PRIVACY AND COOKIE POLICY

This is an English translation provided for convenience. In case of any discrepancy, the Polish version prevails.

PRIVACY POLICY


This document describes how I process personal data, including information on the use of cookies.

1. DEFINITIONS:

1.1 Administrator – the data administrator (controller) is the entity that pursues specific purposes of data processing. I always provide details of processing when collecting data, for example in the contracts I conclude with you or in announcements;



The Personal Data Administrator implementing this Personal Data Security Policy is Paulina Chmielewska, running a business under the name Pracownia Paulina Chmielewska, ul. Kamedulska 17d, 30-252 Kraków, NIP 6792983724, REGON 389638623; contact email: sukienki@pauka.pl



1.2. Personal data – information about an identified or identifiable natural person, identifiable by one or more specific factors relating to their physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, online identifiers and information collected via cookies and similar technologies;

1.3. Policy – this Privacy Policy, containing information on the processing of Personal data and the use of cookies and similar tracking technologies within the Service.

1.4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.5. Act – the Polish Act of 10 May 2018 on the protection of personal data;

1.6. Website/Websites – the website run by the Administrator at www.pauka.pl, accessible via web browsers.

1.7. Online shop – the online shop run by the Administrator at www.pauka.pl

1.8. User – any natural person visiting the Website/online shop or using one or more of the services or features described in the Policy.

1.9. Device – the electronic device through which the User accesses the Website.

2. PRIVACY INFORMATION:

2.1. When you use my website, I collect data and information about your activity. In this respect I am the administrator of your Personal data, and I take their protection seriously. I make sure that my data processing complies with the relevant laws, in particular the GDPR. My aim is to give you full information about how I process your Personal data and to provide tools that let you exercise your rights. Below is information on how I process your Personal data.

2.2. I process your Personal data lawfully, making sure it stays up to date and accurate.

2.3. This Privacy Information also covers marketing content, including offers and services of my business, that I (or a service provider acting on my behalf) display on external websites, platforms and apps based on information about your use of a given site. These external websites generally have their own Privacy Information and Terms and Conditions. We encourage you to read them before using those sites.

3. YOU CAN ALWAYS CONTACT THE ADMINISTRATOR – THAT IS, ME. HOW?

3.1. If you have any questions about how I process your Personal data, or you would like to exercise your rights, write to me directly at: sukienki@pauka.pl

4. HOW DO I OBTAIN YOUR PERSONAL DATA?

4.1. Personal data means any information that can be used to directly or indirectly identify a specific person. This definition includes personal data collected online via my Website and my business pages on external platforms.

4.2. When you contact me, you may be asked to provide your personal data. Data administrators may share your personal data with each other and with other companies linked to the Administrator by capital or personnel, and use it in accordance with this Privacy Information. I may also combine it with other information to improve my content.

4.3. I collect personal data from various sources. These are:

Personal data provided directly. I collect data about how you use my website, e.g. information about the types of content you view or engage with, and the frequency and duration of your activities.
Personal data I collect automatically. I also receive and store certain types of personal data whenever you interact with us online. For example, I use cookies and tracking technologies to obtain personal data when your web browser accesses my website and other content delivered on other websites. Personal data is also collected when searching and publishing posts. Examples of the types of personal data I collect include: IP address, device ID, location data, computer and connection information such as browser type and version, time zone setting, browser plug-in types and versions, and operating system.
5. IS PROVIDING PERSONAL DATA MANDATORY?

It is your decision whether, and which, Personal data you give me – it is not mandatory. Please remember, however, that in some cases providing Personal data is necessary for the proper provision of my services or is a condition for concluding and performing a contract (e.g. in the Online shop);

6. HOW DO I PROCESS YOUR PERSONAL DATA?

6.1. I always inform you of all purposes of processing the data collected in a given case, and of the relevant legal bases, at the time of collection, for example in the contracts we conclude when you buy a product or service from me,

6.2. As a rule, I use data for the following purposes and on the following legal bases:

a) for users of my website:

for statistics on the use of individual website features, to make the service easier to use and to ensure IT security – for these purposes I process personal data about your activity on the website (e.g. pages and subpages visited, length of visit, search history, IP address, location, device ID, and browser and operating system data) – the legal basis is your consent (Art. 6(1)(a) GDPR), expressed through your browser's cookie settings,
to analyse behaviour on the website (profiling) for my own marketing purposes, i.e. to show you personalised ads and messages on the website (so that ads and messages match your interests and preferences) – the legal basis is your consent (Art. 6(1)(a) GDPR), expressed through your cookie settings,
to analyse behaviour on the website regarding products viewed and the user's interest in my offer, in order to build a customer profile and analyse their behaviour – the legal basis is the Administrator's legitimate interest (understood as keeping statistics and verifying how users engage with the website based on their interests) and consent (Art. 6(1)(a) and (f) GDPR). b) to reply to enquiries about a specific offer – the legal basis is the consent of the potential customer (requesting the offer; Art. 6(1)(a) GDPR),
b) to send offers relating to the Administrator – the legal basis is consent to receive such offers electronically or by phone (Art. 6(1)(a) GDPR),

c) when performing contracts for the purchase of my products and services:

the need to perform the contract or to process personal data before concluding it, at your request (Art. 6(1)(b) GDPR), and
compliance with legal obligations (Art. 6(1)(c) GDPR) relating to taxes and document archiving, as well as
the Administrator's legitimate interests (Art. 6(1)(f) GDPR), understood as: pursuing, defending or establishing claims, recovering outstanding payments, ongoing contact regarding the contract, resolving any disputes, maintaining business relationships, and correctly identifying contact persons or representatives of my customers and contractors, their employees or associates,
d) recruitment – the legal basis for processing personal data is:

where the preferred form of employment is an employment contract – compliance with legal obligations (Art. 6(1)(c) GDPR and possibly Art. 9(2)(b) GDPR), the consent of the data subject (Art. 6(1)(a) GDPR and possibly Art. 9(2)(a) GDPR), and the administrator's legitimate interest (Art. 6(1)(f) GDPR), understood as verifying candidates' qualifications and skills in order to select the right person for the position being recruited,
where the preferred form of employment is a civil-law contract – Art. 6(1)(b) GDPR, i.e. the need to perform the contract or to process personal data before concluding it, at the data subject's request, the consent of the data subject (Art. 6(1)(a) GDPR and possibly Art. 9(2)(a) GDPR), and the administrator's legitimate interest (Art. 6(1)(f) GDPR), understood as verifying candidates' qualifications and skills in order to select the right person for the position being recruited,
e) employment, i.e. performance of the contract (Art. 6(1)(b) GDPR) and fulfilment of the Administrator's legal obligations (relating to labour law, insurance, taxes and archiving of employee records; Art. 6(1)(c) GDPR and Art. 9(2)(b) GDPR), as well as legitimate interests (Art. 6(1)(f) GDPR), understood as enabling the Administrator to contact the right person on business matters (where necessary for the proper performance of assigned tasks), g) cooperation under a contract other than an employment contract (e.g. a contract for specific work or a contract of mandate):

the need to perform the contract or to process personal data before concluding it, at your request (Art. 6(1)(b) GDPR),
compliance with legal obligations relating to insurance, taxes and document archiving (Art. 6(1)(c) GDPR),
legitimate interests (Art. 6(1)(f) GDPR), understood as enabling the Administrator to contact the right person on business matters (where necessary for the proper performance of assigned tasks), h) ongoing contact with representatives, designated contact persons or persons who contact us themselves – the legal basis is the administrator's legitimate interests (Art. 6(1)(f) GDPR), understood as accepting an enquiry, responding to it and maintaining ongoing contact,
6.3. You can contact me via my email address, where you give me your email address so that I can get in touch and reply to your enquiry. Providing this data is required to accept and handle the enquiry.

6.4. Browsing my Online shop:

6.4.1. the data of everyone using the Online shop (including IP address or other identifiers and information collected via cookies or similar technologies) who are not registered Users (i.e. people without a profile in my Online shop) is processed by the Administrator for one or more of the following purposes:

providing electronic services by making the content of the Online shop available to Users and providing contact forms – legal basis: processing necessary to perform a contract (Art. 6(1)(b) GDPR);
handling purchases made without registering in the Online shop – legal basis: processing necessary to perform a contract (Art. 6(1)(b) GDPR);
handling complaints – legal basis: processing necessary to perform a contract (Art. 6(1)(b) GDPR);
analytics and statistics – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of analysing Users' behaviour, activity and preferences in order to improve the quality and relevance of the features and services provided;
establishing, pursuing or defending against any claims – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of protecting its rights;
marketing by the Administrator and other entities, in particular relating to behavioural advertising – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of tailoring the advertising content displayed – see the rules on processing personal data for marketing purposes.
6.4.2. Registering in my Online shop:

Users who register in the Online shop by creating a Customer Account are asked to provide the data needed to create and maintain the account. To make ordering easier, the User may provide additional data and consent to its processing. Additional data can be changed or deleted at any time. Providing data marked as mandatory is required to create and maintain an account; without it, an account cannot be created. Personal data provided to the administrator is processed for one or more of the following purposes:

providing services related to running and maintaining an account in the Online shop – legal basis: processing necessary to perform a contract (Art. 6(1)(b) GDPR),
analytics and statistics – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of analysing Users' behaviour, activity and preferences in order to improve the quality and relevance of the features and services provided;
establishing, pursuing or defending against any claims – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of protecting its rights;
marketing by the Administrator and other entities, in particular sellers using the Marketplace service – the rules on processing personal data for marketing purposes are described in the "MARKETING" section.

6.4.3. Placing an order

Placing an order (an offer to buy goods) in the Online shop involves processing the User's personal data. Providing data marked as mandatory is voluntary but necessary to fulfil and deliver the ordered goods; without it, an order cannot be placed. Providing other data is optional and does not affect the fulfilment of the order.
Personal data is processed as part of placing an order in the Online shop for one or more of the following purposes:
– fulfilling the order – legal basis:
– for mandatory data – processing necessary to perform a contract (Art. 6(1)(b) GDPR), and for optional data – consent (Art. 6(1)(a) GDPR);
– fulfilling the Administrator's statutory obligations, arising in particular from tax and accounting regulations – legal basis: legal obligation (Art. 6(1)(c) GDPR);
– analytics and statistics – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of analysing Users' behaviour, activity and preferences in order to improve the quality and relevance of the features and services provided;
– establishing, pursuing or defending against any claims – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of protecting its rights;
6.4.4. Contact form

The Administrator's Online shop allows you to contact the Administrator using an electronic contact form. Using the form requires providing the personal data needed to contact the User and reply to the enquiry. The User may also provide other data to make contact or handling the enquiry easier. Providing data marked as mandatory is required to accept and handle the enquiry; without it, the form cannot be used. Providing non-required data is voluntary.
Personal data provided to the Administrator in the contact form is processed for one or more of the following purposes:
– identifying the sender and handling their enquiry sent via the form – legal basis: processing necessary to perform a contract for the provision of a service (Art. 6(1)(b) GDPR);
– analytics and statistics – legal basis: the Administrator's legitimate interest (Art. 6(1)(f) GDPR), consisting of keeping statistics on enquiries submitted by Users via the Online shop in order to improve its features and the Administrator's activities
6.5. Marketing:

6.5.1. The Administrator processes Users' personal data for marketing purposes, on the legal basis of the Administrator's legitimate interest (Art. 6(1)(f) GDPR). This may include in particular:

displaying marketing content to the User that is not tailored to their preferences (contextual advertising);
displaying marketing content to the User that matches their interests (behavioural advertising);
sending email notifications about interesting offers or content, which in some cases contain commercial information;
carrying out other direct marketing activities for goods and services (sending commercial information electronically and telemarketing).
For marketing purposes, the Administrator in some cases uses profiling.

6.5.2. Contextual advertising. The Administrator processes Users' personal data for marketing purposes in connection with showing Users contextual advertising (i.e. advertising not tailored to the User's preferences). This processing is based on the Administrator's legitimate interest (Art. 6(1)(f) GDPR).

6.5.3. Behavioural advertising. The Administrator processes Users' personal data, including data collected via cookies and similar technologies, for marketing purposes in connection with showing Users behavioural advertising (i.e. advertising tailored to the User's preferences). This processing also includes profiling Users. The use of personal data collected via this technology for marketing purposes, in particular to promote third parties' services and goods, is based on the administrator's legitimate interest and only on condition that the User has consented to the use of cookies. Consent to the use of cookies can be given through the appropriate browser settings and can be withdrawn at any time, in particular by clearing the cookie history and disabling cookies in the browser settings. This consent can be withdrawn at any time.

6.5.4. Direct marketing. If the User has consented to receiving marketing information by email, SMS or other electronic means, their personal data will be processed to send them such information. The legal basis for processing is the Administrator's legitimate interest in sending marketing information within the limits of the consent given by the User (direct marketing). The User has the right to object to processing for direct marketing purposes, including profiling. Data will be stored for this purpose for as long as the Administrator's legitimate interest exists, unless the User objects to receiving marketing information.

7. SOCIAL MEDIA

I run profile pages on:

Facebook, Instagram, Pinterest and TikTok
which may involve me processing your personal data when you visit these profiles, pages and channels or interact with them (likes, subscriptions, comments, messages). If you visit my social media profiles on platforms such as Facebook, data about your activity on that profile is collected, including likes, messages sent, and the content of comments and posts on that profile. Please remember that, as users of a social media platform, both you and I are also bound by the privacy policy and terms accepted on that platform. Data related to your activity on my social media profiles will be stored until you delete it, or until it is deleted by me or by the owner of the platform. Please remember that, as a user of each social media platform where I have a profile, you can also manage your account and the content you post in accordance with that platform's rules. Providing data is voluntary but may be necessary for a specific service

8. INFORMATION ON THE USE OF COOKIES

WHAT ARE COOKIES?

8.1. Cookies are small text files saved and stored on the devices through which the User uses the Service. Cookies collect information that makes the Service easier to use – e.g. by remembering

the User's visits and actions. The cookies I use are safe for the User's Device. In particular, they cannot be used to introduce viruses or other unwanted or malicious software onto Users' Devices. These files make it possible to identify the software used by the User and to tailor the Service to each User individually.

TYPES OF COOKIES USED BY THE ADMINISTRATOR

8.2. We use the following types of cookies:

8.2.1. Required cookies are essential for the Service to work properly. They allow the Administrator to securely carry out actions such as fulfilling the User's order, "remembering" a logged-in User when moving to another page, or automatically filling in address details when shopping. Blocking these cookies in the User's browser may cause the Service to work incorrectly. These cookies are required and cannot be deactivated.

Specific purposes of technical cookies:

a) ensuring the security and reliability of the Service;

b) carrying out processes necessary for the full functionality of the Service, including

among others:

adjusting the content of the Service so the User can make full use of the available features and to optimise the use of the Service's web pages. In particular, these files make it possible to recognise the basic parameters of the User's Device and display the website appropriately;
correct operation of the "Refer a friend" programme, in particular verifying the sources of User referrals to the Service's web pages;
enabling the "Wishlist" and "Cart" features in the Service.
8.2.2. Analytical cookies are used by the Administrator both to analyse User behaviour in the Service for business purposes and to understand how Users use the Service. This helps identify which features need improving or updating. Information obtained by the Administrator via analytical cookies is anonymous – the Administrator cannot use it to identify the User from whom it was obtained.

8.2.3. Personalisation cookies allow analysis of Users' behaviour in the Service and their shopping preferences, which makes it possible to offer Users personalised product suggestions, make changes to the Service's features and display sponsored content. Data obtained via this type of cookie may also be used to improve existing systems and software

and to develop new solutions and features.

8.2.4. Advertising cookies allow the Administrator to tailor the ads displayed to Users' preferences and interests, i.e. to show Users so-called behavioural advertising. With their help, entities cooperating with the Administrator, such as the operators of Facebook or Instagram, can tailor the advertising content displayed to the User's preferences.

COOKIE STORAGE PERIOD

8.3. The cookies described above can be divided into two types according to how long they are stored:

8.3.1. Session cookies are stored on the User's Device until the browser session ends. The stored information is then permanently deleted from the Device's memory.

8.3.2. Persistent cookies are stored on the Device until they are deleted.

Ending the browser session or switching off the Device does not delete them. If the User does not delete persistent cookies from their Device, they will be stored for up to 60 days from when they were set.

MANAGING COOKIES IN THE SERVICE

8.4. Only required cookies are necessary for the Service to work properly. For other types of cookies, you may consent to their use, but this is not mandatory. You can manage my use of analytical, personalisation and advertising cookies by giving or withdrawing consent to their use. You can manage your consent to each type of cookie at any time using the panel I provide. The panel can be opened via the "Your cookies" tab in the footer of the Service.

GOOGLE ANALYTICS

8.5. Google Analytics. If, on your first visit to my website, you accept my use of performance cookies, information about your visits to this site will be recorded on my website using Google Analytics cookies, a web analytics service. This information is transmitted to and stored on a Google server in the United States. I have enabled IP anonymisation on my website. Your address will be shortened by Google within a Member State of the European Union or another signatory state of the European Economic Area. On my behalf, Google will use this information to analyse use of the site, compile reports on site activity and provide further services to the site operator relating to use of the site and the Internet. The IP address sent from your browser as part of Google Analytics will not be combined with other data held by Google. If you change your mind and no longer want cookies to be stored, simply change the relevant settings by clicking the "Cookie settings" button in the footer of my website, or delete cookies through your browser settings (details below).

OTHER TECHNOLOGIES

8.6. Other technologies. On my site I may also use other technologies, including web beacons and JavaScript, which in some cases work together with cookies and other means on my site to identify your device, as well as the FB Pixel (an analytics add-on that lets me monitor your actions in the shop. It helps me understand your behaviour and preferences. It also lets me measure the effectiveness of ads, and is needed for effective remarketing), Hotjar (lets me see how you interact with my Website and shop, and lets me record user data based on their areas of interest), and Tag Manager. These other technologies make it possible to activate certain features on my site. I may also use certain technologies to find out whether an email we sent you was opened or whether you clicked a link in it.

9. WHO WILL I SHARE YOUR PERSONAL DATA WITH?

9.1. The Administrator discloses personal data only to authorised employees and associates and to the following categories of recipients:

authorities entitled under the relevant laws (e.g. inspection authorities, bailiffs, the Police),
authorised entities, where necessary for the proper performance of a contract (e.g. sharing data with a bank in connection with transfers for settlements, or with a notary's office when concluding a property purchase agreement by notarial deed),
authorised entities, where necessary for the proper conduct of proceedings (e.g. disclosing data to legal representatives or in court when defending or pursuing claims),
entities authorised under data processing agreements, i.e. service providers I have authorised to access personal data to the extent necessary to perform the commissioned service (e.g. support services for IT infrastructure or systems, website maintenance, repairing defects in properties). My providers are based mainly in Poland and other countries of the European Economic Area (EEA). In connection with the use of Google Analytics, personal data is transferred outside the EEA (to the United States of America). In connection with the transfer of your data outside the EEA, my providers are obliged to guarantee an adequate level of personal data protection. These guarantees arise in particular from the commitment to apply the standard contractual clauses adopted by the (EU) Commission. Information on data transfers by Google can be found here: https://policies.google.com/technologies/partner-sites?hl=p
9.2. If we transfer Personal data outside the EEA, we will make sure it is protected in the same way as in the EEA.

I will use one of the following safeguards:

Transfer to a non-EEA country whose privacy laws provide the same level of protection of Personal data as countries of the European Economic Area;
Concluding an agreement with the foreign third party requiring it to protect personal data to the same standards as in the EEA; or
Transferring personal data to organisations that are part of specific arrangements on cross-border data transfers with the European Union (e.g. the Privacy Shield, a framework setting privacy standards for data transferred between the United States and European countries, and other similar legal frameworks).
10. HOW LONG WILL I PROCESS YOUR PERSONAL DATA?

10.1. How long I process your data depends on the type of service provided and the purpose of processing. As a rule, data is processed for as long as the service is provided, until consent is withdrawn, or until an effective objection to processing is raised where the legal basis for processing is the Administrator's legitimate interest.

10.2. The processing period may be extended where processing is necessary to establish and pursue any claims or defend against them, and after that only where and to the extent required by law. After the processing period ends, data is irreversibly deleted or anonymised.

10.3. I will actively review the personal data I hold and securely delete it, or in some cases anonymise it, when there is no longer a legal, business or consumer need to keep it.

11. WHAT RIGHTS DO YOU HAVE REGARDING THE PROCESSING OF YOUR PERSONAL DATA?

11.1. In connection with my processing of your Personal data, you have the following rights:

the right to information about the processing of Personal data – on this basis
the Administrator gives you information about the processing of your Personal data, in particular the purposes and legal bases of processing, the scope of data held, the entities to which it is disclosed, and the planned date of deletion;

the right to obtain a copy of data – on this basis the Administrator gives you
a copy of your Personal data that it processes;

the right to rectification – the Administrator must remove any
inconsistencies or errors in the Personal data processed and complete it if it is incomplete;

the right to erasure – on this basis you can request the deletion
of data whose processing is no longer necessary for any of the purposes for which it was collected;

the right to restriction of processing – if you make such a request,
the Administrator stops performing operations on your Personal data – except for operations you have consented to and storage of the data in accordance with the adopted retention rules – or until the reasons for restricting processing cease (e.g. a supervisory authority issues a decision allowing further processing);

the right to data portability – on this basis – to the extent that data
is processed by automated means in connection with a contract or consent – the Administrator provides the data you supplied in a machine-readable format. You may also request that this data be sent to another entity, provided this is technically possible for both the Administrator and you;

the right to object to processing for marketing purposes –
you can object at any time to the processing of your Personal data for marketing purposes, without having to give reasons;

the right to object to other purposes of processing – you can
object at any time – on grounds relating to your particular situation – to the processing of your Personal data based on the Administrator's legitimate interest (e.g. for analytical or statistical purposes or for reasons related to the protection of property); an objection in this respect should include a justification;

the right to withdraw consent – if data is processed on the basis of
your consent, you have the right to withdraw it at any time, which does not affect the lawfulness of processing carried out before withdrawal;

the right to lodge a complaint – if you believe that the processing of Personal data
violates the GDPR or other data protection laws, you can lodge a complaint with the supervisory authority competent for your habitual residence, place of work or the place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

12. CHANGES TO THE PRIVACY POLICY

12.1. The Policy is regularly reviewed and updated when necessary.

12.2. We will update this Privacy Information when necessary. When we publish changes to this statement, we will also change the date of the last update. We will also keep previous versions of this Privacy Information in an archive.

We will not limit your rights under this Privacy Information without your consent.