Privacy Policy

TABLE OF CONTENTS:

1. GENERAL PROVISIONS
2. BASES FOR DATA PROCESSING
3. PURPOSE, BASIS, PERIOD AND SCOPE OF DATA PROCESSING IN THE ONLINE STORE
4. DATA RECIPIENTS IN THE ONLINE STORE
5. PROFILING IN THE ONLINE STORE
6. RIGHTS OF THE DATA SUBJECT
7. COOKIES IN THE ONLINE STORE, OPERATIONAL DATA AND ANALYTICS
8. FINAL PROVISIONS

1. GENERAL PROVISIONS
1.1. This privacy policy of the Online Store is informational in nature, which means it is not a source of obligations for Service Recipients or Customers of the Online Store. The privacy policy primarily contains rules regarding the processing of personal data by the Administrator in the Online Store, including the bases, purposes, and scope of personal data processing, as well as the rights of the data subjects, and information on the use of cookies and analytical tools in the Online Store.
1.2. The administrator of personal data collected via the Online Store is FANECO spółka z ograniczoną odpowiedzialnością with its registered office in Poznań (registered office and correspondence address: ul. Aleksandra Fredry 1/16, 61-701 Poznań and the address for complaints and returns: OLE.PL Magazyn Gorlice, ul. Michalusa 1, 38-300 Gorlice), registered in the Register of Entrepreneurs of the National Court Register under number KRS: 0001190808; the registry court where the company’s documentation is kept: District Court Poznań - New Town and Wilda in Poznań, 8th Commercial Division of the National Court Register; NIP: 7781342896; REGON: 631265483 and email address: [email protected] - hereinafter referred to as the "Administrator" and simultaneously the Service Provider of the Online Store and Seller.
1.3. Personal data in the Online Store are processed by the Administrator in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as "GDPR" or "GDPR Regulation". The official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
1.4. Use of the Online Store, including making purchases, is voluntary. Similarly, providing personal data by the Service Recipient or Customer using the Online Store is voluntary, with two exceptions: (1) concluding contracts with the Administrator - failure to provide personal data necessary for concluding and performing the Sales Agreement or the Electronic Service Agreement with the Administrator, in cases and to the extent indicated on the Online Store’s website and in the Online Store Regulations and this privacy policy, results in the inability to conclude such an agreement. Providing personal data in this case is a contractual requirement, and if the data subject wishes to conclude such an agreement with the Administrator, they are obliged to provide the required data. The scope of data required to conclude the agreement is always indicated in advance on the Online Store’s website and in the Online Store Regulations; (2) statutory obligations of the Administrator - providing personal data is a statutory requirement arising from generally applicable laws imposing on the Administrator the obligation to process personal data (e.g., processing data for the purpose of keeping tax or accounting books), and failure to provide such data will prevent the Administrator from fulfilling these obligations.
1.5. The Administrator exercises particular care to protect the interests of the persons whose personal data are processed by him, and in particular is responsible for and ensures that the data collected are: (1) processed lawfully; (2) collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes; (3) factually correct and adequate in relation to the purposes for which they are processed; (4) stored in a form enabling identification of the data subjects no longer than necessary to achieve the processing purpose; and (5) processed in a manner ensuring appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, by appropriate technical or organizational measures.
1.6. Taking into account the nature, scope, context, and purposes of processing and the risk of violation of the rights or freedoms of natural persons with varying likelihood and severity of threat, the Administrator implements appropriate technical and organizational measures to ensure processing is in accordance with this regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator applies technical measures preventing unauthorized persons from acquiring and modifying personal data transmitted electronically.
1.7. All words, expressions, and acronyms appearing in this privacy policy and starting with a capital letter (e.g., Seller, Online Store, Electronic Service) should be understood according to their definition contained in the Online Store Regulations available on the Online Store’s website.

2. BASES FOR DATA PROCESSING
2.1. The Administrator is authorized to process personal data in cases where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specific purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
2.2. Processing of personal data by the Administrator requires the existence of at least one of the bases indicated in point 2.1 of the privacy policy. The specific bases for processing personal data of Service Recipients and Customers of the Online Store by the Administrator are indicated in the next point of the privacy policy – in relation to the given purpose of personal data processing by the Administrator.

3. PURPOSE, BASIS, PERIOD AND SCOPE OF DATA PROCESSING IN THE ONLINE STORE
3.1. Each time, the purpose, basis, period, scope, and recipients of personal data processed by the Administrator result from the actions taken by the given Service Recipient or Customer in the Online Store. For example, if a Customer decides to make a purchase in the Online Store and chooses personal pickup of the purchased Product instead of courier delivery, their personal data will be processed for the purpose of performing the concluded Sales Agreement but will not be shared with the carrier handling shipments on behalf of the Administrator.
3.2. The Administrator may process personal data in the Online Store for the following purposes, on the following bases, for the following periods, and to the following extent:

Purpose of data processing	Legal basis for processing and data retention period	Scope of processed data
Performance of the Sales Agreement or the Electronic Service Agreement or taking actions at the request of the data subject prior to concluding the above agreements	Article 6(1)(b) of the GDPR Regulation (performance of a contract) Data are stored for the period necessary to perform, terminate, or otherwise expire the concluded agreement.	Maximum scope: first and last name; email address; contact phone number; delivery address (street, house number, apartment number, postal code, city, country), residence/business/headquarters address (if different from delivery address) and bank account number. In the case of Service Recipients or Customers who are not consumers, the Administrator may additionally process the company name and tax identification number (NIP) of the Service Recipient or Customer. The given scope is maximum – for example, in the case of personal pickup, providing a delivery address is not necessary.
Direct marketing	Article 6(1)(f) of the GDPR Regulation (legitimate interest of the administrator) Data are stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the Administrator’s business activity. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years, and for sales agreements two years). The Administrator may not process data for direct marketing purposes if the data subject has effectively objected to such processing.	Email address
Marketing	Article 6(1)(a) of the GDPR Regulation (consent) Data are stored until the data subject withdraws consent for further processing for this purpose.	First name/company name, email address
Expression of opinion by the Customer about the concluded Sales Agreement	Article 6(1)(a) of the GDPR Regulation Data are stored until the data subject withdraws consent for further processing for this purpose.	Email address
Keeping tax records	Article 6(1)(c) of the GDPR Regulation in connection with Art. 86 § 1 of the Tax Ordinance Act of 17 January 2017 (Journal of Laws 2017, item 201) Data are stored for the period required by law mandating the Administrator to keep tax books (until the expiration of the tax liability limitation period, unless tax laws provide otherwise) or accounting books (5 years, counting from the beginning of the year following the financial year to which the data relate).	First and last name; residence/business/headquarters address (if different from delivery address), company name, and tax identification number (NIP) of the Service Recipient or Customer
Establishing, pursuing, or defending claims that the Administrator may raise or that may be raised against the Administrator	Article 6(1)(f) of the GDPR Regulation Data are stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the Administrator’s business activity. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years, and for sales agreements two years).	First and last name; contact phone number; email address; delivery address (street, house number, apartment number, postal code, city, country), residence/business/headquarters address (if different from delivery address). In the case of Service Recipients or Customers who are not consumers, the Administrator may additionally process the company name and tax identification number (NIP) of the Service Recipient or Customer.

4. DATA RECIPIENTS IN THE ONLINE STORE
4.1. For the proper functioning of the Online Store, including the execution of concluded Sales Agreements, it is necessary for the Administrator to use the services of external entities (such as software providers, couriers, or payment service providers). The Administrator uses only such data processors who provide sufficient guarantees of implementing appropriate technical and organizational measures so that processing meets the requirements of the GDPR Regulation and protects the rights of data subjects.
4.2. Data transfer by the Administrator does not occur in every case and not to all recipients or categories of recipients indicated in the privacy policy – the Administrator transfers data only when necessary to achieve the given purpose of personal data processing and only to the extent necessary to achieve it. For example, if a Customer uses personal pickup, their data will not be transferred to the carrier cooperating with the Administrator.
4.3. Personal data of Service Recipients and Customers of the Online Store may be transferred to the following recipients or categories of recipients:
4.3.1. carriers / freight forwarders / courier brokers - in the case of a Customer who uses postal or courier delivery in the Online Store, the Administrator provides the collected personal data of the Customer to the selected carrier, freight forwarder, or intermediary handling shipments on behalf of the Administrator to the extent necessary to deliver the Product to the Customer.
4.3.2. entities handling electronic or card payments - in the case of a Customer who uses electronic or card payment methods in the Online Store, the Administrator provides the collected personal data of the Customer to the selected entity handling such payments on behalf of the Administrator to the extent necessary to process the payment made by the Customer.
4.3.3. providers of survey systems - in the case of a Customer who has agreed to express an opinion about the concluded Sales Agreement, the Administrator provides the collected personal data of the Customer to the selected provider of survey systems for opinions on Sales Agreements concluded in the Online Store on behalf of the Administrator to the extent necessary for the Customer to express an opinion using the survey system.
4.3.4. providers of services supplying the Administrator with technical, IT, and organizational solutions enabling the Administrator to conduct business activities, including the Online Store and Electronic Services provided through it (in particular software providers for running the Online Store, email and hosting providers, and software providers for company management and technical support for the Administrator) - the Administrator provides the collected personal data of the Customer to the selected provider acting on its behalf only in cases and to the extent necessary to achieve the given purpose of data processing in accordance with this privacy policy.
4.3.5. providers of accounting, legal, and advisory services supporting the Administrator with accounting, legal, or advisory assistance (in particular accounting offices, law firms, or debt collection companies) - the Administrator provides the collected personal data of the Customer to the selected provider acting on its behalf only in cases and to the extent necessary to achieve the given purpose of data processing in accordance with this privacy policy.

5. PROFILING IN THE ONLINE STORE
5.1. The GDPR Regulation imposes on the Administrator the obligation to inform about automated decision-making, including profiling, referred to in Art. 22(1) and (4) of the GDPR Regulation, and – at least in these cases – essential information about the principles of their making, as well as about the significance and expected consequences of such processing for the data subject. Bearing this in mind, the Administrator provides in this point of the privacy policy information concerning possible profiling.
5.2. The Administrator may use profiling in the Online Store for direct marketing purposes, but decisions made on its basis by the Administrator do not concern concluding or refusing to conclude a Sales Agreement, or the possibility of using Electronic Services in the Online Store. The effect of using profiling in the Online Store may be, for example, granting a discount to a person, sending them a discount code, reminding about unfinished purchases, sending a Product proposal that may match the interests or preferences of the person, or offering better conditions compared to the standard offer of the Online Store. Despite profiling, the person freely decides whether to use the received discount or better conditions and make a purchase in the Online Store.
5.3. Profiling in the Online Store consists of automatic analysis or forecasting of a person’s behavior on the Online Store’s website, e.g., by adding a specific Product to the cart, browsing a specific Product page in the Online Store, or analyzing the purchase history in the Online Store. A condition for such profiling is that the Administrator has the personal data of the person to be able to send, for example, a discount code.
5.4. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

6. RIGHTS OF THE DATA SUBJECT
6.1. Right of access, rectification, restriction, erasure, or data portability - the data subject has the right to request from the Administrator access to their personal data, their rectification, erasure ("right to be forgotten"), or restriction of processing, and the right to object to processing, as well as the right to data portability. Detailed conditions for exercising these rights are specified in Articles 15-21 of the GDPR Regulation.
6.2. Right to withdraw consent at any time – a person whose data are processed by the Administrator based on consent (under Art. 6(1)(a) or Art. 9(2)(a) of the GDPR Regulation) has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
6.3. Right to lodge a complaint with a supervisory authority – a person whose data are processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the GDPR Regulation and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
6.4. Right to object - the data subject has the right to object at any time – for reasons related to their particular situation – to the processing of their personal data based on Art. 6(1)(e) (public interest or official authority) or (f) (legitimate interest of the administrator), including profiling based on these provisions. In such a case, the Administrator may no longer process these personal data unless they demonstrate compelling legitimate grounds for processing overriding the interests, rights, and freedoms of the data subject, or grounds for establishing, exercising, or defending legal claims.
6.5. Right to object regarding direct marketing - if personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling, to the extent that it is related to such direct marketing.
6.6. To exercise the rights mentioned in this point of the privacy policy, one can contact the Administrator by sending an appropriate message in writing or by email to the Administrator’s address indicated at the beginning of the privacy policy or by using the contact form available on the Online Store’s website.

7. COOKIES IN THE ONLINE STORE, OPERATIONAL DATA AND ANALYTICS
7.1. Cookies are small text files sent by the server and saved on the device of the person visiting the Online Store website (e.g., on the hard drive of a computer, laptop, or on the memory card of a smartphone – depending on the device used by the visitor). Detailed information about cookies and their history can be found, among others, here: http://pl.wikipedia.org/wiki/Ciasteczko.
7.2. The Administrator may process data contained in cookies during visitors’ use of the Online Store website for the following purposes:
7.2.1. identifying Service Recipients as logged into the Online Store and showing that they are logged in;
7.2.2. remembering Products added to the cart for placing an Order;
7.2.3. remembering data from completed Order Forms, surveys, or login data to the Online Store;
7.2.4. adjusting the content of the Online Store website to the individual preferences of the Service Recipient (e.g., regarding colors, font size, page layout) and optimizing the use of the Online Store pages;
7.2.5. conducting anonymous statistics showing how the Online Store website is used;
7.2.6. remarketing, i.e., studying the behavior characteristics of visitors to the Online Store through anonymous analysis of their actions (e.g., repeated visits to specific pages, keywords, etc.) to create their profile and deliver ads tailored to their predicted interests, also when they visit other websites in the advertising network of Google Inc. and Facebook Ireland Ltd.;
7.3. By default, most internet browsers available on the market accept cookies. Everyone can set the conditions for using cookies via their browser settings. This means that one can, for example, partially limit (e.g., temporarily) or completely disable the ability to save cookies – however, in the latter case, this may affect some functionalities of the Online Store (for example, it may be impossible to complete the Order process through the Order Form due to not remembering Products in the cart during subsequent steps of placing the Order).
7.4. Browser settings regarding cookies are important from the point of view of consent to the use of cookies by our Online Store – according to regulations, such consent may also be expressed through browser settings. If such consent is not given, the browser settings regarding cookies should be appropriately changed.
7.5. Detailed information on changing cookie settings and deleting them independently in the most popular internet browsers is available in the browser’s help section and on the following pages (just click the link):

• in Chrome browser
• in Firefox browser
• in Internet Explorer browser
• in Safari browser
• in Microsoft Edge browser

7.6. The Administrator may use Google Analytics and Universal Analytics services provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) in the Online Store. These services help the Administrator analyze traffic in the Online Store. The collected data are processed within these services in an anonymized manner (these are so-called operational data that prevent identification of the person) to generate statistics helpful in managing the Online Store. These data are aggregate and anonymous, i.e., they do not contain identifying features (personal data) of persons visiting the Online Store website. By using these services in the Online Store, the Administrator collects data such as sources and medium of visitors’ acquisition to the Online Store and their behavior on the Online Store website, information about devices and browsers used to visit the site, IP and domain, geographic data, demographic data (age, gender), and interests.

7.7. It is possible for a person to easily block sharing Google Analytics information about their activity on the Online Store website – for this purpose, a browser add-on provided by Google Inc. can be installed, available here: https://tools.google.com/dlpage/gaoptout?hl=pl.

7.8. In case of consent to the use of advertising cookies, analytics, or other similar technologies related to Google services, the user’s personal data and information collected via cookies and similar technologies, including online identifiers, device identifiers, information about user activity on the site, and preferences, may be collected, shared, and used by Google and our partners for ad personalization, i.e., displaying ads tailored to the user’s interests, as well as for measuring ad effectiveness and limiting the number of times the same ads are shown.

After giving consent, this data may be transferred to Google and processed by Google according to the principles described on the page about data use in Google business services: https://business.safety.google/privacy/. Additional information on how Google uses data from partner websites and apps is available at the indicated address.

Consent to the use of cookies and personal data for personalized advertising purposes is voluntary and can be withdrawn or changed by the user at any time using the cookie settings available on the website.

8. FINAL PROVISIONS
8.1. The Online Store may contain links to other websites. The Administrator encourages you to familiarize yourself with the privacy policy established there after visiting other sites. This privacy policy applies only to the Administrator's Online Store.