ONLINE SHOP PRIVACY POLICY
WWW.MARKADLER.PL
§ 1
GENERAL PROVISIONS
The controller of personal data collected via the Online Shop www.markadler.pl MEESTER GROUP SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ is entered in the Register of Entrepreneurs at the District Court for Poznań – Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS number: 0000718471, place of business and address for service: 2 Wagrowska Street, 61-369 Poznań, Tax Identification Number (NIP): 7822769523, National Business Registry Number (REGON): 368932069, email address: sklep@markadler.pl, telephone number: (+48) 61 635 05 40, hereinafter referred to as the “Controller” and also acting as the “Service Provider”.
Personal data collected by the Controller via the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR. Any words or phrases appearing in capital letters within this Privacy Policy shall be understood in accordance with their definitions set out in the Online Shop Terms and Conditions www.markadler.pl.
§ 2
TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION
PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes the personal data of the Shop’s customers www.markadler.pl in the case of:
registration of an Account in the Shop, for the purpose of creating an individual account and managing that Account, pursuant to Article 6(1)(b) of the GDPR (performance of a contract for the provision of electronic services in accordance with the Shop’s Terms and Conditions), placing an order in the Shop, for the purpose of performing the contract of sale, pursuant to Article 6(1)(b) of the GDPR (performance of the contract of sale), and subscribing to the Newsletter for the purpose of sending commercial communications by electronic means. Personal data is processed following the provision of separate consent, pursuant to Article 6(1)(a) of the GDPR, using the Feedback System, for the purpose of obtaining the Customer’s opinion on the Sales Contract concluded with the Controller, pursuant to Article 6(1)(f) of the GDPR (legitimate interests of the business), to use the Contact Form, for the purpose of sending a message to the Controller, pursuant to Article 6(1)(f) of the GDPR (the controller’s legitimate interest), to fulfil the legal obligations incumbent on the Controller, arising in particular from tax law, accounting legislation, consumer protection legislation and other regulations governing the conduct of business, pursuant to Article 6(1)(c) of the GDPR (processing necessary for compliance with a legal obligation to which the Controller is subject).
TYPE OF PERSONAL DATA PROCESSED. The service user provides the following in the event of:
Account details: full name, username, address, email address.
Orders: full name, home address, tax identification number, date of birth, email address, telephone number.
Newsletter: first name and surname, email address.
Feedback System: full name, email address.
Contact form: first name and surname, email address.
RETENTION PERIOD FOR PERSONAL DATA. The Controller retains Service Users’ personal data for:
where the basis for data processing is the performance of a contract, for as long as is necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless otherwise provided for by a specific provision, the limitation period is six years; for claims relating to periodic payments and claims arising from the conduct of business activities, the limitation period is three years.
where the basis for data processing is consent, for as long as the consent remains in force, and, following the withdrawal of consent, for a period corresponding to the limitation period for claims that may be brought by the Controller and those that may be brought against the Controller. Unless otherwise provided for by a specific provision, the limitation period is six years; for claims relating to periodic payments and claims arising from the conduct of business activities, the limitation period is three years.
When using the Shop, additional information may be collected, in particular: the IP address assigned to the Customer’s computer or the external IP address of their internet service provider, the domain name, the type of browser, the time of access, and the type of operating system.
Following the provision of separate consent, pursuant to Article 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial communications by electronic means or making telephone calls for the purposes of direct marketing – in accordance with Article 398(1) and (2) of the Act of 12 July 2024 – Electronic Communications Act, including communications targeted as a result of profiling, provided that the Service User has given the relevant consent.
As part of the User’s activity on the Shop, profiling may take place, the purpose of which is to select appropriate advertising content to be targeted at the User.
Profiling means any form of automated processing of personal data which consists of using personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements. Profiling does not produce legal effects in relation to the Service User nor does it otherwise significantly affect their situation. Its sole purpose is to better tailor marketing content and offers.
Navigation data may also be collected from Customers, including information about the links and hyperlinks they choose to click on or other actions they undertake within the Shop. The legal basis for such activities is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in facilitating the use of services provided electronically and in improving the functionality of those services.
The provision of personal data by the Service User is voluntary.
The data controller takes particular care to protect the interests of data subjects and, in particular, ensures that the data it collects:
processed lawfully, collected for specified, legitimate purposes and not further processed in a way incompatible with those purposes, factually accurate and relevant to the purposes for which they are processed, and stored in a form which permits identification of the data subjects for no longer than is necessary to fulfil the purpose of the processing.
§ 3
DISCLOSURE OF PERSONAL DATA
The personal data of Service Users is transferred to the service providers used by the Controller in the operation of the Shop, and in particular to:
entities responsible for the delivery of the Products,
payment system providers,
providers of customer feedback survey systems,
accountancy firms,
web hosting providers,
suppliers of business management software,
providers of mailing systems,
suppliers of the software required to run an online shop; public bodies processing data in connection with the Data Controller’s legal obligations, including the Ministry of Finance, which operates the KSeF system.
The service providers referred to in point 1 of this paragraph, to whom personal data are transferred, depending on the contractual arrangements and circumstances, either follow the Controller’s instructions regarding the purposes and means of processing such data (processors) or independently determine the purposes and means of processing such data (controllers).
Service Users’ personal data is stored exclusively within the European Economic Area (EEA), subject to § 5(5) and § 6 of the Privacy Policy.
Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the Controller’s use of the services of providers of analytics and marketing tools (e.g. Google LLC, Meta Platforms Inc.).
Data transfers are carried out on the basis of the Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46(2)(c) of the GDPR.
§ 4
THE RIGHT TO CONTROL, ACCESS AND CORRECT ONE’S OWN DATA
The data subject has the right to access their personal data, as well as the right to rectify, erase or restrict the processing of such data, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
Legal basis for the Customer’s request:
Access to data – Article 15 of the GDPR.
Rectification of data – Article 16 of the GDPR.
Deletion of data (the so-called ‘right to be forgotten’) – Article 17 of the GDPR.
Restriction of processing – Article 18 of the GDPR.
Data portability – Article 20 of the GDPR.
Objection – Article 21 of the GDPR
Withdrawal of consent – Article 7(3) of the GDPR.
To exercise the rights referred to in point 2, you may send an email to the following address: sklep@markadler.pl.
Where a Data Subject exercises a right arising from the above provisions, the Controller shall comply with or refuse to comply with the request without delay, but no later than one month after receiving it. However, if – due to the complex nature of the request or the number of requests – the Controller is unable to comply with the request within one month, it shall comply within the following two months, having first informed the Service User, within one month of receiving the request, of the intended extension of the deadline and the reasons for it.
If it is found that the processing of personal data infringes the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Office for Personal Data Protection.
§ 5
"COOKIES" FILES
The Administrator’s website uses ‘cookies’.
The use of cookies is necessary for the proper provision of services on the Shop’s website. Cookies contain information essential for the website to function correctly, and they also enable us to compile general statistics on visits to the website.
This website uses two types of ‘cookies’: ‘session’ and ‘persistent’ cookies.
‘Session’ cookies are temporary files that are stored on the User’s device until they log out (leave the website).
‘Persistent’ cookies are stored on the User’s device for the period specified in the cookie settings or until the User deletes them.
The Administrator uses its own cookies to gain a better understanding of how Service Users interact with the website’s content. These cookies collect information on how the User interacts with the website, the type of website from which the User was redirected, and the number of visits and the duration of the User’s visit to the website. This information does not record any specific personal data of the User, but is used to compile statistics on website usage.
The controller also uses third-party cookies to collect general and anonymous statistical data via the Google Analytics analytics tool (third-party cookie provider: Google LLC, based in the USA).
Cookies may also be used by advertising networks, in particular the Google network, to display adverts tailored to the way in which the User uses the Shop. To this end, they may store information about the User’s navigation path or the length of time spent on a particular page.
The user has the right to decide whether to allow ‘cookies’ to access their computer by:
the selection of the types of cookies that you consent to having collected immediately upon entering the Shop’s website and when the cookie notice appears,
change the settings in your browser window. Detailed information on the options and methods for managing ‘cookies’ is also available in the software (web browser) settings.
§ 6
ADDITIONAL SERVICES RELATED TO THE USER’S ACTIVITY IN THE SHOP
The Shop uses so-called social media plugins (‘plugins’) from social media sites. When you view a web page www.markadler.pl, which contains such a plug-in, the Service User’s browser will establish a direct connection with the Facebook, Instagram, YouTube and Google servers.
The plug-in’s content is transmitted by the relevant service provider directly to the Service User’s browser and integrated into the webpage. Thanks to this integration, service providers are informed that the Service User’s browser has displayed the webpage www.markadler.pl, even if the User does not have a profile with the service provider in question, or is not currently logged in to their account. This information (together with the User’s IP address) is sent by the browser directly to the service provider’s server (some of which are located in the USA) and stored there.
If the user logs in to one of the above social media sites, that service provider will be able to directly link the visit to the website www.markadler.pl to the Service User’s profile on the relevant social media platform.
If the User interacts with a particular plugin, for example by clicking the ‘Like’ or ‘Share’ button, the relevant information will also be sent directly to the service provider’s server and stored there.
The purpose and scope of data collection, as well as the subsequent processing and use of such data by service providers, together with the means of contacting them, the Service User’s rights in this regard, and the option to configure settings to ensure the protection of the Service User’s privacy, are set out in the service providers’ privacy policies:
https://www.facebook.com/policy.php
https://help.instagram.com/519522125107875?helpref=page_content
https://www.youtube.com/intl/ALL_pl/howyoutubeworks/user-settings/privacy/
https://policies.google.com/privacy?hl=pl&gl=ZZ.
If the User does not wish social media platforms to associate the data collected whilst visiting the website www.markadler.pl directly to his profile on that particular website, then before visiting the site www.markadler.pl must log out of this website. The user may also completely prevent plugins from loading on the website by using appropriate browser extensions, e.g. blocking scripts using ‘NoScript’.
The Controller uses remarketing tools on its website, namely Google AdWords; this involves the use of cookies from Google LLC relating to the Google AdWords service. As part of the mechanism for managing cookie settings, the User may decide whether the Service Provider may use Google AdWords (third-party cookie controller: Google Inc., based in the USA) in relation to them.
§ 7
FINAL PROVISIONS
The controller shall implement technical and organisational measures to ensure that the personal data being processed are protected in a manner appropriate to the risks and the categories of data concerned, and, in particular, shall safeguard the data against unauthorised access, unauthorised removal, processing in breach of applicable legislation, and alteration, loss, damage or destruction.
The controller shall implement appropriate technical measures to prevent unauthorised persons from accessing or altering personal data transmitted electronically.
In matters not covered by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply mutatis mutandis.
The Data Controller updates this Privacy Policy in response to changes in the law or the development of its business. Notice of any amendments to the Privacy Policy will be published on the Shop’s website at least 7 days before they come into effect, or sent by email to Service Users who make use of the Electronic Services provided on an ongoing basis (Account, Newsletter).