English
Polski
Deutsch
Nederlands
PRIVACY POLICY
OF THE PRANIE.PL ONLINE STORE
TABLE OF CONTENTS:
1. GENERAL PROVISIONS
2. BASES FOR DATA PROCESSING
3. PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE
4. RECIPIENTS OF DATA IN THE ONLINE STORE
5. PROFILING IN THE ONLINE STORE
6. RIGHTS OF THE DATA SUBJECT
7. COOKIES IN THE ONLINE STORE AND ANALYTICS
8. FINAL PROVISIONS
1. GENERAL PROVISIONS
1.1. This Privacy Policy of the Online Store is for informational purposes only and does not create obligations for Service Recipients or Customers of the Online Store. The Privacy Policy primarily outlines the principles governing personal data processing by the Administrator in the Online Store, including the bases, purposes, and retention periods of personal data processing, as well as the data subjects’ rights and information on the use of Cookies and analytical tools in the Online Store.
1.2. The Administrator of personal data collected via the Online Store is PLANOWNIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Kielce (registration and correspondence address: ul. 1 Maja 93, 25-614 Kielce), entered into the National Court Register under KRS number: 0000678133; court maintaining the company’s documentation: District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register; share capital: PLN 50,000.00; NIP: 7252205113; REGON: 367486449; email address: biuro@pranie.pl; phone: (+48) 41 202 04 90, 412 02 07 27 – hereinafter referred to as the “Administrator,” who is also the Service Provider of the Online Store and the Seller.
1.3. Personal data in the Online Store are processed by the Administrator in accordance with applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”). The official text of the GDPR is available at: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
1.4. Use of the Online Store, including making purchases, is voluntary. Similarly, providing personal data by a Service Recipient or Customer is voluntary, except in two cases: (1) entering into contracts with the Administrator – failure to provide personal data required in the Online Store’s Terms and Conditions and in this Privacy Policy, necessary to conclude and perform the Sales Agreement or the Agreement for the Provision of Electronic Services with the Administrator, will result in the inability to conclude such an agreement. In such a case, providing personal data is a contractual requirement, and if the data subject wishes to enter into the agreement, they must provide the required data. The scope of data required to conclude an agreement is always indicated in the Online Store’s Terms and Conditions and on the Online Store’s website; (2) legal obligations of the Administrator – providing personal data is required by law, and failure to provide such data will prevent the Administrator from fulfilling its legal obligations (e.g., processing data for accounting purposes).
1.5. The Administrator exercises due diligence to protect the interests of data subjects. In particular, the Administrator ensures that collected data are: (1) processed lawfully; (2) collected for specified, legitimate purposes and not processed further in a manner incompatible with those purposes; (3) accurate and adequate in relation to the purposes for which they are processed; (4) stored in a form that permits the identification of data subjects for no longer than necessary to achieve the processing purpose; and (5) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical and organizational measures.
1.6. Considering the nature, scope, context, and purposes of processing and the risks to the rights and freedoms of natural persons, the Administrator implements appropriate technical and organizational measures to ensure GDPR compliance and to demonstrate such compliance. These measures are reviewed and updated as necessary. The Administrator uses technical safeguards to prevent unauthorized persons from accessing or modifying personal data transmitted electronically.
1.7. Any words, expressions, or acronyms in this Privacy Policy starting with a capital letter (e.g., “Seller,” “Online Store,” “Electronic Service”) shall be understood according to their definitions in the Online Store’s Terms and Conditions available on the Online Store’s website.
2. BASES FOR DATA PROCESSING
2.1. The Administrator is authorized to process personal data when at least one of the following conditions applies and to the extent in which it applies: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the data subject’s request before entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data, especially where the data subject is a child.
2.2. Processing of personal data by the Administrator requires at least one of the legal bases specified in section 2.1 of this Privacy Policy. The specific bases for processing personal data of Service Recipients and Customers by the Administrator are indicated in the next section of this Privacy Policy for each processing purpose.
3. PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE
3.1. The purpose, legal basis, and retention period, as well as the recipients of personal data processed by the Administrator, result from actions taken by a given Service Recipient or Customer in the Online Store or by the Administrator. For example, if a Customer decides to make a purchase in the Online Store and chooses in-person pickup instead of courier delivery, their personal data will be processed for performance of the Sales Agreement but will not be shared with the courier service engaged by the Administrator.
3.2. The Administrator may process personal data in the Online Store for the following purposes, on the legal bases and for the retention periods indicated in the table below:
Purpose of Processing | Legal Basis for Processing | Data Retention Period
Performance of the Sales Agreement or the Agreement for the Provision of Electronic Services, or taking steps at the data subject’s request before entering into such agreements | Article 6(1)(b) GDPR (processing necessary for performance of a contract) | Data are retained for the period necessary to perform, terminate, or otherwise conclude the Sales Agreement or the Agreement for the Provision of Electronic Services.
Direct marketing | Article 6(1)(f) GDPR (legitimate interest) – processing is necessary for the purposes of the legitimate interests pursued by the Administrator, consisting of safeguarding the Administrator’s interests and reputation, maintaining the Online Store, and promoting product sales. | Data are retained for as long as the legitimate interest is pursued, but not longer than the limitation period for claims arising from the Administrator’s business activities. Under Polish Civil Code, limitation for business-related claims is generally three years, and for Sales Agreement claims is two years.
Marketing (newsletter, promotional offers) | Article 6(1)(a) GDPR (consent) – the data subject has given consent to process their personal data for one or more specified marketing purposes (e.g., newsletter subscription). | Data are retained until the data subject withdraws consent.
Collecting Customer feedback on the concluded Sales Agreement | Article 6(1)(a) GDPR (consent) – the data subject has given consent to process their personal data to provide feedback. | Data are retained until the data subject withdraws consent.
Keeping accounting records | Article 6(1)(c) GDPR (legal obligation) in connection with Article 74(2) of the Accounting Act of January 30, 2018 (Journal of Laws 2018, item 395 as amended) – processing is necessary to fulfill the Administrator’s legal obligation. | Data are retained for the period required by law for accounting records (five years from the beginning of the year following the financial year to which the data relate).
Establishing, asserting, or defending claims involving the Administrator | Article 6(1)(f) GDPR (legitimate interest) – processing is necessary for the purposes of the legitimate interests pursued by the Administrator in establishing, asserting, or defending claims involving the Administrator. | Data are retained as long as the legitimate interest is pursued, but not longer than the limitation period for claims involving the Administrator (six years under Polish law).
Ensuring proper functioning of the Online Store’s website | Article 6(1)(f) GDPR (legitimate interest) – processing is necessary for the purposes of the legitimate interests pursued by the Administrator in maintaining and operating the Online Store’s website. | Data are retained as long as the legitimate interest is pursued, but not longer than the limitation period for claims arising from the Administrator’s business activities (three years for business-related claims; two years for Sales Agreement claims).
Conducting statistics and analyzing traffic in the Online Store | Article 6(1)(f) GDPR (legitimate interest) – processing is necessary for the purposes of the legitimate interests pursued by the Administrator in conducting statistics and analyzing traffic to improve the Online Store’s functionality and increase product sales. | Data are retained as long as the legitimate interest is pursued, but not longer than the limitation period for claims arising from the Administrator’s business activities (three years for business-related claims; two years for Sales Agreement claims).
4. RECIPIENTS OF DATA IN THE ONLINE STORE
4.1. For the proper functioning of the Online Store, including for the performance of Sales Agreements, the Administrator uses services of external entities (e.g., software provider, courier, payment processor). The Administrator cooperates only with data processors who guarantee appropriate technical and organizational measures to ensure compliance with the GDPR and protect the rights of data subjects.
4.2. Personal data may be transferred to a third country only if that country ensures an adequate level of protection in accordance with the GDPR, or if standard contractual clauses are used. The Administrator ensures that data subjects can obtain a copy of their data. The Administrator transfers personal data only when necessary for the purpose of processing in accordance with this Privacy Policy.
4.3. The Administrator does not transfer data in all cases or to all categories of recipients indicated in this Privacy Policy – data are shared only when necessary for a specific processing purpose and only to the extent necessary to achieve that purpose. For example, if a Customer chooses in-person pickup, their data will not be transferred to the courier.
4.4. Personal data of Service Recipients and Customers may be disclosed to the following recipients or categories of recipients:
4.4.1. Couriers / shipping brokers / third-party warehouse operators / drop-shipping providers – if a Customer chooses courier delivery, the Administrator shares the Customer’s personal data with the selected courier, shipping broker, or third-party warehouse operator to the extent necessary to deliver the product.
4.4.2. Electronic payment or card payment processors – if a Customer chooses electronic or card payment, the Administrator shares the Customer’s personal data with the selected payment processor to the extent necessary to process the payment.
4.4.3. Credit providers / leasing providers – if a Customer chooses installment, deferred payment, or leasing, the Administrator shares the Customer’s personal data with the selected credit or financing provider to the extent necessary to process the financing.
4.4.4. Providers of feedback survey systems – if a Customer agrees to provide feedback about the Sales Agreement, the Administrator shares the Customer’s personal data with the selected survey provider to the extent necessary for the Customer to submit feedback via the system.
4.4.5. Providers of technical, IT, or organizational solutions – including software providers for running the Online Store, email and hosting providers, and providers of enterprise management and technical support software – the Administrator shares the Customer’s personal data only when necessary to achieve the processing purpose in accordance with this Privacy Policy.
4.4.6. Accounting, legal, and advisory service providers – such as accounting firms, law firms, or debt collection agencies – the Administrator shares the Customer’s personal data only when necessary to achieve the processing purpose in accordance with this Privacy Policy.
4.4.7. Marketing, analytics, and advertising service providers – such as marketing agencies, email marketing service providers, and providers of advertising optimization solutions – the Administrator shares the Customer’s personal data only if there is a lawful basis for processing for marketing purposes (including direct marketing) and only to the extent necessary to achieve the processing purpose in accordance with this Privacy Policy.
4.4.8. Providers of social media plugins, scripts, and similar tools embedded in the Online Store’s website that enable the user’s browser to fetch content from plugin providers (e.g., login via social media credentials) and share personal data with those providers, including:
4.4.8.1. Meta Platforms Ireland Ltd. – the Administrator may use Facebook or Instagram social plugins (e.g., “Like” button, “Share” button, login via Facebook credentials). In connection with such plugins, the Administrator collects and shares personal data of Online Store visitors with Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) in accordance with Meta’s privacy policies: https://www.facebook.com/about/privacy/ – this data may include information about activities on the Online Store’s website (e.g., device information, visited pages, purchases, displayed ads, and how services are used), regardless of whether the visitor has a Facebook or Instagram account or is logged in.
5. PROFILING IN THE ONLINE STORE
5.1. The GDPR requires the Administrator to inform about automated decision making, including profiling as referred to in Article 22(1) and (4) GDPR, and to provide, at a minimum, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Accordingly, the Administrator provides information below about possible profiling.
5.2. The Administrator may use profiling in the Online Store for direct marketing purposes; however, decisions based solely on profiling by the Administrator do not affect the conclusion or refusal of a Sales Agreement or access to Electronic Services in the Online Store. Profiling may result in a discount being granted, a discount code being sent, a reminder of an abandoned cart, a product recommendation based on preferences or purchase history, or offer of better terms than standard. Despite profiling, the data subject remains free to decide whether to use the discount or offer and make a purchase.
5.3. Profiling in the Online Store involves automated analysis or prediction of a person’s behavior on the Online Store’s website, e.g., adding a specific product to the cart, browsing a specific product page, or analyzing their purchase history. Profiling requires the Administrator to have personal data about the individual to send, for example, a discount code.
5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them.
6. RIGHTS OF THE DATA SUBJECT
6.1. Right of access, rectification, restriction, erasure, or portability – the data subject has the right to request from the Administrator access to their personal data, correction of inaccurate data, erasure (“right to be forgotten”), restriction of processing, or transfer of their data. Detailed conditions for exercising these rights are set out in Articles 15–21 GDPR.
6.2. Right to withdraw consent at any time – a data subject whose data are processed based on consent (Article 6(1)(a) or Article 9(2)(a) GDPR) may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
6.3. Right to lodge a complaint with a supervisory authority – a data subject whose data are processed by the Administrator has the right to lodge a complaint with the supervisory authority, in accordance with GDPR and Polish data protection law. In Poland, the supervisory authority is the President of the Office for Personal Data Protection.
6.4. Right to object – a data subject has the right to object at any time, for reasons related to their particular situation, to processing of their personal data based on Article 6(1)(e) (public interest or official authority) or Article 6(1)(f) (legitimate interests of the Administrator), including profiling. In such a case, the Administrator must cease processing unless it demonstrates compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject or to establish, exercise, or defend claims.
6.5. Right to object to direct marketing – if personal data are processed for direct marketing purposes, including profiling, the data subject may object at any time to processing for such marketing.
6.6. To exercise the rights described in this section, data subjects can contact the Administrator by sending a written request or email to the Administrator’s address provided at the beginning of this Privacy Policy or via the contact form on the Online Store’s website.
7. COOKIES IN THE ONLINE STORE AND ANALYTICS
7.1. Cookies are small text files sent by the server and stored on the visitor’s device (e.g., computer hard drive or smartphone memory card). Detailed information about Cookies and their history can be found at https://en.wikipedia.org/wiki/HTTP_cookie.
7.2. The Administrator may provide a tool on the Online Store’s website to actively manage Cookies, available upon first visit and thereafter in the bottom corner of the site. Active management allows the visitor to see which Cookies are or may be stored and to choose and modify the scope and purposes of Cookie use. Upon first visit, the user will be prompted to select Cookie settings. Subsequent changes can be made via the management tool.
7.3. Below the Administrator provides information on Cookie usage on the Online Store’s website, their types, purposes, and management via browser settings or the Cookie management tool. The Administrator encourages using the on-site management tool; if it is unavailable, please refer to browser settings.
7.4. Cookies on the Online Store’s website can be categorized as follows:
By provider:
1) First-party (set by the Online Store’s domain) and
2) Third-party (set by domains other than the Administrator’s)
By storage duration:
1) Session (stored until logout or browser closure) and
2) Persistent (stored for a defined period or until manually deleted)
By purpose:
1) Necessary (enabling proper functioning of the Online Store’s website),
2) Functional/Preference (allowing adaptation of the site to user preferences),
3) Analytics and performance (gathering information on site usage),
4) Marketing, advertising, and social (collecting information to display and personalize advertisements, measure effectiveness, and conduct marketing activities across other websites within advertising networks such as Google Ireland Ltd. and Meta Platforms Ireland Ltd.).
7.5. The Administrator may use Cookies for the following specific purposes:
Cookie Usage Purposes in the Online Store:
• Identifying logged-in users and showing that they are logged in (necessary Cookies)
• Remembering products added to the cart for order submission (necessary Cookies)
• Remembering data in completed Order Forms, surveys, or login data (necessary and/or functional/preference Cookies)
• Adapting site content to user preferences (e.g., color scheme, font size, page layout) and optimizing site usage (functional/preference Cookies)
• Conducting anonymous statistics on site usage (analytics and performance Cookies)
• Displaying and rendering ads, limiting ad impressions, ignoring unwanted ads, measuring ad effectiveness, and personalizing ads through anonymous analysis of user behavior (e.g., repeated visits to specific pages, keywords) to build user profiles and deliver tailored ads also on other websites in Google Ireland Ltd. and Meta Platforms Ireland Ltd. ad networks (marketing, advertising, and social Cookies)
7.6. You can check which Cookies are being sent by the Online Store’s website at any time using tools such as https://www.cookiemetrix.com or https://www.cookie-checker.com, regardless of your browser.
7.7. Most internet browsers accept Cookies by default. You can configure your browser to partially limit (e.g., by time) or completely disable Cookies. However, disabling Cookies may affect some site functionalities (e.g., making a purchase may be impossible due to the cart not retaining products across steps).
7.8. Browser settings for Cookies are relevant regarding consent for Cookie use; consent may also be expressed via browser settings. Detailed instructions for changing Cookie settings or deleting them in popular browsers are available in each browser’s help section or on the following pages (click the link):
• Chrome
• Firefox
• Internet Explorer
• Opera
• Safari
• Microsoft Edge
7.9. The Administrator may use Google Analytics and Universal Analytics services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to conduct site statistics and analyze traffic. Collected data are processed to generate statistics useful for managing and analyzing site traffic. Data are aggregated. The Administrator collects data such as referral source, browsing behavior on the Online Store, device and browser information, IP address, domain, geographic data, demographic data (age, gender), and interests.
7.10. You can easily prevent Google Analytics from collecting information about your activity on the Online Store’s website by installing the browser add-on provided by Google Ireland Ltd.: https://tools.google.com/dlpage/gaoptout?hl=en.
7.11. If the Administrator uses analytics and advertising services provided by Google Ireland Ltd., full information on data processing by Google (including Cookie data) is available in Google’s privacy policy: https://policies.google.com/technologies/partner-sites.
8. FINAL PROVISIONS
8.1. The Online Store may contain links to other websites. Upon leaving the site, we encourage you to review the privacy policy of those websites. This Privacy Policy applies only to the Administrator’s Online Store.