Due to the changes in personal data protection regulations and the implementation, as of May 25, 2018, of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), the company Rekonstrukcje Historyczne CEZAR Cezary Wyszyński hereby provides the content of the document titled “Privacy Policy”.

1. DEFINITIONS

• Administrator – the company: Rekonstrukcje Historyczne CEZAR Cezary Wyszyński based in Pogórze, Poland.
• Personal Data – all information about a natural person who is identified or identifiable through one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity, including the device IP address, location data, online identifier, and information collected via cookies and other similar technologies.
• Policy – this Privacy Policy.
• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
• Website – the website operated by the Administrator at: https://www.woolsome.shop/
• User – any natural person visiting the Website or using one or more services or functionalities described in the Privacy Policy.

2. DATA PROCESSING IN CONNECTION WITH USING THE WEBSITE

2.1. In connection with the User’s use of the Website, the Administrator collects data necessary to provide individual services offered and information about the User’s activity on the Website. Below are the detailed rules and purposes of processing personal data collected during the User’s use of the Website.

 

3. PURPOSES AND LEGAL BASIS FOR DATA PROCESSING ON THE WEBSITE

USING THE WEBSITE

3.1. Personal data of all individuals using the Website (including IP address or other identifiers and information collected through cookies or similar technologies) who are not registered Users (i.e., do not have a profile on the Website) are processed by the Administrator:

3.1.1. for the purpose of providing electronic services in the scope of making content available to Users via the Website, booking products or services as part of the booking service, offering products of other vendors as part of cooperation with third parties, providing contact forms – in such cases, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) GDPR);

3.1.2. for the purpose of handling purchases made without registration – in such cases, the legal basis for processing is the necessity of processing for the performance of a contract
(Art. 6(1)(b) GDPR);

3.1.3. for the purpose of handling complaints – in such cases, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) GDPR);

3.1.4. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in conducting analyses of Users’ activity and preferences to improve the functionalities used and the services provided;

3.1.5. for the potential establishment and pursuit of claims or defense against them – the legal basis for processing is the legitimate interest of the Administrator
(Art. 6(1)(f) GDPR), consisting in the protection of its rights;

3.1.6. for marketing purposes of the Administrator and other entities, particularly in connection with behavioral advertising.

User activity on the Website, including personal data, is recorded in system logs (a special computer program for storing a chronological record containing information about events and actions related to the IT system used by the Administrator to provide services). Information collected in logs is processed for service provision purposes. The Administrator also processes them for technical purposes—in particular, data may be temporarily stored and processed to ensure security and proper functioning of IT systems, e.g., in connection with backup creation, system changes testing, error detection, or protection against abuse and attacks.

REGISTRATION ON THE WEBSITE

3.2. Individuals registering on the Website are asked to provide data necessary to create and manage an account. To facilitate service, the User may also provide additional data, thereby consenting to their processing. Such data can be deleted at any time. Providing the data marked as mandatory is required to create and manage the account; failure to provide them will result in being unable to set up the account. Providing other data is voluntary.

3.3. Personal data are processed:

3.3.1. for the purpose of providing services related to account creation and management – the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) GDPR), and for optional data – the legal basis is consent (Art. 6(1)(a) GDPR);

3.3.2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in analyzing Users’ activity on the Website and use of the account, as well as their preferences to improve functionalities;

3.3.3. for the potential establishment and pursuit of claims or defense against them – the legal basis for processing is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in the protection of its rights.

3.3.4. for marketing purposes of the Administrator and other entities.

3.4. If the User places any personal data of other individuals on the Website (including their name and surname, address, phone number, date of birth, or email address), they may do so only in compliance with applicable laws and the personal rights of such individuals.

PLACING ORDERS

3.5. Placing an order (purchase of goods or services) by the User involves processing their personal data. Providing the data marked as mandatory is required for accepting and fulfilling the order; failure to provide them will prevent order completion. Providing other data is optional. If the User places an order through the service in cooperation with third-party entities, the User’s personal data necessary to fulfill the order will be shared with the seller for contract execution purposes.

3.6. Personal data are processed:

3.6.1. for order fulfillment – the legal basis is the necessity of processing for the performance of a contract (Art. 6(1)(b) GDPR); for optional data, the legal basis is consent (Art. 6(1)(a) GDPR);

3.6.2. for the purpose of fulfilling legal obligations imposed on the Administrator, particularly those arising from tax and accounting regulations – the legal basis is a legal obligation (Art. 6(1)(c) GDPR);

3.6.3. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in analyzing User activity on the Website and their purchasing preferences to improve functionalities;

3.6.4. for the potential establishment and pursuit of claims or defense against them – the legal basis is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in the protection of its rights.

CONTACT FORMS

3.7. The Administrator provides the option to contact via electronic contact forms. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide additional data to facilitate contact or inquiry handling. Providing the data marked as mandatory is necessary to handle the inquiry; failure to provide them will result in the inability to process the inquiry. Providing other data is voluntary.

3.8. Personal data are processed:

3.8.1. to identify the sender and handle their inquiry submitted via the provided form – the legal basis is the necessity of processing for the performance of a service contract (Art. 6(1)(b) GDPR);

3.8.2. for analytical and statistical purposes – the legal basis is the legitimate interest of the Administrator (Art. 6(1)(f) GDPR), consisting in keeping statistics of inquiries submitted by Users via the Website to improve its functionalities.

4. MARKETING

4.1. The Administrator processes Users’ personal data to carry out marketing activities, which may include:

4.1.1. displaying marketing content to the User that is not tailored to their preferences (contextual advertising);

4.1.2. displaying marketing content tailored to the User’s interests (behavioral advertising);

4.1.3. sending email notifications about interesting offers or content, which in some cases contain commercial information;

4.1.4. conducting other direct marketing activities for goods and services (sending commercial information electronically and telemarketing).

4.2. To carry out marketing activities, the Administrator sometimes uses profiling. This means that using automated data processing, the Administrator assesses selected factors about individuals to analyze their behavior or predict future behavior.

CONTEXTUAL ADVERTISING

4.3. The Administrator processes Users’ personal data for marketing purposes related to displaying contextual advertising (i.e., advertising that is not adapted to the User’s preferences). Data processing is based on the legitimate interest of the Administrator (Art. 6(1)(f) GDPR).

BEHAVIORAL ADVERTISING

4.4. The Administrator processes Users’ personal data, including data collected via cookies and similar technologies, for marketing purposes related to displaying behavioral advertising (i.e., advertising tailored to the User’s preferences). This includes profiling. Use of such data for marketing, especially to promote third-party goods and services, is based on the Administrator’s legitimate interest, and only if the User has given consent to the use of cookies. This consent can be given through browser settings and withdrawn at any time by clearing cookies or disabling cookies in the browser.

4.5. This consent can be withdrawn at any time.

DIRECT MARKETING

4.6. If the User has consented to receiving marketing information via email, SMS, or other electronic communication channels, their personal data will be processed for this purpose. The legal basis is the legitimate interest of Rekonstrukcje Historyczne CEZAR Cezary Wyszyński in sending marketing information within the scope of the User’s consent (direct marketing). The User has the right to object to the processing of data for direct marketing purposes, including profiling. Data will be stored for this purpose as long as there is a legitimate interest, unless the User objects to receiving such communications.

5. SOCIAL MEDIA

5.1. The Administrator processes personal data of Users visiting the Administrator’s social media profiles (Facebook, Twitter, YouTube, Google+). These data are processed solely in connection with managing the profile, including to inform Users about the Administrator’s activities, promote events, services, and products, and to communicate through social media features. The legal basis for data processing is the Administrator’s legitimate interest (Art. 6(1)(f) GDPR) in promoting its brand and maintaining a community.

6. MOBILE VERSIONS

6.1. The Administrator also processes personal data to allow access to services through mobile versions of the Website. User data are processed for registration and usage of the mobile versions. The legal basis is the necessity of processing for the performance of a contract (Art. 6(1)(b) GDPR).

6.2. Through mobile versions, the User can: browse the Website’s range, place orders and pay for them, view published content, and use other functionalities. Due to technical limitations, the mobile version may not support all functionalities available on the main Website.

7. COOKIES AND SIMILAR TECHNOLOGIES

7.1. Cookies are small text files installed on the User’s device when browsing the Website. Cookies collect information that makes it easier to use the website – for example, by remembering User visits and actions.

“SERVICE” COOKIES

7.2. The Administrator uses so-called service cookies primarily to provide electronic services to the User and improve service quality. For this purpose, the Administrator and analytical/statistical service providers use cookies to store or access information stored on the User’s end device (computer, phone, tablet, etc.). These include:

7.2.1. cookies with data entered by the User (session ID) for the session duration (user input cookies);

7.2.2. authentication cookies used for services requiring authentication during the session;

7.2.3. security cookies (e.g., used to detect authentication abuses);

7.2.4. multimedia player session cookies (e.g., flash player cookies) during the session;

7.2.5. persistent cookies for user interface personalization during or slightly beyond the session;

7.2.6. shopping cart cookies during the session;

7.2.7. cookies for monitoring traffic on the Website (Google Analytics, etc.). Google does not use the data to identify the User or combine the information to enable identification. Detailed data collection and usage terms are available at:

https://www.google.com/intl/pl/policies/privacy/partners

“MARKETING” COOKIES

7.3. The Administrator also uses cookies for marketing purposes, including for behavioral advertising. The Administrator stores or accesses information on the User’s end device (e.g., phone or tablet). Use of cookies and personal data collected through them for marketing, particularly to promote third-party services or goods, requires the User’s consent. This consent can be given through browser settings and withdrawn at any time, including by clearing cookies or disabling cookies in browser settings.

8. PERSONAL DATA RETENTION PERIOD

8.1. The data retention period depends on the type of service and the purpose of processing. As a rule, data are processed for the duration of the service or order fulfillment, until the consent is withdrawn or a valid objection to data processing is raised, where the legal basis is the legitimate interest of the Administrator.

8.2. The processing period may be extended if necessary for establishing or defending against claims. After this period, data are deleted or anonymized, unless otherwise required by law.

9. USER RIGHTS

9.1. Individuals whose data are processed have the following rights:

9.1.1. Right to information – the Administrator provides details on data processing, including purposes, legal basis, scope, recipients, and retention period;

9.1.2. Right to obtain a copy of data – the Administrator provides a copy of the processed data;

9.1.3. Right to rectify – the Administrator corrects or updates inaccurate/incomplete data;

9.1.4. Right to erase data – data can be deleted if no longer needed for the purposes collected;

9.1.5. Right to restrict processing – the Administrator stops processing except for storage or with consent;

9.1.6. Right to data portability – when data is processed based on contract or consent, the Administrator provides data in a computer-readable format or sends them to another controller (if technically feasible);

9.1.7. Right to object to marketing – data subjects can object at any time without justification;

9.1.8. Right to object to other purposes – the User may object to data processing based on legitimate interest (e.g., analytics). The objection must include justification and is subject to assessment;

9.1.9. Right to withdraw consent – if data are processed based on consent, it may be withdrawn at any time, without affecting legality of prior processing;

9.1.10. Right to lodge a complaint – data subjects may file a complaint with the President of the Personal Data Protection Office if GDPR is violated.

9.2. Requests to exercise data rights can be submitted:

9.2.1. in writing to: Rekonstrukcje Historyczne CEZAR Cezary Wyszyński, ul. Żeromskiego 8, 81-198 Pogórze, Poland;

9.2.2. by email to: info@woolsome.shop

9.3. The request should specify, if possible:

9.3.1. the right being exercised (e.g., data copy, erasure, etc.);

9.3.2. the processing process involved (e.g., specific service, newsletter, etc.);

9.3.3. the purpose of processing (e.g., marketing, analytics, etc.).

9.4. If the Administrator cannot determine the request’s content or identify the requester, additional information will be requested.

9.5. A response will be given within one month. If an extension is needed, the User will be informed of the reason.

9.6. The reply will be sent to the email address used for the request or by post if sent in writing (unless the letter specifies an email response).

10. DATA RECIPIENTS

10.1. To fulfill services, personal data may be shared with external entities such as IT service providers, banks, payment operators, accounting, legal and audit firms, couriers (for order fulfillment), marketing agencies, and affiliated entities. In case of a purchase from a third party, data will be shared with that seller for contract execution;

10.2. With the User’s consent, their data may also be shared with other entities for their own purposes, including marketing;

10.3. The Administrator may disclose selected User data to authorities or third parties who request it, based on a valid legal basis and applicable law.

11. TRANSFER OF DATA OUTSIDE THE EEA

11.1. Data protection levels outside the European Economic Area (EEA) differ from those ensured by EU law. Therefore, personal data will only be transferred outside the EEA when necessary and with adequate safeguards, such as:

11.1.1. cooperation with processors in countries with an EC adequacy decision;

11.1.2. standard contractual clauses approved by the EC;

11.1.3. binding corporate rules approved by a supervisory authority;

11.1.4. for the USA – cooperation with entities under the Privacy Shield framework.

11.2. The Administrator will always inform about such transfers at the time of data collection.

12. DATA SECURITY

12.1. The Administrator regularly analyzes risks to ensure personal data are processed securely – allowing access only to authorized individuals and only to the necessary extent. All data operations are logged and performed only by authorized staff or contractors.

12.2. The Administrator ensures that subcontractors and partners apply appropriate safeguards whenever they process personal data on the Administrator’s behalf.

13. CONTACT DETAILS

13.1. Contact the Administrator by email at: info@woolsome.shop or by post at: Rekonstrukcje Historyczne CEZAR Cezary Wyszyński, ul. Żeromskiego 8, 81-198 Pogórze, Poland;

14. CHANGES TO THE PRIVACY POLICY

14.1. The Policy is subject to ongoing review and updated when necessary.