Privacy policy

Personal data protection statement and privacy policy

On the basis of this personal data protection statement, we would like to inform all visitors to our website in a transparent manner of the nature, scope and purpose of the personal data collected, used and processed by us, and to inform you of the rights you have. Using our website is, as a rule, possible without providing personal data. However, if you wish to take advantage of our offer, providing personal data may prove necessary. This English version is a translation provided for convenience; the Polish version prevails.

If data are collected automatically during visits to our websites, they are processed in accordance with the current statutory regulations on the protection of personal data.

If the processing of your personal data is necessary and there is no statutory basis for such processing, we generally obtain the consent necessary for processing the data, e.g. for sending commercial information and Newsletter-type information. As the company responsible for processing personal data, we have put in place technical and organisational measures to guarantee the highest possible level of protection of your personal data.

1. Personal data controller

The Personal Data Controller is: SDI Solution Sp. z o.o., Winnica 2B 89-200 Szubin

2. Data protection officer

Our Data Protection Officer is Sebastian Kopacki - iod@sdisolution.pl

3. General information

a. Personal data are processed by the Data Controller in accordance with the applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as the “GDPR”

b. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the Controller has implemented appropriate technical and organisational measures to ensure that processing is performed in accordance with this Regulation and to be able to demonstrate this. Those measures are reviewed and updated where necessary.

c. The Controller applies technical measures to prevent unauthorised persons from obtaining and modifying personal data sent electronically.

d. The Controller applies measures that ensure the confidentiality, integrity and availability of the personal data it processes.

4. Rights of data subjects concerning their personal data

If you have any questions about your personal data, you may contact us at any time in writing, by e-mail or by telephone, and we will answer your questions. Under the GDPR, you have the following rights:

a) Right to information (Art. 15 GDPR).

You have the right at any time to obtain information about which categories of personal data and what information we process and for what purpose, as well as for how long and according to what criteria these data are stored, and whether profiling is used in this connection.

Furthermore, you have the right to know to which recipients or categories of recipients the data have been or are still being disclosed, in particular in the case of recipients in third countries or international organisations.

You also have the right to be informed of the appropriate safeguards in connection with the transfer of your personal data.

In addition to the right to lodge a complaint with the supervisory authority and the right to obtain information on the processing of your data, you have the right to erasure and rectification of your data, as well as the right to restrict its processing or to object to the processing of your personal data.

In all of the above cases, you have the right to request from the Data Controller a free copy of your personal data that we process. For any other copies you request, or which go beyond the individual’s right to information, we are entitled to charge an appropriate administrative fee.

b) Right to rectification of data (Art. 16 GDPR).

You have the right to request immediate rectification of the personal data processed and - taking into account the purposes of processing – the right to request that incomplete personal data be completed.

If you wish to exercise the right to rectification, you may contact the Data Controller at any time to have the necessary correction made.

c) Right to erasure of data (Art. 17 GDPR).

You have the right to request the immediate erasure of your data (“right to be forgotten”), in particular where the collection of the data is no longer necessary, where you have withdrawn your consent to the processing of the data, where your data are processed unlawfully or were collected unlawfully and there is a legal obligation to erase the data under European Union law or national law.

The right to be forgotten does not apply, however, where there is an overriding right to freedom of expression or freedom of information, where the collection of the data is necessary to comply with a legal obligation (e.g. obligations to retain VAT invoices), where erasure of the data is not possible owing to the Controller’s archiving obligations, or where the collection of the data serves the establishment, exercise or defence of legal claims.

d) Right to restriction of processing (Art. 18 GDPR).

You have the right to request restriction of the processing of your data where you contest the accuracy of the data, the processing is unlawful, you oppose the erasure of your personal data and request

restriction of processing instead, where the necessary purpose of processing ceases to exist, or where you have objected to the processing of the data pursuant to Art. 21(1), pending determination of whether our legitimate interests override your interests.

e) Right to data portability (Art. 20 GDPR).

You have the right to the portability of your personal data, in a commonly used format, in order to transfer them without hindrance to another controller, where the processing is based on your consent and is carried out by automated means.

f) Right to object (Art. 21 GDPR).

You have the right to object at any time to the collection, processing or use of your personal data for the purposes of direct acquisition or market and opinion research and to the marketing (promotional) processing of data, unless we can present compelling evidence worthy of protection concerning the processing of the data which overrides your interests, rights and freedoms.

Furthermore, you cannot exercise your right to object where a legal provision provides for the collection, processing and use of the data or requires such data to be collected, processed or used.

g) Right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

You have the right to lodge a complaint with the competent supervisory authority if you believe that an infringement has occurred in the processing of your personal data.

h) Right to withdraw consent in connection with the right to the protection of personal data (Art. 7(3) GDPR).

You may withdraw the consent you have given to the processing of your personal data at any time without giving a reason. This also applies to the withdrawal of declarations of consent given to us before the European Union regulation on the protection of personal data (GDPR) entered into force.

5. Purpose, legal basis, scope and retention period of the personal data processed

Purpose of processing

Basis for processing

Scope of data processed

Retention period

Performance of a contract or taking steps at the request of the data subject prior to entering into a contract. This provision also covers data processing events that are necessary to carry out pre-contractual steps, in particular for the purpose of creating and managing an Account; handling and fulfilling an Order; carrying out the payment process; ensuring the proper functioning and use of the website and the quality of services; settling contracts performed and services provided by the Controller; handling complaints and enquiries submitted via the contact form; establishing contact in connection with fulfilment.

Art. 6(1)(b) GDPR

Name and surname, e-mail address, contact telephone number, street, house/flat number, postcode, town/city, order delivery address. In the case of Service Recipients or Customers who are not consumers, the Controller may additionally process the company name, the business/registered office address and the tax identification number (NIP) of the Service Recipient or Customer.

Data are stored for the period necessary for the performance, termination or other expiry of the contract concluded.

Direct marketing / sending commercial information.

Art. 6(1)(a), (f) GDPR

Name and surname, address, e-mail address, contact telephone number.

Data are processed until the data subject withdraws consent. The Controller may not process data for the stated purpose after consent has been withdrawn. The Controller may not process data for direct marketing purposes if the recipient has not consented to receiving commercial information and has not provided an electronic address identifying them (e.g. an e-mail address) for that purpose, in the event that the data subject objects in this respect.

Obligation to keep accounting records.

Article 6(1)(c) of the GDPR in conjunction with Art. 74(2) of the Accounting Act, i.e. of 29 September 1994 (Journal of Laws [Dz.U.] 2021.217, consolidated text of 1 February 2021)

Name and surname; address of residence or of business, company name and tax identification number (NIP), bank account number.

Data are stored for the period required by law.

Establishment, pursuit and defence of claims by the Controller.

Art. 6(1)(f) GDPR

–

Data are stored for as long as the legitimate interest pursued by the Controller exists, but no longer than the limitation period for claims against the data subject arising from the business activity conducted by the Controller. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and for claims under a contract of sale concluded by an entrepreneur, two years).

Use of COOKIES

Art. 6(1)(a) GDPR

On the website we process text information. Personal data are processed on the basis of voluntarily given consent (on the first visit to the website, a request for consent to the use of cookies appears).

Data are processed until the data subject withdraws consent. The Controller may not process data for the stated purpose after consent has been withdrawn.

6. Recipients of data

a) Data are transferred to third parties beyond the scope indicated in this personal data protection statement only where this is necessary to provide the requested service.

b) We transfer data only where there is a corresponding legal obligation. This happens when state authorities (e.g. law enforcement authorities) request information in writing.

c) Your personal data are not transferred to so-called third countries outside the European Union/ European Economic Area.

d) Your personal data will not be resold to third parties. Data collected during registration will be processed solely to enable use of the website, any purchase and the performance of the contract.

e) In order to ensure the proper functioning of the Controller’s product website, including for the performance of the contracts concluded, the Controller uses the services of external entities such as:

IT companies, providers of software supporting the Controller’s business activity, e.g. in the area of sending the Newsletter, commercial information and marketing activities,

entities providing accounting, legal and advisory services,

entities handling electronic payments.

f) The Controller uses only the services of such processors as provide sufficient guarantees of implementing appropriate technical and organisational measures, so that the processing meets the requirements of the GDPR and protects the rights of data subjects.

g) The Controller does not transfer data in every case, nor to all of the recipients or categories of recipients indicated in the privacy policy.

h) The Controller transfers data only when this is necessary to achieve the given purpose of processing and only to the extent necessary to achieve it

7. Automated decision-making - profiling

a) The GDPR imposes on the Controller an obligation to provide information about automated decision-making, including profiling, referred to in Art. 22(1) and (4) of the GDPR, and – at least in those cases – meaningful information about the rules on which such decisions are based, as well as the significance and the envisaged consequences of such processing for the data subject. With this in mind, the Controller provides in this section of the privacy policy information concerning possible profiling.

b) We inform you that we do not use profiling in the services we provide.

c) The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

8. Automated decision-making - profiling

Analytics, cookies and operational data.

a) As a company aware of its responsibility within the scope of its obligations and the services we offer, we inform you that, in order to increase the effectiveness and quality of our services, we use profiling of visitors to our website only with your consent, using tools such as:

Google Analytics, Universal Analytics - provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). These services help the Controller analyse traffic on the Website. The data collected are processed within the above services in anonymised form (these are so-called operational data, which make it impossible to identify a person) to generate statistics helpful in administering the Website. These data are aggregate and anonymous, i.e. they do not contain identifying features (personal data) of persons visiting the Website. When using the above services on the Website, the Controller collects data such as the sources and media through which visitors reach the Website and how they behave on the Website, information about the devices and browsers from which they visit the site, IP address and domain, geographical data, as well as demographic data (age, gender) and interests.

b) A person can easily block Google Analytics from sharing information about their activity on the Website - for this purpose, a browser add-on provided by Google Inc. can be installed, available here: https://tools.google.com/dlpage/gaoptout?hl=pl.

c) Remarketing tags - used in Google Ads campaigns. They make it possible to track the user’s movements on the web and to tailor the ads that appear. As regards the operation of the Shop, these will mainly be tags that allow an advertisement (in text or graphic form) to follow the user.

d) Google Ads tags - allow ads to be linked to the website and data similar to those of Google Analytics to be collected. These data are visible in Google Analytics.

e) Cookie files (cookies) are small pieces of text information in the form of text files, sent by the server and saved on the side of the person visiting the Website (e.g. on the hard drive of a computer or laptop, or on the memory card of a smartphone – depending on which device the visitor uses to access our Website). Detailed information about Cookies, as well as the history of their creation, can be found, among other places, here: http://pl.wikipedia.org/wiki/Ciasteczko.

f) The Controller may process data contained in Cookies when visitors use the Website, for the following purposes:

performing the basic functions of the Website, such as identifying Service Recipients as logged in and maintaining the login session, storing dynamic data, e.g. statistics, summaries;

adapting the content of the Website to the Service Recipient’s individual preferences (e.g. concerning language);

remembering the IP location and the time zone;

keeping anonymous statistics showing how the Website is used;

remembering products ordered in the basket, as well as the proper functioning of the Shop;

personalising and publishing advertising content placed on the Website in line with the interests of Service Recipients.

remarketing, i.e. advertising activity in which, after appropriate remarketing lists have been created on the basis of selected behavioural characteristics (using Google Analytics), banner ads are targeted and displayed to users while they visit various websites in the Google advertising network.

g) By default, most web browsers available on the market accept the storage of Cookies. Everyone can determine the conditions for the use of Cookies through the settings of their own web browser. This means that one can, for example, partially restrict (e.g. temporarily) or completely disable the storage of Cookies – in the latter case, however, this may affect some functionalities of the Website (for example, it may prove impossible to complete the Order path via the order form, as products are not remembered in the basket during the subsequent steps of placing an Order).

h) Web browser settings regarding Cookies are relevant to consent to the use of Cookies by our Website – under the law, such consent may also be expressed through

web browser settings. In the absence of such consent, the web browser settings regarding Cookies should be changed accordingly.

i) Detailed information on changing Cookie settings and on deleting Cookies yourself in the most popular web browsers is available in the help section of the web browser and on the following pages (just click the relevant link):

in the Chrome browser

in the Firefox browser

in the Internet Explorer browser

in the Opera browser

in the Safari browser

in the Microsoft Edge browser

9. Final provisions

a) Matters not regulated by this document are governed by the provisions on the protection of personal data.

b) You will be informed of any changes to this document by e-mail.

c) This Privacy Policy applies from 1 October 2021.