Polityka prywatności

GDPR Information Clause

In accordance with the obligations under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), we provide the following information:

Who is the controller of your personal data?

The controller of your personal data is:
GLASSDOOR Ryszard Ptaszek spółka komandytowa,
Żelazowice 174, 26-307 Białaczów, Opoczno County, Łódź Voivodeship,
KRS: 0000963843, NIP: 7681847409, REGON: 52161701300000
– operator of the online store available at www.sklep.galakor.pl (hereinafter, the “Store”, “we”).

How can you contact us regarding your personal data?

You can contact us via email: galakor@galakor.pl
or by post at the following address:
GLASSDOOR Ryszard Ptaszek spółka komandytowa
Żelazowice 174, 26-307 Białaczów, Poland

Where did we obtain your personal data from?

We received your personal data when you registered an account in our Store, placed orders, submitted inquiries via the contact form, or contacted us via phone or email.
We do not purchase or otherwise acquire databases of potential customers.

What personal data do we process?

First name, last name, login, password to the Store account, IP address, email address, correspondence address, phone number, VAT ID of a sole proprietorship, company name, bank account number, photos containing your image, order history, social media activity, content of comments/reviews containing personal data, and other personal data.
In combination with the above: your order history, browsing history in our Store, and your activity within the Store.

What is the purpose and legal basis for processing your personal data?

We process your personal data on the basis of Article 6(1)(b) of the GDPR, i.e., in order to perform a contract concluded with you and to fulfill your order, or to take steps prior to concluding a contract with you, in particular to:
a. enable you to use the functionalities of our Store, browse its assortment, make purchases via the Store, and provide you with information on cooperation terms,
b. create and manage your account and resolve technical issues related to its use,
c. process your orders,
d. handle complaints and the right of withdrawal in our Store,
e. respond to other inquiries directed to us (e.g. via the contact form),
f. communicate with you regarding the contract.
We also process your personal data based on your consent, in order to:
a. analyze data from our website saved in cookies,
b. organize competitions and promotional campaigns,
c. send newsletters.
You may withdraw your consent for the processing of personal data at any time, without providing a reason, in the same way you gave it. We will process your data for these purposes until your consent is withdrawn.
Withdrawal of consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.
Additionally, we process your data based on Article 6(1)(c) of the GDPR, because legal regulations require us to process your data for tax and accounting purposes.
We also process your personal data based on Article 6(1)(f) of the GDPR, for the purposes listed below, because it constitutes our legitimate interest:
a. monitoring your activity in our Store, such as searching for products, browsing the assortment, tracking your order history and consumer behavior,
b. adjusting advertisements according to the content you previously viewed, personalizing product categories or specific offers based on your shopping preferences (this is profiling – you may object to it – see below),
c. ensuring the security of electronic services we provide, including enforcement of our Store’s internal policies, fraud prevention, and traffic security,
d. conducting statistical analysis of website traffic,
e. handling your requests when they are not directly related to the contract,
f. maintaining business relationships with you,
g. asserting our claims or defending against claims made against us,
h. storing data for archival purposes and ensuring data accountability.

Do you have to provide us with your personal data?

In order to conclude and perform a contract with us, the following personal data must be provided (this is a contractual requirement):
a. First name, last name, email address, correspondence address, and phone number – in all cases,
b. Additionally: VAT ID and company name – in the case of entrepreneurs,
c. In case of the need to refund payment – your bank account number.
Providing this data is voluntary, but if you do not provide it, we will not be able to conclude a contract with you or perform services for you, and as a result, you will not be able to shop in our Store or use its features.
If required by law, we may also ask you to provide other data necessary for accounting or tax purposes. In other cases, providing your data is voluntary.

What are your rights regarding the processing of your personal data?

You have the right to request from the Controller:

Access to your data – pursuant to Article 15 of the GDPR,
Rectification of your data – pursuant to Article 16 of the GDPR,
Erasure of your data (“right to be forgotten”) – pursuant to Article 17 of the GDPR,
Restriction of processing (e.g., to data storage only) – pursuant to Article 18 of the GDPR,
Information about recipients of your data – pursuant to Article 19 of the GDPR,
Data portability – pursuant to Article 20 of the GDPR.

Requests concerning the processing of personal data can be submitted by email to the Controller's address (see the “Contact” section).
You also have the right to object at any time to the processing of your personal data, including for direct marketing purposes and profiling – pursuant to Article 21 of the GDPR. In such a case, we will stop processing your data for these purposes.
You may also withdraw your consent to the processing of your personal data at any time if it is processed based on your consent.
You have the right to lodge a complaint with a supervisory authority – in Poland, this is the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).
You may exercise your rights when:
a. requesting access to data – if you want to know whether we process your data, and if so, on what basis, to what extent, and for what purpose;
b. requesting rectification – if your data is incorrect or incomplete;
c. requesting erasure – in cases specified in Article 17 of the GDPR;
d. requesting restriction – in cases under Article 18 of the GDPR, we will only store the data, and further processing will require your consent unless other exceptions apply under Art. 18(2);
e. requesting portability – if you want a copy of your data to transmit to another company.

Who may receive your personal data?

Your personal data may be disclosed or transferred to the following entities:

Companies providing us with technical and IT support for our Store (email server, domain, cloud computing, CRM system, etc.), including:
a. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Companies analyzing electronically processed statistical data, including:
a. Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA – through Google Analytics (see Google Privacy Policy for partners).
Companies providing delivery services (couriers),
Social media service providers, including:
a. Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (Facebook Privacy Policy).
Payment service providers (payment operators),
Electronic communications service providers,
Authorized public authorities under applicable law, such as:
– Social Insurance Institution (ZUS),
– Tax Offices,
– Common courts,
– Local government authorities (in municipalities, counties, voivodeships),
Law firms,
Accounting offices,
With your consent – to other entities.

How long do we store your personal data?

We store your personal data no longer than necessary, depending on the purpose of processing and the requirements of applicable law.
We store your data for the duration of the contract and also after its termination:

for a maximum of 6 years from the contract’s expiry date (or 3 years for entrepreneurs),
or for the duration of legal or administrative proceedings, unless the applicable limitation period is longer.

If the data is processed before a contract is concluded, we store it for 1 year from the date it was provided.
For marketing purposes, we store your data for 1 year from the moment it was obtained, or for the duration of the contract, or until you object to such processing – whichever occurs first.
Personal data processed based on your consent will be stored until that consent is withdrawn.

Do we transfer your data outside the European Economic Area (EEA)?

Yes, your personal data may be transferred outside the EEA, but only to entities providing us with IT systems and solutions that may store data on servers located outside the EEA (including the United States, which is currently considered a “safe country” for personal data under EU regulations).
Such transfers are made in accordance with legal safeguards – in this case, the Data Privacy Framework (www.dataprivacyframework.gov).
We declare that the entities we may transfer your data to are certified under the Data Privacy Framework, meaning they have voluntarily committed to comply with GDPR requirements.

Do we process your personal data automatically (including profiling) in a way that affects your rights?

Yes, your data may be processed automatically, including profiling, but we do not make decisions based solely on automated processing that would produce legal effects or similarly significant consequences for you.
Profiling in our Store means analyzing your data (also automatically) to assess certain personal aspects – especially to analyze or predict your shopping preferences and behavior.