Privacy policy

This document describes the Privacy Policy at the Taiwangun online store (hereinafter: "Store"). The Store's administrator is Krakman P. Kiepura, K. Michalik sp. k. located in Poland - Pollanki 18, 30-740 Krakow, Poland (hereinafter: "Administrator").

The personal data collected by the Administrator are processed in accordance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1), hereinafter: GDPR.

The Administrator makes every effort to protect privacy and the information provided concerning the Store's customers (hereinafter: "Customers", "Users"). The Administrator selects and applies, with due care, appropriate technical means, including software and organisational ones, to ensure the protection of the processed data; in particular the Administrator protects the data against making them available to unauthorised parties, their disclosure, loss and destruction, unauthorised modification, as well as against their processing in breach of the applicable law.

The services available on the Store's website (in particular the possibility to place an order) are not meant for persons under 16 years of age. The Administrator does not intend to collect data concerning persons below the age of 16.

Personal data

Personal Data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to the identification of a particular person, also constitute personal data.

Administrator of personal data

The Administrator of your personal data is:

Krakman P. Kiepura, K. Michalik sp. k. located in Poland (Pollanki 18, 30-740 Krakow, Poland), added to the Register of Entrepreneurs by the District Court of Krakow-Srodmiescie, XI Commercial Department under KRS 0000567135, REGON 122593008, VAT PL6793082897.

You can contact the Administrator regarding your personal data via:

Data Protection Officer

The Administrator has appointed a Data Protection Officer, whom you can contact in regard to your personal data protection:

The purposes of processing of personal data

The Administrator processes your personal data for the following purposes and in the following scope:

• In order to take action before the conclusion of a contract upon your request (e.g. creating an account), i.e. the data provided in the registration form on the Store's website, i.e. e-mail address and password, gender; if the account is registered through a third-party authentication service (e.g. Facebook, Apple), we collect your name and surname and your e-mail address, and if you register upon the purchase of goods, we collect your name and surname and the data provided to process the order, such as your mailing address; in order to provide services which require the creation of an Account such as: keeping an orders history, providing information about the order status, publishing product reviews and questions, we process your data provided in the account and upon the purchase of goods;
• In order to provide services which do not require the creation of an account and purchase of goods, i.e. browsing Store's webpages, browsing of goods, we process the personal data concerning your activity on the Store's website, i.e. the data on the goods you browse, data on the session in your device, operating system, browser, location and the unique ID, and IP address;
• In order to fulfil a goods purchase contract (e.g. deliver the goods which have been ordered), we process the personal data you provided upon the purchase of the goods, such as your name and surname, e-mail address, postal address, payment data and, if you make a purchase through the account, additionally your password;
• For the statistics of using particular functionalities available in the Store, in order to facilitate the use of the Store and to ensure its IT security, we process the personal data concerning your activity in the Store and the amount of time spent on each of its subpages, your search history within the Store, location, IP address, ID of the device, data concerning your internet browser and operating system;
• In order to establish, assert and enforce claims and defend claims in proceedings before courts of law and other enforcement bodies, we can process your personal data you provided when purchasing goods or creating your account, and other data which are necessary to support the claim, or which follow from a legal requirement, court order or another legal procedure;
• In order to handle complaints, grievances and requests and to reply to enquiries from customers, we process the personal data you have provided in the contact form and in your complaints, grievances and requests. In order to provide answers to questions in another form, we process some personal data you have provided in the account, as well as data concerning the order for goods and other services we provide, which are the reason for the complaint, grievance or request. We also process the data contained in the documents attached to complaints, grievances and requests;
• For the purpose of marketing our goods and services, as well as those of our customers and partners, including remarketing, we process the personal data you have provided when creating and updating your account, as well as the data concerning your activity in the Store. For remarketing, we use data about your activity in order to reach you with our marketing messages outside of the Store - for this purpose we use the services of third-party providers. These services consist in displaying our messages on websites other than the website of the Store. You will find details on that in the section on cookies files;
• In order to organise contests and loyalty programmes, i.e. notifications of the points you have scored, prizes and in order to advertise our offer, we use your personal data provided in your Account and upon your registration for a contest or a loyalty programme. If the privacy policy of the contest differs from the general privacy policy described here, the details thereof are provided each time in the terms and conditions of participation in the contest or loyalty programme;
• In order for us or for our partners to survey the market and opinions, i.e. information about your order, your e-mail address and data provided when creating the account or purchasing goods. We do not use the data collected in the market and opinion surveys for advertising purposes. Detailed information is provided in the description of the particular questionnaire or in the data entry part of the questionnaire itself.

Personal data categories

The Administrator processes the following categories of personal data:

• contact data,
• data pertaining to the activity on the Store,
• data pertaining to making purchases,
• data pertaining to complaints, grievances and requests,
• data pertaining to marketing services.

Voluntary provision of data

The provision of your personal data is voluntary, but it is a condition for the provision of services by the Administrator through the online Store.

Data processing timeframe

Personal data will be processed for a period necessary to fulfil orders, services, marketing activities or other activities provided for the customer. The personal data will be deleted in the following cases:

• when the person who is the subject of the particular set of data requests the erasure or withdraws their consent for storing and processing the data,
• when the person who is the subject of the particular set of data is not active for more than 10 years,
• after we receive information that specific data is incorrect or outdated.

Some data, namely e-mail address, name and surname, can be stored for another three years to serve as evidence, for the purpose of processing complaints, grievances and claims related to the services provided via the Store. This data will not be used for marketing purposes.

Data related to orders and paid services, contests and loyalty programmes will be stored for 6 years from the date of delivering the order or service.

Data of the customers who are not logged in is stored for a period equal to that of the lifespan of the cookie files saved on the devices in question or until these files are deleted by the user on their device.

The data related to your preferences, activities and the choice of marketing material may be used as a basis for automated decisions to determine the Store's sales capacity.

Personal data recipients

Your personal data may be shared with the following categories of entities:

• authorised state authorities and institutions (e.g. the police, the prosecutor's office, courts), upon filing a lawful request, to the extent specified in this request,
• the Minister of Finance of the Republic of Poland, as the operator of the National e-Invoice System (KSeF) - with respect to data contained in invoices subject to the obligation of issuance in KSeF (such as full name or company name, address, VAT number, phone number, email), on the basis of a legal obligation arising from the Polish Act on Goods and Services Tax,
• service providers that are used for operating the online Store, e.g. to process an order. Depending on the contractual arrangements and circumstances, these parties work upon our instructions or they independently determine the purposes and means of their processing of the data. The list of providers is updated on an ongoing basis and available at the seat of the Administrator for viewing.

Your rights as the subject of personal data

Under the General Data Protection Regulation (GDPR) you have the right to:

• request access to your personal data,
• request the rectification of your personal data,
• request the erasure of your personal data,
• request the restriction of processing of your personal data,
• object to processing your personal data,
• exercise your right to data portability,
• withdraw your consent for your data to be processed.

The Personal Data Administrator, without undue delay, at most within two weeks from the receipt of the request, shall provide information on the actions taken in relation to your request.

Right to access your personal data (GDPR art. 15)

You have the right to ask the Administrator whether your personal data is processed.

If the Administrator processes your personal data, you have the right to:

• access your personal data;
• obtain information on the purposes of the processing, the categories of personal data concerned, the data recipients or categories of recipients, the intended period for which your data will be stored or the criteria used to determine that period, the rights you have under the GDPR and about the right to file a complaint with a supervisory authority, about the data source, about automated decision-making, including profiling and safeguards applied when such data is transferred outside of the European Union;
• receive a copy of your personal data.

If you wish to access your personal data, please write the request to the following e-mail: rodo@taiwangun.com.

Right to rectify your personal data (GDPR art. 16)

If your personal data are inaccurate, you have the right to request the Administrator to rectify your personal data without undue delay.

You also have the right to request the Administrator to have your incomplete personal data completed.

If you wish to request rectification or completion of your personal data, address your request to: rodo@taiwangun.com.

If you have registered an account on the online Store, you can rectify or complete your personal data yourself after logging in.

Right to erasure of your personal data - "right to be forgotten" (GDPR art. 17)

You have the right to request the erasure of your personal data when:

• your personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• you have withdrawn your consent on which the processing is based;
• your personal data have been unlawfully processed;
• you have objected to the processing of your personal data for the purposes of direct marketing, including profiling, to the extent to which the processing of your personal data relates to direct marketing;
• you have objected to the processing of your personal data necessary for the performance of a task carried out in the public interest or necessary for the purposes of the legitimate interests pursued by the Administrator or a third party.

Despite your request to erase your personal data, the Administrator may continue to process your data in order to establish, assert or defend claims - of which you will be informed.

If you wish to request the erasure of your personal data, address your request to: rodo@taiwangun.com.

Right to restriction of processing of personal data (GDPR art. 18)

You have the right to request restriction of processing your personal data when:

• you contest the accuracy of your personal data - the Administrator will restrict the processing of your personal data for a period necessary to verify the accuracy of such data;
• the processing of your personal data is unlawful and instead of erasure of your personal data you request restriction of its use;
• your personal data are no longer needed for the purposes of processing, but they are required for the establishment, assertion, or defence of legal claims;
• you have objected to processing your personal data - pending the verification whether the legitimate grounds of the Administrator override the grounds indicated in your objection.

If you wish to request a restriction of processing your personal data, address your request to: rodo@taiwangun.com.

Right to object to processing of your personal data (GDPR art. 21)

You have the right to object, at any time, to processing your personal data, including profiling, in relation to:

• processing necessary for the performance of a task carried out in the public interest or necessary for the purposes of the legitimate interests pursued by the Administrator or a third party;
• processing for the purposes of direct marketing.

If you wish to object to processing your personal data, address your request to: rodo@taiwangun.com.

Right to data portability (GDPR art. 20)

You have the right to receive your personal data in a structured, commonly used and machine-readable format and transmit it to another personal data administrator.

You can also request that the Administrator transmits your personal data to another administrator directly (if technically possible).

If you wish to exercise your right to data portability, address your request to: rodo@taiwangun.com.

Right to withdraw consent

You can withdraw your consent to processing your personal data at any time.

Withdrawal of the consent to processing your personal data has no effect on the compliance with the law of the processing done under your consent before its withdrawal.

If you wish to withdraw your consent to processing your personal data, address your request to rodo@taiwangun.com or use the relevant functionalities in your account.

Complaints to supervisory authorities

If you believe that the processing of your personal data is in breach of the GDPR, you have the right to file a complaint with the supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

In Poland, the supervisory authority in the meaning of the GDPR is the President of the Personal Data Protection Office (PUODO).

Authentication via third-party services

By choosing to log in to the Store via external authentication services (for example Facebook, Apple), the User provides, via the selected service, the personal data necessary to log in, which were previously made available to the administrator of that service.

Third-party social media and other authentication services follow their own, separate privacy policies which require separate consent. If the User uses these services, such consent was already granted earlier.

Online payment systems

By selecting the online payment system, the User provides the payment operator with the necessary personal data that will be processed in order to complete the payment transaction, notify about the status of the payment, consider complaints, as well as to fulfil the legal obligations of the payment operator.

List of payment operators available in the Store:

• DotPay / Przelewy24: The data administrator is PayPro SA, ul. Pastelowa 8, 60-198 Poznan, Poland. Full text of the DotPay GDPR information clause. By paying, you accept the payment terms.
• PayU: The data administrator is PayU SA, ul. Grunwaldzka 186, 60-166 Poznan, Poland. PayU privacy policy and PayU payment terms apply.
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A. 2-24 Boulevard Royal, L-2449, Luxembourg.

The automated activity detection system

To protect the Store against bots, spam and abuse, we use the reCAPTCHA service provided as part of Google Cloud. For this purpose, selected data, in particular the IP address and technical information about the device and browser used, are processed by Google acting as a data processor, solely on our instructions, on the basis of a data processing agreement (Cloud Data Processing Addendum).

This data is used solely to provide, maintain and secure the reCAPTCHA service (threat detection and fraud prevention) and is not used by Google for its own purposes, including advertising. The legal basis for the processing is the legitimate interest of the Administrator (art. 6(1)(f) GDPR) in ensuring the security of the Store. If data is transferred outside the European Economic Area, safeguards provided for in the GDPR (including standard contractual clauses) are applied.

Cookie files

General information

While browsing the website of the Store, cookie files (or "Cookies") are used. These are small text files which are saved and stored on your device.

These files allow us to identify the software used by you and to adjust the Store's functionality to your needs. Cookies allow the Store's websites to work correctly.

Cookies usually include the name of the domain of their origin, their expiry date and their assigned values.

Cookie files security

Cookie files are safe for your devices. In particular, it is not possible for your devices to be infected by computer viruses or other malware via cookie files.

Cookie files types

We use two types of Cookies:

• Session Cookies are stored on your device and remain there until the browser session ends. The recorded information is then permanently deleted from the memory of your device.
• Persistent Cookies are stored on your device and remain there until they are deleted, or until they reach their expiry date. Closing the browser or shutting down the device does not delete these Cookies from your device.

Cookies do not allow for downloading any personal data or any other confidential information from your device.

The purposes of using Cookies

We also use third-party Cookies for the following purposes:

• to adapt the website content to the User's preferences and to optimise website use;
• to compile viewing statistics;
• to ensure due functioning of the order placement procedure, including the log in procedure, the correct operation of the shopping cart and order placement mechanism;
• to keep the session of the User (after logging in), so that the User does not have to enter the login and password on each subpage;
• to provide the Users with content customised to their preferences.

Cookies may be used by advertising networks, Google in particular, to display commercials matching your preferences. For this purpose, information may be stored on the way you surf the internet or the time spent using the website.

Using the settings of your internet browser or service configurations, you can change the Cookies settings at any time, specifying the conditions for their storage and their access to your device. You can change these settings to block the automatic handling of Cookies in your internet browser settings or to be informed each time Cookies are placed on your device. Detailed information on the possibilities and ways of handling Cookies is available in your software (internet browser) settings.

Security

We use appropriate procedures, security measures and systems in order to ensure that your personal data is safe, in particular to minimise the risk of theft, loss, unauthorised access, alteration or use of your personal data. Nevertheless, no security method available offers 100% protection. For this reason, we cannot guarantee that our database is entirely immune to attempts of external attacks and abuse.

Changes to Privacy Policy and Cookies

The Administrator reserves the right to change the Privacy Policy at any time. Registered users will be notified about any changes. If they do not accept the updated Privacy Policy terms, they should cease to use the Store and they may request for their data to be deleted. Using the Store after being notified about the changes will mean accepting the updated Privacy Policy.

Any potential changes are in force starting from the moment they are published on the Privacy Policy and Cookies page of the Store.