Woodeco Privacy Policy

Acting in the interest of the security of your personal data, based on Articles 13 and 14, paragraphs 1 and 2 of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, as amended), hereinafter also referred to as "GDPR", we hereby present information and principles related to the processing of your personal data by Woodeco Limited Liability Company based in Wrocław.

§ 1 Personal Data Administrator

1. The Administrator of your Personal Data is Woodeco Limited Liability Company based in Wrocław, ul. Strzegomska 42AB, 53-611 Wrocław, entered into the Register of Entrepreneurs of the National Court Register by the District Court for Wrocław-Fabryczna in Wrocław, VI Commercial Division of the National Court Register under the number: 0000247423, NIP: 719-150-39-73, REGON: 200052769, hereinafter referred to as "Administrator" or equivalently "Woodeco."
2. For matters related to the processing of personal data (hereinafter: "PD") you can obtain information at the address: Woodeco Sp. z o.o., ul. Strzegomska 42 AB, 53-611 Wrocław or by email: rodo@woodeco.eu.
3. The Administrator processes personal data of natural persons (consumers), data concerning natural persons conducting business or professional activity on their own behalf, and natural persons representing legal entities or organizational units not being legal entities, to which the law grants legal capacity, conducting business or professional activity on their own behalf, hereinafter referred to as "Clients" or equivalently as "Users."

§ 2 Principles of Personal Data Processing

1. The Administrator, when processing personal data, adheres to the following principles of personal data protection:
   1. Principle of lawfulness, fairness, and transparency of data processing, according to which data is processed by the Administrator lawfully, fairly, and in a transparent manner for the data subject;
   2. Principle of purpose limitation of data processing – data is collected by the Administrator in a manner consistent with the purposes of their processing.
   3. Principle of data minimization – the Administrator processes such an amount of data that is adequate, relevant, and limited to what is necessary for the purposes for which they are processed.
   4. Principle of accuracy of processed data – the Administrator processes only accurate data and updates it if necessary. The Administrator takes all reasonable steps to ensure that personal data that is inaccurate in light of the purposes for which it is processed is promptly deleted or rectified.
   5. Principle of storage limitation and purposes for which data may be stored – the Administrator stores data in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data is processed. The Administrator may store personal data for a longer period if it is stored for statistical purposes. The Administrator will simultaneously implement appropriate technical and organizational measures to protect the rights and freedoms of the individuals to whom the data relates.
   6. Principle of ensuring data processing in an integral and confidential manner – the Administrator processes data in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures.
   7. Principle of accountability – the Administrator is responsible for adhering to all the principles of personal data processing mentioned in letters a) – f) above and is able to demonstrate their compliance.
2. The Administrator implements appropriate technical and organizational measures that ensure the highest level of security for the personal data processed by him, according to the principles mentioned above.

§ 3 Purpose of processing, legal basis for processing, duration of storage and processing

§ 4 Type and Categories of Personal Data Processing

1. The Administrator processes the following personal data:
   1. in the case of creating an online store customer account or a user account on a shopping platform or communication platform, Users provide the following personal data:
      • first and last name,
      • email address,
      • address data, including city and postal code, street, house number, and apartment number,
      • phone number,
      • VAT number (in the case of entrepreneurs and legal entities).
      The password for the Customer Account on the online store or user platform is set independently by the User. The User has the right to change the password at any time.
   2. in the case of placing an order in the online store or on the shopping platform, the User provides the following personal data:
      • first and last name,
      • email address,
      • address data, including city and postal code, street, house number, and apartment number,
      • phone number,
      • VAT number (in the case of entrepreneurs and legal entities),
      • company (in the case of entrepreneurs and legal entities).
      The password for the Customer Account on the online store is set independently by the User. The User has the right to change the password at any time.
   3. in the case of subscribing to the Administrator's product Newsletter, the User provides the following personal data:
      • user's email address,
   4. in the case of providing data via the contact form, the User provides the following personal data:
      • first and last name,
      • email address,
      • phone number,
      • address data (optional).
2. In connection with the use of the website, online store, shopping platform, or communication platform, Woodeco Administrator may process the following information, i.e., the IP address of the User's computer or Internet provider, browser type, access time, navigation data, location data, browser type, operating system type, payment transaction history, website visit history, user behavioral data on the website.

§ 5 Source of Personal Data

The processed personal data is obtained by the Administrator:

1. directly from customers/users,
2. directly from customers/users,
   1. Central Registration and Information on Business (CEIDG),
   2. Central Information of the National Court Register (KRS),
   3. Internet.

§ 6 Recipients of Personal Data

1. The recipients of your personal data will be:
   1. state authorities or other entities authorized by law,
   2. entities supporting the Administrator in its activities on its behalf, in particular: external IT system providers supporting the activity, as well as running the online store, shopping platform, or communication platform, carriers and postal operators, including Poczta Polska S.A., couriers delivering on behalf of the Administrator, online sales platforms,
   3. domain, hosting, and email providers,
   4. banks in case of the need to conduct settlements,
   5. in the case of legal proceedings, claims enforcement – law firms or debt collection companies.
2. The entrustment of personal data processing may occur only to such entities that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure that processing meets the requirements of GDPR and protects the rights of the data subjects.
3. The Administrator applies implemented rules for selecting and verifying data processing entities on behalf of Woodeco developed to ensure that processors provide guarantees of implementing appropriate organizational and technical measures to ensure security, the realization of individual rights, and other data protection obligations.

§ 7 Exercise of Rights of Data Subjects

1. Woodeco exercises the rights of data subjects by introducing procedural guarantees for the protection of the rights and freedoms of personal data subjects. According to the content of Articles 12 - 23 of GDPR, you have the right to:
   1. access your data and receive a copy of it,
   2. rectify (correct) your personal data if it is incorrect,
   3. restrict the processing of personal data,
   4. delete personal data,
   5. file a complaint with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw), if you believe that the processing of your personal data violates GDPR regulations,
   6. withdraw consent to the processing of personal data if the basis for data processing was consent,
   7. object to data processing in cases specified in Articles 21-22 of GDPR.
2. [Right of Access to PD] Based on Article 15 of GDPR, the User has the right to obtain from the Administrator confirmation as to whether personal data is being processed, and if so, the User has the right to:
   1. access their personal data,
   2. obtain information about the purposes of processing, categories of processed personal data, recipients or categories of recipients of this data, the planned period of storage of User data or the criteria for determining this period (when determining the planned period of data processing is not possible), the rights available to the User under GDPR, and the right to file a complaint with the supervisory authority, the source of this data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of this data outside the European Union;
   3. obtain a copy of their personal data.
3. [Right to Obtain a Copy of PD] Upon the User's request, the Administrator issues a copy of the data concerning them and records the fact of issuing the first data copy. The Administrator introduces and maintains a price list for data copies, according to which fees are charged for subsequent data copies. The price of data copies is calculated based on the estimated unit cost of handling the request for issuing data copies.
4. [Right to Rectify Incorrect PD] The Administrator rectifies incorrect data upon the request of the data subject. The Administrator has the right to refuse to rectify the data unless the data subject reasonably demonstrates the inaccuracies of the data they request to be rectified.
5. [Right to Erase PD] Upon the request of the data subject, the Administrator deletes PD in the following cases:
   1. the data is no longer necessary for the purposes for which it was collected or processed for other purposes,
   2. the data subject has withdrawn consent to their processing, and the Administrator has no other legal basis for processing this data,
   3. the data subject has effectively objected to the processing of this data,
   4. personal data was processed unlawfully,
   5. the necessity to delete personal data arises from a legal obligation,
   6. the request concerns data of a child collected based on consent for the provision of information society services offered directly to the child.
6. The Administrator fulfills requests for data deletion in a way that ensures effective realization of this right while respecting all data protection principles, including security, and has an established method of verifying whether exceptions mentioned in Article 17.3 of GDPR do not apply.
7. If the data to be deleted was made public by the Administrator, the Administrator takes reasonable actions, including technical measures, to inform other administrators and entities processing this personal data about the need to delete the data and access to it.
8. The Administrator refuses to fulfill the right to delete personal data to the extent that processing is necessary:
   1. to exercise the right to freedom of expression and information;
   2. to comply with a legal obligation requiring processing under Union law or the law of a Member State to which the Administrator is subject, or to perform a task carried out in the public interest or in the exercise of official authority vested in the Administrator;
   3. to establish, exercise, or defend legal claims.
9. [Right to Restrict Processing of PD] The Administrator restricts data processing upon the request of the data subject when:
   1. the person contests the accuracy of personal data – for a period allowing verification of their accuracy,
   2. processing is unlawful, and the data subject opposes the deletion of personal data, requesting instead the restriction of their use,
   3. the Administrator no longer needs personal data, but they are needed by the data subject to establish, exercise, or defend legal claims,
   4. the data subject has objected to processing for reasons related to their particular situation – until it is determined whether the Administrator has legitimate grounds overriding the grounds for objection.
10. During the restriction of processing, the Administrator stores the data but does not process it (does not use or transfer it) without the consent of the data subject unless for establishing, exercising, or defending legal claims, or for protecting the rights of another natural or legal person, or for important reasons of public interest.
11. The Administrator informs about the rectification or deletion of personal data or restriction of processing carried out in accordance with Article 16, Article 17.1, and Article 18 of GDPR, each recipient to whom personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The Administrator informs the data subject about these recipients if the data subject requests it.
12. [Right to Data Portability] Upon the request of the data subject, the Administrator issues in a structured, commonly used, machine-readable format or transfers to another entity, if possible, the data concerning this person, which they provided to the Administrator, processed based on their consent or for the conclusion or performance of a contract with them, in the Administrator's IT systems.
13. [Right to Object to Data Processing] The User has the right to object at any time – for reasons related to their particular situation – to the processing of their personal data, including profiling, if the Administrator processes their data based on a legitimate interest, e.g., marketing of products and services, sending commercial information electronically, including newsletters, conducting statistics on the use of individual functionalities, including the online store, shopping platform, or communication platform.
14. Resignation in the form of an email from receiving marketing communications regarding products or services will be considered as the User's objection to the processing of their personal data, including profiling for these purposes.
15. If the User's objection is justified, and the Administrator does not have another legal basis for processing personal data, the User's personal data against which the objection was raised will be deleted and will not be processed for this purpose.
16. In the event of the User exercising the rights mentioned in this paragraph, Woodeco fulfills the request or refuses to fulfill it immediately, but no later than within one month of receiving it. However, if – due to the complex nature of the request or the number of requests – Woodeco cannot fulfill the request within a month, it will fulfill it within the next two months, informing the User in advance within a month of receiving the request – about the intended extension of the deadline and its reasons.
17. [Right to File a Complaint with the Supervisory Authority] The User has the right to file a complaint with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw), if, in their opinion, the Administrator violates their rights regarding personal data protection or other rights granted under GDPR.

§ 8 Right to Withdraw Consent to Data Processing in Connection with Direct Marketing and Profiling

1. Regarding your personal data processed based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing carried out based on consent before its withdrawal (including primarily for direct marketing purposes, sending newsletters, presenting commercial information, and profiling).
2. The right to withdraw consent is available to you at any time, but the withdrawal of consent takes effect from the moment of withdrawal.
3. Withdrawal of consent occurs by submitting a statement of withdrawal of consent, sent to the Administrator's address in written or electronic form, provided in § 1 of this Woodeco Privacy Policy. Withdrawal of consent can also occur by unchecking the appropriate selection buttons (so-called "checkboxes") available on the websites of services operated by Woodeco.
4. Withdrawal of consent does not affect the processing carried out by the Administrator in accordance with the law before submitting the statement of its withdrawal.
5. Submitting a statement of withdrawal of consent does not entail any negative legal consequences for Users, but it may prevent further use of certain services or functionalities that the Administrator can provide only with consent.

§ 9 Information on the Obligation to Provide Data

1. Providing data is necessary for the conclusion and settlement of contracts and for the Administrator to comply with legal requirements, and this applies to the following situations:
   1. conclusion and performance of contracts with customers/contractors,
   2. consideration of complaints submitted by customers (under warranty and guarantee) and complaints,
   3. claims enforcement by the Administrator or defense against legal claims directed against the Administrator,
   4. storage of documents containing personal data (contracts, invoices) for accounting purposes.
2. In other cases (in particular for processing data for marketing purposes), providing data is voluntary, although the Administrator indicates that failure to provide certain data in the registration process and creating a Customer Account will prevent registration and creation of a Customer Account, and in the case of placing an order without registering a Customer Account, it will prevent the submission and fulfillment of the User's order.

§ 10 Profiling

1. Woodeco may conduct profiling within the meaning of Article 4 point 4) of GDPR, i.e., use a form of automated processing of your personal data, involving the use of this data to evaluate certain personal factors of a natural person interested in Woodeco products. In other words, Woodeco adjusts the content of services and marketing communication directed to users to their preferences.
2. In connection with profiling, the data Administrator has implemented appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject, including at least the right to obtain human intervention from the Administrator, to express their position, and to contest the decision.
3. Decisions involving the presentation of a specific commercial offer by the Administrator are made based on the evaluation of certain information about Woodeco Customers, including based on your payment transaction history, website visit history, location data, user behavioral data.
4. Profiling is conducted for the Administrator's marketing purposes (legitimate interest of the Administrator).
5. At any time, you have the right to object to the processing of personal data in connection with profiling for marketing purposes. Objections should be reported to the Data Administrator in writing to the correspondence address indicated in § 1 or by email at: rodo@woodeco.eu.

§ 11 Transfer of Personal Data Outside the EEA

1. Your personal data may be transferred outside the European Economic Area (EEA):
   1. subject to appropriate safeguards;
   2. to countries such as Belarus, Russia, Ukraine, Serbia, the United Kingdom in connection with the sale or delivery of goods by the Administrator. Due to the lack of recognition of these countries by the European Commission as providing an adequate level of personal data protection, transferring data to these countries involves greater risk.
2. The transfer of personal data outside the EEA is based on:
   1. Article 46(1)(b) of GDPR, which allows in such a situation the transfer of personal data to a third country or international organization only when appropriate safeguards are provided, and on condition that enforceable rights of data subjects and effective legal remedies are available;
   2. Article 49(1)(b) of GDPR, which allows in such a situation the transfer of personal data provided that it is necessary for the performance of a contract between the data subject and the Administrator, or based on
   3. Article 49(1)(c) of GDPR, which allows the transfer of personal data if it is necessary for the performance of a contract concluded in the interest of the data subject.

§ 12 Cookie Policy

1. To tailor the sale of individual products to the individual needs and preferences of Customers, information is collected in the form of so-called cookies. Cookies are IT data, including text files, which are stored on the user's end device and are intended for using the website's pages.
2. Cookies are used to identify the software used by the website user and to optimize the functioning and security of the website. Cookies contain domain data from which they originate, specify the time of their storage on the user's computer, and have an assigned number.
3. The entity placing cookies on the user's end device and accessing them is the website Administrator.
4. On our website, we use two types of cookies:
   1. session cookies – temporary files stored on the user's end device until logging out, leaving the website,
   2. persistent cookies – stored on the user's end device for the time specified in the cookie parameters or until they are deleted by the user.
5. Detailed information on the possibilities and methods of handling cookies and setting the mechanism for handling them by the user's software is available in the settings of the user's software (web browser).
6. The user has the ability to limit the use of cookies, but this limitation may affect the functionality and availability of some features contained on the website's pages.
7. To tailor the sale of individual products to the individual needs and preferences of Customers, information is collected in the form of so-called cookies.
   1. User activity is monitored anonymously. If the user provides their data in one of the forms, HubSpot will associate their previous views of individual subpages based on the tracking cookie.
   2. It is possible to delete cookies, which means that the user will be treated as a new user in such a situation and will be assigned a new cookie.
   3. HubSpot will assign page views to the user if the user clicks a link in an email that directs to a page with the installed HubSpot tracking code.

§ 13 Changes to the Privacy Policy

1. This Privacy Policy is effective from July 1, 2024.
2. The Administrator reserves the right to change the Privacy Policy, which may be influenced by the development of internet technology or possible changes in data protection law and the development of our website.
3. We will inform about any changes to the Privacy Policy in a visible and understandable manner on the websites operated by Woodeco.