Binding version: Polish.
Translation to be verified by the Client.
1. General provisions
1.1. This Privacy Policy sets out the rules for processing the personal data of users of the website and online shop at thesybinlabs.pl.
1.2. In particular, this document sets out:
- who the controller of personal data is,
- what data is processed,
- for what purposes and on what legal bases the data is processed,
- to whom the data may be transferred,
- how long the data is stored,
- what rights data subjects have,
- how cookies and analytics tools are used.
2. Controller of personal data
2.1. The controller of personal data is THESYBIN LABS PROSTA SPÓŁKA AKCYJNA, with its registered office at ul. Lubiejewska 158, 07-300 Ostrów Mazowiecka, Poland, entered in the National Court Register (KRS) under number KRS 0001130421, NIP (tax ID) 7162845553, REGON 529829000.
2.2. You can contact the Controller at the email address: kontakt@thesybinlabs.pl.
2.3. If the Controller appoints a Data Protection Officer, their contact details will be published in this Privacy Policy.
3. Scope and sources of data
3.1. The Controller may process personal data that the user provides directly, in particular:
- first name and surname,
- email address,
- phone number,
- delivery address,
- invoice address,
- company details, if the user buys as a business,
- data necessary to process the payment and the order,
- data given in the contact form,
- data given when signing up for the newsletter,
- data related to the user’s activity on the website, including technical and statistical data and information saved in cookies.
3.2. Personal data may be collected in connection with:
- placing an order in the shop,
- creating a customer account,
- signing up for the newsletter,
- sending a message through the contact form or by email,
- using the website and the shop.
4. Purposes and legal bases of data processing
4.1. Personal data may be processed for the following purposes:
- fulfilling orders, handling sales, payments, delivery, returns and complaints, and contact related to performing the contract
legal basis: Article 6(1)(b) GDPR, - creating and running a customer account
legal basis: Article 6(1)(b) GDPR, - replying to a message sent through the contact form, by email or in another way
legal basis: Article 6(1)(f) GDPR, which is the legitimate interest of the Controller in handling correspondence and communication with users, - meeting the legal obligations of the Controller, in particular accounting and tax obligations and obligations related to documenting sales
legal basis: Article 6(1)(c) GDPR, - pursuing claims, defending against claims and keeping records as evidence
legal basis: Article 6(1)(f) GDPR, - sending the newsletter and marketing information electronically, if the user has given consent
legal basis: Article 6(1)(a) GDPR, - carrying out statistical analysis of how the website and shop are used, improving how the website works and analysing website traffic with Google Analytics, to the extent that the user has agreed to the relevant cookies
legal basis: Article 6(1)(a) GDPR.
5. Providing data voluntarily
5.1. Providing personal data is voluntary, but in some cases it is necessary to:
- make and perform a contract of sale,
- create a customer account,
- receive a reply to an enquiry,
- receive the newsletter.
5.2. If you do not provide the data required to fulfil the order, it may not be possible to make or perform the contract.
6. Recipients of data
6.1. Personal data may be transferred to entities that work with the Controller, only to the extent necessary for the purposes of processing, in particular to:
- providers of hosting, technical and IT services,
- payment operators,
- companies that deliver orders,
- an accounting office or entities that support accounting and legal services,
- providers of mailing or newsletter systems,
- providers of analytics tools, including Google Analytics.
6.2. Personal data is not sold to third parties.
7. Transfer of data outside the European Economic Area
7.1. Because the Controller uses analytics or technology tools provided by entities based outside the European Economic Area, user data may be transferred to third countries, including the United States.
7.2. In such a case, the Controller uses the mechanisms provided by law, in particular transfer of data on the basis of an adequacy decision or on the basis of appropriate safeguards required by the GDPR.
8. Data storage period
8.1. Data related to fulfilling orders will be stored for the period necessary to perform the contract, then for the time required by law and for the period necessary to pursue or defend claims.
8.2. Customer account data will be stored while the account exists, and after it is deleted for the period necessary to settle the contract, meet legal obligations and possibly defend against claims.
8.3. Data processed to handle correspondence will be stored for the time necessary to reply and close the matter, and then for the period needed to secure possible claims.
8.4. Data processed on the basis of consent, including for the newsletter, will be stored until consent is withdrawn or the purpose of processing ends.
8.5. Data related to cookies and analytics will be stored until these files expire, until the user deletes them or until consent is withdrawn, depending on the type of files and the tool settings.
9. Rights of data subjects
9.1. The user has the right to:
- access their personal data,
- have their data corrected,
- have their data deleted,
- restrict processing,
- data portability,
- object to the processing of data based on the legitimate interest of the Controller,
- withdraw consent at any time, if processing is based on consent, without affecting the lawfulness of processing carried out before consent was withdrawn,
- make a complaint to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
9.2. A complaint can be made to the President of the Personal Data Protection Office.
10. Automated decision-making
10.1. Users’ personal data is not used to make decisions about them based only on automated processing that have legal effects or similarly significant effects on them.
10.2. The Controller may use data for analytics and statistical purposes related to how the website and shop work.
11. Cookies and similar technologies
11.1. The thesybinlabs.pl website uses cookies and similar technologies.
11.2. Cookies are small pieces of text information saved on the user’s device.
11.3. The website may use:
- necessary cookies, which allow the website and shop to work correctly, including keeping the user session, handling the shopping basket, logging in to the account and website security,
- analytics cookies, which are used to create statistics and analyse website traffic, including through Google Analytics.
11.4. Necessary cookies may be used without the user’s consent if they are necessary to provide the service the user requested.
11.5. Analytics cookies are used only after the user gives consent.
11.6. The user can manage cookie consent through the cookie banner or browser settings.
11.7. The user can withdraw consent to the use of cookies at any time, and withdrawing consent should be as easy as giving it.
11.8. Limiting the use of cookies may affect some functions of the website or shop.
12. Google Analytics
12.1. The website uses Google Analytics, an analytics tool used to study how users use the website.
12.2. Google Analytics may collect information about how you move around the website, the time of the visit, the pages you view, where you came from and other statistical data.
12.3. The data collected with Google Analytics is used to analyse website traffic, improve how the website works and optimise its functions.
12.4. Google Analytics is used on the basis of the user’s consent given through the cookie mechanism, if the tool works in a mode that requires consent.
13. Newsletter
13.1. The user can sign up for the newsletter by giving an email address and the relevant consent, if it is required.
13.2. Personal data given when signing up for the newsletter is processed to send commercial, marketing, educational or organisational information about the Controller’s activities.
13.3. The user can unsubscribe from the newsletter at any time by clicking the unsubscribe link in the message or by contacting the Controller.
14. Contact through the form
14.1. When the user contacts the Controller through the contact form, by email or by phone, the user provides the data necessary to handle the message and reply.
14.2. This data is processed only to handle the enquiry, carry on correspondence and resolve the matter the contact is about.
15. Changes to the Privacy Policy
15.1. The Controller may make changes to this Privacy Policy, in particular if the law changes, the functions of the website change, the tools used change or the way data is processed changes.
15.2. The current version of the Privacy Policy is published on the thesybinlabs.pl website.
This version is already good as a working draft, but for the final version I still need the exact names of:
the payment operator, delivery companies, hosting and the newsletter tool. Without this, the document will be formally correct, but still too general in the part about data recipients. The list of user rights, the information obligation, the right to complain to the President of UODO and the rules for cookie consent come from the GDPR and the current approach of UODO and the provisions of the Electronic Communications Law.