for Goods that may match the Client's interests or preferences. Despite profiling, it is the Client who makes the decision each time whether they want to take advantage of the received discount or better conditions and make a purchase based on the received discount or proposed conditions.
Profiling consists of the automatic analysis or forecasting of a Client's behavior on the Website, for example, by adding a specific product to the cart, browsing a specific product page, or analyzing the Client's history of activity on the Website.
The legal basis for the processing of personal data for the above purpose is Article 6(1)(f) of the GDPR, according to which the Controller may process personal data for the purposes of its legitimate interests, in this case, conducting marketing activities tailored to the preferences of recipients. Providing the aforementioned personal data is voluntary but necessary to achieve the aforementioned purpose (the consequence of failure to provide it will be the impossibility for the Controller to conduct marketing activities tailored to the preferences of recipients).
§ 3 Recipients of personal data
1. The Controller ensures that all collected personal data is used to fulfill obligations towards Clients. This information will not be shared with third parties, except in situations where:
1) express consent is given beforehand by the persons concerned for such action, or
2) if the obligation to transfer this data arises or will arise from applicable legal provisions, e.g., to law enforcement authorities.
2. additionally, Clients' personal data may be transferred to the following recipients or categories of recipients:
1) service providers supplying the Controller with technical, IT, and organizational solutions enabling the Controller to conduct business, including the Website and electronic services provided through it, including computer software providers, marketing agencies, e-mail and hosting providers, providers of company management software, and technical support for the Controller, and suppliers – the Controller makes the collected Client personal data available to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a specific data processing purpose in accordance with this privacy policy;
2) accounting, legal, and advisory service providers providing the Controller with accounting, legal, or advisory support, including an accounting office, law firm, or debt collection company – the Controller makes the collected Client personal data available to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a specific data processing purpose in accordance with this privacy policy.
3. The Controller may share anonymized data, i.e., data that does not identify specific Users, to external service providers in order to better recognize the attractiveness of advertisements and services for Clients, and in this regard, due to the location of software providers, data may be transferred – while maintaining data protection rules – to third countries which, however, ensure standard contractual clauses approved by the European Commission regarding the processing of personal data or have appropriate authorization for such action based on bilateral data processing agreements between the European Union and a given third country that is not a member of the European Economic Area. In the case of the Controller, these entities are:
a) Google LLC. (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for Google Analytics tools used for analyzing website statistics, Google Tag Manager: used for managing scripts by easily adding code snippets to the website or application and tracking actions performed by users on the website, Google Ads used for displaying sponsored links in Google search results and on websites participating in the Google AdSense program,
b) Meta Platforms, Inc. (registered office: 1601 Willow Road Menlo Park, CA 94025, USA) for Facebook pixel used for tracking conversions from Facebook ads, optimizing them based on collected data and statistics, and building a target audience for future advertisements.
4. The Website may use Google Analytics functionality, a web analytics service provided by Google, LLC. ("Google"). Google Analytics uses cookies to help website operators analyze how visitors use the site. The information generated by the cookie about the use of the site by visitors is generally transmitted to and stored by Google on servers in the United States. In accordance with current IT standards, the IP addresses of users visiting the Controller's page are truncated. Only in exceptional cases is the complete IP address transmitted to a Google server in the United States and truncated there. On behalf of the Controller, Google will use this information to evaluate the website for its users, compile reports on website activity, and provide other services related to website activity and internet usage for website operators. Google will not associate the IP address transmitted within the framework of Google Analytics with any other data held by Google. More information about how Google Analytics collects and uses data can be found on the official Google website at: www.google.com/policies/privacy/partners. Furthermore, any User can prevent the collection and processing by Google of data concerning their use of the website by downloading and installing the browser plug-in at the following link: http://tools.google.com/dlpage/gaoptout.
5. The Website may use Google reCaptcha, a service of Google LLC., based on Article 6(1)(f) of the GDPR. In this context, the analysis of various information is used to determine whether the input of data is being performed by a human or an automated program. The generated information is sent to a Google server in the USA and stored there. The collection and analysis of data do not enable us or Google to identify the Client's identity. In particular, this information is not linked by Google to the Clients' personal data.
6. When sharing data with third parties, the Controller makes every effort to ensure that this is done only with entities that possess certifications under the (former) EU-US and Swiss-US Privacy Shield programs, which are available at www.privacyshield.gov. Such entities, in the case of using information originating from the European Economic Area (EEA), will do so in accordance with the "Accountability for Onward Transfer" principle of the Privacy Shield program. In appropriate cases, the Controller will rely on EU standard contractual clauses and other safeguards to enable transfers outside the EEA. In accordance with the decision of the Court of Justice of the European Union of July 16, 2020, regarding the EU-US Privacy Shield and the guidelines of the European Data Protection Board, the Controller continues to assess the legal system of the countries to which data is transferred and, as necessary, updates measures aimed at ensuring appropriate levels of protection.
§ 4. User Rights
1. In connection with the processing of personal data, Website Clients have the following rights:
1) the right to information about what personal data of the Client is processed by the Controller and to receive a copy of this data (the so-called right of access). Issuing the first copy of the data is free of charge; for subsequent copies, the Controller may charge a fee;
2) if the processed data becomes outdated or incomplete (or is otherwise incorrect), the Client has the right to demand its rectification;
3) the Client may request the Controller to delete their personal data in cases where:
a) the Client's personal data is no longer needed by the Controller for the purposes of which it informed;
b) the Client has effectively withdrawn consent for data processing - provided that the Controller has no right to process the data on another legal basis;
c) the processing of personal data is unlawful;
d) the necessity to delete the data results from a legal obligation incumbent upon the Controller.
4) in cases where personal data is processed by the Controller on the basis of granted consent to process:
a) or for the purpose of performing a Contract concluded with them, the Client has the right to transfer their data to another controller;
b) the Client has the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing that was carried out on the basis of consent before its withdrawal);
5) in the event that the Client considers that their processed personal data is incorrect, its processing by the Controller is unlawful, or the Controller no longer needs specific data, the Client has the right to demand that for a specific, necessary time (e.g., verifying the correctness of data or asserting claims), the Controller does not perform any operations on the data, but only stores it;
6) the Client has the right to object to the processing of personal data for which the basis for processing is the legitimate interest of the Controller. In the event of an effective objection, the Controller will cease to process the personal data for the aforementioned purpose;
7) the Client has the right to lodge a complaint with the President of the Personal Data Protection Office when they consider that the processing of personal data violates the provisions of the GDPR.
2. The exercise of the above rights takes place on the basis of a request sent to the e-mail address biuro@krakowskikredens.pl. Such a request should contain the Client's first and last name.
3. The Client ensures that the data provided or published by them on the website is correct.
§ 4. Cookies
1. The Controller informs that the Website uses "cookies," installed on the Client's end device.
2. "Cookies" should be understood as IT data, in particular text files, stored on users' end devices (usually on a computer hard drive or mobile device) used for saving specific settings and data by the user's browser in order to use websites. These files allow the user's device to be recognized and the website to be displayed accordingly, ensuring comfort during its use. Storing "cookies" therefore enables the appropriate preparation of the website and offer in terms of user preferences – the server recognizes them and remembers, among other things, preferences such as: visits, clicks, previous actions.
3. The Controller may place both persistent and temporary (session) cookies on your device. Session cookies are usually deleted when the browser is closed, while closing the browser does not cause the deletion of persistent cookies.
4. "Cookies" are not used to identify the user and their identity is not determined on their basis.
5. "Cookies" are used to:
1) ensure the proper functioning of the Website – thanks to cookies, it is possible for the Website to function efficiently, use its features, and conveniently move between individual subpages;
2) increasing the comfort of browsing the Website – thanks to cookies, it is possible to detect errors on certain subpages and constantly improve them;
3) creating statistics – cookies are used to analyze how Customers use the Website. This makes it possible to constantly improve the Website and adjust its operation to the preferences of Customers;
4) conducting marketing activities – thanks to cookies, the Administrator can direct advertisements tailored to their preferences to users.
6. Two basic types of cookies are used within the Website: persistent and temporary (session) cookies. Session cookies are usually deleted when the browser is closed, while closing the browser does not delete persistent cookies.
7. Additionally, the following types of "cookies" are used within the Website:
1) necessary "cookies", which contribute to the usability of the Website. They are essential for the proper functioning of the Website or the functionalities that the Customer wishes to use, as without them the Administrator would not be able to provide many of the services offered to Customers.
2) functional cookies. The aforementioned files serve to:
a) enrich the functionality of the Website; without them, the Website will work correctly, but it will not be adapted to the Customer's preferences;
b) ensure a high level of functionality of the Website; without them, the level of functionality of the Website may decrease, but their absence should not prevent the use of the Website entirely;
c) most of the Website's functionality; blocking them will cause selected features of the Website not to work correctly.
3) statistical cookies. The aforementioned files allow the Administrator to understand how Customers behave on the Website by collecting and reporting anonymous information; they enable the saving of information on how Customers use the Website. They help improve services and increase the comfort of browsing the Website;
4) cookies used for the security and reliability of websites – they enable the verification of authenticity and the optimization of the Website's performance;
5) authentication cookies – they make it possible to inform when a Customer is logged in, thanks to which the Website can show appropriate information and functions;
6) advertising cookies – they enable the display of advertisements that are more interesting for Customers and at the same time more valuable for publishers and advertisers; "cookie" files may also be used to personalize advertising, as well as to display advertisements outside of websites;
7) cookies used for analysis, research, or audience auditing – they enable the owner of websites to better understand their users' preferences and, through analysis, to improve and develop products and services. Usually, the website owner or a research company collects information anonymously and processes data on trends without identifying the personal data of individual users;
8) cookies enabling the adjustment of displayed information to the Customer's location
8. The Administrator may use tracking pixels or clear GIF files to collect information on how the user uses their services and their reaction to marketing messages sent via email. A pixel is software code that allows for embedding an object on a page, usually a pixel-sized image, which enables tracking user behavior on the websites where it has been placed. Upon giving appropriate consent, the browser automatically establishes a direct connection with the server storing the pixel, which is why the processing of data collected by the pixel takes place within the framework of the data protection policy of the partner who administers the aforementioned server.
9. The legal basis for collecting personal data read from "cookies" is Article 6(1)(f) of the GDPR, which allows for the processing of personal data to achieve the Administrator's legitimate interest. Such an interest is to adapt the Website to the individual settings of the Customer and to remember data entered by the Customer related to the use of the Website, including also conducting statistical analyses regarding Customers and people visiting the Website for the needs of the Website Administrator.
10. "Cookies" used by the Website are not harmful to either the Customer or the terminal device used by them, which is why it is recommended not to disable them in browsers for the proper functioning of the Website.
11. Through most commonly used browsers, the Customer can check whether "cookies" have been installed on the Customer's terminal device, as well as delete installed "cookies" and block their installation in the future by the Website. Disabling or limiting the handling of "cookies" may, however, cause quite serious difficulties in using the Website, e.g., in the form of the need to log in on every subpage, a longer loading period of the Website, or restrictions on the use of certain functionalities of the Website.
12. Detailed information on changing settings regarding "cookies" and their independent removal in the most popular web browsers is available in the web browser's help section and on the following pages (just click on the given link):
13. Detailed information on managing "cookies" on a mobile phone or other mobile device should be found in the instruction manual of the given mobile device.
§ 5. Changes to the privacy policy
The Administrator may introduce changes to this privacy policy. The latest version is always available on the website krakowskikredens.pl
Last update: [x]