PRIVACY AND COOKIES POLICY

ONLINE STORE

KACPER GLOBAL

https://kacperglobal.pl/

 General information

This document defines the privacy rules in the Online Store https://kacperglobal.pl/ (hereinafter referred to as the „Online Store”). The data administrator in the Online Store is KACPER GLOBAL sp.z o.o., ul. Partyzantów 4, 42-300 Myszków, NIP: 5771976084, KRS number 0000470314, krakow@kacperglobal.pl

Personal data

1. Personal data collected by the Administrator are processed on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46 / WE (hereinafter referred to as GDPR), the current act on the protection of personal data and the act of 18 July 2002 on the provision of electronic services (Journal of Laws 2002 No. 144 item 1204 as amended).
2. The administrator collects information provided voluntarily by the Customers of the Online Store. However, providing marked personal data is a condition for placing an order, while failure to do so will result in the inability to order products in the store. The store will collect the following customer data: surname, first name, e-mail address, telephone number, address for delivery of goods.
3. In addition, the Administrator may save information about connection parameters, such as IP addresses, for technical purposes related to server administration and to collect general, statistical demographic information (e.g. about the region from which the connection takes place), as well as for security purposes.
4. The Administrator makes special efforts to protect the privacy and information provided to him regarding the Customers of the Online Store. The administrator with due diligence selects and applies appropriate technical measures, including programming and organizational measures, ensuring the protection of the data being processed, in particular, protects the data against unauthorized disclosure, disclosure, loss and destruction, unauthorized modification, as well as against their processing in violation of applicable law.
5. Personal data will be processed in accordance with the principles of art. 5 (GDPR).

Personal data will be:

1.   processed lawfully, fairly and in a transparent manner for the data subject („lawfulness, fairness and transparency”);
2.   collected for specific, explicit and legitimate purposes and not further processed in a manner inconsistent with these purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not recognized in accordance with Art. 89 sec. 1 GDPR for inconsistent with the original purposes („purpose limitation”);
3.   adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed („data minimization”);
4.   correct and, where necessary, kept up to date („correctness”);
5.   kept in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the data are processed; personal data may be stored for a longer period as long as they are processed solely for archiving purposes in the public interest, for scientific or historical research purposes or for statistical purposes pursuant to Art. 89 sec. 1 GDPR, subject to the implementation of the appropriate technical and organizational measures required by this Regulation to protect the rights and freedoms of data subjects („storage limitation”);
6.   processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organizational measures („integrity and confidentiality”).

1.   As part of the Administrator’s use of tools supporting his current activity provided, for example, by Google, the Customer’s Personal Data may be transferred to a country outside the European Economic Area, in particular to the United States of America (USA) or another country where the entity cooperates with it maintains tools for the processing of Personal Data in cooperation with the Administrator.

Law basics

1.   The basis for the processing of the Customer’s personal data is primarily the need to perform the contract to which he is a party or the need to take action at his request before its conclusion (Article 6 (1) (b) of the GDPR).
2.   After expressing a separate consent, pursuant to art. 6 sec. 1 lit. a) GDPR, data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for direct marketing purposes – in connection with art. 10 sec. 2 of the Act of July 18, 2002 on the provision of electronic services or art. 172 sec. 1 of the Act of July 16, 2004 – Telecommunications Law.
3.   For other purposes, the Customer’s personal data may be processed on the basis of:

1.   applicable law – when processing is necessary to fulfill the legal obligation incumbent on the Administrator, e.g. when on the basis of tax or accounting regulations, the Administrator settles concluded sales contracts (Article 6 (1) (c) of the GDPR);
2.   indispensability for purposes other than those listed above, resulting from legitimate interests pursued by the Administrator or by a third party, in particular to establish, investigate or defend claims, conduct correspondence with customers, also via contact forms (including replying to customer messages), market and statistical analyzes (Article 6 (1) (f) of the GDPR).

1.   Personal data processed for purposes related to the implementation of purchases will be processed for the period necessary to carry out purchases and orders, after which the data subject to archiving will be stored for the period appropriate for the limitation of claims. Personal data processed for marketing purposes covered by the consent declaration will be processed until the consent is revoked.

Recipients of personal data

1.   The recipients of the Buyer’s data may be entities performing the order at the request of the Seller and dealing with its service: mail order companies, accounting companies, suppliers of goods, IT solution providers, payment processing companies, banks, companies providing marketing services, storage service providers, telecommunications service providers, law firms. legal, authorized state bodies.

Your rights in the protection of personal data

1.Due to the voluntary nature of providing your personal data, you have the right

1. access to your personal data (Article 15 of the GDPR);
2. rectify your personal data (Article 16 of the GDPR);
3.   delete your personal data („the right to be forgotten” – Article 17 of the GDPR);
4.   restrictions on the processing of your personal data (Article 18 of the GDPR);
5.   transferring your personal data (art. 20 GDPR);
6.   for objection -art. 21 GDPR);

1.   If it is found that the processing of personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.
2.   The consent to the processing of personal data may be withdrawn at any time. Withdrawal of consent to data processing does not affect the lawfulness of data processing carried out by the Administrator on the basis of consent before its withdrawal.

Breach of personal data protection

1.   In the event of a breach of personal data protection, the Administrator, without undue delay, no later than 72 hours after finding the breach – reports it to the supervisory body – (the President of the Personal Data Protection Office), unless it is unlikely that the breach would result in a risk of breach of rights or the freedom of individuals. The Administrator attaches an explanation of the reasons for the delay to the notification submitted to the supervisory authority after 72 hours. If the breach of personal data protection may result in a high risk of violation of the rights or freedoms of natural persons, the Administrator shall notify the data subject of such breach without undue delay.