§ 1 Definitions

Privacy Policy – this privacy and cookies policy of the Online Store.
Administrator – Keten Group Veysel Tuncay, with its principal place of business and service address in Warsaw.
Personal Data – any information relating to a natural person who can be identified directly or indirectly, in particular by reference to an identifier such as a name and surname, identification number, location data, online identifier, or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person, including device IP address, location data, online identifier, and information collected through cookies or similar technologies.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119, p. 1).
Act – the Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2019, item 1781, consolidated text as amended).
User – any natural person browsing the Online Store website or using one or more services or functionalities described in the Privacy Policy.
Device – an electronic device through which the User accesses the Online Store.

Purposes and legal bases for the processing of personal data

Browsing the Online Store website;
Registration in the Online Store (creating an Account in the Online Store);
Placing an Order (including handling complaints and returns).

§ 3 Browsing the Online Store website

Data of individuals using the Online Store who do not have an Account in the Online Store (i.e., unregistered Users), including IP address or other identifiers as well as information collected via cookies or other similar technologies, are processed by the Controller for one or more of the following purposes:
a) providing electronic services in the scope of making available to Users the content published in the Online Store (legal basis for processing – necessity of processing for the performance of a contract – Article 6(1)(b) of the GDPR);

b) handling complaints (legal basis for processing – necessity of processing to comply with a legal obligation to which the Controller is subject – Article 6(1)(c) of the GDPR);

c) possible establishment, investigation, or defense of claims (legal basis for processing – processing is necessary for the purposes of the legitimate interests pursued by the Controller – Article 6(1)(f) of the GDPR);

d) analytical and statistical purposes (legal basis for processing – legitimate interest of the Controller – Article 6(1)(f) of the GDPR – conducting analyses of Users’ behavior and activity as well as their preferences, aimed at improving the quality and relevance of the functionalities used and services provided).

§ 4 Browsing the Online Store website

Cookies are used for the following purposes:
a) configuring the Service and adapting the content of its web pages to the User’s preferences, as well as optimizing the use of the website; these files in particular allow the User’s device to be recognized and the website to be displayed appropriately, tailored to the User’s individual needs;

b) analytics and research, traffic auditing, and generating statistics that help understand how Users of the Service use the website, which enables improvement of its structure and content;

c) maintaining the User’s session (after logging in), so that the User does not have to re-enter their login and password on each subpage of the Service;

d) carrying out processes necessary for the full functionality of the website and ensuring its security and reliability.

§ 5 Registration in the Online Store (creating an Account in the Online Store)

Users registering are asked to provide the data necessary to create and maintain an Account (first name, last name, contact details, email address). Providing this data is voluntary, but required in order to create and operate the Account (failure to provide the data will result in the inability to create an Account). Personal data is processed by the Controller for one or more of the following purposes:
a) providing services related to the creation and operation of an Account in the Online Store (legal basis for processing – processing is necessary for the performance of a contract – Article 6(1)(b) GDPR);

b) handling complaints (legal basis for processing – processing is necessary for compliance with a legal obligation to which the Controller is subject – Article 6(1)(c) GDPR);

c) possible establishment, exercise or defence of legal claims (legal basis for processing – processing is necessary for the purposes of the legitimate interests pursued by the Controller – Article 6(1)(f) GDPR);

d) analytical and statistical purposes (legal basis for processing – processing is necessary for the purposes of the legitimate interests pursued by the Controller – Article 6(1)(f) GDPR – analysis of users’ behaviour and activity, as well as their preferences, in order to improve the quality and relevance of the features and services provided).

§ 6 Placing an Order (including handling complaints and returns)

In the case of placing an Order, the User provides personal data necessary to process the Order (first name, last name, email address, phone number, and delivery address). In the case of entrepreneurs, the above scope of data is additionally extended to include the company name, address, and tax identification number (NIP). Providing the data is voluntary, but necessary in order to place and process the Order (failure to provide the data results in the inability to place an Order). Personal data are processed by the Controller for one or more of the following purposes:
a) processing the placed Order (legal basis for processing – processing is necessary for the performance of a contract – Art. 6(1)(b) GDPR);

b) handling complaints and returns (legal basis for processing – processing is necessary for compliance with a legal obligation incumbent on the Controller – Art. 6(1)(c) GDPR);

c) fulfilling legal obligations imposed on the Controller, in particular those arising from tax and accounting regulations (legal basis for processing – processing is necessary for compliance with a legal obligation incumbent on the Controller – Art. 6(1)(c) GDPR);

d) possible establishment, exercise, or defence of legal claims (legal basis for processing – processing is necessary for the purposes of legitimate interests pursued by the Controller – Art. 6(1)(f) GDPR);

e) analytical and statistical purposes (legal basis for processing – processing is necessary for the purposes of legitimate interests pursued by the Controller – Art. 6(1)(f) GDPR – analysis of users’ behaviour and activity as well as their preferences in order to improve the quality and relevance of services and functionalities provided);

f) customer satisfaction purposes, in particular by sending emails requesting reviews or completion of satisfaction surveys (legal basis for processing – processing is necessary for the purposes of legitimate interests pursued by the Controller – Art. 6(1)(f) GDPR – satisfaction surveys are conducted to maintain a high level of service quality and user satisfaction with the offered products and services).

§ 7 Data retention periods

Personal data will be processed by the Controller for the period necessary to achieve the purposes referred to in Section III entitled “Purposes and legal bases for personal data processing.”If the processing of personal data is necessary for the performance of a contract, personal data may be processed for as long as it is necessary to perform the contract, and thereafter for a period corresponding to the statute of limitations for claims that may be asserted against the Controller, as well as claims that the Controller may assert.If the processing of personal data is necessary to comply with a legal obligation incumbent on the Controller, personal data may be processed for as long as is necessary to fulfill obligations imposed by legal provisions (e.g., in relation to handling complaints, maintaining accounting records, or fulfilling tax obligations).If the processing of personal data is necessary for purposes arising from the legitimate interests pursued by the Controller, personal data may be processed until an objection to such processing is raised (provided that there are no overriding legitimate grounds for processing such data) and for a period corresponding to the statute of limitations for claims.

§ 8 Rights of data subjects

The user has the following rights:

Right to information about the processing of personal data – on this basis, the Controller provides the requesting person with information regarding the processing of personal data, including in particular the purposes and legal bases for processing, the scope of the data held, the entities to which the personal data are disclosed, and the planned retention period for their deletion.
Right to obtain a copy of data – on this basis, the Controller provides a copy of the personal data being processed concerning the person making the request.
Right to rectification – on this basis, the Controller removes any inconsistencies or errors in the processed personal data, and supplements or updates it if it is incomplete or has changed.
Right to erasure of data – on this basis, you may request the deletion of data whose processing is no longer necessary for any of the purposes for which it was collected.
Right to restrict processing – on this basis, the Controller shall cease carrying out operations on personal data, except for operations to which the data subject has consented, as well as their storage in accordance with adopted retention rules, or until the reasons for restricting data processing cease to exist (e.g., a decision is issued by a supervisory authority permitting further processing of the data).
Right to data portability – on this basis, to the extent that the data are processed in connection with a concluded contract or given consent, the Controller shall provide the data supplied by the data subject in a format readable by a computer. It is also possible to request that these data be transmitted to another entity – provided that there are technical capabilities to do so both on the part of the Controller and the other entity.
Right to object to data processing – the data subject may, at any time, object to the processing of personal data based on the legitimate interest of the Controller (e.g., for analytical or statistical purposes). Such an objection should include justification and is subject to assessment by the Controller.
Right to object to the processing of data for direct marketing purposes – the data subject may object at any time to the processing of personal data for direct marketing purposes, without having to justify such objection.
Right to withdraw consent – where data is processed based on consent, the data subject has the right to withdraw consent at any time; however, this does not affect the lawfulness of processing carried out before the consent was withdrawn.
Right to lodge a complaint – if it is considered that the processing of personal data violates the provisions of the GDPR or other data protection regulations, the data subject may lodge a complaint with the President of the Personal Data Protection Office (UODO).

The user can exercise their rights by contacting the Data Controller at: info@ketenstore.pl. The request should, as far as possible, precisely indicate the subject of the request, in particular:

a) the type of right the person submitting the request wishes to exercise;

b) the type of processing activity to which the request relates;

c) the purposes of processing to which the request relates (e.g. marketing purposes, analytical purposes, etc.).

The Data Controller may request additional information from the person submitting the request if it is not possible to determine the content of the request or identify the requester based on the information provided. A response to the request will be provided within one month of its receipt. If it is necessary to extend this period, the Data Controller will inform the requester of the reasons for the extension.The response will be sent to the email address from which the request was submitted, and in the case of requests submitted by post, by regular mail to the address indicated by the requester, unless the letter indicates a preference to receive the response by email (in which case an email address must be provided).

§ 9 Data recipients

Dane osobowe Użytkownika przekazywane są dostawcom usług, z których korzysta Administrator przy prowadzeniu Sklepu Internetowego. Dostawcy usług, którym przekazywane są dane The User’s personal data is transferred to service providers used by the Controller in operating the Online Store. The service providers to whom personal data are transferred act on behalf of the Controller with respect to the purposes and methods of processing such data.The Controller uses the following categories of service providers:
a) technological and IT services;

b) logistics, transport, and delivery services;

c) customer service-related services;

d) accounting services;

e) marketing and advertising services.
Service providers are mainly based in Poland and other countries of the European Economic Area (EEA).The Controller has the right, as well as a legal obligation, to disclose selected or all information concerning Users to public authorities or third parties that request such information based on applicable provisions of Polish law.

§ 10 Data transfer outside the EEA

The Controller may, in justified and necessary cases due to the circumstances, disclose your personal data to entities established outside the EEA, i.e. for example in the USA, Singapore, India, China, Hong Kong, and Canada, where such transfer is necessary for the purposes indicated in Section III entitled “Purposes and legal bases for the processing of personal data.” The transfer of personal data outside the EEA is carried out with an appropriate level of data protection, as required by European regulations, primarily through:
a) cooperation with data processors in countries for which an adequacy decision has been issued by the European Commission;

b) the use of standard contractual clauses adopted by the European Commission;

c) the application of binding corporate rules approved by the competent supervisory authority;

d) other safeguards ensuring an adequate level of protection based on appropriate legal security measures.
The User has the right to obtain a copy of the above-mentioned standard contractual clauses (or other applicable safeguards for data transfers outside the EEA) via the Controller.

§ 11 Cookie Policy

The Administrator uses cookies (so-called “cookies”), which are IT data, in particular text files stored on the User’s end device. The cookies used by the Administrator are safe for the User’s device. In particular, it is not possible for viruses or other unwanted or malicious software to enter Users’ devices via this method.Cookies enable the Administrator, in particular, to better tailor the Online Store website to the individual interests and preferences of the User.Cookies usually contain the name of the domain of the website from which they originate, the time they are stored on the end device, and a unique number used to store information about Users.
The Administrator uses cookies for the following purposes:
a) configuration of the Online Store – adapting the content of the website www.ketenstore.pl to the User’s preferences and optimizing the use of the Online Store;

b) enabling login to the Online Store Account, monitoring Online Store User traffic, and preparing usage statistics of the Online Store;

c) analytics, research, and traffic auditing – collecting general and anonymous statistical data, creating anonymous statistics using analytical tools that help understand how Online Store Users use the website www.ketenstore.pl, which enables improvement of its structure and content;
The user may independently and at any time change the settings concerning cookies, specifying the conditions for their storage and access by cookies to the User’s Device. Changes to the settings referred to in the previous sentence may be made by the User using the settings of their web browser or by configuring the service. These settings may be modified in particular in such a way as to block the automatic handling of cookies in the web browser settings or to inform the User each time cookies are placed on the User’s Device. Detailed information about the possibilities and methods of handling cookies is available in the settings of the software (web browser).Restricting the use of cookies may affect some of the functionalities available on the website www.ketenstore.pl.

§ 12 Profiling

Personal data such as: first name, last name, contact details, email address, and phone number, after the User has given voluntary consent, are also collected and processed for statistical and marketing purposes (“Profiling”).Through the use of personal data profiling tools, the Controller is able to assess personal factors relating to a specific User, in particular to analyse or predict aspects concerning personal preferences, interests, or behaviour.Profiling is carried out in order to provide individual Users with personalised and tailored offers and content, including through dynamic content on the Online Store website or via email marketing.The profiling of the User’s personal data is based on the User’s prior voluntary consent.The User has the right to withdraw consent to the processing of their personal data involving Profiling, as well as the right to object to Profiling by contacting the Controller.

§ 13 Final provisions

In matters not regulated by this Privacy Policy, the provisions of the Act and the GDPR shall apply.This Privacy Policy is effective as of 02.04.2024.