Privacy Policy
You have the right, among others, to access your data, correct it, and request its deletion. Additionally, you have the right to object to the processing of your personal data or request the restriction of its processing.
Providing the required personal data is voluntary but is a condition for us to provide certain services to you (e.g., maintaining an account) or to fulfill a contract. We do not make individual decisions based solely on automated processing (profililing) that would produce legal effects or similarly significantly affect your situation.
Our domain has an SSL certificate, ensuring that your data is encrypted.
Below you will find all the most important issues related to the processing of personal data on our website.
Who is the controller of the website and personal data?
The controller of the website and personal data is Bracia Wydmuch sp. z o.o. sp. k., with its registered office at ul. Śląska 69, 42-130 Wręczyca Wielka, entered in the register of entrepreneurs maintained by the District Court in Częstochowa, XVII Commercial Division of the National Court Register under the number KRS: 0000790847, with NIP: 5742068289.
Contact details: phone number +48 792 252 222, email address: czesci@braciawydmuch.pl
What is the legal basis for processing personal data?
Personal data is collected and processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR). The processing of personal data is also regulated by the national Act of 10 May 2018 on the protection of personal data (consolidated text: Journal of Laws of 2019, item 1781).
What data do we process?
Depending on the purpose and user preferences, we may process data such as: name and surname, address, email address, phone number, bank account number, IP address, and in the case of entrepreneurs, also NIP number and address of business operations. Additionally, we may process other personal data provided in correspondence sent to us.
For purposes related to analytics, we may also process data concerning the source of the visit to the Store, the operating system and web browser used to browse the Store, data on viewed products, time spent on the website, abandoned carts, placed orders, user age range, gender, approximate location, and interests (based on online activity).
The above data is provided to us as a result of actions such as:
- Using the contact form
- Sending correspondence directly to our email address
- Providing us with data during a phone conversation
- Registering an account in the Store
- Placing an order in the Store
- Adding a product review (if such an option is available)
- Collecting other data used for analytics by the Store’s software or tools listed in this Privacy Policy.
For what purposes do we process your data?
We process data to the extent necessary for the functioning of our store and store it for the period permitted by law. We process data provided by users during their use of the store.
Concluding and performing a contract – based on Article 6(1)(b) GDPR, i.e., when processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
Creating and maintaining an account – based on Article 6(1)(b) GDPR, i.e., when processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
Ensuring contact with us via the contact form, email, or phone conversation – based on Article 6(1)(b) GDPR, i.e., when processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract.
Adding and verifying reviews – based on Article 6(1)(a) GDPR, i.e., when the data subject has given consent to the processing of their personal data for one or more specific purposes.
Direct marketing – based on Article 6(1)(a) GDPR, i.e., when the data subject has given consent to the processing of their personal data for one or more specific purposes, or based on Article 6(1)(f) GDPR, i.e., when processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Fulfilling legal obligations, establishing, and pursuing claims – based on Article 6(1)(c) GDPR, i.e., when processing is necessary for compliance with a legal obligation to which the controller is subject, and based on Article 6(1)(f) GDPR, i.e., when processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Analytical and statistical activities – based on Article 6(1)(f) GDPR, i.e., when processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
We use tools such as Facebook Ads and Google Ads, through which we may target advertisements to specific groups based on interests, gender, age, or profession. These tools are described in detail in the cookie policy.
Who do we share personal data with?
We share personal data with other entities only to the extent that the data subject has consented to the processing, as necessary to perform a contract, or to the extent resulting from the legitimate interests pursued by the controller. These include entities cooperating with the store: the hosting provider, CRM system provider, invoicing system provider, accounting office, courier and transport companies, IT company providing services for the Store, online payment operators, banks, marketing tool providers, and other subcontractors, as well as entities to which we are obliged to transfer your data under applicable regulations.
In the case of data related to analytics and statistics that do not constitute personal data, they may be transferred to companies providing commonly used analytics, statistics, and optimization services, including to the United States (e.g., companies: Google LLC, Meta Platforms Inc.).
Are data transferred to third countries or international organizations?
Some data processing operations may involve transferring them to third countries or international organizations in connection with the use of tools that store personal data on servers located in third countries, particularly the USA.
However, it should be noted that the providers of these tools ensure an adequate level of personal data protection, in particular by participating in the Privacy Shield program or using standard contractual clauses. This applies in particular to services provided by Google Ireland Limited.
What specific rights do you have regarding the processing of your personal data?
You have the right to:
- request access to your personal data
- request rectification of your personal data
- object to the processing of your personal data
- request deletion of your personal data
- request restriction of the processing of your personal data
- request data portability
- obtain information about automated decision-making, including profiling, and the safeguards applied in connection with the transfer of this data outside the EU
- obtain information about the purposes of processing, categories of personal data processed, and the recipients or categories of recipients of this data
- obtain information about the rights under GDPR, the right to lodge a complaint with the Personal Data Protection Office (PUODO), the planned data retention period or the criteria for determining this period, and the source of this data
- obtain a copy of your personal data.
If you wish to exercise any of the aforementioned rights, please inform us. We will promptly provide you with all information regarding the actions taken in response to your request.
You may withdraw your consent to the processing of your personal data at any time. To do so, please contact us.
