PRIVACY POLICY

VIDEOSPACE.Agency ONLINE SHOP

 

CONTENTS:

1. GENERAL PROVISIONS

2. LEGAL BASIS FOR DATA PROCESSING

3. PURPOSE, LEGAL BASIS AND DURATION OF DATA PROCESSING IN THE ONLINE SHOP

4. RECIPIENTS OF DATA IN THE ONLINE SHOP

5. PROFILING ON THE ONLINE SHOP

6. RIGHTS OF THE DATA SUBJECT

7. COOKIES IN THE ONLINE SHOP AND ANALYTICS

8. FINAL PROVISIONS

 

1. GENERAL PROVISIONS

1.1. This Online Shop’s privacy policy is for information purposes only, which means that it does not impose any obligations on Users or Customers of the Online Shop. The privacy policy primarily sets out the rules governing the processing of personal data by the Controller on the Online Shop, including the legal basis, purposes and duration of such processing, as well as the rights of data subjects, and provides information on the use of cookies and analytical tools on the Online Shop.

1.2. The data controller for personal data collected via the Online Shop is VIDEOSPACE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Poznań (registered office and address for service: ul. Strzelecka 29A/39, 61-846 Poznań); entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000752496; the registry court where the company’s records are held: Poznań – Nowe Miasto and Wilda District Court in Poznań, 9th Commercial Division of the National Court Register; share capital: 5,000 PLN; Tax Identification Number (NIP): 7861718889; Statistical Identification Number (REGON): 381535071, email address: shop@nullvideospace.agency and contact telephone number: +48 61 250 40 29 – hereinafter referred to as the “Controller” and acting simultaneously as the Online Shop Service Provider and the Seller.

1.3. Personal data in the Online Shop is processed by the Controller in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as the “GDPR” or the “GDPR Regulation”. Official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679

1.4. Use of the Online Shop, including making purchases, is voluntary. Similarly, the provision of personal data by a Service User or Customer using the Online Shop is voluntary, subject to two exceptions: (1) entering into contracts with the Controller – failure to provide, in the cases and to the extent specified on the Online Shop’s website, in the Online Shop’s Terms and Conditions and in this privacy policy, the personal data necessary for the conclusion and performance of a Sales Contract or a contract for the provision of an Electronic Service with the Controller will result in the inability to concludethat contract. In such cases, the provision of personal data is a contractual requirement and, if the data subject wishes to enter into the relevant contract with the Controller, they are obliged to provide the required data. In each case, the scope of data required to conclude the contract is specified in advance on the Online Shop’s website and in the Online Shop’s Terms and Conditions; (2) the Controller’s statutory obligations – the provision of personal data is a statutory requirement arising from generally applicable legal provisions imposing on the Controller an obligation to process personal data (e.g. processing data for the purpose of keeping tax or accounting records) and failure to provide such data will prevent the Controller from fulfilling these obligations.

1.5. The controller takes particular care to protect the interests of the data subjects whose personal data it processes, and in particular is responsible for ensuring that the data it collects: (1) is processed lawfully; (2) collected for specified, lawful purposes and not subject to further processing incompatible with those purposes; (3) factually correct and relevant to the purposes for which they are processed; (4) stored in a form which permits identification of the data subjects for no longer than is necessary for the purposes for which the personal data are processed; and (5) processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

1.6. Taking into account the nature, scope, context and purposes of the processing, as well as the risk of infringement of the rights or freedoms of natural persons, which may vary in likelihood and severity, the Controller shall implement appropriate technical and organisational measures to ensure that processing is carried out in accordance with the GDPR and to be able to demonstrate this. These measures shall be reviewed and updated as necessary. The Controller shall implement technical measures to prevent unauthorised persons from intercepting or altering personal data transmitted electronically.

1.7. All words, phrases and acronyms appearing in this privacy policy and beginning with a capital letter (e.g. Seller, Online Shop, Electronic Service) shall be understood in accordance with their definitions set out in the Online Shop Terms and Conditions available on the Online Shop’s website.

2. LEGAL BASIS FOR DATA PROCESSING

2.1. The controller is authorised to process personal data where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the data subject’s request prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Controller is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

2.2. The processing of personal data by the Data Controller requires, in each instance, the presence of at least one of the grounds set out in point 2.1 of the privacy policy. The specific legal bases for the Controller’s processing of personal data relating to Service Users and Customers of the Online Shop are set out in the following section of this Privacy Policy – in relation to the specific purpose of the Controller’s processing of personal data.

3. PURPOSE, LEGAL BASIS AND DURATION OF DATA PROCESSING IN THE ONLINE SHOP

3.1. In each case, the purpose, legal basis, duration and recipients of the personal data processed by the Controller are determined by the actions taken by the relevant Service User or Customer in the Online Shop or by the Controller. For example, if a Customer decides to make a purchase in the Online Shop and chooses to collect the purchased Product in person rather than have it delivered by courier, their personal data will be processed for the purpose of performing the concluded Sales Contract, but will no longer be disclosed to the carrier handling deliveries on behalf of the Controller.

3.2. The Data Controller may process personal data within the Online Shop for the following purposes, on the legal grounds and for the periods set out in the table below:

 

Purpose of data processing Legal basis for data processing Data retention period

The performance of a Contract of Sale or a contract for the provision of an Electronic Service, or the taking of action at the request of the data subject prior to the conclusion of the aforementioned contracts – Article 6(1)(b) of the GDPR (performance of a contract) – processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract

Data is retained for the period necessary for the performance, termination or other expiry of the concluded Sales Agreement or the agreement for the provision of an Electronic Service.

Marketing of the Controller’s goods and services

(e.g. sending commercial communications, including direct marketing, using telecommunications terminal equipment such as email and telephone, or automated calling systems) Article 6(1)(f) of the GDPR (the controller’s legitimate interests) – processing is necessary for the purposes arising from the controller’s legitimate interests, which include direct marketing – consisting of safeguarding the controller’s interests and positive image, its Online Shop and the promotion of Product sales – for example, in connection with the data subject’s prior consent (e.g. when subscribing to the newsletter) to the sending of commercial communications via telecommunications terminal equipment, such as email or telephone, depending on the scope of the consent granted, the Data is retained for the duration of the legitimate interest pursued by the Controller, but for no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims relating to the conduct of business activities is three years, and for a Contract of Sale it is two years).

The data controller may not process data for the purposes of direct marketing if the data subject has validly objected to such processing.

Furthermore, where the basis for processing is consent given to the sending of commercial information, including direct marketing, using telecommunications terminal equipment or automated calling systems, the data shall be retained until the data subject withdraws their consent to the further processing of their data for that purpose, without prejudice to the lawfulness of the processing carried out on the basis of that consent prior to its withdrawal.

The Customer’s expression of an opinion on the concluded Sales Agreement Article 6(1)(a) of the GDPR – the data subject has consented to the processing of their personal data for the purpose of expressing an opinion

The data is retained until the data subject withdraws their consent to the further processing of their data for this purpose.

Keeping of accounts: Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act, i.e. that of 30 January 2018 (Journal of Laws of 2018, item 395, as amended) – the processing is necessary for compliance with a legal obligation to which the Controller is subject

The data is retained for the period required by the legislation obliging the Controller to retain accounting records (5 years from the start of the year following the financial year to which the data relates).

The establishment, exercise or defence of legal claims that may be brought by the Controller or against the Controller – Article 6(1)(f) of the GDPR (the Controller’s legitimate interests) – processing is necessary for the purposes of the Controller’s legitimate interests – consisting in establishing, pursuing or defending claims that the Controller may bring or that may be brought against the Controller

The data is retained for as long as the legitimate interest pursued by the Controller subsists, but for no longer than the limitation period for claims that may be brought against the Controller (the standard limitation period for claims against the Controller is six years).

Use of the Online Shop website and ensuring its proper functioning Article 6(1)(f) of the GDPR (legitimate interests of the controller) – processing is necessary for the purposes of the Controller’s legitimate interests – namely, the operation and maintenance of the Online Shop website. The data is retained for as long as the legitimate interest pursued by the Controller subsists, but for no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by law, in particular the Civil Code (the basic limitation period for claims relating to the conduct of business activities is three years, and for a Contract of Sale it is two years).

Compilation of statistics and analysis of traffic on the Online Shop Article 6(1)(f) of the GDPR (legitimate interests of the controller) – processing is necessary for the purposes of the legitimate interests pursued by the Controller – consisting of maintaining statistics and analysing traffic on the Online Shop in order to improve the functioning of the Online Shop and increase sales of Products. The data is retained for the duration of the legitimate interest pursued by the Controller, but for no longer than the limitation period for the Controller’s claims against the data subject arising from the Controller’s business activities. The limitation period is determined by statutory provisions, in particular the Civil Code (the basic limitation period for claims relating to the conduct of business is three years, and for a Contract of Sale it is two years).

4. RECIPIENTS OF DATA IN THE ONLINE SHOP

4.1. For the Online Shop to function properly, including the fulfilment of concluded Sales Agreements, it is necessary for the Controller to use the services of third parties (such as, for example, a software provider, a courier or a payment service provider). The Controller uses only the services of such data processors who provide sufficient guarantees that they have implemented appropriate technical and organisational measures to ensure that the processing complies with the requirements of the GDPR and protects the rights of data subjects.

4.2. The Controller does not disclose data in every instance, nor to all recipients or categories of recipients specified in the privacy policy – the Controller discloses data only where this is necessary to fulfil a specific purpose of personal data processing and only to the extent necessary to achieve that purpose. For example, if a Customer opts for collection in person, their data will not be transferred to a carrier working with the Controller.

4.3. The personal data of Service Users and Online Shop Customers may be disclosed to the following recipients or categories of recipients:

4.3.1. entities processing electronic or card payments – in the case of a Customer who uses an electronic or card payment method in the Online Shop, the Controller shall make the Customer’s personal data available to the selected provider handling such payments in the Online Shop on the Controller’s behalf, to the extent necessary to process the payment made by the Customer.

4.3.2. service providers supplying the Controller with technical, IT and organisational solutions that enable the Controller to carry out its business activities, including the Online Shop and the Electronic Services provided through it (in particular, suppliers of computer software for operating the Online Shop, email and hosting providers, and suppliers of business management software and technical support to the Controller) – The Controller shall make the Customer’s personal data available to a selected supplier acting on its behalf only where, and to the extent, necessary to fulfil a specific purpose of data processing in accordance with this privacy policy.

4.3.3. providers of accounting, legal and advisory services who provide the Controller with accounting, legal or advisory support (in particular, an accountancy firm, a law firm or a debt collection agency) – The Controller shall disclose the Customer’s personal data to a selected service provider acting on its behalf only where and to the extent necessary to fulfil a specific purpose of data processing in accordance with this privacy policy.

5. PROFILING ON THE ONLINE SHOP

5.1. The GDPR imposes an obligation on the Controller to provide information on automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR, and – at least in such cases – relevant information on the principles governing such decision-making, as well as on the significance and anticipated consequences of such processing for the data subject. With this in mind, the Controller provides information in this section of the privacy policy regarding possible profiling.

5.2. The Controller may use profiling in the Online Shop for direct marketing purposes; however, any decisions taken by the Controller on this basis do not relate to the conclusion or refusal to conclude a Sales Contract, nor to the ability to use the Electronic Services in the Online Shop. The use of profiling in the Online Shop may result, for example, in a discount being granted to a particular person, sending them a discount code, reminding them of unfinished purchases, sending a suggestion for a Product that may match that person’s interests or preferences, or offering better terms than the Online Shop’s standard offer. Despite profiling, it is the individual who freely decides whether they wish to take advantage of the discount or better terms and conditions received in this way and make a purchase in the Online Shop.

5.3. Profiling on the Online Shop involves the automatic analysis or prediction of an individual’s behaviour on the Online Shop’s website, for example by adding a specific Product to the basket, viewing a specific Product page on the Online Shop, or by analysing their previous purchase history on the Online Shop. A prerequisite for such profiling is that the Data Controller holds the individual’s personal data, so that they can subsequently send them, for example, a discount code.

5.4. A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning that person or similarly significantly affects them.

6. RIGHTS OF THE DATA SUBJECT

6.1. Right of access, rectification, restriction, erasure or data portability – the data subject has the right to request from the Controller access to their personal data, its rectification, erasure (‘right to be forgotten’) or restriction of processing, and has the right to object to the processing, as well as the right to data portability. The specific conditions for exercising the above rights are set out in Articles 15–21 of the GDPR.

6.2. The right to withdraw consent at any time – a data subject whose data is processed by the Controller on the basis of consent given (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw their consent at any time without affecting the lawfulness of the processing carried out on the basis of that consent prior to its withdrawal.

6.3. Right to lodge a complaint with a supervisory authority – a data subject whose data is processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and in accordance with the procedures set out in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Office for Personal Data Protection.

6.4. Right to object – the data subject has the right at any time to object – on grounds relating to their particular situation – to the processing of their personal data based on Article 6(1)(e) (public interest or public tasks) or (f) (the controller’s legitimate interest), including profiling based on those provisions. In such a case, the controller may no longer process that personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

6.5. Right to object to direct marketing – where personal data is processed for the purposes of direct marketing, the data subject has the right at any time to object to the processing of their personal data for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing.

6.6. In order to exercise the rights referred to in this section of the privacy policy, you may contact the Data Controller by sending a written message or an email to the Data Controller’s address indicated at the beginning of this privacy policy, or by using the contact form available on the Online Shop’s website.

7. COOKIES IN THE ONLINE SHOP AND ANALYTICS

7.1. Cookies are small pieces of text information in the form of text files, sent by the server and stored on the visitor’s device when they visit the Online Shop (e.g. on the computer’s hard drive, laptop or on a smartphone’s memory card – depending on which device the visitor to our Online Shop is using). Detailed information on cookies, as well as the history of their development, can be found, amongst other places, here: https://pl.wikipedia.org/wiki/HTTP_cookie.

7.2. The Controller may provide a tool on the Website for the easy and active management of cookies – available upon first visiting the Website, and subsequently accessible in the Website’s footer. Active management allows, amongst other things, the user to check which cookies are or may be stored whilst using the Website, as well as to select and subsequently change the scope and purposes of cookie use in relation to the device and the person visiting the Website. When you start using the Website, you will be asked to select your cookie settings. You can change these settings at a later date via the tool available on the Website.

7.3. In the privacy policy, the Controller provides a range of information regarding the use of cookies on the Website, their types and purposes, and how to manage them using, for example, web browser settings and/or the cookie management tool available on the Website. The Controller encourages you to use the cookie management tool available on the Website, which allows you to easily and actively manage cookies whilst using the Website, and, should this tool not be available, to familiarise yourself with the information below concerning, amongst other things, managing cookies via your browser.

7.4. Cookies that may be sent by the Online Shop’s website can be categorised into different types according to the following criteria:

Depending on their supplier:

1) proprietary (created by the Administrator’s Online Shop website) and

2) belonging to third parties (other than the Controller) due to the length of time they are stored on the device of a visitor to the Online Shop’s website:

1) session cookies (stored until you log out of the Online Shop or close your web browser) and

2) permanent (stored for a specified period, as defined by the parameters of each file, or until manually deleted) Depending on their intended use:

1) essential (enabling the Online Shop to function properly),

2) functional/preference-based (enabling the Online Shop website to be tailored to the visitor’s preferences),

3) analytical and performance cookies (which collect information on how the Online Shop website is used),

4) marketing, advertising and social media cookies (which collect information about visitors to the Online Shop’s website in order to display adverts to them, personalising them, measuring their effectiveness and carrying out other marketing activities, including on websites separate from the Online Shop’s website, such as social media platforms or other websites belonging to the same advertising networks as the Online Shop)

7.5. The Data Controller may process the data contained in cookies whilst visitors are using the Online Shop website for the following specific purposes:

The purposes of using cookies on the Administrator’s Online Shop are to identify Service Users as being logged in to the Online Shop and to indicate that they are logged in (strictly necessary cookies)

to remember the products added to the basket in order to place an order (essential cookies)

storing data from completed Order Forms, surveys or login details for the Online Shop (strictly necessary and/or functional/preference cookies)

to tailor the content of the Online Shop to the Service User’s individual preferences (e.g. regarding colours, font size and page layout) and to optimise the user experience on the Online Shop’s pages (functional/preference cookies)

to compile anonymous statistics showing how the Online Shop website is used (analytical and performance cookies)

displaying and rendering adverts, limiting the number of adverts displayed and ignoring adverts that the User does not wish to view, measuring the effectiveness of adverts, as well as personalising adverts, i.e. analysing the behavioural characteristics of visitors to the Online Shop through anonymous analysis of their activities (e.g. repeated visits to specific pages, keywords, etc.) in order to create a profile of them and provide them with adverts tailored to their anticipated interests, including when they visit other websites within the advertising networks of Google Ireland Ltd. and Facebook, i.e. Meta Platforms Ireland Ltd. (marketing, advertising and social media cookies)

7.6. You can check which cookies are currently being sent by the Online Shop’s website, regardless of the web browser you are using, using tools available, for example, on the following website: https://www.cookiemetrix.com or https://www.cookie-checker.com.

7.7. By default, most web browsers available on the market accept the storage of cookies. Everyone has the option to specify the conditions for the use of cookies via their own web browser settings. This means that you can, for example, partially restrict (e.g. temporarily) or completely disable the storage of cookies – in the latter case, however, this may affect certain functions of the Online Shop (for example, it may not be possible to complete the Order process via the Order Form, as the Products in the basket will not be retained during the subsequent steps of placing the Order).

7.8. Your web browser’s cookie settings are relevant to your consent to the use of cookies by our Online Shop – in accordance with the relevant regulations, such consent may also be given via your web browser settings. Detailed information on how to change your cookie settings and delete cookies yourself in the most popular web browsers is available in the browser’s help section and on the following pages (simply click on the relevant link):

in the Chrome browser

in the Firefox browser

in Internet Explorer

in the Opera browser

in the Safari browser

in the Microsoft Edge browser

7.9. The Controller may use the Google Analytics and Universal Analytics services in the Online Shop, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Controller to compile statistics and analyse traffic on the Online Shop. The data collected is processed within the framework of the above services to generate statistics that assist in the administration of the Online Shop and the analysis of traffic on the Online Shop. This data is aggregated. By using the above services on the Online Shop, the Controller collects data such as the sources and media through which visitors access the Online Shop, their behaviour on the Online Shop’s website, information about the devices and browsers they use to visit the site, IP addresses and domains, geographical data, demographic data (age, gender) and interests.

7.10. Users can easily prevent information about their activity on the Online Shop’s website from being shared with Google Analytics – to do so, they can, for example, install the browser add-on provided by Google Ireland Ltd., which is available here: https://tools.google.com/dlpage/gaoptout?hl=pl.

7.11. In view of the possibility that the Controller may use advertising and analytics services provided by Google Ireland Ltd. on the Online Shop, the Controller notes that full details regarding the processing of data relating to visitors to the Online Shop (including information stored in cookies) by Google Ireland Ltd. can be found in Google’s privacy policy, available at the following web address: https://policies.google.com/technologies/partner-sites.

7.12. The Administrator may use the Meta Pixel service, provided by Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland), on the Online Shop. This service helps the Controller to measure the effectiveness of adverts and to find out what actions visitors to the online shop take, as well as to display personalised adverts to those visitors.

7.13. You can manage the Meta Pixel via the ad settings in your Facebook.com account: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

7.14. In view of the possibility that the Controller may use advertising and analytics services provided by Meta Platforms Ireland Limited on the Online Shop, the Controller hereby states that full information regarding the rules governing the processing of data relating to visitors to the Online Shop (including information stored in cookies) by Meta Platforms Ireland Limited can be found in Meta’s privacy policy, available at: https://www.facebook.com/privacy/policy/?entry_point=facebook_help_center_ig_data_policy_redirect.

8. FINAL PROVISIONS

8.1. The Online Shop may contain links to other websites. The Administrator urges you to familiarise yourself with the privacy policy set out on those websites once you have accessed them. This privacy policy applies only to the Administrator’s Online Shop.