Privacy and Cookies Policy
This document sets out the terms on which personal data (also referred to below as “data”) and cookies are processed in connection with the online store at pasuri.pl, operated through the website available at pasuri.pl, hereinafter referred to as the “Store”.
§1. HOW TO CONTACT THE DATA CONTROLLER
The controller of personal data processed in connection with the Store is:
Pasuri Group Spółka Cywilna, with its registered office in Zielona Góra, at Zjednoczenia 9, 65-120 Zielona Góra, Poland, REGON statistical number: 526769012 and NIP tax identification number: 9731097355.
You can contact the Data Controller by telephone at +48 601 447 443 or by email at [email protected].
§2. THE LEGAL BASES ON WHICH WE PROCESS YOUR DATA
Whenever we collect personal data, we inform you of the legal basis for its processing. The legal bases arise from the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC – the General Data Protection Regulation). References to:
- Article 6(1)(a) GDPR mean that we process personal data on the basis of consent;
- Article 6(1)(b) GDPR mean that we process personal data because it is necessary to perform a contract or, at your request, to take steps before entering into a contract;
- Article 6(1)(c) GDPR mean that we process personal data to comply with a legal obligation;
- Article 6(1)(f) GDPR mean that we process personal data for the purposes of legitimate interests.
§3. PROCESSING FOR ENTERING INTO AND PERFORMING CONTRACTS, PURSUING CLAIMS AND DEFENDING AGAINST CLAIMS
1. We may process personal data necessary to perform a contract entered into with you. Before the contract is entered into, we may also process personal data necessary to take steps at your request. This processing is based on Article 6(1)(b) GDPR.
2. When performing a contract for paid services, we may process your data to comply with accounting and tax obligations. This processing is based on Article 6(1)(c) GDPR.
3. During and after performance of the contract, we process the personal data of the contracting party in order to consider, pursue or defend against potential claims. Our legitimate interest includes, for example, responding to complaints as required by separate provisions of civil law. In such cases, we process personal data on the basis of our legitimate interest in defending against or pursuing claims, pursuant to Article 6(1)(f) GDPR.
4. We will retain this data for as long as necessary for the stated purposes, but no longer than until the expiry of the applicable limitation periods under separate laws.
5. You have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to lodge a complaint with a supervisory authority. Where data is processed for the purpose described in point 3, you also have the right to object to its processing.
6. Providing this data is voluntary; however, failure to provide it will prevent us from entering into or performing the contract.
7. Recipients of this data include our hosting provider, email service provider, IT service provider, telecommunications service provider, accounting and invoicing software providers, banking and electronic payment providers, legal, advisory and debt collection service providers, and other providers whose services we use for the stated purpose.
§4. PROCESSING FOR SENDING THE NEWSLETTER
1. You may subscribe to our newsletter. If you use this feature, we process your personal data to send it to you. The newsletter may contain advertising, commercial or marketing content.
2. This data is processed on the basis of your consent under Article 6(1)(a) GDPR.
3. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
4. We will retain your data until you withdraw your consent. If you never withdraw it, we will process your data until we stop sending the newsletter.
5. You have the right of access, rectification, erasure, restriction of processing and data portability, as well as the right to lodge a complaint with a supervisory authority.
6. Providing this data is voluntary; however, failure to provide it will prevent us from sending you the newsletter.
7. Recipients of this data include our hosting provider, IT service provider, email service provider and newsletter distribution provider.
§5. PROCESSING FOR DIRECT MARKETING AND PROFILING
1. We may process data for direct marketing, measuring advertising effectiveness, attributing conversions to campaigns, building audiences, limiting the frequency of advertisements, and tailoring advertising content to a user’s interests.
2. For these purposes, we may record information about your use of the Store, such as pages and products viewed, searches, shopping-cart contents, checkout initiation, purchases, basic order information, and technical data concerning your device and browser.
3. Where necessary to attribute an advertising event correctly and where the user has given the relevant consent, an advertising platform may also receive a customer identifier or contact data in a protected, hashed form. This safeguard limits the possibility of directly reading the data while it is being transmitted.
4. We activate marketing and analytics technologies that are not essential for the operation of the Store on the basis of the user’s consent, pursuant to Article 6(1)(a) GDPR and the applicable laws on storing information on, or accessing information from, terminal equipment. Direct marketing carried out without such technologies may be based on our legitimate interest under Article 6(1)(f) GDPR, subject to separate requirements governing electronic communications.
5. Profiling consists of analysing activity and transaction data to assess interest in particular products, measure campaign effectiveness and select advertisements. We do not make decisions about you based solely on automated processing where those decisions produce legal effects concerning you or similarly significantly affect you.
6. We process data until consent is withdrawn, an effective objection is raised or the purpose of processing ceases to apply, and thereafter for the period necessary to demonstrate legal compliance or defend against claims. Individual providers may apply their own retention periods as specified in their privacy policies and service settings.
7. You have the right of access, rectification, erasure, restriction of processing and data portability; the right to withdraw consent; the right to object to direct marketing; and the right to lodge a complaint with a supervisory authority.
8. Recipients of this data may include the providers listed in §8, in particular Google, Meta, Pinterest, TikTok and OpenAI.
§6. PROCESSING FOR SECURITY PURPOSES
1. From the moment you access our website, we process the following data to ensure the security of our services:
- the public IP address of the device from which the request originated;
- browser type and language;
- the date and time of the request;
- the number of bytes sent by the server;
- the URL of the previously visited page, where the Store was accessed through that link;
- information about errors occurring while the request was processed.
2. Our legitimate interest in this processing is to maintain server event logs and protect the Store against potential hacking attacks and other abuse. This includes the ability to identify the IP address of a person carrying out an unauthorised activity in the Store, such as attempting to circumvent security measures, publishing prohibited content or attempting to use our servers for unauthorised activities.
3. This data is processed pursuant to Article 6(1)(f) GDPR.
4. We will retain this data for as long as necessary for the stated purposes, but no longer than until the expiry of the applicable limitation periods under separate laws.
5. You have the right of access, rectification, erasure, restriction of processing and objection to processing, as well as the right to lodge a complaint with a supervisory authority.
6. Providing this data is a condition of using the Store. Failure to provide it will prevent you from using the Store.
7. Recipients of this data include our hosting provider, IT service provider and telecommunications service provider.
§7. PROCESSING FOR PRODUCT AVAILABILITY NOTIFICATIONS
1. The Store allows users to request a notification about a selected product at an email address provided by the user.
2. Our legitimate interest in this processing is to fulfil the user’s request and subsequently to protect the Store against potential abuse.
3. This data is processed pursuant to Article 6(1)(f) GDPR.
4. We will retain this data for as long as necessary for the stated purposes, but no longer than until the expiry of the applicable limitation periods under separate laws.
5. The data subject has the right of access, rectification, erasure, restriction of processing and objection to processing, as well as the right to lodge a complaint with a supervisory authority.
6. Providing this data is a condition of receiving the notification. Failure to provide it will prevent us from sending the notification.
7. Recipients of this data include our hosting provider and IT service provider.
§8. DATA RECIPIENTS
1. We use external providers that help us operate the Store, fulfil orders, maintain security and carry out analytics and advertising activities. They receive data only to the extent necessary to provide the relevant service.
2. Data recipients may include, in particular:
- hosting, data storage, security and IT service providers – to the extent necessary to operate and protect the Store;
- payments: Stripe, Klarna, PayPo, Paynow, banks, card organisations and other providers of the payment method you select;
- delivery and order fulfilment: carriers, postal operators, logistics and warehousing providers, and returns-handling providers, depending on the selected delivery method;
- email, newsletter and communications service providers – to the extent necessary to send messages and provide customer support;
- analytics and advertising: Google, Meta, Pinterest, TikTok and OpenAI – depending on the consent choices made;
- purchase reviews: TrustMate S.A.;
- business support: accounting, invoicing, legal, auditing, advisory, insurance and debt collection service providers, as well as authorised public authorities where disclosure is required by law.
3. Not every recipient listed above receives every category of data. We limit disclosure to the data necessary to provide the relevant service. The current payment or delivery provider is also indicated during checkout.
4. Further information on the processing practices of the main analytics and advertising platforms is available in their privacy policies: Google, Meta, Pinterest, TikTok and OpenAI.
§9. TRANSFERS OF DATA TO THIRD COUNTRIES
1. Some providers listed in §8 operate globally. Data may therefore be stored or processed outside the European Economic Area, in particular in the United States and, depending on the provider’s infrastructure, in other countries.
2. Transfers outside the EEA take place only on the basis of a mechanism permitted by the GDPR, in particular an adequacy decision issued by the European Commission – including, where applicable, the EU–US Data Privacy Framework – standard contractual clauses approved by the European Commission, or another safeguard permitted by law.
3. Information about the transfer mechanism used, or a copy of the relevant safeguards, may be obtained by contacting the Data Controller. Certain information may be redacted or restricted to the extent necessary to protect trade secrets and the rights of other persons.
§10. RIGHTS AVAILABLE REGARDLESS OF THE LEGAL BASIS
When we refer to rights relating to the processing of your personal data, we mean the rights described below. Your ability to exercise these rights does not depend on the legal basis for processing.
Right of access
You have the right to obtain confirmation from us as to whether personal data concerning you is being processed. If it is, you have the right to access that data and receive additional information about:
- the purposes of processing;
- the categories of personal data concerned;
- the recipients or categories of recipients to whom the data has been or will be disclosed, in particular recipients in third countries or international organisations;
- where possible, the envisaged retention period or, if this is not possible, the criteria used to determine that period;
- the right to request rectification, erasure or restriction of processing, to object to processing, and to lodge a complaint with a supervisory authority;
- the source of the data, where your data was not collected from you;
- the existence of automated decision-making, including profiling, meaningful information about the logic involved, and the significance and envisaged consequences of such processing for you.
After receiving such a request, we are required to provide a copy of the personal data undergoing processing. If the request is submitted electronically, and unless you request otherwise, we will also provide the information electronically.
Right to rectification
You have the right to require us to rectify inaccurate personal data concerning you without undue delay. Taking into account the purposes of processing, you also have the right to have incomplete personal data completed, including by providing a supplementary statement.
Right to erasure (“right to be forgotten”)
You have the right to require us to erase personal data concerning you without undue delay. We must erase the personal data without undue delay where one of the following applies:
- you have withdrawn your consent and we have no other legal basis for processing;
- you have successfully objected to the processing of data concerning you;
- your personal data has been processed unlawfully;
- your personal data must be erased to comply with a legal obligation;
- your data was collected in connection with the offer of information society services.
Right to restriction of processing
You have the right to require us to restrict processing in the following cases:
- you contest the accuracy of the data – for a period enabling us to verify its accuracy;
- the processing is unlawful and you oppose erasure of the data, requesting restriction of its use instead;
- we no longer need the personal data for processing purposes, but you require it for the establishment, exercise or defence of legal claims;
- you have objected to processing – pending verification of whether our legitimate grounds override the grounds for your objection.
Automated decisions, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
This right does not apply where the decision:
- is necessary for entering into or performing a contract between you and us;
- is authorised by European Union or Polish law that also lays down suitable measures to safeguard your rights, freedoms and legitimate interests; or
- is based on your explicit consent.
Right to lodge a complaint
You have the right to lodge a complaint concerning the processing of your personal data with the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, tel. +48 22 531 03 00, fax +48 22 531 03 01, email: [email protected].
§11. RIGHTS DEPENDING ON THE LEGAL BASIS
When we refer to rights relating to the processing of your personal data, we mean the rights described below. Your ability to exercise them depends in each case on the legal basis for processing.
Right to withdraw consent
Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.
Right to data portability
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit that data to another controller without hindrance from us where the processing is:
- based on consent or a contract; and
- carried out by automated means.
When exercising your right to data portability, you have the right to have the personal data transmitted directly by us to another controller where technically feasible. This right must not adversely affect the rights and freedoms of others.
Right to object
Where we process your personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.
We may then no longer process that personal data unless we demonstrate:
- compelling legitimate grounds for the processing which override your interests, rights and freedoms; or
- grounds for the establishment, exercise or defence of legal claims.
If you object to the processing of your personal data for direct marketing purposes, we may no longer process it for those purposes.
§12. COOKIES – INTRODUCTION
The Store website uses cookies. These are commonly used small files containing strings of characters that are sent to and stored on the terminal device (for example a computer, laptop, tablet or smartphone) used when visiting the Store. This information is sent to the browser’s storage and returned on subsequent visits to the website. Cookies may be classified using the three methods below.
Based on the purposes for which cookies and similar technologies are used, we distinguish four categories:
- Strictly necessary cookies – these enable the Store and its features to function correctly, including authentication and security cookies. Without storing them on your device, it will not be possible to use the Store.
- Functional cookies – these remember the settings you select and tailor the Store to your needs and preferences, for example your selected language. They allow us to improve the Store’s functionality and performance. Without storing them on your device, some Store features may be limited.
- Analytics cookies – these help measure traffic, sources of visits, how the Store is used, errors, and the effectiveness of individual features.
- Marketing cookies – these are used to measure campaigns, attribute conversions, build audiences, limit advertising frequency and personalise advertisements in the Store and in our partners’ services.
Based on their duration, we distinguish two categories of cookies:
- session cookies – which remain until the end of a given session;
- persistent cookies – which remain after the session has ended.
Based on the entity that manages them, we distinguish:
- our own cookies;
- third-party cookies.
§13. COOKIES MANAGED BY THE DATA CONTROLLER
Cookies managed by us enable:
- access authentication;
- maintenance of a logged-in session;
- protection of the Store against hacking attacks;
- the browser to “remember” content entered into form fields (optional);
- the browser to “remember” items added to the shopping cart.
This makes the Store’s features easier and more convenient to use.
§14. THIRD-PARTY COOKIES
1. With your consent, we may use cookies and similar technologies provided by the following platforms:
- Google – to analyse traffic, measure advertising effectiveness and provide YouTube content;
- Meta – to measure and improve advertising on Facebook and Instagram;
- Pinterest – to measure and improve advertising;
- TikTok – to measure and improve advertising;
- OpenAI – to measure advertising effectiveness.
2. These technologies may transmit information about use of the Store, the device, the source of the visit and purchases made. If the user also uses a given platform’s services, that platform may combine this information with the user’s account in accordance with its own privacy policy.
3. The operation of these technologies depends on the user’s consent settings. Details of the providers and links to their privacy policies can be found in §8.
§15. COOKIE CONSENT AND MANAGEMENT
Consent to the processing of cookies is voluntary and may be withdrawn at any time. Please note, however, that withholding consent to the use of certain cookies may restrict access to the Store and its features or may even make it impossible to use them.
Consent to the processing of cookies may be given:
- through the settings of software installed on the telecommunications terminal device used by the user;
- by selecting the relevant settings in the consent banner or consent panel available in the Store.
Refusing or withdrawing consent is as easy as giving it. Withdrawal does not affect the lawfulness of earlier processing. Strictly necessary cookies may operate without consent because they are required to provide the service, ensure security, remember privacy choices, maintain the shopping cart or maintain the session.
Browser settings usually allow cookies and other information to be stored on a terminal device by default. If you do not agree to these files being stored, you must change your browser settings accordingly. You may disable storage for all connections made through a browser or for a specific website, and you may delete stored files. The method for managing them depends on the software you use.
Current cookie-management options can be found in your browser settings. Additional guidance is available here in Polish: https://www.e-regulaminy.pl/biuletyn/polityka-cookies-obsluga/.
§16. CACHE AND DEVICE STORAGE
When you use the Store website, we may use your device’s cache, local storage or session storage. These technologies may retain information between page views or visits, including Store settings, consent choices, shopping-cart contents, session identifiers and – after the relevant consent has been given – information about the source of the visit and advertising click identifiers. Their purpose is to enable the Store to operate, improve security and performance and, in the case of optional technologies, provide analytics and campaign attribution.
§17. ADVERTISING EFFECTIVENESS MEASUREMENT
1. After the relevant consent has been given, information about selected actions in the Store may be transmitted to Google, Meta, Pinterest, TikTok and OpenAI. This takes place both through technologies operating in the browser and through secure connections between our system and the partner’s system.
2. This information may concern, for example, viewing a product, adding it to the shopping cart, beginning checkout or making a purchase. It is used to determine whether advertising was effective and to improve campaign targeting. The scope of the data is described in §5.
3. Consent may be withdrawn at any time in the Store’s cookie settings. Withdrawal applies to future use of optional marketing technologies and does not affect the lawfulness of prior processing.
§18. LINKS TO OTHER WEBSITES OR SOFTWARE
The Store may contain links to other websites or software. We are not responsible for the privacy and cookie practices that apply to those websites or software. We recommend reviewing their privacy and cookie policies after accessing them or before installing the software.
§19. CHANGES TO THIS PRIVACY AND COOKIES POLICY
1. This Privacy and Cookies Policy takes effect when it is published on the Store website.
2. This Privacy and Cookies Policy may be amended by publishing its new wording on the Store website.
3. We will publish information about changes to this Privacy and Cookies Policy on the Store website before the revised wording takes effect.
4. Where the parties are bound by a contract entered into for an indefinite period, the Seller will provide information about changes to this Privacy and Cookies Policy electronically.
§20. CONSENT TO THE COLLECTION OF REVIEWS
1. REVIEWS IN THE ONLINE STORE
1.1. Customers of the Online Store may voluntarily and free of charge submit a review concerning purchases made in the Online Store. A review may also include a rating, photograph or review of a product purchased in the Online Store.
1.2. After a purchase is made in the Online Store, the Seller provides the data necessary to create an email invitation to the company handling the survey process. Surveys and the collection of reviews through forms are handled entirely by TrustMate S.A., with its registered office at Bartoszowicka 3, 51-641 Wrocław, Poland. TrustMate S.A. sends the Customer an email asking them to submit a review and containing a link to an online form. The form enables the Customer to answer the Seller’s questions about the purchase, rate it, add their own description and attach a photograph of the purchased product. If no review is submitted after the first invitation, TrustMate may send another invitation.
1.3. A review may be submitted only by a Customer who has made a purchase in the Seller’s Online Store.
1.4. Reviews submitted by Customers are published by the Seller in the Online Store and on the TrustMate.io profile.
1.5. Customers may not use reviews for unlawful activities, including acts of unfair competition against the Seller or activities that infringe personal rights, intellectual property rights or other rights of the Seller or third parties.
1.6. A review may be submitted only for products actually purchased in the Seller’s Online Store. Entering into fictitious or sham sales contracts for the purpose of submitting a review is prohibited. Neither the Seller nor its employees, irrespective of the basis of their employment, may author a review.
1.7. A review may be deleted by its author at any time.
META USER DATA DELETION
To request the deletion of personal data processed in connection with PASURI Marketing Hub and Meta services, please send an email to [email protected] with the subject “Meta Data Deletion Request”.
Please provide the email address associated with your request so that we can verify your identity and locate the relevant data. We will process the request in accordance with applicable data protection law.
Certain information may be retained where required by law, including for tax, accounting, fraud-prevention purposes or for the establishment, exercise or defence of legal claims.