PRIVACY POLICY



PRIVACY POLICY OF Atut & Primar s.c., BASED IN KRAKOW

Thank you for your interest in our online store. Protecting your privacy is very important to us.

The purpose of this Privacy Policy is, among other things, to fulfil the information obligation referred to in Article 13, paragraphs 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the "GDPR." This privacy policy (hereinafter referred to as the "Privacy Policy") contains information about the processing by Atut & Primar s.c., with its registered office in Krakow, of the personal data of:
1) individuals who are contractors, employees, or representatives of contractors,
2) other individuals who contact Atut & Primar s.c. (by phone, email, contact form, or letter), and individuals with whom Atut & Primar s.c. contacts (by phone, email, or letter).

Who is the controller of your personal data?

The controller of your personal data is Atut & Primar s.c., with its registered office in Krakow. You can contact us as follows:
1) by mail to the following address: Atut & Primar s.c., ul. Łowińskiego 7e, 31-752 Krakow
2) by email: atut@atut-primar.pl
3) by telephone: +48 517 249 235, +48 667 881 308

Type of data stored:

The data collected is determined by the forms into which the data is entered. We use the data you provide to fulfill the contract and respond to your inquiries. After the contract is fulfilled or your customer account is deleted, the processing of your data will be restricted, and after the retention periods specified in tax regulations and the Accounting Act expire, the data will be deleted, unless you expressly consent to the continued use of this data or, in accordance with applicable law, we reserve the right to continue using the data, in which case we inform you in this statement. Your customer account can be deleted at any time. To do this, please send a message to our contact address indicated in the section "Who is the controller of your personal data".

For what purpose and on what legal basis do we process your personal data

Your personal data may be processed for the following purposes and legal bases:
1) Contacting you regarding current matters, in particular the performance of contracts between us and you or the entity you represent, presenting offers, receiving orders and requests, and answering questions. The legal basis for data processing is our legitimate interest (Article 6, Section 1, Letter f of the GDPR), consisting in the need for ongoing contact with our contractors.
2) Fulfilling contracts concluded between us and you or the entity you represent, including accepting and fulfilling orders, placing orders, concluding contracts, performing accounting activities, providing bookkeeping services, and debt collection. The legal basis for data processing is the necessity to perform a contract or take steps prior to entering into a contract with you (Article 6, paragraph 1, letter b of the GDPR), as well as our legitimate interest (Article 6, paragraph 1, letter f of the GDPR), consisting in the proper execution of contracts with contractors.
3) Providing services related to maintaining an account on the website – online store, including tracking order history and the ability to quickly place orders. The legal basis for data processing is the necessity to perform the contract to which you are a party (Article 6, paragraph 1, letter b of the GDPR).
4) Informing you about new products via the Newsletter. The legal basis is your consent to the processing of personal data and the sending of such information (Article 6, paragraph 1, letter a of the GDPR).
5) Responding to your inquiries and contacting you regarding matters you have addressed to us, including by sending a message to our email address. The legal basis for data processing is the legitimate interest of the controller (Article 6, paragraph 1, letter f of the GDPR), consisting in the need to provide a response;
6) Fulfilling our legal obligations, in particular those arising from tax law. The legal basis is the necessity to fulfil the legal obligation of the controller (Article 6, paragraph 1, letter c of the GDPR).
7) Establishing, securing, and pursuing any claims, both on our part and yours. The legal basis is the legitimate interest of the controller (Article 6, paragraph 1, letter f of the GDPR), consisting in the ability to establish, pursue, or defend legal claims.

Data recipients:

We may share your personal data with:
We may disclose your personal data to external entities to whom we entrust services related to personal data processing, with whom we conclude a personal data processing agreement. Entities with whom we may share your personal data include IT service providers, accounting and bookkeeping services providers, banks, postal operators and couriers, and legal or auditing service providers. Your personal data will not be transferred to countries outside the European Union.

How long do we store personal data?

We will store your personal data for the period necessary to achieve the purposes specified above. If:
1) Your personal data is processed in connection with the performance of a contract concluded with you or the entity you represent, we will store it for the duration of the contract and, to the extent necessary, for a period of 5 years from the end of the calendar year in which the tax due in connection with the conclusion and performance of the contract expired, or longer if required by law or the limitation period for claims arising from that contract;
2) you have created an account on the website, your data will be processed for the entire period of your account's activity until its deletion;
3) you have contacted us, your data will be processed for a period of 3 years from the end of the contact;
4) we process personal data based on your consent, and these data will be stored until you withdraw your consent.
If your personal data are no longer necessary for the purposes for which they were processed, we will process them to establish, pursue, or defend against potential claims, both on our side and yours, only for the limitation periods specified by law.

Consequences of not providing personal data:

Except where the provision of personal data is a legal requirement, providing personal data is entirely voluntary; however, failure to provide them will hinder or prevent us from achieving the purposes set out above.

What are your rights related to the processing of your personal data?

We guarantee the exercise of all rights you are entitled to under the provisions of the GDPR. Therefore:
1) You have the right to obtain information from us on how and to what extent we process your personal data, and the right to access it
2) If you notice that the personal data we process is incorrect or incomplete, you have the right to request its rectification or completion.
3) You may request the deletion of personal data concerning you:
a. if your data is no longer necessary for the purposes for which it was collected by us;
b. your consent is withdrawn;
c. you object to the processing of your personal data and there are no overriding legitimate grounds for processing;
d. your data is processed unlawfully;
e. personal data must be deleted in order to fulfil an obligation arising from the law.
4) You may request that the processing of your personal data be restricted:
a. if you contest the accuracy of the personal data – for a period enabling us to verify its accuracy;
b. if you believe that we are processing your personal data unlawfully, but you do not want it deleted;
c. it turns out that we no longer need your personal data for the purposes for which we collected it, but you may need it to pursue or defend legal claims;
d. you object to the processing of your personal data – until we determine whether our legitimate interests override the grounds for your objection.
5) With respect to your personal data that we process based on our legitimate interest, you have the right to object to the processing of such data for reasons relating to your particular situation.
6) With respect to your personal data that we process based on your consent, you have the right to withdraw consent at any time, provided that the withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
7) If the processing of your personal data is based on:
a. your consent, or
b. is necessary for the performance of a contract concluded with you, or
c. is necessary to take steps at your request prior to entering into a contract, or
d. the processing is carried out by automated means, you have the right to receive your personal data from us in a structured, commonly used, machine-readable format (e.g., PDF format). You can send this data to another data controller or request that we send it to another controller. However, we will only do this if such transfer is necessary. Sending will be technically possible.
8) You have the right to lodge a complaint regarding our processing of your personal data with a supervisory authority, i.e., the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw. Information on automated decision-making: We do not make decisions regarding your personal data that are based on automated processing, including profiling, that produce legal effects or similarly significantly affect the data subject.
To exercise the above rights, please contact us. The contact details are provided above.