1. Data controller
The controller within the meaning of Regulation (EU) 2016/679 (GDPR) is [to be completed by the shop owner], NIP [to be completed by the shop owner], [to be completed by the shop owner].
For data protection matters: [to be completed by the shop owner].
2. Data we process
Name, phone number, email address, delivery address or parcel locker number, the contents and status of your order, your loyalty point history and the marketing consents you have given.
Account passwords are stored only as a cryptographic hash (scrypt with a unique salt) and cannot be read back.
Payment data is processed by the payment provider. The shop does not store full card numbers.
3. Purposes and legal bases
Concluding and performing the sales contract, running your account and the MONÉLY Circle programme — Article 6(1)(b) GDPR.
Meeting legal obligations, in particular tax and accounting obligations, and handling complaints and withdrawals — Article 6(1)(c) GDPR.
Preventing abuse, keeping the service secure and establishing or defending legal claims as the controller's legitimate interest — Article 6(1)(f) GDPR.
Direct marketing, the newsletter, and cookie-based analytics and advertising — Article 6(1)(a) GDPR, on the basis of separate consent which may be withdrawn at any time.
4. Recipients of the data
Postal and courier operators handling delivery, the payment provider, the hosting and email provider, the accounting office, and — only after consent — providers of analytics and advertising tools.
Data is shared only to the extent necessary for the service concerned. The controller does not sell personal data.
5. Transfers outside the European Economic Area
Where the use of analytics or advertising tools involves a transfer outside the EEA, it takes place on the basis of standard contractual clauses approved by the European Commission or another mechanism provided for in Chapter V of the GDPR.
6. Retention
Account data is kept until you delete the account or the purpose of processing ends.
Order data is kept for the period required by tax and accounting law and for as long as claims may be brought.
Data processed on the basis of consent is kept until that consent is withdrawn.
7. Your rights
You have the right to access your data, to have it rectified or erased, to restrict processing, to data portability, and to object to processing based on legitimate interest.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
8. Cookies
Necessary cookies support secure sign-in to your account and to the admin panel, and remember the language you chose. The shop cannot work properly without them.
The contents of your cart and your favourites are stored locally in your browser and are not sent to the server.
Analytics and advertising tools are loaded only after you allow all cookies in the privacy notice. You can change that choice at any time by clearing the site data in your browser.
9. Providing data is voluntary
Providing data is voluntary but necessary to conclude and perform the sales contract and to run an account. Without it, an order cannot be fulfilled.