PRIVACY POLICY of the MATCHYRA online shop
Table of contents:
1. general provisions
2 Personal Data Administrator
3 Contact details
4 Personal data processing principles
5 Purposes and legal basis of personal data processing
6 Period of storage of personal data
7 Categories of personal data
8 Data sharing
9 Customer rights
1 General provisions
This Privacy Policy sets out the principles for the processing and protection of personal data of Customers using the online shop available at https://www.etsy.com/pl/shop/MATCHYRA (hereinafter referred to as the ‘Online Shop’).
This Privacy Policy constitutes the fulfilment of the Administrator's information obligation pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as ‘RODO’).
2 Personal Data Administrator
The Administrator of the Personal Data of the Customers of the Online Store is PPHU MAT Małgorzata Chyra, Długa 17 Street, 42-152 Iwanowice Małe, NIP: 574-167-82-93, Regon: 151985088, e-mail address: sklep@matchyra.pl.
(hereinafter referred to as the ‘Administrator’). 3.
3 Contact details
The Administrator can be contacted via email address: sklep@matchyra.pl
or in writing to the address: PPHU MAT Małgorzata Chyra, Długa 17 Street, 42-152 Iwanowice Małe, Poland.
4 Principles of personal data processing
The Administrator processes Customers' personal data in accordance with the provisions of RODO.
The Administrator shall apply the technical and organisational measures required by the provisions of the EU law ensuring the protection of the processed personal data and securing the personal data against their access to unauthorised persons, takeover by unauthorised persons, processing in violation of the provisions of the law and against their change, loss or destruction.
The Administrator declares that the provision of data marked as required in the Online Shop is voluntary, but necessary for the use of the functionality, including for the establishment and maintenance of the Customer's account and for the placement and execution of the order.
5 Purposes and legal basis of personal data processing
Customers' personal data will be processed for the following purposes:
maintaining the Customer's account in the Online Shop and providing other services provided electronically, on the basis of the Terms and Conditions (Article 6(1)(b) of the RODO),
processing of orders in the Online Shop (art. 6(1)(b) and (c) RODO),
running the newsletter service (art. 6(1)(a) RODO),
direct marketing of the Administrator's own services and products, in addition to the newsletter service, being a legitimate interest of the Administrator (Article 6(1)(a) and (f) RODO),
responding to an email or telephone contact or a message sent via online chat, which is the legitimate interest of the Administrator (Article 6(1)(f) RODO),
analytical research, consisting in particular of researching and analysing the traffic on our website in order to keep statistics, which is the Administrator's legitimate interest (Article 6(1)(f) RODO),
archiving (evidence) in the event of a legal need to prove the facts, which is the Administrator's legitimate interest (Article 6(1)(f) RODO),
possible establishment, investigation or defence against claims which is the fulfilment of the Administrator's legitimate interest (Art. 6(1)(f) RODO).
6 Period of storage of personal data
Customer data will be stored for the following period:
data related to the provision of services under the Terms and Conditions - for the period of the provision of a given service, unless their further storage is justified by the statute of limitations for claims or results from generally applicable laws,
data related to the fulfilment of orders - for a period of 5 years from the end of the year in which the sale took place, unless their further storage is justified by the time limitation period for claims,
keeping the newsletter service - until the moment of unsubscribing from the newsletter,
data related to the implementation of marketing activities - until you raise an objection,
data related to responding to an e-mail or telephone contact - until the correspondence is conducted or the consent is withdrawn, unless further storage is justified by the overriding interest of the Administrator, e.g. in defence against possible claims,
keeping statistics - until an objection is raised, but no longer than for a period of 50 months from the last activity of the Client on the website
archiving purposes - for the period of time necessary for this purpose,
establishing, investigating or defending against claims - for the period necessary for this purpose,
7 Categories of personal data
The Administrator collects, processes and stores the following Customer data:
in connection with the creation of a Customer account: name, surname, address, e-mail address and other data entered within the Customer account,
in connection with placing an order: name, surname, address, telephone, e-mail, and in the case of entrepreneurs also the company name and VAT number,
in connection with e-mail or telephone contact: name, e-mail address and telephone number,
in connection with the provision of the newsletter service: e-mail address.
In other respects, the Administrator processes only the data necessary for the purpose in question.
When using the Online Shop, the Administrator collects and gathers automatically such information as: IP address, request URL, device identifier, amount of time spent on individual pages, browser type, browser language, date and time of use, screen resolution, operating system type and version, and other such information.
8 Data sharing
Customers' personal data may be disclosed to entities to which the Administrator entrusts the processing of personal data on the basis of contracts and to entities entitled to obtain personal data on the basis of legal regulations.
In order to perform the contract concluded through the Internet Shop and to ensure the proper functioning of the Shop, the Administrator shall make the Customers' personal data available to entities providing services in particular:
postal, shipping and courier services, and order processing,
electronic payments,
accounting,
hosting,
IT and within the scope of supplying software and tools used in particular for conducting analytical research, creating statistics, tracking traffic on our website, marketing automation, CRM systems,
marketing for the operation of the online shop,
Entities providing services to the Administrator may store Customer data outside the European Economic Area. In such situations, Users' data will be transferred only to countries that provide an adequate level of protection, and to countries that do not provide an adequate level of protection only if adequate safeguards are provided, including, among others, on the basis of standard contractual clauses adopted by the European Commission.
9 Customer rights
The Customer has the right to access his/her data and the right to request rectification, erasure or restriction of processing. To the extent that the basis for the processing of personal data is the premise of the controller's legitimate interest, the Customer has the right to object to the processing of his/her personal data.
To the extent that the basis for the processing of the Customer's personal data is consent, the Customer has the right to withdraw consent. The withdrawal of consent does not affect the lawfulness of the processing that was carried out on the basis of consent before its withdrawal.
To the extent that the Customer's data is processed for the purpose of concluding and performing the Agreement or processed on the basis of consent - the Customer also has the right to portability of personal data, i.e. to receive personal data from the controller, in a structured, commonly used machine-readable format. The Customer may send this data to another data controller.
The customer also has the right to lodge a complaint with the data protection supervisory authority.
