Privacy policy
PRIVACY POLICY
What is the privacy policy
This Privacy Policy of the online shop vandanovak.com (‘Privacy Policy’, ‘Policy’) is for information purposes, which means that it does not create obligations for the customers of the online shop. This document is intended to fulfil the information obligation imposed on processors of personal data by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, ‘GDPR’).
The information contained in this Privacy Policy is of a general nature, while detailed information regarding the processing of specific personal data is made available each time it is obtained in the content of the information clause placed on the websites during the shopping activity. In this Policy, we are careful not to use terms whose meaning differs from their meaning in everyday language. In case of doubt, the terms defined in our Online Shop Regulations shall be deemed to be used in this Privacy Policy with the same meaning.
Data administrator
The administrator of the personal data is a company under the name of Vanda Novak spółka z ograniczoną odpowiedzialnością, entered in the Register of Entrepreneurs of the National Court Register under the KRS number 0000712700, NIP: 6751632399, REGON: 369217883 with its registered office in Kraków (31-511), ul. Rakowicka 11, with the share capital of PLN 10,950. The Customer's personal data is processed in accordance with RODO and other currently applicable data protection laws, including in particular the Act of 10 May 2018 on the protection of personal data, Journal of Laws 2018.1000.
Contact with the data controller
Contact with the data controller is possible: at the e-mail address shop@vandanovak.com, by telephone at +48 518 263 621 and by postal mail, to: Vanda Novak sp. z o.o., 11 Rakowicka Street, 31-511 Kraków.
Purposes and legal basis of data processing
The Administrator processes data for the following purposes, on the following legal grounds under the RODO:
conclusion and performance of a contract for the provision of a service for the creation and maintenance of a customer's online account - the data is processed in particular to enable the customer to make purchases without having to fill in data forms each time, as well as to access the purchase history, to manage the data provided, to manage the consents granted, to enable the use of other services available on the website - Article 6(1)(b) of the RODO,
concluding and performing the contract of sale of the offered products - the data is processed in order to enable the Administrator to execute the customer's order and to perform the concluded contract - in particular to confirm its placement, to reserve or send the selected product to the customer, to execute the payment, including on accepting and considering the complaints, warranty or guarantee claims - Article 6(1)(b) RODO,
fulfilment of legal obligations - data is processed in the event that the law in force in Poland so stipulates, in particular in order to fulfil tax law obligations, accounting law - art. 6(1)(c) RODO,
asserting and defending against claims - data is processed in order to enable the shop to assert claims arising from contracts concluded in connection with the shop's operations, as well as to defend against claims by customers or third parties, including the disposal of overdue claims against customers - Article 6(1)(f) RODO,
ensuring the proper and safe use of the online shop - data is collected in order to ensure the smooth and safe operation of the online shop, including for the purpose of uncovering and prosecuting fraud, torts or crimes committed by customers or third parties, as well as for the purpose of making the necessary analyses and comparisons in this regard, insofar as a legal provision imposes such obligations on the Administrator - Article 6(1)(c) RODO,
marketing activities - data is processed for the purpose of presenting commercial information (offers, advertisements, or promotions (discounts) concerning the products or services of the controller or its individual partners or intended for all recipients, in particular for the purpose of fulfilling the newsletter contract; as well as for the purpose of enabling promotional activities, including competitions, and for the purpose of ensuring that competition winners can be selected and prizes can be realised - Article 6(1)(a) RODO.
Profiling
The administrator, for the purpose of presenting advertisements, offers or promotions (discounts) intended for all customers, in a manner tailored to the interests of the customer in question, may learn about the customer's preferences, e.g. by analysing data such as the frequency of visits to the online shop, the type of products/services used by the customer, the value of purchases made, the frequency of visits to the stationary shop, the place of residence and delivery of products, the chosen method of payment/delivery, etc. This action by the administrator allows a better understanding of the customer's expectations and adaptation to their needs. The above-mentioned activities of the controller are performed with the help of technologies that enable the automated processing of customer data. Importantly, profiling does not have legal effects on the customer or affect the customer in any other significant way.
Obtaining data in this way allows decisions to be made regarding:
(a) the type of products presented to the Customer offered to him/her in the first instance on the websites,
the content of advertisements or offers presented or sent to the customer,
offer the customer specific discounts or benefits for the purchase of specific products, offer the customer participation in a marketing or promotional action. Decisions on the aforementioned matters may be taken either by persons acting under the authority of the administrator or automatically, using technology contained in the software used by the administrator. The decisions made do not have legal effects on the customer and do not deprive or limit the customer's access to any products and services offered by the online shop.
However, the result of the above actions may be to offer the customer specific solutions, e.g. a favourable, temporary offer addressed exclusively to an individually selected customer created on the basis of his/her purchase history and behaviour on the website, to which other customers will not have access. In this context, profiling may influence the customer's behaviour and, in some cases, the impact of profiling may be determined to be significant. Therefore, the controller considers that profiling requires the customer's consent in each case. Failure to provide consent will result in the inability to target the customer with offers, advertisements, invitations to participate in promotional or marketing actions formulated according to the customer's preferences.
A customer who has given his or her consent to profiling and in relation to whom a decision as set out above has been made, has the right to obtain human intervention from the controller, to express his or her own position and to challenge this decision and, above all, has the right to withdraw his or her consent to the transmission of such content.
Types of data processed
In particular, the controller may process the following personal data of customers using the online shop:
personal data provided in the form when registering for an account or placing orders in the online shop without creating an account, or in order to use the newsletter or to participate in marketing campaigns, or provided in the course of a conversation with a representative of the controller for any other purpose, i.e: name and surname; e-mail address; contact telephone number; delivery address [street, house number, premises number, postal code, town, country], residence/business/establishment address [if different from the delivery address], bank account number, payment card number, and in the case of non-consumer customers, additionally company name and tax identification number [nip]) and other data collected during the use of the online shop, such as the type of product ordered, shoe number; data obtained from customer activity on the internet or in stationary shops belonging to the controller, including that obtained via the online shop or other channels of communication with the customer, using cookies and similar technologies, such as the duration of the customer's activity in the online shop, the ip address, the customer's order history, the type of terminal device used by the customer.
Voluntary provision of data
The provision of personal data by the customer in the webshop is voluntary. However, it should be borne in mind that the provision of certain personal data may, however, be necessary for the use of individual functions of the shop. Failure to provide personal data may prevent, in particular, the proper performance of the online account service contract, product sales contract, newsletter service contract and the performance of marketing and promotional activities. Therefore, the scope of data required to conclude the respective contract is indicated each time on the web shop pages (data required to conclude a contract/use a specific functionality is clearly marked). The consequence of failing to provide personal data may be the inability to effectively perform the activities the customer intends to use.
Odbiorcy danych
Zewnętrzne podmioty, do których mogą być przekazane dane osobowe Klienta należą następujących kategorii:
Podmioty pomocne w prowadzeniu sklepu internetowego (księgowość, informatycy obsługujący system, podmioty świadczące usługi hostingu, doradcy prawni, windykatorzy) – w celu wykonania ich obowiązków;
Podmioty wykonujące usługi związane z działalnością sklepu (organizujący akcje marketingowe, promocje, obsługujący infolinię, świadczący wsparcie w zakresie obsługi korespondencji z klientami) w celu wykonania ich obowiązków;
Podmioty wykonujące doręczenie (dostawcy, kurierzy, przedsiębiorstwa pocztowe, przewoźnicy) – w celu doręczenia zamówionych produktów;
Podmioty administracji publicznej, sądy i organy sądowe w celu wykonaniu obowiązków ustawowych i w celu dochodzenia roszczeń;
Podmioty obsługujące system płatności (TPay, PayPal, organizacje obsługujące płatności bezgotówkowe i za pomocą kart płatniczych, banki) – w celu obsługi płatności.
Wszystkie podmioty wymienione powyżej przetwarzają dane Klienta na podstawie zawartych umów powierzenia przetwarzania danych osobowych i gwarantują odpowiedni poziom ochrony danych osobowych.
Transfer of data to third countries (outside the EEA)
The controller may transfer personal data to third countries, i.e. countries outside the European Economic Area. Your data may only be transferred to third countries or entities for which an adequacy decision has been issued by the European Commission. A list of countries for which the European Commission has issued a decision confirming that the third country provides an adequate level of protection can be found at this link.
With regard to transfers of personal data to the United States, on 10 July 2023. The European Commission issued on 10 July 2023 a decision finding an adequate level of protection for personal data provided by the so-called ‘EU-US Data Privacy Framework’. A list of the Data Privacy Framework can be found at this link.
In the absence of a decision by the European Commission finding an adequate level of protection as set out in Article 45(3) of the RODO, your personal data may only be transferred to a third country on the basis of: binding corporate rules, standard data protection clauses adopted by the European Commission, standard data protection clauses adopted by the Polish supervisory authority and approved by the Commission, an approved code of conduct or an approved certification mechanism (Article 46 of the RODO).
Data retention period
The data storage period depends on the purpose for which the data was collected, as indicated below.
Data collected for the conclusion and performance of a contract for the provision of services for the creation and maintenance of a customer's online account - for the duration of the contract and thereafter for the maximum period for the assertion of any civil claims arising from this contract, until they are fulfilled, expire or become time-barred;
Data collected for the purpose of concluding and performing a contract for the sale of products - for the duration of the contract and thereafter for the maximum period for the assertion of any civil claims arising from this contract, until their performance, expiry or limitation;
Data collected for the purpose of asserting and defending against claims - for the maximum period for the assertion of any civil claims arising from the conclusion and performance of the contract;
Fulfilment of legal obligations - for the period required by law, including in particular tax law and accounting law;
Data collected for the performance of direct marketing activities not performed by electronic means - for the duration of the contract concluded with the customer;
Data collected to carry out other marketing activities - for the period until the customer's consent is withdrawn;
Profiling - for the period until the customer's consent is withdrawn.
Customer's rights
Each customer has the right at any time to:
To be informed of the processing of personal data;
To have access to personal data (including but not limited to being informed which personal data is being processed);
To request rectification and restriction of processing (e.g. if personal data is incorrect) or erasure of personal data;
To withdraw any consent given to the controller at any time, whereby the withdrawal of consent does not affect the processing lawfully carried out by the controller before the withdrawal;
Data portability;
Object to the processing of personal data concerning him/her carried out for the legitimate interests of the controller or of a third party, including in particular processing for marketing purposes, including profiling (where there are no other valid legitimate grounds for processing overriding the interests of the customer);
Lodge a complaint to a supervisory authority (i.e. the President of the Office for Personal Data Protection, address: 2 Stawki Street, 00-193 Warsaw (www.uodo.gov.pl).
COOKIES POLICY
The Administrator warns that the website uses ‘cookies’, which are installed on the Client's terminal equipment. These are computer data, usually small text files, which can be read both by the administrator's system and by the systems of other entities whose services are used by the administrator (for example Meta Platforms Ireland Ltd or Google LLC).
Cookies make it possible:
Adaptation of the shop's web pages to the customers' needs,
Maintaining the customer session (after logging in), so that the customer does not have to log in again on each subsequent page or subpage of the shop,
Profiling in order to personalise marketing messages,
Ensuring the security and reliability of the online shop.
For the purposes specified above, by means of cookies, from the moment the customer connects to the web shop, the administrator processes data concerning the number (including IP) and type of the customer's terminal equipment, as well as the time of the customer's connection to the web shop and other exploitation data concerning the customer's activity on the web pages.
The administrator uses the following tools that use cookies:
Google Analytics - tracking website traffic,
Google Tag Manager - extended tracking of user activity on the website,
Facebook - investigation of user activity for the purposes of promotional activities by the Facebook platform (Meta Platforms Ireland Ltd.),
Klavio - tracking of user activity for the purposes of a newsletter sending system,
WPML - website language settings,
Instagram - social plug-in, user activity tracking for promotional activities by the Instagram platform (Meta Platforms Ireland Ltd.).
The customer may independently and at any time change the settings regarding cookies, specifying the conditions for storing and accessing cookies on the customer's device. The customer may change the settings referred to in the previous sentence by means of the settings of his or her Internet browser or by means of the configuration of the service. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the web browser settings or inform about each time cookies are placed on the customer's device. Detailed information on the possibility and methods of handling cookies is available in the settings of the customer's software (web browser). The customer may, at any time, delete cookies using the available functions in the web browser he or she uses, bearing in mind that restricting the use of cookies may affect some of the functionalities available in the web shop.