Polityka Prywatności
Thank you for your interest in our online store. Protecting your privacy is very important to us. This privacy policy provides detailed information on how to handle your data. The data controller is: COLORMED S.C. M.Waliszewska K.Waliszewska, Inowrocławska 12, 88-170, Pakość, biuro@colormed.pl
1. Access Data and Hosting
You can visit our websites without providing any personal data. Each time you access the website, the server automatically saves only so-called server logs, such as the name of the requested file, your IP address, the date and time of the request, the amount of data transferred, and the requesting internet service provider (access data), and documents the page access.
This data is analyzed solely to ensure the proper functioning of the website and to improve our offer. This serves – as part of the interest assessment – to safeguard our legitimate interest in the proper presentation of our offer. All access data is deleted within seven days of the end of your visit to the website.
Hosting Services Provided by an External Service Provider
As part of data processing, an external service provider, at our request, provides us with website hosting and presentation services. All data collected – as described in this privacy policy – during your use of our website or in the forms provided for this purpose in the online store is stored on this service provider's servers. Processing on other servers takes place only to the extent specified in this privacy policy.
This service provider is based in a country within the European Union or the European Economic Area.
2. Data Collection and Processing for Contract Fulfillment and Creation of a Customer Account
We collect personal data only when you voluntarily provide it to us by placing an order, contacting us (e.g., via the contact form or email), or creating a customer account. Required fields are marked as such because the data contained therein is necessary for us to fulfill the contract or to process the matter about which you contacted us, or to create a customer account. Without this data, you cannot complete your order, create a customer account, or contact us. The data collected is determined by the forms you enter your data into. We use the data you provide to fulfill the contract and respond to your inquiries. After the contract is fulfilled or your customer account is deleted, the processing of your data will be restricted, and after the retention periods specified in tax regulations and the Accounting Act expire, unless you expressly consent to further use of this data or, in accordance with applicable law, we reserve the right to continue using the data, in which case we inform you in this statement. Your customer account can be deleted at any time. To do this, please send a message to our contact address indicated in the section "Our Contact Details and Your Rights" or use the appropriate function in your customer account.
3. Data Transfer
The online store processes your personal data for the following purposes:
To fulfill the contract, we transfer your data to the courier company responsible for delivery, provided this is necessary to deliver the ordered goods. Depending on the payment service provider you select during the ordering process, we transfer the payment data collected for this purpose to the credit institution processing the payment and, where applicable, to the payment service provider selected by us or you. Some payment service providers collect data independently if you create an account with them. In such cases, you must log in to the payment service provider as part of the order process by providing your access details. In such cases, the privacy policy of the respective payment service provider also applies.
Some payment service providers and couriers we cooperate with are based in a country outside the European Union. Personal data is transferred to these companies only when necessary to fulfill the contract.
a) Transfer of data to the courier company
If you expressly consent to this during or after placing your order, we will transfer your telephone number to the selected courier company so that they can contact you before delivering your order to notify you or arrange delivery.
The above consent may be withdrawn at any time by sending us an appropriate message to our contact address indicated.
You can do so in the section "Our Contact Details and Your Rights" or by sending a message directly to the courier company at the contact address provided below. Upon withdrawal of consent, we will delete the data provided for this purpose, unless you expressly consent to the further use of your data for other purposes or unless we reserve the right to continue using your data in legally permitted cases, in which case we inform you in this statement.
DPD Polska Sp. z o. o.
Mineralna
02-274
Warsaw
Poczta Polska S.A.
ul. Rodziny Hiszpańskich 8
00-940
Warsaw
InPost - Integer S.A.
ul. Wielicka 28
30-552
Kraków
b) Transfer of your personal data to ING Bank Śląski S.A. ("Bank")
In connection with the processing of personal data for the purposes specified in paragraph 3 and 4, your personal data may be made available by the Online Store to other recipients or categories of personal data recipients, which may include: a) ING Bank Śląski S.A. b) Twisto Polska sp. z o.o.
in connection with:
a. the provision by the Bank to the Online Store of the service of providing infrastructure for processing online payments (legal basis: Art. 6 sec. 1 letter f) of the Regulation).
b. the processing and settlement by the Bank of payments made by customers of the Online Store online using payment instruments (legal basis: Art. 6 sec. 1 letter f) of the Regulation).
c. for the Bank to verify the proper performance of agreements concluded with the Online Store, in particular to ensure the protection of payers' interests in connection with their complaints (legal basis: Art. 6 sec. 1 letter f) of the Regulation).
transfer of your personal data to Twisto Polska sp. in connection with the possibility of offering payment for purchased goods or services by Twisto Polska sp. z o.o. under a mandate agreement covering the "Buy with Twisto" purchasing formula and making this purchasing formula available through the Online Store, as well as for the purpose of verifying the proper performance of such mandate agreements by Twisto Polska Sp. z o.o. (legal basis: Article 6, paragraph 1, letter f) of the Regulation).
In connection with the processing of personal data for the purposes specified in paragraph 3, your personal data may be made available by the Online Store to other recipients or categories of recipients of personal data, which may include: a) ING Bank Śląski S.A. b) Twisto Polska sp. z o.o.
If you provide your personal data for the purpose of concluding a contract with the Online Store, providing your personal data is a condition for concluding this contract. Providing personal data in this situation is voluntary; however, failure to provide this data will result in the inability to conclude a contract with the Online Store. If you provide your personal data for the purpose of transferring your personal data to Twisto Polska sp. z o.o. prior to concluding a sales contract for goods (or services) purchased in the Online Store, the provision of this data is a condition for concluding a sales contract in connection with the business model adopted by the Online Store. If your personal data is transferred to the Bank in connection with the processing and settlement of payments made by you to the Online Store via the Internet using payment instruments, the provision of this data is required to process the payment and provide confirmation of its execution by the Bank to the Online Store. If your personal data is transferred to the Bank for the purpose of the Bank verifying the proper performance of contracts concluded with the Online Store, in particular to ensure the protection of payers' interests in connection with their complaints, the provision of this data is required to enable the performance of the contract concluded between the Online Store and the Bank. If your personal data is transferred to Twisto Polska sp. z o.o. In connection with the possibility of offering you payment for goods or services purchased by Twisto Polska sp. z o.o. under a mandate agreement covering the "Buy with Twisto" purchasing formula and the provision of this formula by the Online Store, providing this data and processing it for this purpose is required in connection with the business model adopted by the Online Store and for the performance of the contract concluded between the Online Store and Twisto Polska Sp. z o.o.
c) Transfer of Personal Data to Payment Operators
To process payments for orders placed in the Online Store, your personal data may be transferred to payment operators supported by the secure IdoPay payment system, provided by IAI S.A.
Depending on the payment method you choose, the following data may be transferred: name and surname, email address, order number, transaction amount, and technical data required for processing.
to process payments.
Personal data may be transferred to the following entities:
ING Bank Śląski S.A. – for electronic payment processing (imoje),
PayPo Sp. z o.o. – if PayPo deferred payments are selected,
Visa Inc. and Mastercard Incorporated – for card payments,
Google Ireland Limited – for Google Pay payments,
Apple Inc. – for Apple Pay payments,
Polski Standard Płatności Sp. z o.o. – for BLIK payments.
These entities process personal data as separate controllers of personal data in accordance with their own privacy policies or – depending on the processing model – as processors commissioned by the controller.
The legal basis for the processing of personal data in the above scope is Article 6(1)(b) of the GDPR (necessity for the performance of the sales contract) and Article 6(1)(b) of the GDPR (necessity for the performance of the sales contract) and Article 6(1)(c) of the GDPR (necessity for the performance of the sales contract). f GDPR (legitimate interest of the controller in enabling payment processing and preventing abuse).
4. Email Newsletter and Postal Advertising
Email Advertising after Subscribing to the Newsletter
If you subscribe to our newsletter, we will use the data required for this purpose or provided to us separately to regularly send you our newsletter electronically based on your consent.
You can unsubscribe from the newsletter at any time by sending us a message with the relevant information or by using the appropriate link in the newsletter. After unsubscribing, we will delete your email address unless you expressly consent to the further use of your data for other purposes or we reserve the right to further use your data in legally permitted cases, in which case we inform you in this declaration.
Postal Advertising and Your Right to Object
We also reserve the right to process your data – your name and postal address – for our own advertising purposes regarding our products, such as sending you the latest offers and information about our products by post. This serves to protect our legitimate interest in contacting customers for advertising purposes.
4a. GetResponse Email Marketing, Abandoned Shopping Carts, and Product Recommendations
For marketing communications, including newsletter distribution, messages regarding abandoned shopping carts, marketing automation, and the presentation of product recommendations on the website, we use tools offered by GetResponse S.A., based in Gdańsk (ul. Arkońska 6/A3, 80-387 Gdańsk).
GetResponse S.A. processes personal data on our behalf as a processor, pursuant to a concluded personal data processing agreement.
The scope of data processed may include, in particular:
email address,
data regarding orders and store activity (e.g., information about abandoned shopping carts),
statistical data regarding opening and clicking on messages,
technical data, including cookie identifiers or similar technologies.
Data processing takes place:
in the case of a newsletter – based on the consent of the data subject (Article 6, paragraph 1, letter a of the GDPR); in the case of messages regarding abandoned shopping carts and product recommendations – based on the legitimate interest of the controller (Article 6, paragraph 1, letter f of the GDPR), consisting in marketing its own products and increasing sales, while respecting the rights and freedoms of data subjects.
GetResponse may use cookies and similar technologies for analytical and marketing purposes. The use of these technologies is in accordance with the consent settings expressed by the user via the cookie banner available on the store's website.
Personal data may be transferred outside the European Economic Area, in particular to third countries where GetResponse maintains technical infrastructure. In such cases, data is transferred based on standard contractual clauses approved by the European Commission or other mechanisms compliant with the GDPR.
5. Cookies and Web Analytics
To enhance our website and enable the use of certain features, to display relevant products, or for market research purposes, we use so-called cookies on our websites. These cookies, as part of the analysis and assessment of interests, serve to protect our legitimate interest in the optimal presentation of our offer. Cookies are small text files that are automatically saved on your end device. Some of the cookies we use are deleted after the end of the browser session, i.e., after closing it (so-called session cookies).
Other cookies
They are stored on your end device and enable us to recognize your browser the next time you visit the website (persistent cookies). The storage period is specified in your browser's cookie settings. You can configure your browser to receive information about the use of cookies and to decide whether to accept or reject them in specific cases, or completely. Browsers manage cookie settings in various ways. You'll find instructions on changing cookie settings in your browser's help menu. They are available at the following links:
Internet Explorer™: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies
Safari™: http://safari.helpmax.net/pl/ochrona-i-prywatnosc/usuwanie-plikow-cookie/
Chrome™: https://support.google.com/chrome/answer/95647?hl=pl&hlrm=en
Firefox™: https://support.mozilla.org/pl/kb/usuwanie-ciasteczek
Opera™: http://help.opera.com/Windows/12.10/pl/cookies.html
If you do not consent to the use of cookies, the functionality of our website may be limited.
5a. Classification of Cookies
Our website uses the following categories of cookies:
essential (functional) cookies – necessary for the proper operation of the website and store (e.g., shopping cart management, logging in),
analytical cookies – enabling analysis of website usage, including Google Analytics and tools provided by IAI S.A.,
marketing (advertising) cookies – enabling the display of personalized ads and product recommendations, including Google Ads, Meta (Facebook), GetResponse, and TrustMate.
5b. Cookie Banner (IdoSell)
Cookie consent is managed through the mechanism provided by the IdoSell platform. Users can:
consent to individual cookie categories,
withdraw consent at any time,
change cookie settings via the banner or web browser settings.
Analytical and marketing cookies are saved on the user's device only after the user has provided appropriate consent via the cookie banner.
Use of Google (Universal) Analytics for Web Analytics
Our website uses Google (Universal) Analytics, a web analytics tool from Google Inc. (www.google.com). This serves our legitimate interest in optimally presenting our services as part of the analysis and evaluation of interests. Google (Universal) Analytics uses methods that enable the analysis of your use of the website, such as cookies. Automatically collected information about your use of this website is generally transferred to a Google server in the United States and stored there. Due to the IP anonymization activated on this website, your IP address is shortened before transmission within Member States of the European Union or in other states that are party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transferred to a Google server in the United States and shortened there. The anonymized IP address transmitted by your browser as part of Google Analytics is generally not combined with other Google data.
Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. The current certification is available at this link. As part of the agreement between the USA and the European Commission, the latter has determined that companies certified under the Privacy Shield offer an adequate level of data protection.
You can prevent the collection of data collected by cookies about your use of our website (including your IP address) by Google, as well as the processing of this data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=pl
Alternatively, instead of installing the browser plug-in, you can click this link to disable data collection by Google Analytics on our website. An opt-out cookie will then be stored on your device. If you delete your cookies, you must click this link again.
6. Advertising with e-marketing tools
Google AdWords Remarketing
We use Google AdWords to promote our website in search results and on third-party websites. For this purpose, when you visit our website, a so-called Google remarketing cookie is automatically placed on your device. This cookie uses a pseudonymous identifier (ID) and based on the websites you visit, this enables the display of interest-based advertising. This serves to protect our legitimate interest in the optimal performance of our website.
Further data processing only takes place if you have consented to Google linking your browsing and app usage history to your account and using the information from your Google account to personalize the ads displayed on websites. If you are logged in to Google while visiting our website, Google uses your data together with Google Analytics data to create and define target group lists for cross-device remarketing purposes. For this purpose, Google temporarily links your personal data with Google Analytics data to create target groups.
The Google AdWords Remarketing service is an offer of Google LLC (www.google.com). Google LLC is headquartered in the USA and is certified under the EU-US Privacy Shield. The current certification is available at the link provided. As part of the agreement between the USA and the European Commission, the latter has determined an adequate level of data protection for companies certified under the Privacy Shield.
You can deactivate cookies used for remarketing by clicking this link. You can also find information about the use of cookies and appropriate settings on the Digital Advertising Alliance website.
7. Social Media Plugins
Use of Social Media Plugins
Our website uses so-called social plugins ("plugins") from social media platforms.
When you view our website containing such a plugin, your browser establishes a direct connection to the servers of Facebook, Google, Twitter, or Instagram. The content of the plugin is transmitted directly to your browser by the respective service provider and integrated into the website. Through this integration, the service providers receive information that your browser has viewed our website, even if you do not have a profile with the service provider or are not currently logged in. This information (including your IP address) is sent by your browser directly to the server of the respective service provider (some servers are located in the USA) and stored there. If you're logged in to a social networking site, that service provider can directly associate your visit to our website with your profile on that social networking site. If you use a plugin, for example, by clicking the "Like" or "Share" button, the corresponding information will also be sent directly to the service provider's server and stored there. This information will also be published on the social networking site and displayed to your contacts.
The purpose and scope of data collection and its further processing and use by the service providers, as well as your contact options and your rights in this regard, and the ability to configure settings to protect your privacy, are described in the service providers' privacy policies.
https://www.facebook.com/policy.php
https://developers.google.com/+/web/buttons-policy
https://about.pinterest.com/de/privacy-policy
If you do not want social media platforms to directly associate the data collected during your visit to our website with your profile on that platform, you must log out of that platform before visiting our website. You can also completely prevent plugins from loading on the website by using appropriate browser extensions, e.g., blocking scripts with "NoScript" (https://noscript.net/).
8. Reminders about the possibility of leaving a review
Reminder about the possibility of leaving a review sent by Trusted Shops
If you have given us your explicit consent during or after placing an order, we will forward your email address to Trusted Shops GmbH, Subbelrather Str. 15c, 50823 Cologne, Germany (www.trustedshops.pl), so that we can send you an electronic reminder about the opportunity to leave a review about your purchase in our shop.
You can revoke your consent at any time by sending a message to our contact address specified in the section "Our contact details and your rights" or by submitting a direct declaration to Trusted Shops.
8a. TrustMate – Customer Review System
To collect and present customer reviews regarding purchases made in our online store, we use the services of TrustMate S.A., based in Warsaw.
As part of this service, TrustMate S.A. may process customer personal data, such as:
email address,
order information (e.g., order number, purchase date),
content of the review provided
The processing of personal data is based on:
the legitimate interest of the controller (Article 6, Section 1, Letter f of the GDPR), consisting in building the store's credibility, improving the quality of service, and enabling customers to share their purchase reviews.
TrustMate S.A. acts as a personal data processor based on a concluded data processing agreement.
As part of the TrustMate system, cookies or similar technologies may be stored on the user's device to enable the proper functioning of the review system and its presentation. These technologies are used in accordance with the consent settings expressed by the user via the cookie banner available on the store's website.
9. Our Contact Details and Your Rights
You have the following rights:
• the right to obtain information about the processing of your data within the scope specified in Article 15 of the GDPR;
• the right to rectify inaccurate or incomplete personal data concerning you pursuant to Article 16 of the GDPR;
• the right to object to the processing of inaccurate or incomplete personal data concerning you pursuant to Article 17 of the GDPR; 17 GDPR – the right to erasure (“right to be forgotten”) of your personal data stored with us, provided that their further processing is not necessary: - for exercising the right to freedom of expression and information; - for compliance with a legal obligation; - for reasons of public interest; - for the establishment, exercise or defence of legal claims;
• in accordance with Art. 18 GDPR – the right to restrict the processing of your personal data, provided that: - the accuracy of the personal data is contested by you; - processing is unlawful and you object to their erasure; - we no longer need the personal data, but you require them to establish, exercise or defend legal claims; - you have objected to processing under Art. 21;
• in accordance with Art. 20 GDPR – the right to receive the data you have provided to us in a structured, commonly used and machine-readable format and to have them transmitted to another controller (“right to data portability”);
• in accordance with Art. 77 GDPR – the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority at your habitual residence, place of work, or our registered office. If you have any questions regarding the collection, processing, and use of your personal data, the rectification, blocking, or deletion of your data, or if you wish to revoke your consent or object to the use of your data for the purposes set out in this privacy policy, please contact the data controller: (email address / telephone number if applicable). Right to object: If we process your personal data as described in this privacy policy to protect our legitimate interests, you may object to the processing of your data for this purpose – with future effect. Where data is processed for direct marketing purposes, you may exercise your right to object at any time. If processing is carried out for other purposes, you may only object on grounds arising from your particular situation. After you exercise your right to object, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for processing that override your interests and rights, or if the processing is for the purpose of pursuing, exercising, or defending legal claims. This does not apply when data is processed for direct marketing purposes. In such a case, we will no longer process your personal data for this purpose.
In matters not regulated by these Terms and Conditions, the provisions of the Civil Code and relevant Polish laws, as well as European Union law, in particular the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC), apply.
You have the right to free information regarding your personal data stored with us, as well as the right to rectification, restriction of processing, erasure, or transfer of such data.
If you require information or have any questions regarding the collection, processing, and use of your personal data, or wish to rectify, block, or delete your data, or to withdraw your consent or object to the use of certain data, please contact our data protection contact person:
Katarzyna Waliszewska
Inowrocławska 12
88-170 Pakość
(+48) 663331990
k.waliszewska@colormed.pl
Furthermore, you have the following rights:
You have the right to lodge a complaint with the competent supervisory authority.
*****************************************************************************
Right to object
If, as described in this privacy policy, we process personal data to protect our legitimate interests, as part of the analysis and assessment of interests, you may object to such processing for this purpose with future effect. If the processing is for direct marketing purposes, you may exercise your right to object at any time. If the processing is for other purposes, you have the right to object only on grounds arising from your particular situation.
After you exercise your right to object, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for processing that override your interests and rights, or if the processing is for the purpose of asserting, exercising, or defending legal claims.
The above does not apply if the processing is for direct marketing purposes. In such a case, we will no longer process your personal data for the above purpose.