This document defines the principles of processing and protecting the personal data of the Online Shop Customers available at https://shamanka.nl/.
The owner of the Online Store and the administrator of personal data of Customers – natural persons – and the users to whom the data pertain are Shamanka – Magdalena Widzińska, BTW Number :NL780608148B01 , KvK 71367071 tel. +31616989127, e-mail: firstname.lastname@example.org hereinafter referred to as the Administrator and being at the same time the Seller.
Personal data collected by the Administrator via the Online Store are processed in accordance with the Regulation of the European Parliament and Council (EU) 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and repeal Directive 95/46 / EC (Journal of Laws No. 119, page 1) (general regulation on data protection, RODO) and other regulations currently in force, i.e. throughout the entire period of data processing, legal provisions on personal data protection . Personal data means information about an identified or identifiable physical person (hereinafter referred to as Personal Data). An identifiable natural person is a person who can be directly or indirectly identified, in particular on the basis of an identifier such as first and last name, identification number, internet identifier, location data, one or several specific factors determining physical, genetic, psychological, economic, cultural or the social identity of a natural person.
The Administrator takes special care to respect the privacy of customers visiting his Online Shop.
§ 1 Type of data processed, objectives and legal basis
The Administrator collects information on natural persons conducting legal transactions not directly related to their activities, natural persons running their own business or professional activity and natural persons representing legal persons or organizational units that are not legal entities to whom the act grants legal capacity, conducting business activity on its own behalf or professional, hereinafter referred to as clients.
The purposes of processing the Customer’s Personal Data by the Administrator are in particular:
a) registering an account in the Online Store in order to create an individual account and manage this account. Legal basis – necessary for the performance of the contract for the provision of the Account service – art. 6 par. 1 lit. b RODO;
b) placing an order in the Online Store in order to perform the sales contract. Legal basis – necessary for the performance of the contract of sale – art. 6 par. 1 lit. b RODO;
c) subscription to the Newsletter, in order to perform the contract, the subject of which is the service provided electronically. Legal basis – consent of the data subject to the contract for the provision of the Newsletter service – art. 6 par. 1 lit. and RODO.
When registering an account for the Newsletter service in the Online Store, the Customer provides the following data:
a) e-mail address.
When placing an order in the Online Store, the Customer provides the following data:
a) email address;
b) address details: zip code and town, country, street, house / flat number;
c) name and surname;
d) telephone number.
Entrepreneurs provide the above data and in addition:
a) Company name Entrepreneurs;
b) BTW number.
When using the Newsletter service, the Customer provides data:
a) email address;
b) telephone number.
When using the Online Store, additional information may also be downloaded, including: the IP address assigned to the client’s computer or the external IP address of the Internet provider, domain, browser type, access time, type of operating system.
Customers can also download navigation data, including information about links and links in which they decide to click or other activities performed in our Online Store. Legal basis – legitimate interest – art. 6 par. 1 lit. f RODO, enabling better use of services provided electronically.
In order to determine, investigate and enforce claims, some personal data provided by the Customer as part of the use of the functionality may also be processed, including: name, surname, data on the use of services, if the claims result from the manner in which the customer uses the services, other data necessary to prove the existence of the claim, including the extent of the damage suffered. Legal basis – legitimate interest – art. 6 par. 1 lit. f RODO, consisting in establishing, investigation and examClaims recovery and defense against claims in court and other state bodies. Personal data collected by the Administrator are voluntarily given to him, in connection with concluded sales contracts, or also providing services via the Online Store, with the reservation that failure to specify in the data forms in the Registration process prevents registration and establishment of the Customer Account, and in the situation of submitting Order without registering the Customer Account, will prevent the submission and execution of the order
§ 2 Who can transfer your data to and how long it is stored
The catalog of recipients of Personal Data processed by the Administrator results mainly from the scope of services used by the Customer. The Customer’s personal data is provided to service providers used by the Administrator when running the Online Store. Providers of the Administrator’s services to whom personal data are transferred, depending on the contractual arrangements and circumstances, are subject to the Administrator’s instructions as to the purposes and methods of data processing – the processors – or define the purposes and methods of their processing – administrators.
a) Processors – the Administrator uses suppliers who process personal data only at the Administrator’s request and they are among others providers of hosting or ICT services, accounting services, providing marketing systems, systems for analyzing traffic in the Online Store, systems for effectiveness analysis marketing campaigns, companies that carry out marketing campaigns, software service companies.
b) Administrators – The administrator also uses suppliers who do not act solely on his instructions and set the goals and methods of using personal data of clients. They provide electronic payment services and banking services. Location – Service providers are based in Poland and other countries of the European Economic Area (EEA).
Customers’ personal data is stored:
a) In the situation where the basis for the processing of personal data is transferred to this consent, the Customer’s personal data are processed by the Administrator until the consent is revoked. After its cancellation, personal data is stored for a period corresponding to the period of limitation of claims that may be raised by the Administrator and which may be raised against him. Unless a special rule provides otherwise, the period of limitation is 10 years, and for claims for periodic benefits and claims related to running a business for 3 years.
b) In the situation when the data processing is based on the performance of the contract, then the client’s personal data are processed by the Administrator for as long as it is necessary to perform the contract. After this time, personal data is processed for a period corresponding to the period of limitation of claims. Unless specific provisions provide otherwise, the limitation period is 10 years for claims for periodic benefits and claims related to running a business for 3 years.
In the situation of making a purchase in the Online Store, personal data may be transferred, depending on the Customer’s choice, to the following entities in order to deliver the products ordered in the Online Store: Post.nl . In the event that the Online Store Customer chooses a payment through the iDeal payment system, his personal data is transferred to the extent necessary for the payment system .
Personal data may be used to provide customers with better service, statistical data analysis and adaptation of the Online Store to customer preferences and to administer the Online Store. If the Customer chooses the Newsletter subscription service, the Administrator will send information to his e-mail address or SMS message on his mobile phone, containing commercial information about promotions, reductions, new products available in his Online Store. In the case of a request to the Administrator, he makes data available, he will make personal data available to authorized state authorities, in particular to the organizational units of the Prosecutor’s Office, the Police, the President of the Office for Personal Data Protection, the President of the Office of Competition and Consumer Protection, or the President of the Office of Electronic Communications.
§ 3 Cookies, IP addresses and SERVER LOGO
Two types of cookies are used:
a) Session cookies – after the browser session is over or the computer is turned off, the saved information is removed from the device’s memory. The mechanism of session cookies does not allow the collection of any personal data and any confidential information from the client computers;
b) Persistent cookies – they are stored in the memory of the Customer’s end device and remain until they are deleted or expired. The mechanism of persistent cookies does not allow the collection of any personal data and any confidential information from the client’s computer. c) If the Client’s objection proves to be justified and the Administrator has no other legal basis to process personal data, the Customer’s data will be deleted, the Client will file the objection with respect to the processing. The right to delete data, the right to be forgotten – the legal basis of art. 17
The administrator uses his own cookies in order to:
a) authentication of the Customer in the Online Shop and providing him with the Customer session after logging into the Customer Account;
b) anonymous statistics and analyzes that help to understand how customers use the Online Store.
The administrator uses external cookies in order to:
a) collection of static data via analytical tools of Google Analytics – external cookie administrator: Google Inc with its registered office in the USA;
b) presenting ads from the Google AdSense website – external cookie administrator: Google Inc with its registered office in the USA;
c) promoting the Online Store on Facebook.com – administrator of external cookies: Facebook Inc with its registered office in the USA or Facebook Ireland based in Ireland;
d) an online platform dedicated to customer service: Zendesk based in San Francisco, California, United States,
The mechanism of cookies is completely safe for computers of the Online Shop Customers. The customer can change the settings for Cookie files independently and at any time, specifying the conditions for their storage and access to their device via cookies. Changes to the settings in question can be made by the customer using the web browser settings. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the web browser’s settings or inform each time that Cookies are placed on the Customer’s Device. Detailed information about the possibilities and ways of handling cookies are available in the web browser settings. Blocking cookies may affect some of the functionalities available in the Online Store.
5. The administrator may collect IP addresses of clients. The IP address is the number assigned to the computer of the visitor of the Online Store by the ISP. The IP address is used by the Administrator in diagnosing technical problems with the server, creating statistical analyzes and improving the Online Store.
6. The Online Store contains links and links to other websites on the Internet and the Administrator is not responsible for the privacy practices of these websites.
7. Server logs – Information about some of the users’ behaviors are subject to logging in the server layer. These data are used only to administer the website and to ensure the most efficient service of hosting services.
8. The viewed resources are identified by URL addresses. In addition, the subscription may be subject to:
a) the time of arrival of the inquiry,
b) time of sending the answer,
c) name of the client station – identification performed by the HTTP protocol,
d) information on errors that occurred during the execution of the HTTP transaction,
e) URL address of the page previously visited by the user (referrer link) – in the case when the website was accessed via a link,
f) information about the user’s browser,
g) information on the IP address.
9. The above data is not associated with specific persons browsing the website.
10. The above data is used only for the purposes of administering the server.
4§ Rights and obligations of the person to whom the Personal Data relates
The right to withdraw consent – the legal basis of art. 7 par. 3 RODO
a) The customer has the right to send a request to delete all or some personal data. b) The customer has the right to request the deletion of personal data if: – personal data are no longer necessary for the purposes for which they were collected or in which they were processed; The customer withdrew the consent to the extent to which the customer’s data was processed based on his consent; he objected to the use of his data for commercial or marketing purposes; personal data are processed unlawfully; personal data must be removed in order to comply with a legal obligation under Union law or the law of the Member State to which the Administrator is subject; personal data were collected in connection with the offering of information society services
b) Despite the request to delete personal data, in connection with opposition or withdrawal of consent, the Administrator may retain some personal data to the extent that processing is necessary to establish, investigate or defend claims, as well as to fulfill a legal obligation requiring processing them under Union law or the law of the Member State to which they are subject.
The right to limit data processing – the legal basis of art. 18 RODO
a) The Online Store customer has the right to request a restriction to the processing of his data. The submission of such a request prevents the use of certain functionalities or services, the use of which will involve the processing of data covered by this request.
b) the Online Shop Customer has the right to demand limitation of the use of personal data in the following situations: if the personal data is not being met, then the Administrator limits their use for the time needed to verify the correctness of this data; when the data processing is unlawful and the client does not request removal but restricting their use; when the personal data of the Customer ceased to be necessary for the purposes for which they were collected or used, but they are needed by the Customer to establish, investigate or defend claims; when he objected to the use of his data, then the restriction takes place for the time needed to consider whether, due to the special situation, protection of the Client’s interests, rights and freedoms outweighs the interests that the Administrator performs while processing the Customer’s data.
The right of access to data, the legal basis of art. 15 THE RODO
a) The Customer has the right to obtain from the Administrator confirmation whether he processes his personal data, and if so, the Customer has the right to: gain access to his personal data; obtain information on the purposes of processing and recipients or categories of recipients of this data, the planned period of data storage or the criteria for determining this period, on the rights of the customer under the RODO and the right to lodge a complaint to the supervisory authority, data source, automated decision-making, including profiling and safeguards applied in connection with the transfer of these data outside the European Union; get a copy of your personal data.
The right to rectify data – the legal basis of art. 16 THE RODO.
a) The Customer has the right to demand from the Administrator that he or she corrects his / her personal data incorrectly. Taking into account the purposes of processing, the Customer has the right to request supplementing incomplete personal data, including by submitting an additional statement, by sending an e-mail to the administrator’s e-mail address. The right to data transfer – the legal basis of art. 20 RODO The customer has the right to receive his data, which he provided to the Administrator, and then send them to another personal data administrator of his choice. The Online Shop customer also has the right to demand that his personal data be sent directly by the Administrator to such an administrator, if technically possible. In this situation, the Administrator will send such Customer data in CSV file format, which is a commonly used format. In the event of the Customer demanding that his / her rights be met, the Administrator has the right to meet or refuse them, and he will do so immediately. The customer has the right to report to the Administrator’s complaints, inquiries and requests regarding the processing of his personal data and the exercise of his rights. The Customer has the right to demand from the Administrator a copy of standard contractual clauses by sending a query to the administrator’s e-mail address. The Customer has the right to lodge a complaint to the President of the Office for Personal Data Protection in the scope of violation of his rights to the protection of personal data or other rights granted under the RODO.
§ 5 Securing Personal Data The Administrator declares that it makes every effort to provide customers with a high level of security in the use of the Online Store and for this purpose: a) applies legal technical and organizational measures required by law, in particular in the field of security of personal data processing; (b) apply measures that ensure the ability to continually ensure the confidentiality, integrity, availability and resilience of processing systems and services; (c) the ability to quickly restore and access the Personal Data in the event of a physical or technical incident; d) provides the Online Store customers with a secure and encrypted connection when transferring personal data and when logging into the Customer Account, using SSL certificate. All events affecting the security of information, personal data, including suspected sharing of files containing viruses, should be reported Administrator via e-mail to e-mail:shamanka.nl
§ 6 Final provisions