PRIVACY POLICY

Dear User!

We care about your privacy and we want you to feel comfortable when using our services. That is why here we have gathered the most important information on the processing of your personal data. This information has been prepared taking into account GDRP, the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, OJEU 2018.127.2, consolidated text).

Section 1

GENERAL

1. This Privacy Policy governs personal data processing by the Personal Data Controller,  Alux Profile sp. z o. o., having its registered seat in Jawornik Polski, ul. Grabnik 234, 37–232 Jawornik Polski, KRS No.: 0000930973, TIN: 7941831978, for its business purposes, including operating the Web Store at www.aluxprofile.pl
2. For all matters concerning the processing of your personal data and the exercise of your rights with regard to personal data processing, you may contact the Personal Data Controller:

1. by email to: info@aluxprofile.pl
2. in writing to:  ul. Grabnik 234, 37-232 Jawornik Polski

Section 2

DATA SOURCES

1.  The Personal Data Controller collects information on website users and their behaviour:

1. If the Customers voluntarily consent to provide data (by email, phone);
2. If the Customers voluntarily enter personal data in forms available in the Web Store’s system;
3. By storing cookies on user’s end devices.

2. If you intend to buy products directly from the Controller (orders placed by email or phone) or use the Web Store’s services, you will be asked to provide your personal data.
3. You provide your personal data voluntarily. By providing your personal data you consent to its processing by the Controller.
4. If you decide not to provide your personal data, your order will not be completed.
5. If you only browse the Store’s website the Controller will process the cookies. For rules on cookies please refer to Section 13 of this Privacy Policy.

Section 3

TYPES OF PERSONAL DATA AND PURPOSE OF ITS PROCESSING

1. The Personal Data Controller processes the following types of ordinary personal data:

1. First and last name;
2. User’s address or the address for the delivery of goods;
3. Phone number;
4. Email address;
5. Bank account number;
6. Company name and Tax Identification Number (of an entrepreneur).
7. IP address.

2. The Controller may also process other types of personal data if its processing is necessary to comply with legal obligation the Controller is required to observe or to perform rights and obligations under a contract between the Web Store and the Customer.
3. The Controller also processes information on orders placed by individual User Accounts to ensure the functionality of the Web Store’s services.
4. The Controller does not process sensitive personal data (biometrics, information on health, race, religion, etc.).
5.  The Controller uses your personal data to:

1. Provide Web Store’s services;
2. Complete orders;
3. Handle returns;
4. Present the Web Store’s product range;
5. Adapt its products to user needs;
6. Advise on the availability of individual goods;
7. Process messages sent via the contact form;
8. Support web chats;
9. Analyse data (customer preferences) in order to adapt promotion activities to its products and services;
10. Comply with the Controller’s rights and obligations.

6. Ordinary personal data is processed for the purpose of communication, promotion and marketing activities provided by the Controller following a voluntary consent of the Customer. If the Customer agrees to receive business information by email, personal data will be used for communication, promotion and marketing activities of the Controller, in particular to advise on:

1. Product range;
2. New products;
3. Promotions;
4. Discount vouchers/codes.

Section 4

LEGAL BASIS FOR PERSONAL DATA PROCESSING

1. Your personal data is processed pursuant to Article 6(1)(b) of GDRP if personal data processing is required to execute and perform a contract or undertake any activities prior to executing a contract.
2. Your personal data is processed pursuant to Article 6(1)(c) of GDPR if personal data is processed under the legal obligation the Controller is required to observe (e.g. related to the accounting).
3. Your personal data is processed pursuant to Article 6(1)(a) of GDPR if personal data is processed following a consent to personal data processing (transmission of business information by email).
4. Otherwise the legal basis is the legitimate interest of the Controller according to its business activities (Article 6(1)(f) of GDPR).

Section 5

PERIOD OF PERSONAL DATA PROCESSING

1. Your personal data is processed by the Personal Data Controller for as long as necessary.
2. We will process your personal data only for as long as we are entitled to do so, that is:

1. Until we are no longer required by law to process your personal data;
2. As soon as it will not be possible to establish, assert or defend any claims with regard to the sales contract concluded;
3. Once you revoke your consent to the processing of your personal data (if we have processed your personal data based on your consent);
4. Once we accept your objection to the processing of your personal data, if your personal data is processed based on the legitimate interest of the Controller.

Section 6

RIGHTS

1. With regard to the processing of your personal data, you have the right to:

1. Access your personal data;
2. Correct or rectify your personal data by yourself (by logging to your User Account in the Web Store);
3. Close your User Account in the Web Store by yourself by initiating the account closing procedure;
4. Delete your personal data without giving a reason (in some cases this may result in your User Account in the Web Store being closed);
5. Object to the processing all of your personal data or its part or for the indicated purpose;
6. Restrict the processing of your personal data for a certain period of time or within a certain scope;
7. Withdraw the consent to receive business information by email;
8. Transfer your personal data in our possession to another entity;
9. Obtain information on the processing of your personal data;
10. Lodge a complaint to the supervisory authority for personal data: President of the Polish Personal Data Protection Office (Polish: Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, email: kancelaria@uodo.gov.pl

2. Any request you may make or any rights you may exercises will not affect the previous processing of your personal data. Information on your request will be provided within 14 days from the request at the latest.
3. We store your transaction data for as long as required by tax laws or to safeguard the Controller’s interests by collecting evidence with regard to complaints accepted and goods returned. Even if your request to delete your personal data is legitimate we will still process (store) your data to the extent indicated before the statutory limitation periods expire.

Section 7

PERSONAL DATA PROTECTION

1. When you log to your User Account or enter your personal data the transmission of data is protected (with an SSL certificate). This ensures that personal data and login information are encrypted on the user’s computer and may only be read on the target server.
2. The Controller changes its administrative passwords periodically.
3. All software used by the Controller to process personal data of its users is updated regularly, which is particularly important to provide required levels of data protection.
4. The Controller does not send out any communication, including emails, prompting the users to submit their login credentials, especially the password necessary to access the User Account.

Section 8

EXTERNAL SERVICES / DATA RECIPIENTS

1. In certain situations, the Personal Data Controller may be permitted to transfer your personal data to other recipients if this is necessary to perform the sales contract concluded or to fulfil the obligations of the Controller.
2. Personal data may be processed by the following groups of recipients:

1. Authorized employees and service providers to handle orders and/or returns;
2. Persons cooperating with us under civil law contracts, supporting our ongoing activities (accountants, law firms);
3. Suppliers of software required for the operation of the website;
4. Carriers (courier companies, forwarders);
5. Providers of online payment solutions;
6. Providers of software to facilitate our business operations (e.g., accounting solutions);
7. Companies providing technical support;
8. Email system providers;
9. Providers of marketing services;
10. Providers of statistical services.

3. No entity to which the Controller transmits personal data to be processed as required will be entitled to use it in its own interest, not related to services provided to the Controller.
4. Where justified, your personal data may also be transmitted to regulatory bodies, law enforcement bodies, enforcement agencies and other public authorities under statutory requirements.

Section 9

DATA TRANSMISSION OUTSIDE THE EEA

1. As the Personal Data Controller uses tools to support its day-to-day operations (provided, for example, by Google), your personal data may be transferred to a country outside the European Economic Area (EEA), in particular to the United States of America (USA) or another country in which an entity cooperating with the Controller has its tools for the processing of personal data.
2. Adequate safeguarding of personal data processed outside the EEA is guaranteed under agreements for personal data processing by external entities according to standard contractual clauses that meet the requirements of GDPR.

Section 10

PROFILING

1. The Personal Data Controller may take actions involving Automated decision-making (ADM), including profiling of your personal data, in order to provide services under any sales contract concluded and for the purpose of direct marketing.
2. The extent of profiling does not significantly affect your personal data, in particular it does not result in any negative legal consequences. 

Section 11

PERSONAL DATA PROCESSING BY THE WEB BROWSER

1. The Personal Data Controller may store information on the Internet connection (time stamp, IP address) to ensure the functionality of the website.
2. In some cases the Controller may store information to facilitate the association of data in the form with the email address of the user who filled in the form. Then, the user’s email address will be part of the URL address of the web page with the form.
3. The data in the form will be processed according to the purpose of the specific form, e.g. to contact the user or complete the order. The context and description of the form will clearly advise its user on its purpose.

Section 12

ESSENTIAL MARKETING TECHNIQUES

1. The Personal Data Controller analyses the traffic on the website. The Controller transmits only anonymised information, not personal data, to external providers. This service employs cookies stored on the user’s end device.
2. The Controller uses remarketing techniques to match advertising messages with the user's behaviour on the website, which may lead to an impression that personal data is used to track the users, however no personal data is actually transferred from the Controller to advertising operators. The user must first enable cookies.
3. The operator uses the “pixel tracking”. With this technology a social network knows that a person registered using that social network uses the website of the Controller. In this case, the social network uses the data for which it is responsible as its Controller. The Controller does not provide any social network with any additional personal data. This service employs cookies stored on the user’s end device.

Section 13

INFORMATION ON COOKIES

1. For ensuring the functionality of the website (including the Web Store) the Personal Data Controller uses co-called “cookies”
2. which are IT data (small text files) sent by a server and stored on the user’s end device (e.g. computer, smartphone, tablet). 
3. The cookies are necessary for a proper operation of the website (including the Web Store), e.g. features such as logging in, storing a shopping cart, processing of electronic payments or placing orders.
4. The Controller also uses technologies that store data on the user’s end device (cookies) for analytical and marketing purposes.
5. The Controller may also employ features similar to cookies (e.g. local storage). The information presented in this Privacy Policy also applies to those technologies.
6. The Controller uses two main types of cookies: “session” and “persistent”.
7.  Session cookies are temporary files that identify the user during an ongoing visit on the website. For example, they enable the user to log to the User Account securely. Session cookies are stored in the ephemeral storage, instead of the persistent storage (e.g. hard drive). Session cookies are automatically deleted once you close your web browser.
8. “Persistent” cookies are files with a specific expiry time. They are stored on the user’s end device for the time specified in a cookie or until they are deleted by the user. They make the use of frequently visited sites more user-friendly (e.g. storing the selected location and website’s language).
9. Cookies can also be divided according to the purpose of the information stored in the cookies:

1. Cookies necessary for the operation of the service – usually session cookies (e.g. for logging to the User Account, handling the shopping cart or completing the purchase process);
2. Analytical and diagnostic cookies – cookies to allow us to count the number of visits on our website, interest in a particular product group, popularity of pages visited or preferences with regard to the content presented (based on them we can prepare the best offer for our customers and measure its quality and efficiency of the website);
3. Marketing cookies – cookies to ensure that advertising content is of high quality and tailored to preferences of the user (to prevent the user from seeing the same promotions, products or other information repeatedly).

10. The web browser usually enables the storage of cookies on the user’s end device by default. The users may change the relevant settings. The web browser enables its users to delete cookies. It is also possible to automatically block cookies. For details, please refer to the assistance or documentation section of the web browser you are using.
11. Restrictions on the use of cookies may affect some of the features available on our website. By visiting our website, you accept that cookies will be installed on your end device to provide our services. Failure to consent to the cookies storage means that certain features of the website may not be available.

Section 14

AMENDMENTS TO THE PRIVACY POLICY

In the future we may make amendments to the Privacy Policy. A new version of this document will be announced at www.aluxprofile.pl

Last Update of the Privacy Policy – 24 September 2024