Privacy policy

Privacy policy of the www.smilesonic.pl online store

§ 1. General provisions

1. The controller of personal data collected through the www.smilesonic.pl online store is Smilesonic Spółka z ograniczoną odpowiedzialnością, entered in the register of entrepreneurs by the District Court Szczecin-Centrum in Szczecin, XIII Commercial Division of the National Court Register, KRS 0000857918, share capital PLN 5,000, place of business: ul. Sienna 9, 70-542 Szczecin, correspondence address: ul. Łukasińskiego 110, 71-215 Szczecin, NIP 8513251527, REGON 386916949, email: [email protected], telephone: 516 446 370, hereinafter the “Controller”, also the “Service Provider”.

2. Personal data collected through the website are processed under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to processing personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”.

3. Capitalised terms in this policy have the meanings given in the terms and conditions of the www.smilesonic.pl online store.

§ 2. Types of personal data, purposes and scope of collection

1. PURPOSE AND LEGAL BASIS. The Controller processes Store users’ personal data when:

1.1. registering an Account, to create and manage an individual account, under Article 6(1)(b) GDPR (performance of the electronic services agreement under the Store’s terms);
1.2. placing an Order, to perform the Sales Agreement, under Article 6(1)(b) GDPR;
1.3. using the Review System, to learn the Customer’s opinion of the Product and Sales Agreement, under Article 6(1)(f) GDPR (the trader’s legitimate interest).

2. DATA TYPES. The user provides:
2.1. for an Account: email address;
2.2. for an Order: first and last name, address, tax identification number, email and telephone number;
2.3. for the Review System: first and last name.

3. RETENTION. The Controller stores personal data:

3.1. where processing is based on performance of a contract, for as long as necessary to perform it and then for the limitation period for claims. Unless a specific provision states otherwise, that period is six years, or three years for periodic benefits and business-related claims;

3.2. where processing is based on consent, until consent is withdrawn and subsequently for the limitation period for claims that the Controller may bring or that may be brought against it. Unless a specific provision states otherwise, that period is six years, or three years for periodic benefits and business-related claims.

4. Additional information may be collected during use of the Store, particularly the IP address assigned to the user’s computer or the internet provider’s external IP address, domain name, browser type, access time and operating system.

5. With separate consent, under Article 6(1)(a) GDPR, data may also be processed to send commercial information electronically or make direct marketing telephone calls, respectively in connection with Article 10(2) of the Act of 18 July 2002 on the Provision of Electronic Services or Article 172(1) of the Telecommunications Law of 16 July 2004. This includes messages targeted through profiling where the user has given the relevant consent.

6. Navigation data may also be collected, including links clicked and other actions taken in the Store. The legal basis is the Controller’s legitimate interest (Article 6(1)(f) GDPR) in making electronic services easier to use and improving their functionality.

7. Providing personal data is voluntary.

8. The Controller takes particular care to protect data subjects’ interests and ensures that data are:
8.1. processed lawfully;
8.2. collected for specified, lawful purposes and not further processed incompatibly with those purposes;
8.3. accurate, adequate for their purposes and retained in an identifiable form no longer than necessary for the processing purpose.

§ 3. Disclosure of personal data

1. Personal data are provided to service providers used in operating the Store, particularly:
1.1. product delivery providers;
1.2. payment system providers;
1.3. the accounting office;
1.4. the hosting provider;
1.5. business software providers;
1.6. mailing system providers;
1.7. software providers required to operate the online store.

2. Depending on contractual arrangements and circumstances, those providers either follow the Controller’s instructions on processing purposes and means (processors) or determine those purposes and means independently (controllers).

3. Personal data are stored exclusively within the European Economic Area (EEA), subject to § 5(7) of this policy.

§ 4. Rights to control, access and correct personal data

1. Data subjects may access, rectify or erase their data, restrict processing, request portability, object and withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

2. Legal bases:
2.1. access: Article 15 GDPR;
2.2. rectification: Article 16;
2.3. erasure (“right to be forgotten”): Article 17;
2.4. restriction: Article 18;
2.5. portability: Article 20;
2.6. objection: Article 21;
2.7. withdrawal of consent: Article 7(3).

3. To exercise these rights, email [email protected].

4. The Controller fulfils or refuses a request without undue delay, no later than one month after receipt. If the complexity or number of requests prevents fulfilment within a month, it will act within a further two months, informing the user within the first month of the extension and its reasons.

5. If processing infringes GDPR, the data subject may lodge a complaint with the President of Poland’s Personal Data Protection Office.

§ 5. Cookies and advertising measurement

1. Necessary cookies support the cart, account, security and consent preferences. You can shop without analytics or marketing consent. Optional services start only after you choose the relevant category in “Cookie settings”. Consent is the legal basis for processing for these optional purposes (Article 6(1)(a) GDPR).

2. Google Analytics 4 (Google) starts with analytics consent and measures visits and store events, including purchases. Data include browser/device information, pages, products, transaction ID, value and currency. These data are not treated as entirely anonymous. Our purchase integration does not send names, delivery addresses, telephone numbers or email addresses.

3. Google Ads (Google) and OpenAI Ads Measurement Pixel (OpenAI) start with marketing consent. They measure advertising outcomes, particularly purchases, and may associate events with earlier ad clicks or impressions through browser/ad identifiers. We send transaction ID, discounted product value and currency, excluding tax and shipping. OpenAI receives amounts in minor currency units. Our integration does not enable Google ad personalization or automatic transmission of contact data; OpenAI events opt out of future user-level personalization.

If automatic advanced matching is enabled in the OpenAI Pixel settings, the SDK may also detect contact information entered in forms, normalize it and transmit SHA-256 hashes for conversion matching. Hashes are not anonymous data. This feature requires marketing consent and is not necessary for basic transaction ID, value and currency measurement.

4. Identifiers include _ga / _ga_* (Google Analytics), _gcl_* (Google Ads), and __oppref / __obref (OpenAI). OpenAI requests cookie lifetimes of up to 30 and 365 days respectively; browser restrictions may shorten them. The ss_consent preference lasts 180 days. After consent, purchase receipt markers prevent duplicate measurement for up to 180 days. Withdrawal removes persistent markers; a minimal technical copy remains until the tab session ends to prevent replay.

5. You can change or withdraw consent at any time in the footer’s “Cookie settings”. Withdrawal stops further events in that category and removes known optional identifiers from our domain. It does not affect lawful processing before withdrawal. Meta Pixel and the old Google Tag Manager container are currently inactive.

6. YouTube starts only with external-media consent and a click to play. Google then receives information needed to operate the player, including IP address and device information.

7. Google and OpenAI may process data outside the EEA, including in the United States. Their current privacy policies describe processing, protection, transfers and rights: Google and OpenAI. This supplements the recipients described in § 3. For data we process, contact [email protected].

§ 6. Final provisions

1. The Controller applies technical and organisational measures appropriate to the risks and data categories, protecting data against unauthorised disclosure or acquisition, unlawful processing, alteration, loss, damage or destruction.

2. The Controller provides appropriate technical measures to prevent unauthorised acquisition or alteration of personal data sent electronically.

3. Matters not covered by this policy are governed by GDPR and other applicable Polish law.