Privacy policy

IPersonal data controller

The controller of personal data is WCE sp. z o.o., with its registered office at: ul. Humańska 8/3, 00-789 Warszawa, entered in the register of entrepreneurs kept by the District Court in Warsaw, XIII Commercial Division, under KRS number: 0000858080, NIP: 5213905934 (hereinafter: the “Owner”).

IIPurpose of processing personal data

1. The controller processes the User’s personal data for the purpose of:
   the proper performance of sales contracts concluded within the online shop via the website www.woomsklep.pl.
2. This means that these data are needed in particular to:
   a. register on the website;
   b. conclude a contract;
   c. make settlements;
   d. deliver the goods ordered by the User or perform services;
   e. enable the User to exercise all consumer rights (e.g. withdrawal from the contract, statutory warranty).
3. The User may also consent to receiving information about new products and promotions, as a result of which the controller will also process personal data for the purpose of sending the User commercial information concerning, among other things, new products or services, promotions or sales.
4. Personal data are also processed in order to fulfil legal obligations incumbent on the data controller and to perform tasks in the public interest, including tasks related to security and defence or the retention of tax records.
5. Personal data may also be processed for the purposes of direct marketing of products, securing and pursuing claims or defending against claims of the User or a third party, as well as marketing of third parties’ services and products or the controller’s own marketing other than direct marketing.
   

IIIType of data

1. The controller processes the following personal data, the provision of which is necessary in order to:
   a. register on the website:
   – first name and surname;
   – e-mail address;
   b. make purchases via the website:
   – first name and surname;
   – gender;
   – delivery address;
   – telephone number;
   – e-mail address;
   c. Data provided by the User optionally:
   – date of birth;
   – PESEL number (where an invoice is requested);
   – NIP number (where an invoice for a business is requested).
2. In the event of withdrawal from the contract or acceptance of a complaint, where the refund is made directly to the User’s bank account, we also process information concerning the bank account number in order to make the refund.
   

IVLegal basis for processing personal data

1. Personal data are processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88, hereinafter referred to as the “GDPR”.
2. The controller processes personal data only after first obtaining the User’s consent, given at the time of registration on the website or at the time of confirmation of a transaction made on the website.
3. Giving consent to the processing of personal data is entirely voluntary; however, failure to give it makes it impossible to register on the website and to make purchases via the website.

VRights of the User

1. The User may at any time request from the controller information on the scope of the processing of personal data.
2. The User may at any time request the correction or rectification of their personal data. The User may also do so themselves after logging in to their account.
3. The User may at any time withdraw their consent to the processing of their personal data without giving a reason. A request that data not be processed may concern a specific purpose of processing indicated by the User, e.g. withdrawal of consent to receive commercial information, or may concern all purposes of data processing. Withdrawal of consent for all purposes of processing will result in the User’s account being deleted from the website, together with all of the User’s personal data previously processed by the controller. Withdrawal of consent will not affect actions already performed.
4. The User may at any time request, without giving a reason, that the controller erase their data. A request for erasure of data will not affect actions performed to date. Erasure of data means the simultaneous deletion of the User’s account, together with all personal data stored and processed by the controller up to that time.
5. The User may at any time object to the processing of personal data, both with regard to all of the User’s personal data processed by the controller and only to a limited extent, e.g. as regards the processing of data for a specifically indicated purpose. An objection will not affect actions performed to date. Lodging an objection will result in the deletion of the User’s account, together with all personal data stored and processed by the controller up to that time.
6. The User may request the restriction of the processing of personal data, either for a specified period or without a time limit but to a specified extent, and the controller will be obliged to comply with such a request. This request will not affect actions performed to date.
7. The User may request that the controller transfer the User’s processed personal data to another entity. For this purpose, the User should send a written request to the controller, indicating to which entity (name, address) the User’s personal data are to be transferred and which specific data the User wishes the controller to transfer. Once the User has confirmed their wish, the controller will transfer the User’s personal data in electronic form to the indicated entity. Confirmation of the request by the User is necessary for the security of the User’s personal data and to ensure that the request comes from an authorised person.
8. The controller shall inform the User of the action taken before the expiry of one month from the receipt of one of the requests listed in the preceding points.

VIPersonal data retention period

1. As a rule, personal data are stored only for as long as is necessary to fulfil the contractual or statutory obligations for which they were collected. These data will be deleted immediately once their storage is no longer necessary for evidentiary purposes in accordance with civil law or in connection with a statutory obligation to retain data.
2. Information concerning the contract is stored for evidentiary purposes for a period of three years, starting from the end of the year in which the business relationship with the User ended. The data will be deleted after the expiry of the statutory limitation period for pursuing contractual claims.
3. Furthermore, the controller may retain archival information concerning concluded transactions, as its storage is related to claims available to the User, e.g. under the statutory warranty.
4. If no contract has been concluded between the User and the Owner, the User’s personal data are stored until the User’s account on the website is deleted. The account may be deleted as a result of a request made by the User, the withdrawal of consent to the processing of personal data or the lodging of an objection to the processing of such data.

VIIEntrusting data processing to other entities

1. The controller may entrust the processing of personal data to entities cooperating with the controller, to the extent necessary to carry out transactions, e.g. to prepare the ordered goods and deliver parcels or to transmit commercial information originating from the controller (the latter applies to Users who have consented to receiving commercial information).
2. Apart from the purposes indicated in this Privacy Policy, Users’ personal data will not in any way be made available to third parties or transferred to other entities for the purpose of sending marketing materials of those third parties.
3. The personal data of the website’s Users are not transferred outside the European Union.
4. This Privacy Policy complies with the provisions of Article 13(1) and (2) of the GDPR.

VIIICookies

1. The website uses cookies or similar technology (hereinafter collectively referred to as “cookies”) to collect information about the User’s access to the website (e.g. by means of a computer or smartphone) and about the User’s preferences. They are used, among other things, for advertising and statistical purposes and to adapt the website to the User’s individual needs.
2. Cookies are pieces of information containing a unique reference code which the website sends to the User’s device in order to store, and sometimes track, information concerning the device used. They usually do not make it possible to identify the User personally. Their main purpose is to tailor the website better to the User.
3. Some of the cookies present on the website are available only for the duration of a given browsing session and expire when the browser is closed. Other cookies are used to remember the User, who is then recognised upon returning to the website. Such cookies are stored for a longer period.
4. The cookies used on this website are:
   ecsi: 1 month, cck3: deleted when the browser is closed, __Secure_CASTGC: deleted when the browser is closed, has_js: deleted when the browser is closed.
5. All cookies present on the website are set by the controller.
6. All cookies used by this website comply with the applicable law of the European Union.
7. Most Users and some mobile browsers accept cookies automatically. If the User does not change the settings, cookies will be stored in the device’s memory.
8. The User may change their preferences regarding the acceptance of cookies or modify the browser so as to receive an appropriate notification each time a cookie is set. To change the cookie acceptance settings, the browser settings should be adjusted.
9. Please note that blocking or deleting cookies may prevent full use of the website.
10. Cookies will be used for necessary session management, including:
    a. Creating a special login session for the User of the website, so that the website remembers that the User is logged in and the User’s requests are delivered in an effective, secure and consistent manner;
    b. Recognising a User who has previously visited the website, which makes it possible to identify the number of unique users who have used the service and to ensure that the service has sufficient capacity for the number of new users;
    c. Recognising whether a person visiting the website is registered on the website;
    d. Recording information from the User’s device, including: cookies, the IP address and information about the browser used, in order to be able to diagnose problems, administer and track use of the website;
    e. Adapting elements of the graphic layout or the content of the website;
    f. Collecting statistical information on how the User uses the website, in order to be able to improve the website and determine which areas of the website are most popular with Users.