Privacy policy

Definitions

1. Controller: Ed Red SA, ul. Zwierzyniecka 17/4 31-103 Kraków, Tax Identification Number (NIP) 5252754250

2. Personal Data – means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data also includes device IP, location data, online identifier, and information collected through cookies and other similar technology.

3. Policy – this Privacy Policy.

4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

5. Cookies – means IT data, in particular small text files, saved and stored on the devices through which the User uses the Website’s pages.

6. Controller's Cookies – means Cookies placed by the Controller related to the provision of services by the Controller electronically via the Website.

7. Third-Party Cookies – means Cookies placed by the Controller's partners via the Website’s page.

8. Website – means the website or application operated by the Controller, acting under the domain(s): www.sklep.edred.pl, www.edred.pl

9. Device – means an electronic device through which the User gains access to the Website.

10. User – any natural person visiting the Website or using one or more services or functionalities described in the Policy.

Processing of Personal Data

In connection with the User's use of the Website, the Controller collects data to the extent necessary to provide the various services offered, as well as information about the User's activity on the Website.

1. Personal data of all persons using the Website (identifiers and information collected via Cookies or other similar technologies), who are not registered Users (i.e., persons who do not have an account on the Website) are processed by the Controller:

2. for the purpose of providing services electronically in terms of making content collected on the Website available to Users and providing contact forms – in this case, the legal basis for processing is Art. 6(1)(b) of the GDPR, i.e., necessity of processing for the performance of a contract;

3. for analytical and statistical purposes – in this case, the legal basis for processing is Art. 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller consisting in conducting analyses of Users' activity, as well as their preferences in order to improve the applied functionalities and services provided;

4. for the purpose of potential establishment and assertion of claims or defense against them – the legal basis for processing results from Art. 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller;

5. User activity on the Website, including their personal data, is recorded in system logs (a special computer program used to store a chronological record containing information about events and actions concerning the IT system used to provide services by the Controller). Information collected in the logs is processed in connection with the provision of services. The Controller also processes them for technical purposes; in particular, data may be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with performing backups, testing changes in IT systems, detecting irregularities, or protection against abuse and attacks.

6. Persons who, when registering on the Website, provide their personal data to the extent necessary to create and manage an account and carry out purchases. Providing data marked as mandatory is required to create and manage an account, and failure to provide it results in the inability to create an account. Providing other data is voluntary. Personal data is processed: a) for the purpose of providing services related to the maintenance and management of an account on the Website – the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR), and regarding data provided optionally – the legal basis for processing is consent (Art. 6(1)(a) of the GDPR);
b) for the purpose of handling purchases made on the Website - in this case, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);
c) for the purpose of handling complaints - in this case, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);
d) for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website and the manner of account usage, as well as their preferences in order to improve the applied functionalities;
e) for the purpose of potential establishment and assertion of claims or defense against them – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in the protection of their rights.
f) for marketing purposes of the Controller and other entities in accordance with the principles described in the Policy – in such a case, the legal basis for processing is the consent granted (Art. 6(1)(a) of the GDPR).

7. Placing an order for the purchase of goods by the User involves the processing of their personal data. Providing data marked as mandatory is required to accept and process the order, and failure to provide it results in the inability to fulfill it. Personal data is processed: a) for the purpose of fulfilling the placed order – the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);
b) for the purpose of handling purchases made on the Website - in this case, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);
c) for the purpose of handling complaints - in this case, the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);
d) for the purpose of fulfilling statutory obligations incumbent on the Controller, resulting in particular from tax and accounting regulations – the legal basis for processing is a legal obligation (Art. 6(1)(c) of the GDPR);
e) for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website, as well as their purchasing preferences in order to improve the applied functionalities;
f) for the purpose of potential establishment and assertion of claims or defense against them – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in the protection of their rights.

8. The Controller ensures the possibility of contact using electronic contact forms. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide other data to facilitate contact or handle the inquiry. Providing data marked as mandatory is required to accept and handle the inquiry, and failure to provide it results in the inability to process it. Providing other data is voluntary. Personal data is processed: a) for the purpose of identifying the sender and handling their inquiry sent via the provided form – the legal basis for processing is the necessity of processing for the performance of a service contract (Art. 6(1)(b) of the GDPR);
b) for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in keeping statistics of inquiries submitted by Users via the Website in order to improve its functionalities.

Cookies

1. The Cookies used by the Controller are safe for the User's Device. In particular, it is not possible for viruses or other unwanted software or malware to enter Users' Devices this way. These files allow identifying the software used by the User and adapting the Website individually to each User. Cookies usually contain the domain name they come from, their storage time on the Device, and an assigned value.

2. The Controller uses two types of Cookies: a) Session cookies: are stored on the User's Device and remain there until the session of the given browser ends. The saved information is then permanently removed from the Device's memory. The session cookie mechanism does not allow for collecting any personal data or any confidential information from the User's Device;
b) Persistent cookies: are stored on the User's Device and remain there until they are deleted. Ending the session of the given browser or turning off the Device does not remove them from the User's Device. The persistent cookie mechanism does not allow for collecting any personal data or any confidential information from the User's Device.

3. The User has the option to limit or disable the access of Cookies to their Device. If this option is used, using the Website will be possible, except for functions that, by their nature, require Cookies.

4. The Controller uses First-Party Cookies for the following purposes: a) Website configuration - adjusting the content of the Website's pages to the User's preferences and optimizing the use of the Website's pages – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in improving the Website's functionality;
b) analysis and research and audience auditing – collecting general and anonymous statistical data, creating anonymous statistics via analytical tools that help understand how Website Users use the Website's pages, which enables improving their structure and content – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website in order to improve the applied functionalities;
c) providing advertising services – presenting advertisements tailored to the User's preferences – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website in order to improve the applied functionalities;
d) marketing in connection with directing contextual advertising to Users (i.e., advertising that is matched to the content of the pages on which it is displayed) – the basis for processing personal data is then related to the pursuit of the Controller's legitimate interest (Art. 6(1)(f) of the GDPR).
e) direct marketing, including profiling, through the selection and display of available Store goods taking into account the activity and preferences of specific Users, as well as through creating matched groups of advertising recipients taking into account their preferences, which constitutes the Seller's legally legitimate interest (legal basis for data processing: Art. 6(1)(f) of the GDPR

5. The service controller uses Third-Party Cookies for the following purposes: a) Website configuration - adjusting the content of the Website's pages to the User's preferences and optimizing the use of the Website's pages – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in improving the Website's functionality.
b) analysis and research and audience auditing - collecting general and anonymous statistical data via Google Analytics analytical tools – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website in order to improve the applied functionalities.
c) providing advertising services – presenting advertisements tailored to the User's preferences using Google AdWords analytical tools – the legal basis for processing is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR) consisting in conducting analyses of Users' activity on the Website in order to improve the applied functionalities.
d) marketing in connection with directing contextual advertising to Users (i.e., advertising that is matched to the content of the pages on which it is displayed) – the basis for processing personal data is then related to the pursuit of the Controller's legitimate interest (Art. 6(1)(f) of the GDPR).

6. The User can independently and at any time change the settings regarding Cookies, defining the conditions for their storage and gaining access by Cookies to the User's Device. The User can make the changes to the settings referred to in the previous sentence using the web browser settings or by configuring the service. These settings can be changed in particular in such a way as to block the automatic handling of Cookies in the web browser settings or to inform about their every placement of Cookies on the User's device. Detailed information about the possibilities and methods of handling Cookies is available in the software (web browser) settings.

7. The User may at any time delete Cookies using the available functions in the web browser they are using.

8. Limiting the use of Cookies may affect some functionalities available on the Website's page.

9. If the User has consented to receiving marketing information via e-mail, the User's personal data will be processed for the purpose of sending such information. The basis for data processing is the Controller's legitimate interest consisting in sending marketing information within the limits of the consent granted by the User (direct marketing). The User has the right to object to the processing of data for direct marketing purposes, including profiling. Data will be stored for this purpose for the duration of the Controller's legitimate interest, unless the User objects.

Period of Personal Data Processing

1. The period of data processing by the Controller depends on the type of service provided and the purpose of processing. As a rule, data is processed for the duration of the service provision or order fulfillment, until the consent granted is withdrawn or an effective objection to data processing is filed in cases where the legal basis for data processing is the Controller's legitimate interest.

2. The data processing period may be extended if processing is necessary to establish and assert potential claims or defend against them, and after this time only in the case and to the extent required by law. After the processing period expires, the data is irreversibly deleted.

Rights of Users

1. Data subjects have the following rights: a) right to information about personal data processing – in this case, upon the request of the reporting person, the Controller provides information about personal data processing, including primarily the purposes and legal bases of processing, the scope of data held, the entities to which personal data is disclosed, and the planned date of their deletion (Art. 12 of the GDPR);
b) right to rectification – in this case, the Controller removes any inconsistencies or errors regarding the processed personal data and completes or updates them if they are incomplete or have changed (Art. 16 of the GDPR);
c) right to obtain a copy of the data – in this case, the Controller provides a copy of the processed data concerning the person making such a request (Art. 15(3) of the GDPR);
d) right to restriction of processing – in this case, the Controller fulfills the obligations indicated in Art. 18 of the GDPR;
e) right to erasure – in this case, the Controller fulfills the obligations indicated in Art. 19 of the GDPR;
f) right to data portability – in this case, the Controller fulfills the obligations indicated in Art. 20 of the GDPR
g) Right to object to data processing for marketing purposes – the data subject may at any time object to the processing of personal data for marketing purposes, without the need to justify such an objection (Art. 21(2) of the GDPR);
h) Right to object to other data processing purposes – the data subject may at any time object to the processing of personal data based on the Controller's legitimate interest (e.g., for analytical or statistical purposes or for reasons related to the protection of property). An objection in this regard should include a justification and is subject to the Controller's assessment (Art. 21(1) of the GDPR);
i) Right to withdraw consent – if data is processed based on consent, the data subject has the right to withdraw it at any time, which, however, does not affect the lawfulness of processing carried out before the withdrawal of such consent (Art. 7(3) of the GDPR);
j) Right to lodge a complaint – in the event of concluding that the processing of personal data violates the provisions of the GDPR or other provisions regarding personal data protection, the data subject may lodge a complaint with the President of the Personal Data Protection Office (Art. 77(1) of the GDPR).

2. A request regarding the exercise of data subjects' rights can be submitted: a) in writing to the address: Ed Red SA, ul. Zwierzyniecka 17/4, 31-103 Kraków
b) via e-mail to the address: sklep@edred.pl

3. The application should specify as precisely as possible what the request concerns, i.e., in particular: a) which right the person submitting the application wishes to exercise (e.g., the right to receive a copy of the data, the right to data erasure, etc.);
b) which processing process the request concerns (e.g., use of a specific service, activity on the Website, receipt of a newsletter containing commercial information at a specific email address, etc.);
c) which processing purposes the request concerns (e.g., marketing purposes, analytical purposes, etc.).

4. If the Controller is unable to determine the content of the request or identify the person submitting the application based on the notification provided, they will ask the applicant for additional information.

5. A response to the notification will be provided within one month of its receipt. If it is necessary to extend this period, the Controller will inform the applicant of the reasons for such an extension.

6. The response will be provided to the email address from which the application was sent, and in the case of applications sent by post, by regular mail to the address indicated by the applicant, unless the content of the letter indicates a desire to receive feedback via email (in which case an email address must be provided).

Recipients of Personal Data

1. In connection with the provision of services, personal data will be disclosed to external entities, including in particular suppliers responsible for the operation of IT systems, entities such as payment operators, entities providing accounting, legal, audit, and consulting services, couriers (in connection with order fulfillment), and entities affiliated with the Controller.

2. Subject to the User's consent, their data may also be made available to other entities for their own purposes, including marketing purposes.

3. The Controller reserves the right to disclose selected information regarding the User to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.

Transfer of Personal Data outside the European Economic Area (EEA)

1. As a rule, Ed Red SA does not transfer your personal data outside the EEA. The transfer of personal data outside the EEA may only take place when necessary and with the assurance of an adequate level of protection.

2. The Controller always informs about the intention to transfer personal data outside the EEA at the stage of their collection.

Security of Personal Data

1. The Controller carries out ongoing risk analysis to ensure that the personal data processed by them is handled securely—ensuring primarily that only authorized persons have access to the data and only to the extent necessary due to the tasks they perform. The Controller ensures that all operations on personal data are recorded and performed only by authorized employees and associates.

2. The Controller takes all necessary actions to ensure that their subcontractors and other cooperating entities also guarantee the application of appropriate security measures in every instance where they process personal data on behalf of the Controller.

Contact Details

Controller's contact details: a) email address: sklep@edred.pl
b) correspondence address: Ed Red SA, ul. Zwierzyniecka 17/4, 31-103 Kraków

Policy Changes

The Controller verifies the provisions of this Policy on an ongoing basis and updates it if necessary.