Privacy Policy

Table of Contents

General Provisions

This Privacy Policy of the Online Store is for informational purposes only, which means that it does not impose any obligations on the Customers of the Online Store. The Privacy Policy primarily sets out the rules for the processing of personal data by the Administrator in the Online Store, including the legal basis, purposes, and duration of data processing, as well as the rights of individuals whose data is processed. It also includes information on the use of cookies and analytical tools in the Online Store.

1.Using the Online Store, including making purchases, is voluntary. Similarly, providing personal data by the Customer using the Online Store is voluntary, subject to two exceptions:

Entering into Agreements with the Administrator – Failure to provide personal data required for the conclusion and execution of a Sales Agreement or an Electronic Service Agreement with the Administrator, as specified on the Online Store’s website, in the Terms and Conditions, and in this Privacy Policy, will result in the inability to conclude such an agreement.

Providing personal data in such cases is a contractual requirement, and if the individual wishes to enter into an agreement with the Administrator, they are obligated to provide the required data. The exact scope of the required data is always specified in advance on the Online Store’s website and in the Terms and Conditions.

Administrator’s Legal Obligations – Providing personal data is a legal requirement arising from generally applicable laws that impose an obligation on the Administrator to process personal data (e.g., for maintaining tax or accounting records). Failure to provide such data will prevent the Administrator from fulfilling these legal obligations.

2.All terms, expressions, and acronyms used in this Privacy Policy that begin with a capital letter (e.g., Seller, Online Store, Electronic Service) should be understood in accordance with their definitions provided in the Terms and Conditions of the Online Store, available on its website, unless the context clearly indicates otherwise.

The products and services available on the website are not intended for children under the age of 16. The Administrator does not knowingly collect personal data from children under 16 years old.
In case of any doubts or discrepancies between this Privacy Policy and the consents given by an individual, the voluntarily granted consents or applicable legal provisions shall always take precedence in determining the scope of actions taken by the Administrator.
Who is the Administrator of Your Data?
The Administrator of personal data collected through the Online Store is Katarzyna Ostapowicz, conducting business under the name Kasia Ostapowicz Katarzyna Ostapowicz, registered in the Central Registration and Information on Business (CEIDG) of the Republic of Poland, maintained by the Minister responsible for economic affairs.

The Administrator’s details:
Business address and mailing address: Al. T. Kościuszki 120/47, 90-446 Łódź ,NIP: 8461540141 | REGON: 528376883

Email: info@kasiaostapowicz.com

Hereinafter referred to as the “Administrator”, who is also the Service Provider of the Online Store and the Seller.

If you provide additional consent, our partners may also act as data administrators for information collected based on your online activity, using technologies such as cookies.
For any inquiries regarding your personal data, you can contact the Administrator via:
Email: info@kasiaostapowicz.com
Mailing Address: Al. T. Kościuszki 120/47, 90-446 Łódź
The Administrator retains correspondence for statistical purposes, to ensure the best and fastest response to inquiries, and for handling complaints. Data collected in this way will not be used for communication other than processing the submitted request.
If you contact the Administrator to carry out specific actions (e.g., submitting a complaint via a form), the Administrator may request you to provide additional personal data (such as name, surname, email address, etc.) to confirm your identity and facilitate further communication regarding the matter. Providing this data is not mandatory, but it may be necessary to complete the requested action or obtain the desired information.
How do we protect your data?
Personal data in the Online Store is processed by the Administrator in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (Official Journal of the EU L No. 119, p. 1) (hereinafter also referred to as “GDPR”), as well as other currently applicable data protection laws throughout the entire period of data processing.
Taking into account the nature, scope, context, and purposes of processing, as well as the risks of violating the rights or freedoms of natural persons with varying likelihood and severity, the Administrator implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with this Regulation and to be able to demonstrate compliance. These measures are reviewed and updated as necessary.Początek formularzaDół formularza

3.The technical measures implemented by the Administrator to prevent unauthorized access to and modification of personal data transmitted electronically, as well as to ensure the protection of processed personal data, include: SSL Certificate; securing the data set against unauthorized access; encrypting data used for user authentication in the Online Store; and granting access to the Account only after entering an individual login and password.

The Administrator takes special care to protect the interests of individuals whose data is processed and, in particular, ensures that the collected data is:
processed lawfully, fairly, and transparently for the data subject;
collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
accurate and, where necessary, kept up to date;
stored in a form that allows the identification of the data subject for no longer than necessary for the purposes for which the data is processed;
processed in a manner that ensures appropriate security of Personal Data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures.

For what purposes is data about you used?

1.Each time, the purpose, basis and period, as well as the recipients of personal data processed by the Administrator result from the actions taken by a given Service Recipient or Customer in the Online Store or by the Administrator. For example, if the Customer decides to make purchases in the Online Store and chooses personal collection of the purchased Product instead of courier delivery, then their personal data will be processed for the purpose of performing the concluded Sales Agreement, but will no longer be made available to the carrier carrying out the shipments on behalf of the Administrator.

Possible purposes of processing Customers’ Personal Data by the Administrator include in particular:
Concluding and implementing the Agreement for the Provision of Services (Account) or taking action at the request of a future Client before concluding it, we process data in order to maintain your Account so that you can use functionalities such as: placing orders without having to fill out forms every time and accessing information on the status of the order, maintaining purchase history;
In order to provide Services that do not require the creation of an Account and the purchase of Goods, i.e. browsing the websites of the Online Store, searching for Goods, we process personal data relating to your activity in the Online Store, i.e. data relating to the Goods you browse, data relating to the session of your device, operating system, browser, location and unique ID, IP address;
In order to perform the contract for the sale of Goods (e.g. delivery of ordered Goods), we process personal data provided by you when purchasing Goods, such as name and surname, e-mail address, telephone number, address details, payment details. We need your personal data to process your order and perform the concluded contract – in particular to confirm its placement and to reserve or send you the selected product, as well as to contact you in this matter if necessary;
In order to establish, pursue and enforce claims and defend against claims in court proceedings and other enforcement bodies, we may process your personal data provided when purchasing Goods or creating an Account and other data necessary to prove the existence of a claim or which result from a legal requirement, court order or other legal procedure;
In order to consider complaints, grievances and requests and to answer Customers’ questions, we process the personal data provided by you in the contact form, complaints, grievances and requests, or in order to answer questions included in another form and some of the personal data provided by you in the Account, as well as data regarding the order of the Goods and other Services provided by us that are the reason for the complaint, grievance or request and data contained in the documents attached to the complaints, grievances and requests;
In order to fulfil legal obligations arising from regulations, e.g. tax and accounting, especially in the case of paid contracts;
Conducting correspondence with Clients, including responding to Client messages.
For statistical purposes relating to the use of individual functionalities available in the Online Store, to facilitate the use of the Online Store and to ensure the IT security of the Online Store, we process personal data relating to your activity in the Online Store and the amount of time spent on each of the subpages in the Online Store, your search history, location, IP address, device ID, data relating to your web browser and operating system;
For the purpose of marketing our products, including remarketing, for this purpose we process personal data provided by you when creating an Account and updating it, data regarding your activity in the Online Store, including orders, which are registered and stored via cookies, and in particular order history, search history, clicks in the Online Store, login and registration dates, history and your activity related to our communication with you. In the case of remarketing, we use data about your activity in order to reach you with our marketing messages outside the Online Store and we use the services of external suppliers for this purpose. These services consist in displaying our messages on websites other than the Online Store.
On what basis and for what period do we process data?
The basis for processing the Customer’s Personal Data is primarily the need to perform the contract to which he is a party or the need to take action at his request before its conclusion (Article 6, paragraph 1, (b) of the GDPR). This applies primarily to Personal Data provided in the form when registering an Account, placing Orders and concluding a Sales Agreement in the Online Store, as well as when signing up for the newsletter. Also in the case of Personal Data provided to us in connection with the Customer’s complaint, the legal basis for their processing is the necessity to perform / service the sales agreement for the goods complained about.
The Administrator is entitled to process personal data in cases where – and to the extent that – at least one of the following conditions is met: (1) the data subject has consented to the processing of his or her personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party or to take action at the request of the data subject prior to entering into a contract; (3) processing is necessary to fulfill a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data.
Personal data will be processed for the period necessary to fulfill orders, services, marketing activities, and other services provided to the Client. If the processing of Personal Data is based on the Client’s consent, the Personal Data may be processed until the consent is withdrawn.
Personal data may be deleted in the following cases:
when the data subject requests their deletion or withdraws the given consent;
upon receiving information that the stored data is outdated or inaccurate;
after three years from the Client’s last activity within the Online Store;
if they are related to cookies and similar technologies – through browser/device settings.
Some data, such as email address, first name, and last name, may be stored for an additional 3 years for evidentiary purposes, handling complaints, claims, and disputes related to the services provided by the Online Store. These data may be used by the Administrator to pursue claims or to defend against claims from third parties but will not be used for marketing purposes.
A longer retention period for Personal Data may also apply if legal regulations (e.g., accounting or tax laws) require the Administrator to process them.
Data concerning non-logged-in Clients is stored for a period corresponding to the lifecycle of cookies saved on their devices or until the Client deletes them from their device.

Purpose of Data Processing – Legal basis – Data storage period

Execution of a Sales Agreement or an agreement for the provision of an Electronic Service or taking action at the request of the data subject before concluding the above-mentioned agreements. – Article 6(1)(b) of the GDPR (performance of a contract) – processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject before entering into a contract. – The data is stored for the period necessary to execute, terminate or otherwise expire the concluded Sales Agreement or the agreement for the provision of Electronic Services.

Marketing. – Article 6(1)(a) of the GDPR Regulation (consent) – the data subject has consented to the processing of his or her personal data for marketing purposes by the Controller. – The data is stored until the data subject withdraws consent to further processing of his or her data for this purpose.

Direct marketing. – Article 6 paragraph 1 (f) of the GDPR Regulation (legitimate interest of the administrator) – processing is necessary for the purposes resulting from the legitimate interests of the Administrator – consisting in taking care of the interests and good image of the Administrator, its Online Store and striving to sell Products. – Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator’s claims against the data subject, resulting from the business activity conducted by the Administrator. The limitation period is specified by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years, and for the Sales Agreement two years). The Administrator may not process data for direct marketing purposes in the event of an effective objection in this respect by the data subject.

The Customer’s expression of opinion on the concluded Sales Agreement – Article 6(1)(a) of the GDPR Regulation – the data subject has consented to the processing of his or her personal data for the purpose of expressing an opinion – The data is stored until the data subject withdraws consent to further processing of his or her data for this purpose.

Tax bookkeeping. – Article 6 section 1 (c) of the GDPR Regulation in connection with Article 86 § 1 of the Tax Ordinance Act of 17 January 2017 (Journal of Laws of 2017, item 201) – processing is necessary to fulfil the legal obligation incumbent on the Administator. – The data is stored for the period required by law requiring the Administrator to store tax books (until the expiry of the limitation period for the tax liability, unless tax laws provide otherwise).

Determining, pursuing or defending claims that may be raised by the Administrator or that may be raised against the Administrator. – Article 6 paragraph 1 (f) of the GDPR Regulation (legitimate interest of the administrator) – processing is necessary for the purposes resulting from the legitimate interests of the Administrator – consisting in determining, pursuing or defending claims that may be raised by the Administrator or that may be raised against the Administrator. – The data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims that may be brought against the Administrator (the basic limitation period for claims against the Administrator is six years).

Using the Online Store website and ensuring its proper functioning. – Article 6 paragraph 1 (f) of the GDPR Regulation (legitimate interest of the administrator) – processing is necessary for the purposes resulting from the legitimate interests of the Administrator – consisting in managing and maintaining the Online Store website. – Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator’s claims against the data subject resulting from the business activity conducted by the Administrator. The limitation period is specified by law, in particular the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and for the Sales Agreement – two years).

Maintaining statistics and analyzing traffic in the Online Store. – Article 6 paragraph 1 (f) of the GDPR Regulation (legitimate interest of the Administrator) – processing is necessary for the purposes resulting from the legitimate interests of the Administrator – consisting in keeping statistics and analysing traffic in the Online Store in order to improve the functioning of the Online Store and increase sales of Products. – Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator’s claims against the data subject resulting from the business activity conducted by the Administrator. The limitation period is specified by law, in particular the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and for the Sales Agreement – two years).

6.Data recipients – who can we share your data with?

For the proper functioning of the Online Store, including the implementation of concluded Sales Agreements, it is necessary for the Administrator to use the services of external entities, in particular providers of technical, logistic and financial services (such as carriers or intermediaries carrying out the shipment of Orders or an entity handling electronic payments). The Administrator only uses the services of such processing entities that provide sufficient guarantees for the implementation of appropriate technical and organizational measures so that the processing meets the requirements of the GDPR Regulation and protects the rights of data subjects.
Each time, the catalog of recipients of Personal Data processed by the Administrator results primarily from the scope of services used by the Client. The catalog of data recipients also results from the Client’s consent, or from legal regulations, and is specified as a result of actions taken by him in the Online Store.
The Administrator does not transfer data in every case and not to all recipients or categories of recipients indicated in the privacy policy – the Administrator transfers data only when it is necessary to achieve a given purpose of personal data processing and only to the extent necessary to achieve it. For example, if the Customer uses personal collection, their data will not be transferred to a carrier cooperating with the Administrator.
The personal data of Service Users and Customers of the Online Store may be transferred to the following recipients or categories of recipients:
Carriers / entities operating the warehouse and/or the shipping process – in the case of a Customer who uses the Online Store to deliver the Product by post or courier, the Administrator makes the collected personal data of the Customer available to the selected carrier or intermediary carrying out shipments on behalf of the Administrator, and if the shipment is made from an external warehouse – to the entity operating the warehouse and/or the shipping process – to the extent necessary to complete the delivery of the Product to the Customer.
Entities handling electronic payments or payment cards – in the case of a Customer who uses electronic payments or payment cards in the Online Store, the Administrator makes the collected personal data of the Customer available to the selected entity handling the above payments in the Online Store at the request of the Administrator to the extent necessary to handle the payment made by the Customer.
Providers of accounting, legal and advisory services providing the Administrator with accounting, legal or advisory support (in particular an accounting office, law firm or debt collection company) – the Administrator makes the collected personal data of the Client available to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing in accordance with this privacy policy.
Depending on the contractual arrangements and circumstances, these entities act on our behalf or independently determine the purposes and methods of their processing.
Personal data may also be transferred to state authorities (e.g. the President of the Office of Competition and Consumer Protection, UODO, prosecutor’s office, police) if they request it.

Data subject rights – what rights do you have?
Under the Personal Data Protection Regulation, every Client has the right at any time to:
request access to your personal data (including, for example, receiving information about which data is being processed);
request the rectification of your personal data (e.g. if the data is incorrect);
request the deletion of your personal data (the right to be forgotten);
request to limit the processing of personal data, e.g. to withdraw any consent given to the Administrator at any time, provided that the withdrawal of consent does not affect the processing carried out by the Administrator in accordance with the law before its withdrawal;
request the transfer of personal data.
object to the processing of personal data;
lodging a complaint with the President of the Personal Data Protection Office;
The right to access, rectify, limit, delete or transfer – the data subject has the right to request from the Administrator access to their personal data, rectify, delete (“the right to be forgotten”) or limit processing and has the right to object to processing, as well as the right to transfer their data. Detailed conditions for exercising the above-mentioned rights are indicated in Articles 15-21 of the GDPR Regulation.
The right to withdraw consent at any time – a person whose data is processed by the Administrator on the basis of expressed consent (based on art. 6 sec. 1 l (a) or art. 9 sec. 2 (a) of the GDPR Regulation) has the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal.
The right to lodge a complaint with a supervisory authority – a person whose data is processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the provisions of the GDPR Regulation and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
Right to object – the data subject has the right to object at any time – for reasons relating to his or her particular situation – to the processing of his or her personal data based on Article 6(1)(e) (public interest or tasks) or (f) (legitimate interest of the administator), including profiling based on these provisions. In such a case, the administrator is no longer allowed to process the personal data, unless he or she demonstrates compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject, or grounds for establishing, pursuing or defending claims.
The right to object to the processing of personal data – if personal data are processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of his or her personal data for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing.
In order to exercise the rights referred to in this point of the privacy policy, you can contact the Administrator by sending an appropriate message in writing or by e-mail to the Administrator’s address indicated at the beginning of the privacy policy or by using the contact form available on the Online Store website.
The personal data Administrator shall provide you with information on the actions taken in relation to your request without undue delay – and in any case within one month of receiving the request. If necessary, the one-month period may be extended by another two months due to the complex nature of the request or the number of requests.
In each case, the Personal Data Controller will inform you of such extension within one month of receiving the request, stating the reasons for the delay.
Will commercial information be sent to you (e.g. to your email address)?
The Administrator has the technical ability to communicate with the Client remotely (e.g. e-mail).
Commercial and marketing information related to the commercial activities conducted by the Administrator may be sent only on the basis of the consent expressed by the Client.
Cookies
What are cookies?

Cookies are text files stored in end-user devices (computers, phones, etc.) intended for using websites. These files allow the user’s device to be recognized and the website to be displayed appropriately, adjusted to their individual preferences. Cookies usually contain the name of the website they come from, the time they are stored on the device, and a unique number. Detailed information on Cookies, as well as the history of their creation, can be found here: HTTP cookie – Wikipedia, wolna encyklopedia

What do we use cookies for?

Cookies are contained in the HTTP protocol, which is used for communication between the web server and the browser. It consists of: a key defining the name of the value, the value and the lifetime after which the browser should delete the cookie. Their functions are mostly standard for the settings provided by browsers. Cookies are used to facilitate the use of the website and to adapt its content, including our offers, to user preferences and to increase the usability and personalization of the content of websites.

What cookies do we use?

Two types of cookies are used – session cookies and persistent cookies. The first are temporary files that remain on the user’s device until logging out of the website or disabling the software (internet browser) – then they are automatically deleted from the user’s device. “Permanent” files remain on the user’s device for the time specified in the parameters of “cookies” files or until they are manually deleted by the user. Cookies used by the website operator’s partners are subject to their own privacy policies.

The “cookies” we use are primarily intended to make it easier for the user to use our website, for example by “remembering” information provided once, so that the user does not have to provide it every time. We also use cookies that allow us to adapt the presented content to the user’s preferences.

When a user uses our website, we use cookies to identify the user’s browser or device – cookies collect various types of information that, as a rule, do not constitute personal data (they do not allow the user to be identified).

Profiling

Using the cookie technology used on our website, it is possible to learn about user preferences – e.g. by analyzing how often they visit our website, or what products they most often view. Analyzing online behavior helps us better understand the habits and expectations of users and adapt to their needs and interests.

The Administrator may use profiling in the Online Store for direct marketing purposes, but the decisions made on its basis by the Administrator do not concern the conclusion or refusal to conclude a Sales Agreement, or the possibility of using Electronic Services in the Online Store. The effect of using profiling in the Online Store may be, for example, granting a given person a discount, sending them a discount code, reminding them about unfinished purchases, sending a proposal for a Product that may suit the interests or preferences of a given person, or proposing better conditions compared to the standard offer of the Online Store. Despite profiling, the given person freely decides whether they will want to use the discount received in this way, or better conditions and make a purchase in the Online Store.

Retargeting

Based on cookies, we use technology that allows us to reach users who have previously visited our website with advertising messages on other websites they visit, including those belonging to entities cooperating with our partners, in order for the message received by the user to correspond to their interests and needs identified as a result of the analysis of their previous behavior, based on cookie technology.

Third party cookies

The cookies we use are primarily used to optimize the user experience when using our website. We also cooperate with other companies in the scope of their marketing activities. For the purposes of this cooperation, the browser or other software installed on the user’s device also saves cookies from entities conducting such marketing activities.

Cookies sent by these entities are intended to improve the effectiveness of presenting the user with advertisements that correspond to their online activity – third parties provide advertising content to users.

Therefore, during a visit to our website, cookies from our partners are also saved on the user’s computer or other device. In this way, information about viewed or purchased products is collected, for example.

As part of marketing (advertising) and analytical activities (creating statistics), the Administrator may use the services of the following entities that use cookies in the Online Store:

Google Analytics
Google Ads
Google TagManager
Google Dynamic Retargeting
Facebook Ads
Facebook Dynamic Retargeting
Facebook Pixel
Facebook Messenger
Freshmail

More information about the cookies of these entities can be found in their privacy policies.

Deleting and blocking cookies

You can manage cookie consent through your browser’s privacy settings. By default, web browsers or other software installed on a computer or other user device connected to the network allow certain types of cookies to be placed on such a device. These settings can be changed to block the use of cookies in the web browser settings or to inform about each time they are sent to the user’s device. In this way, the consent expressed to use this technology can also be modified or withdrawn at any time (blocking the saving of cookies in the future). It is also possible to block third-party cookies while accepting cookies directly from the Service Administrator.

Detailed information about the possibilities and methods of handling cookies is available in the settings of a given web browser. For example, in Internet Explorer, cookies can be modified from: Tools -> Internet Options -> Privacy; in Mozilla Firefox: Tools -> Options -> Privacy; and in Google Chrome: Settings -> Show advanced settings -> Privacy -> Content settings -> Cookies. Access paths may vary depending on the browser version used.

Detailed information on managing cookies on a mobile phone or other mobile device can be found in the user manual/instruction manual for the phone or mobile device. Restricting the use of cookies may affect some of the functionalities available on the website, for example it may be associated with the inability to maintain a login session. Please note that opting out of cookies will only apply to a specific browser. This means that the same actions will have to be taken in the case of any other browser used on the same or another device.

Final provisions
The Administrator may change the Policy in the future for the following reasons, among others:
changes in applicable regulations, in particular in the field of Personal Data protection, telecommunications law, services provided electronically and regulating consumer rights, affecting the rights and obligations of the Administrator or the rights and obligations of the data subject;
development of functionalities or Electronic Services dictated by the progress of Internet technology, including the use/implementation of new technological or technical solutions affecting the scope of the Policy.
With each change, a new version of the Policy will appear with a new date.
The Online Store may contain links to other websites. The Administrator encourages you to read the privacy policy established there after going to other websites. This privacy policy applies only to the Administrator’s Online Store.

Privacy Policy

Privacy Policy

Help

Contact