Privacy policy

Privacy policy of the www.smilesonic.pl online store

§ 1. General provisions

1. The controller of personal data collected through the www.smilesonic.pl online store is Smilesonic Spółka z ograniczoną odpowiedzialnością, entered in the register of entrepreneurs by the District Court Szczecin-Centrum in Szczecin, XIII Commercial Division of the National Court Register, KRS 0000857918, share capital PLN 5,000, place of business: ul. Sienna 9, 70-542 Szczecin, correspondence address: ul. Łukasińskiego 110, 71-215 Szczecin, NIP 8513251527, REGON 386916949, email: [email protected], telephone: 516 446 370, hereinafter the “Controller”, also the “Service Provider”.

2. Personal data collected through the website are processed under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”.

3. Capitalised terms in this policy have the meanings given in the terms and conditions of the www.smilesonic.pl online store.

§ 2. Types of personal data, purposes and scope of collection

1. PURPOSE AND LEGAL BASIS. The Controller processes Store users’ personal data when:

1.1. registering an Account, to create and manage an individual account, under Article 6(1)(b) GDPR (performance of the electronic services agreement under the Store’s terms);
1.2. placing an Order, to perform the Sales Agreement, under Article 6(1)(b) GDPR;
1.3. using the Review System, to learn the Customer’s opinion of the Product and Sales Agreement, under Article 6(1)(f) GDPR (the trader’s legitimate interest).

2. DATA TYPES. The user provides:
2.1. for an Account: email address;
2.2. for an Order: first and last name, address, tax identification number, email and telephone number;
2.3. for the Review System: first and last name.

3. RETENTION. The Controller stores personal data:

3.1. where processing is based on performance of a contract, for as long as necessary to perform it and then for the limitation period for claims. Unless a specific provision states otherwise, that period is six years, or three years for periodic benefits and business-related claims;

3.2. where processing is based on consent, until consent is withdrawn and subsequently for the limitation period for claims that the Controller may bring or that may be brought against it. Unless a specific provision states otherwise, that period is six years, or three years for periodic benefits and business-related claims.

4. Additional information may be collected during use of the Store, particularly the IP address assigned to the user’s computer or the internet provider’s external IP address, domain name, browser type, access time and operating system.

5. With separate consent, under Article 6(1)(a) GDPR, data may also be processed to send commercial information electronically or make direct marketing telephone calls, respectively in connection with Article 10(2) of the Act of 18 July 2002 on the Provision of Electronic Services or Article 172(1) of the Telecommunications Law of 16 July 2004. This includes messages targeted through profiling where the user has given the relevant consent.

6. Navigation data may also be collected, including links clicked and other actions taken in the Store. The legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) in making electronic services easier to use and improving their functionality.

7. Providing personal data is voluntary.

8. The Controller takes particular care to protect data subjects’ interests and ensures that data are:
8.1. processed lawfully;
8.2. collected for specified, lawful purposes and not further processed incompatibly with those purposes;
8.3. accurate, adequate for their purposes and retained in an identifiable form no longer than necessary for the processing purpose.

§ 3. Disclosure of personal data

1. Personal data are provided to service providers used in operating the Store, particularly:
1.1. product delivery providers;
1.2. payment system providers;
1.3. the accounting office;
1.4. the hosting provider;
1.5. business software providers;
1.6. mailing system providers;
1.7. software providers required to operate the online store.

2. Depending on contractual arrangements and circumstances, those providers either follow the Controller’s instructions on processing purposes and means (processors) or determine those purposes and means independently (controllers).

3. Personal data are stored exclusively within the European Economic Area (EEA), subject to § 5(5) of this policy.

§ 4. Rights to control, access and correct personal data

1. Data subjects may access, rectify or erase their data, restrict processing, request portability, object and withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

2. Legal bases:
2.1. access: Article 15 GDPR;
2.2. rectification: Article 16;
2.3. erasure (“right to be forgotten”): Article 17;
2.4. restriction: Article 18;
2.5. portability: Article 20;
2.6. objection: Article 21;
2.7. withdrawal of consent: Article 7(3).

3. To exercise these rights, email [email protected].

4. The Controller fulfils or refuses a request without undue delay, no later than one month after receipt. If the complexity or number of requests prevents fulfilment within a month, it will act within a further two months, informing the user within the first month of the extension and its reasons.

5. If processing infringes GDPR, the data subject may lodge a complaint with the President of Poland’s Personal Data Protection Office.

§ 5. Cookies

1. The Controller’s website uses cookies.

2. Cookies are necessary for proper provision of services on the Store website. They contain information needed for website operation and also enable general visit statistics to be prepared.

3. Two types are used:
3.1. session cookies: temporary files stored on the user’s device until logout or leaving the website;
3.2. persistent cookies: stored for the period defined in their parameters or until deleted by the user.

4. The Controller uses first-party cookies to understand how users interact with the website. They collect information about usage, the type of referring page, visit numbers and duration. This information does not record specific personal data but is used for website usage statistics.

5. The Controller also uses third-party cookies to collect general anonymous statistical data through Google Analytics (third-party cookie controller: Google LLC, based in the USA).

6. Advertising networks, particularly Google, may also use cookies to display advertisements suited to how the user uses the Store. They may retain navigation history or time spent on a page for this purpose.

7. Users decide whether cookies can access their computer by:
7.1. choosing permitted cookie categories in the cookie notice shown upon entering the Store;
7.2. changing browser settings. Further information on managing cookies is available in the browser’s settings.

§ 6. Final provisions

1. The Controller applies technical and organisational measures appropriate to the risks and data categories, protecting data against unauthorised disclosure or acquisition, unlawful processing, alteration, loss, damage or destruction.

2. The Controller provides appropriate technical measures to prevent unauthorised acquisition or alteration of personal data sent electronically.

3. Matters not covered by this policy are governed by GDPR and other applicable Polish law.