Privacy Policy

Privacy policy of the Ars Tattoo online store

This document defines the rules for the processing and protection of personal data of customers of the Online Store available at sklep@ars-beauty.pl.
The owner of the Online Store and the administrator of personal data of Customers - natural persons - and users to whom the data pertains is VERANO Szwedzicki S.K.A., ul. Styrska 20, 04-188 Warsaw; NIP: 525-289-48-38; REGON: 521179257; Tel. +48 22 509 69 80; sklep@arstattoo.pl hereinafter referred to as the Administrator and being the Seller at the same time.
Personal data collected by the Administrator via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repeal Directive 95/46 / EC (EU Official Journal L No. 119, p. 1) (general regulation on data protection, GDPR) and other currently applicable, i.e. for the entire period of processing certain data, the provisions of the law on the protection of personal data . Personal data means information about an identified or identifiable natural person (hereinafter referred to as Personal Data). An identifiable natural person is a person who can be directly or indirectly identified, in particular on the basis of an identifier such as name and surname, identification number, internet identifier, location data, one or more specific factors determining the physical, genetic, mental, economic, cultural or the social identity of a natural person.
The Administrator takes special care to respect the privacy of customers visiting its Online Store.

§ 1 Type of data processed, purposes and legal basis

The administrator collects information on natural persons performing legal transactions not directly related to their activities, natural persons conducting business or professional activity on their own behalf and natural persons representing legal persons or organizational units that are not legal persons, to whom the law grants legal capacity, conducting economic activity on their own behalf. or professional, hereinafter referred to as customers.
The purposes of processing Customers' Personal Data by the Administrator are in particular:
- account registration in the Online Store in order to create an individual account and manage this account. Legal basis - necessary for the performance of the contract for the provision of the Account service - art. 6 sec. 1 lit. b GDPR;
- placing an order in the Online Store in order to perform a sales contract. Legal basis - necessary for the performance of the sales contract - art. 6 sec. 1 lit. b GDPR;
- subscription to the Newsletter, in order to perform the contract, the subject of which is the service provided electronically. Legal basis - consent of the data subject to perform the contract for the provision of the Newsletter service - art. 6 sec. 1 lit. a GDPR.
When registering an account for the Newsletter service in the Online Store, the Customer provides the following data:
- e-mail adress.
When placing an order in the Online Store, the Customer provides the following data:
- e-mail adress;
- address data: zip code and city, country, street, house / flat number;
- first name and last name;
- phone number.
Entrepreneurs provide the above data and additionally:
- Entrepreneurs' company name;
- number TIN.
When using the Newsletter service, the Customer provides the following data:
- e-mail adress;
- phone number.
When using the Online Store, additional information may also be downloaded, including: the IP address assigned to the Customer's computer or the external IP address of the Internet provider, domain, browser type, access time, type of operating system.
Navigational data may also be collected from customers, including information about links and references that they decide to click or other activities performed in our Online Store. Legal basis - legitimate interest - art. 6 sec. 1 lit. f GDPR, enabling better use of services provided electronically.
In order to determine, investigate and enforce claims, some personal data provided by the Customer may also be processed as part of using the functionality, including: name, surname, data on the use of services, if the claims result from the manner in which the Customer uses the services, other data necessary to prove the existence of the claim, including the extent of the damage suffered. Legal basis - legitimate interest - art. 6 sec. 1 lit. f GDPR, consisting in the determination, investigation and enforcement of claims and defense against claims in proceedings before courts and other state authorities.
Personal data collected by the Administrator are provided to him voluntarily in connection with concluded sales contracts or the provision of services via the Online Store, with the proviso that failure to provide the data specified in the forms in the Registration process prevents Registration and setting up a Customer Account, and in the event of submitting orders without registering a Customer Account, it will not be possible to place and execute the order.

§ 2 Who can we transfer your data to and how long is it stored

The catalog of recipients of Personal Data processed by the Administrator results primarily from the scope of services used by the Customer. The Customer's personal data is provided to service providers used by the Administrator when running the Online Store. The Administrator's service providers to whom personal data are transferred, depending on contractual arrangements and circumstances, are subject to the Administrator's instructions as to the purposes and methods of processing this data - processors - or independently determine the purposes and methods of their processing - administrators.
- Processing entities - the Administrator uses suppliers who process personal data only at the Administrator's request, and these include, among others, hosting service providers or ICT services, accounting services, providing marketing systems, systems for analyzing traffic in the Online Store, systems for analyzing the effectiveness of marketing campaigns , companies carrying out marketing campaigns, software servicing companies.
- Administrators - The administrator also uses suppliers who do not act solely on his command and set the goals and methods of using the clients' personal data themselves. They provide electronic payment services and banking services.
Location - Service providers are based in Poland and other countries of the European Economic Area (EEA).
Customers' personal data is stored:
- If the basis for the processing of personal data is the consent provided, the Customer's personal data is processed by the Administrator until the consent is revoked. After its cancellation, personal data is stored for a period corresponding to the period of limitation of claims that may be raised by the Administrator and which may be raised against him. Unless a specific provision provides otherwise, the limitation period is 10 years, and for claims for periodic benefits and claims related to running a business, it is 3 years.
- If the basis for data processing is the performance of the contract, then the Customer's personal data is processed by the Administrator as long as it is necessary to perform the contract. After this time, personal data is processed for a period corresponding to the period of limitation of claims. Unless specific provisions provide otherwise, the limitation period is 10 years, and for claims for periodic benefits and claims related to running a business, it is 3 years.
In the event of a purchase in the Online Store, personal data may be transferred, depending on the Customer's choice, to the following entities in order to deliver the products ordered in the Online Store:
- Poczta Polska S.A. based in Warsaw;
- UPS Polska Sp. zoo. based in Warsaw;
- InPost sp. z o.o. based in Krakow.
Depending on the selected form of payment, the Customer's personal data is transferred to the extent necessary for the payment to be made to the company:
- Poczta Polska S.A. based in Warsaw;
- UPS Polska Sp. zoo. based in Warsaw;
- mBank S.A. - with its registered office and main address of business in Warsaw;
- Bank Millennium S.A. based in Warsaw;
- Bank Handlowy w Warszawie S.A. based in Warsaw;
- Dotpay S.A. based in Krakow;
- PayU S.A. based in Poznan;
- PayPal (Europe) S.à r.l. et Cie, S.C.A.
Personal navigation data may be used to provide customers with better service, analyze statistical data and adapt the Online Store to customer preferences and to administer the Online Store.
If the Customer chooses the Newsletter subscription service, the Administrator will send information to his e-mail address or SMS messages to his mobile phone, containing commercial information about promotions, discounts, new products available in his Online Store.
In the event of a request being made to the Administrator, the data shall be made available, personal data shall be made available to authorized state authorities, in particular to organizational units of the prosecutor's office, the Police, the President of the Office for Personal Data Protection, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.

§ 3 Cookies and IP addresses

The cookies used by the Administrator are primarily used to optimize the service of visitors when using the Online Store and provide the opportunity to develop visit statistics for the presented products in the Online Store. These files are saved by the Administrator on the end device of the person visiting the Online Store, if the web browser allows it. Cookies usually contain the name of the domain they come from, their "expiry time" and an individual, randomly selected number identifying these files.
Two types of cookies are used:
- Session cookies - after the browser session ends or the computer is turned off, the saved information is removed from the device's memory. The mechanism of session cookies does not allow the collection of any personal data and any confidential information from clients' computers;
- Persistent cookies - they are stored in the memory of the Customer's end device and remain until they are deleted or expired. The mechanism of persistent cookies does not allow the collection of any personal data and any confidential information from the clients' computer.
The administrator uses his own cookies for the purpose of:
- authentication of the Customer in the Online Store and providing him with a Customer session after logging in to the Customer Account;
- anonymous statistics and analyzes that help to understand how customers use the Online Store.
The administrator uses external cookies for the purpose of:
- collecting static data via Google Analytics analytical tools - external cookie administrator: Google Inc. based in the USA;
- presenting advertisements from the Google AdSense website - external cookie administrator: Google Inc. based in the USA;
- promoting the Online Store on Facebook.com - external cookie administrator: Facebook Inc based in the USA or Facebook Ireland based in Ireland;
- promoting the Online Store on Instagram.com - external cookie administrator: Facebook Inc based in the USA or Facebook Ireland based in Ireland;
- sending e-mails from Redlink - external cookie administrator: Vercom S.A.based in Poznan.
The cookie file mechanism is completely safe for the computers of the Online Store Customers. The customer may independently and at any time change the settings for cookies, specifying the conditions for their storage and access to their device via cookies. The changes to the settings in question can be made by the Customer using the web browser settings. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the web browser settings or to inform about each posting of Cookies on the Customer's Device. Detailed information on the possibilities and methods of handling cookies is available in the web browser settings. Blocking cookies may affect some of the functionalities available in the Online Store.
The administrator may collect IP addresses of clients. The IP address is the number assigned to the computer of the visitor of the Online Store by the Internet Service Provider. The IP address is used by the Administrator when diagnosing technical problems with the server, creating statistical analyzes and improving the Online Store.
The Online Store contains links and links to other websites on the Internet and the Administrator is not responsible for the privacy protection rules applicable on these websites.

§ 4 The rights and obligations of the person to whom the Personal Data relates

The right to withdraw consent - the legal basis of art. 7 sec. 3 GDPR.
- The customer has the right to withdraw any consent given to the Administrator.
- Withdrawal of consent takes effect from the moment the consent is withdrawn.
- Withdrawal of consent does not substantially affect the processing performed by the Administrator in accordance with the law before its withdrawal.
- Withdrawal of consent does not cause any negative consequences for the Customer of the Online Store, however, it may prevent further use of services or functionalities that can only be provided with consent.
The right to object to data processing - the legal basis of art. 21 GDPR.
- The customer has the right to object at any time to the processing of his personal data, including profiling, if the Administrator processes his data based on a legitimate interest, e.g. marketing of products and services, keeping statistics on the use of individual functionalities of the Online Store and facilitating the use of Online Store and customer satisfaction survey.
- Resignation from receiving commercial messages regarding products or services, sent via e-mail, will be the Customer's objection to the processing of his personal data, including profiling for these purposes.
- If the Customer's objection turns out to be well-founded and the Administrator has no other legal basis to process personal data, the Customer's data will be deleted, against the processing of which the Customer has objected.
The right to delete data, the right to be forgotten - the legal basis of art. 17 GDPR.
- The customer has the right to send a request to delete all or some personal data.
- The customer has the right to request the deletion of personal data if:
  - personal data are no longer necessary for the purposes for which they were collected or processed;
  - The customer withdrew consent to the extent to which the customer's data was processed based on his consent;
  - he objected to the use of his data for commercial or marketing purposes;
  - personal data is processed unlawfully;
  - personal data must be removed in order to comply with the legal obligation provided for in the Union law or the law of the Member State to which the Administrator is subject;
  - the personal data has been collected in relation to the offering of information society services.
- Despite the request to delete personal data, in connection with the objection or withdrawal of consent, the Administrator may retain some personal data to the extent that processing is necessary to establish, assert or defend claims, as well as to fulfill the legal obligation requiring their processing on under Union law or the law of the Member State to which it is subject.
The right to limit data processing - the legal basis of art. 18 GDPR.
- The Online Store customer has the right to demand that the processing of his data be restricted. Submitting such a request prevents the use of certain functionalities or services, the use of which will involve the processing of data covered by this request.
- The Online Store customer has the right to request the restriction of the use of personal data in the following situations:
  - if their personal data is incompatible, the Administrator limits their use for the time needed to verify the correctness of this data;
  - when the processing of data is unlawful and the Customer does not request their deletion, but restriction of their use;
  - when the Customer's personal data are no longer necessary for the purposes for which they were collected or used, but they are needed by the Customer to establish, assert or defend claims;
  - when he objected to the use of his data, then the restriction takes place for the time needed to consider whether, due to the special situation, the protection of the interests, rights and freedoms of the client outweighs the interests that the Administrator performs when processing the client's data.
The right to access data, the legal basis of art. 15 GDPR.
- The Customer has the right to obtain confirmation from the Administrator whether he processes his personal data, and if so, the Customer has the right to:
  - get access to your personal data;
  - obtain information about the purposes of processing and recipients or categories of recipients of this data, the planned period of data storage or the criteria for determining this period, about the rights of the Customer under the GDPR and the right to lodge a complaint with the supervisory authority, about the data source, about automated decision-making, this about profiling and the security measures used in connection with the transfer of such data outside the European Union;
  - obtain a copy of your personal data.
The right to rectify data - the legal basis of art. 16 GDPR.
- The customer has the right to request the Administrator to immediately correct his personal data that is incorrect. Taking into account the purposes of processing, the Customer has the right to request supplementing incomplete personal data, including by submitting an additional statement by sending an e-mail to the Administrator's e-mail address.
The right to data portability - the legal basis of art. 20 GDPR.
- The customer has the right to receive his data, which he provided to the Administrator, and then send it to another personal data administrator of his choice. The Online Store customer also has the right to request that the indicated personal data be sent by the Administrator directly to such an administrator, if technically possible. In this situation, the Administrator will send such Customer data in the CSV file format, which is a commonly used format.
If the Customer requests the fulfillment of the above-mentioned rights, the Administrator has the right to fulfill them or refuse him, and he will do so immediately.
The customer has the right to submit complaints, inquiries and requests to the Administrator regarding the processing of his personal data and the implementation of his rights.
The customer has the right to request the Administrator to provide copies of standard contractual clauses by sending an inquiry to the Administrator's e-mail address.
The customer has the right to lodge a complaint with the President of the Personal Data Protection Office regarding the violation of his rights to the protection of personal data or other rights granted under the GDPR.

§ 5 Personal Data Protection

The Administrator declares that he makes every effort to provide Customers with a high level of security in the use of the Online Store and for this purpose:
- uses technical and organizational measures required by law, in particular with regard to the security of Personal Data processing;
- applies measures ensuring the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
- the ability to quickly restore the availability and access to Personal Data in the event of a physical or technical incident;
- provides customers of the Online Store with a secure and encrypted connection when sending personal data and when logging in to the Customer Account, using an SSL certificate.
All events affecting the security of the transmission of information and personal data, including the suspicion of sharing files containing viruses, should be reported to the Administrator via e-mail to the following e-mail address: sklep@ars-beauty.pl.

§ 6 Final provisions

In matters not regulated in the Privacy Policy, the provisions of law regarding the processing of Personal Data, including the GDPR, shall apply.
The current version of the Privacy Policy is effective from May 25, 2018.