LEGAL BASIS
1 / Pursuant to Article 20(1) of the Act of July 18, 2002, on the provision of electronic services, and pursuant to REGULATION (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR).
PRIVACY POLICY
1 / This Privacy Policy sets forth the manner in which personal data provided to us by the Customer is processed, the rules for securing such data, and the Customer’s rights in this regard, as collected by the LUFT online store, available at the website address (ADDRESS), hereinafter referred to as the online store.
2 / The controller of the Customer’s personal data is Spółdzielnia Socjalna Honolulu, registered with the District Court for Katowice-Wschód, 8th Commercial Division of the National Court Register. The cooperative’s registered office is located at ul. Koszalińska 18, 40-717 Katowice, Tax Identification Number (NIP) 9542747680, REGON 243497937.
3 / In order to comply with statutory requirements, the controller selects and implements appropriate technical and organizational measures to ensure the protection of the processed data and safeguards the data against unauthorized access, as well as against processing in violation of applicable laws. 4 / In order to use specific services, the user fills out the appropriate form by entering specific personal data:
4.1 / newsletter service (legal basis – consent of the data subject to perform the contract for the provision of the Newsletter service (Article 6(1)(a) of the GDPR));
4.2 / to create and manage an individual account (necessity for the performance of the Account Service Agreement (Article 6(1)(b) of the GDPR));
4.3 / to place an order for the performance of a sales contract (legal basis: necessity for the performance of the sales contract (Article 6(1)(b) of the GDPR));
4.4 / to use the “Ask about a product” service (legal basis: necessity for the performance of the contract for the provision of the “Ask about a product” service (Article 6(1)(b) of the GDPR)).5 / When registering an account in the online store, the Customer provides:
5.1 / email address;
5.2 / address details: country, postal code, and city, street along with house/apartment number;
5.3 / first and last name;
5.4 / phone number;
5.5 / password.
6 / When registering an account in the online store, the Customer independently sets an individual password to access their account. The Customer may change the password at any time.
7 / When placing an order in the online store, the Customer provides the following information:
7.1 / email address;
7.2 / address details: country, postal code, and city, street address including house/apartment number;
7.3 / first and last name;
7.4 / phone number.8 / For Business Customers, the above scope of data is additionally expanded to include:
8.1 / the Business Customer’s company name;
8.2 / the Business Customer’s address details: country, postal code, and city, street along with house/apartment number;
8.3 / Tax ID number;9 / When subscribing to the newsletter, the Customer provides only their email address.10 / When using the “Ask about a product” service, the Customer provides:
10.1 / email address;
10.2 / first name.
11 / All personal data collected in the online store is provided on a fully voluntary basis.
12 / The basis for the controller’s processing of personal data collected during registration is Article 6(1)(a) of the GDPR, i.e., the Customer’s explicit consent to the processing of such data, granted for the purpose of creating an account in the online store. This consent is confirmed by accepting the terms and conditions and the privacy policy.
13 / While using the store’s website, additional information may be collected, in particular: the IP address assigned to the Customer’s computer or the external IP address of the Internet service provider, domain name, browser type, access time, and operating system type.
14 / We may also collect browsing data from Customers, including information about the links and references they choose to click on, or other actions taken on our online store. Legal basis – legitimate interest (Article 6(1)(f) of the GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of those services.
15 / Possible purposes of collecting Customers’ personal data by the controller:
15.1 / placing orders,
15.2 / conclusion and performance of the contract,
15.3 / settlement of sales, handling of any complaints, and archiving,
15.4 / ongoing communication regarding placed orders or concluded contracts,
15.5 / conducting marketing activities for our own products and services (in traditional form),
15.6 / with separately expressed consent – for the purpose specified in the statement, e.g., to send Customers commercial information regarding goods or the administrator (in the form of a newsletter) electronically (via the provided email address).
16 / Potential recipients of Customers’ personal data:
16.1 / employees and associates of the controller;
16.2 / entities authorized to receive such data under applicable law;
16.3 / in the case of a Customer who uses courier delivery or a parcel locker as the delivery method in the online store, the controller shares the collected personal data of the Customer with the selected carrier or intermediary handling shipments on behalf of the controller, who directly performs the contract concluded with the Customer on behalf of the controller, and thus solely for the purpose of proper performance of such a contract;
16.4 / In the case of a Customer who uses electronic payment methods or a payment card in the online store, the controller shares the collected personal data of the Customer with the selected entity processing such payments in the online store, which directly performs the contract concluded with the Customer on behalf of the controller, and thus solely for the purpose of proper performance of such a contract;
16.5 / companies or individuals on the basis of relevant agreements, i.e., data processing agreements, among other things, for the purpose of storing data, delivering newsletters, and conducting marketing campaigns to maintain customer relationships on behalf of the controller or the controller’s business partners. 17 / Entities entrusted with the processing of personal data under a separate agreement are required to comply with the principles of confidentiality and security of personal data, in particular not to disclose data to unauthorized persons, and to apply physical and technical security measures appropriate to the manner in which such data is processed. The Cooperative provides the Customer, upon request, with detailed information about the entity to which it has entrusted data processing, the scope of the entrusted data, and the date of its transfer.
COOKIES
1 / When visiting the online store, certain personal data of the Customer is collected automatically. This data is collected by so-called cookies. They serve to make your visit to the online store’s website more user-friendly, efficient, and secure, as well as to speed up navigation through the online store. Cookies are small text files that are stored on the user’s device.
2 / Some of the cookies we use (so-called session cookies) are deleted at the end of the browsing session, i.e., when the browser is closed. Other cookies remain on the end device and allow us or our partners to recognize the browser again during the next visit to our websites (so-called persistent cookies).
3 / Cookies are used for the following purposes:
3.1 / to enable adding products to the shopping cart and managing the shopping cart during a shopping session;
3.2 / to recognize the user during a subsequent visit to the online store in order to retain their preferred settings in the shopping cart (payment method, delivery method);
3.3 / language settings;
3.4 / better tailoring the website to the user’s needs.
4 / Making purchases through the online store using the shopping cart feature requires the use of session and persistent cookies. Restricting the use of cookies by a user of the online store may affect certain functionalities available in the online store.
5 / This online store uses:
5.1 / session cookies: these are not stored on the end-user’s device. They are automatically deleted when the session ends. Thanks to the information they contain, LUFT can analyze data regarding the user’s behavior on the site. This allows for continuous optimization of the online store and improvement of its usability;
5.2 / persistent cookies: these are stored for the duration specified in the cookie settings, unless the user of the online store deletes them manually beforehand, after which they are automatically deleted. Deleting a persistent cookie is possible provided that the browser used by the user of the online store supports this feature.
6 / Below is a description of the steps to take to change cookie settings in the most popular web browsers:
6.1 / Internet Explorer;
6.2 / Microsoft EDGE;
6.3 / Mozilla Firefox;
6.4 / Chrome;
6.5 / Safari;
6.6 / Opera.
7 / The cookie mechanism is safe for the computers of the online store’s customers. In particular, it is not possible for viruses or other unwanted or malicious software to enter customers’ computers through this method. 8 / The online store may contain links and references to other websites. LUFT is not responsible for the data protection policies in effect on those sites.
CUSTOMER RIGHTS
1 / Every data subject has the right:
2 / To access data. The customer has the right to obtain confirmation from the controller as to whether personal data is being processed, and if so, the customer has the right:
2.1 / to access their personal data;
2.2 / to obtain information about the purposes of processing, the categories of personal data being processed, the planned retention period for the Customer’s data or the criteria for determining that period, the rights to which the Customer is entitled under the GDPR, and the right to lodge a complaint with a supervisory authority, regarding automated decision-making, including profiling, and regarding the safeguards applied in connection with the transfer of such data outside the European Union;
2.3 / obtain a copy of their personal data.
3 / Rectification of data. The Customer has the right to request that the controller immediately rectify any of their personal data that is inaccurate.
4 / Erasure of data. The Customer has the right to request the erasure of all or some of their personal data. The Customer has the right to request the erasure of personal data if:
4.1 / the personal data is no longer necessary for the purposes for which it was collected or processed;
4.2 / the customer has withdrawn specific consent, to the extent that the personal data was processed based on such consent;
4.3 / the customer has objected to the use of their data for marketing purposes;
4.4 / the personal data is being processed unlawfully;
4.5 / the personal data must be erased to comply with a legal obligation under Union or Member State law;
4.6 / the personal data was collected in connection with the offering of information society services.
5 / Notwithstanding a request to erase personal data, in connection with an objection or withdrawal of consent, the controller may retain certain personal data to the extent that processing is necessary to establish, asserting or defending claims, as well as to comply with a legal obligation requiring processing under Union law or the law of a Member State to which the controller is subject.
6 / This applies in particular to personal data including: first name, last name, and email address, which are retained for the purpose of handling complaints and claims related to the use of the controller’s services, or additionally the residential address/mailing address and order number, which are retained for the purpose of handling complaints and claims related to concluded sales contracts or the provision of services.
7 / Restrictions on data processing:
7.1 / The Customer has the right to request a restriction on the processing of their personal data. Submitting such a request, until it is reviewed, prevents the use of certain functionalities or services related to the processing of the data covered by the request.
7.2 / The Customer has the right to request a restriction on the use of personal data in the following cases:
7.3 / when the Customer disputes the accuracy of their personal data—in which case the controller shall restrict its use for the time necessary to verify the accuracy of the data, but for no longer than 7 days;
7.4 / when the processing of data is unlawful, and instead of erasing the data, the Customer requests the restriction of its use;
7.5 / when the Customer has objected to the use of their data – in which case the restriction applies for the time necessary to assess whether, due to a specific situation, the protection of the Customer’s interests, rights, and freedoms outweighs the interests pursued by the controller in processing the Customer’s personal data.
8 / Right to object to data processing:
8.1 / The Customer has the right to object at any time to the processing of their personal data, including profiling, if the controller processes their data based on a legitimate interest, e.g. marketing of products and services, maintaining statistics on the use of specific features of the online store, and facilitating the use of the online store, as well as conducting satisfaction surveys, if required by a specific situation.
8.2 / Opting out via email of receiving marketing communications regarding products or services shall constitute the Customer’s objection to the processing of their personal data, including profiling for these purposes.
8.3 / If the Customer’s objection is found to be valid and the controller has no other legal basis for processing personal data, the Customer’s personal data to which the Customer has objected will be deleted.
9 / Right to lodge a complaint with a supervisory authority:
10 / Right to withdraw consent – legal basis: Article 7(3) of the GDPR.
10.1 / The Customer has the right to withdraw any consent granted to the controller.
10.2 / Withdrawal of consent takes effect from the moment consent is withdrawn.
10.3 / Withdrawal of consent does not entail any negative consequences for the Customer; however, it may prevent further use of services or functionalities that, in accordance with the law, the controller may provide only with the Customer’s consent.
