Privacy Policy
Privacy Policy of the AWIH Online Store
1. This document sets out the rules for processing and protecting the personal data of Customers of the Online Store available at www.awih.pl.
2. The owner of the Online Store and the controller of the personal data of Customers who are natural persons and of users whose data are concerned is AWIH Zbigniew Zieliński, based in Opacz Kolonia, ul. Ryżowa 96A, tax identification number (NIP): 1130061093, telephone: 501256996, email: marketing@awih.pl, hereinafter referred to as the Controller, who is also the Seller.
3. Personal data collected by the Controller through the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (Official Journal of the EU, L 119, p. 1), the General Data Protection Regulation (GDPR), and other personal data protection provisions applicable throughout the period in which the data concerned are processed. Personal data means information relating to an identified or identifiable natural person, hereinafter referred to as Personal Data. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data, or one or more factors specific to that person’s physical, genetic, mental, economic, cultural or social identity.
4. The Controller takes particular care to respect the privacy of Customers visiting the Online Store.
§ 1 Types of data processed, purposes and legal basis
1. The Controller collects information about natural persons entering into legal transactions not directly related to their business activities, natural persons conducting business or professional activities in their own name, and natural persons representing legal persons or organisational units without legal personality to which the law grants legal capacity and which conduct business or professional activities in their own name, hereinafter referred to as Customers.
2. The purposes for which the Controller processes Customers’ Personal Data include, in particular:
a) registering an account in the Online Store to create and manage an individual account. Legal basis: processing necessary for the performance of the Account service agreement — Article 6(1)(b) GDPR;
b) placing an order in the Online Store to perform the sales contract. Legal basis: processing necessary for the performance of the sales contract — Article 6(1)(b) GDPR;
c) subscribing to the Newsletter to perform an agreement for a service provided electronically. Legal basis: the data subject’s consent to the performance of the Newsletter service agreement — Article 6(1)(a) GDPR.
3. When registering an account for the Newsletter service in the Online Store, the Customer provides the following data:
a) email address.
4. When placing an order in the Online Store, the Customer provides the following data:
a) email address;
b) address details: postcode and town or city, country, street, house or flat number;
c) first name and surname;
d) telephone number.
5. Business customers provide the above data and, additionally:
a) the business name;
b) tax identification number (NIP).
6. When using the Newsletter service, the Customer provides:
a) email address;
b) telephone number.
7. Additional information may also be collected when the Online Store is used, including the IP address assigned to the Customer’s computer or the external IP address of the internet service provider, domain, browser type, access time and operating system type.
8. Browsing data may also be collected from Customers, including information about links they choose to click and other actions they perform in our Online Store. Legal basis: legitimate interest — Article 6(1)(f) GDPR — in improving the use of services provided electronically.
9. For the purpose of establishing, pursuing and enforcing claims, certain personal data provided by the Customer when using the available features may also be processed, including first name, surname, data relating to the use of services where claims arise from the way the Customer uses them, and other data necessary to demonstrate the existence of a claim, including the extent of the damage suffered. Legal basis: legitimate interest — Article 6(1)(f) GDPR — in establishing, pursuing and enforcing claims and defending against claims in proceedings before courts and other public authorities.
10. Personal data collected by the Controller are provided voluntarily in connection with sales contracts or services provided through the Online Store. However, failure to provide the data specified in the forms during Registration prevents Registration and creation of a Customer Account. When placing an order without registering a Customer Account, failure to provide the required data prevents the order from being placed and fulfilled.
§ 2 Recipients of your data and retention periods
1. The recipients of Personal Data processed by the Controller depend primarily on the scope of services used by the Customer. The Customer’s personal data are transferred to service providers used by the Controller to operate the Online Store. Depending on contractual arrangements and circumstances, providers receiving personal data either follow the Controller’s instructions concerning the purposes and means of processing, as processors, or independently determine those purposes and means, as controllers.
a) Processors — the Controller uses providers who process personal data solely on the Controller’s instructions. These include hosting and IT service providers, accounting service providers, providers of marketing systems, systems for analysing traffic in the Online Store and the effectiveness of marketing campaigns, companies running marketing campaigns, and software maintenance companies.
b) Controllers — the Controller also uses providers who do not act solely on its instructions and independently determine the purposes and means of using Customers’ personal data. They provide electronic payment and banking services.
2. Location — service providers are based in Poland and in other countries of the European Economic Area (EEA).
3. Customers’ personal data are retained as follows:
a) Where consent is the basis for processing, the Controller processes the Customer’s personal data until that consent is withdrawn. After withdrawal, personal data are retained for a period corresponding to the limitation period for claims that the Controller may bring or that may be brought against it. Unless a specific provision provides otherwise, the limitation period is 10 years, or 3 years for claims concerning periodic payments and claims connected with business activities.
b) Where processing is based on the performance of a contract, the Controller processes the Customer’s personal data for as long as necessary to perform that contract. Thereafter, the personal data are processed for a period corresponding to the limitation period for claims. Unless specific provisions provide otherwise, the limitation period is 10 years, or 3 years for claims concerning periodic payments and claims connected with business activities.
4. When a purchase is made in the Online Store, personal data may, depending on the Customer’s choice, be transferred to the following entity to deliver products ordered in the Online Store: GLS courier company.
5. If the Customer chooses to pay through the PayPal Express payment system, based at L-1150 in Luxembourg, their personal data are transferred to the extent necessary to process the payment.
6. Personal browsing data may be used to provide Customers with better service, analyse statistical data, adapt the Online Store to Customers’ preferences and administer the Online Store.
7. If the Customer subscribes to the Newsletter, the Controller will send information to their email address or SMS messages to their mobile telephone containing commercial information about promotions, discounts and new products available in the Online Store.
8. Where the Controller receives a request to disclose data, it will disclose personal data to authorised public authorities, in particular organisational units of the Public Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.
§ 3 Cookies and IP addresses
1. Cookies used by the Controller primarily help optimise visitors’ experience of the Online Store and enable the preparation of statistics on visits to products displayed in the Store. The Controller stores these files on the visitor’s device if the web browser permits this. Cookies usually contain the domain name from which they originate, their expiry time and an individual, randomly selected number identifying the files.
2. Two types of cookies are used:
a) Session cookies — stored information is removed from the device’s memory when the browser session ends or the computer is switched off. The session cookie mechanism does not allow any personal data or confidential information to be retrieved from Customers’ computers;
b) Persistent cookies — these are stored in the memory of the Customer’s device and remain there until deleted or until they expire. The persistent cookie mechanism does not allow any personal data or confidential information to be retrieved from Customers’ computers.
3. The Controller uses its own cookies to:
a) authenticate the Customer in the Online Store and maintain the Customer’s session after they log in to their Customer Account;
b) produce anonymous statistics and analyses that help understand how Customers use the Online Store.
4. The Controller uses third-party cookies to:
a) collect statistical data through Google Analytics tools — third-party cookie controller: Google Inc., based in the USA;
b) display advertisements from Google AdSense — third-party cookie controller: Google Inc., based in the USA;
c) promote the Online Store on Facebook.com — third-party cookie controller: Facebook Inc., based in the USA, or Facebook Ireland, based in Ireland;
5. The cookie mechanism is completely safe for the computers of Customers of the Online Store. Customers may independently change their cookie settings at any time, specifying the conditions under which cookies are stored on and access their device. These changes can be made in the web browser settings. In particular, the settings can be changed to block automatic handling of cookies or notify the Customer whenever a cookie is placed on their device. Detailed information about cookie settings and how to manage them is available in the web browser settings. Blocking cookies may affect certain features available in the Online Store.
6. The Controller may collect Customers’ IP addresses. An IP address is a number assigned by an internet service provider to the computer of a person visiting the Online Store. The Controller uses IP addresses to diagnose technical problems with the server, prepare statistical analyses and improve the Online Store.
7. The Online Store contains links to other websites. The Controller is not responsible for the privacy policies applicable on those websites.
§ 4 Rights and obligations of the data subject
1. Right to withdraw consent — legal basis: Article 7(3) GDPR.
a) The Customer has the right to withdraw any consent given to the Controller.
b) Withdrawal of consent takes effect from the time it is withdrawn.
c) Withdrawal of consent does not, in principle, affect processing lawfully carried out by the Controller before the withdrawal.
d) Withdrawal of consent has no negative consequences for the Customer of the Online Store, but may prevent continued use of services or features that can only be provided with consent.
2. Right to object to data processing — legal basis: Article 21 GDPR.
a) The Customer has the right to object at any time to the processing of their personal data, including profiling, where the Controller processes the data on the basis of a legitimate interest, such as marketing products and services, compiling statistics on the use of particular features of the Online Store, facilitating use of the Online Store, or measuring Customer satisfaction.
b) An email opting out of commercial messages about products or services constitutes the Customer’s objection to the processing of their personal data, including profiling, for those purposes.
c) If the Customer’s objection is justified and the Controller has no other legal basis for processing the personal data, the Customer’s data to whose processing they objected will be erased.
3. Right to erasure, or the right to be forgotten — legal basis: Article 17 GDPR.
a) The Customer has the right to request erasure of all or some of their personal data.
b) The Customer has the right to request erasure of personal data if:
a. the personal data are no longer necessary for the purposes for which they were collected or processed;
b. the Customer has withdrawn consent, to the extent that their data were processed on the basis of that consent;
c. the Customer has objected to the use of their data for commercial or marketing purposes;
d. the personal data are being processed unlawfully;
e. the personal data must be erased to comply with a legal obligation under Union or Member State law to which the Controller is subject;
f. the personal data were collected in connection with the offer of information society services.
c) Despite a request to erase personal data following an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary to establish, pursue or defend claims, or to comply with a legal obligation requiring processing under Union or Member State law to which it is subject.
4. Right to restriction of processing — legal basis: Article 18 GDPR.
a) The Customer of the Online Store has the right to request restriction of the processing of their data. Such a request prevents use of certain features or services that involve processing the data covered by the request.
b) The Customer of the Online Store has the right to request restriction of the use of personal data in the following situations:
a. where the accuracy of their personal data is disputed, the Controller restricts use of the data for the time needed to verify their accuracy;
b. where processing is unlawful and the Customer requests restriction of use instead of erasure;
c. where the Customer’s personal data are no longer necessary for the purposes for which they were collected or used, but the Customer needs them to establish, pursue or defend claims;
d. where the Customer has objected to the use of their data, restriction applies for the time needed to consider whether, in their particular situation, the protection of the Customer’s interests, rights and freedoms overrides the interests pursued by the Controller in processing the data.
5. Right of access to data — legal basis: Article 15 GDPR.
a) The Customer has the right to obtain confirmation from the Controller as to whether it processes their personal data. If it does, the Customer has the right to:
a. access their personal data;
b. obtain information about the purposes of processing, the recipients or categories of recipients of the data, the envisaged retention period or the criteria used to determine it, the Customer’s rights under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making including profiling, and the safeguards applied when the data are transferred outside the European Union;
c. obtain a copy of their personal data.
6. Right to rectification — legal basis: Article 16 GDPR.
a) The Customer has the right to request that the Controller rectify inaccurate personal data without delay. Taking account of the purposes of processing, the Customer has the right to have incomplete personal data completed, including by providing a supplementary statement, by sending an email to the Controller’s email address.
7. Right to data portability — legal basis: Article 20 GDPR.
a) The Customer has the right to receive the data they provided to the Controller and then transmit them to another personal data controller of their choice. The Customer of the Online Store also has the right to request that the Controller transmit the specified personal data directly to that other controller, where technically feasible. In this situation, the Controller will transmit the Customer’s data in CSV format, which is a commonly used file format.
8. If the Customer requests the exercise of the rights listed above, the Controller may grant or refuse the request and will do so without delay.
9. The Customer has the right to submit complaints, enquiries and requests to the Controller concerning the processing of their personal data and the exercise of their rights.
10. The Customer has the right to request a copy of the standard contractual clauses from the Controller by sending a request to the Controller’s email address.
11. The Customer has the right to lodge a complaint with the President of the Personal Data Protection Office concerning a breach of their right to personal data protection or other rights granted under the GDPR.
§ 5 Security of Personal Data
1. The Controller declares that it makes every effort to provide Customers with a high level of security when using the Online Store and, for this purpose:
a) applies the technical and organisational measures required by law, in particular measures relating to the security of Personal Data processing;
b) applies measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
c) maintains the ability to restore the availability of and access to Personal Data promptly in the event of a physical or technical incident;
d) provides Customers of the Online Store with a secure, encrypted connection when transmitting personal data and logging in to their Customer Account, using an SSL certificate.
2. Any incidents affecting the security of information or personal data transmission, including suspected sharing of files containing viruses, should be reported to the Controller by email at marketing@awih.pl.
§ 6 Final provisions
1. Matters not covered by this Privacy Policy are governed by the laws on the processing of Personal Data, including the GDPR.
2. This version of the Privacy Policy has been effective since 25 June 2022.