Privacy Policy

Privacy Policy

Introduction

This Privacy Policy sets out the rules governing the processing of personal data in connection with the use of the Website. The terms and conditions governing the conclusion and performance of sales contracts are set out in the SHOP TERMS AND CONDITIONS.

I. INTRODUCTION

  1. This Privacy Policy explains how personal data is processed and protected within the website available at antyksobieski.pl (hereinafter referred to as the “Website”).

  2. The controller of personal data is Paweł Kolata, conducting business under the name ANTYKWARIAT SOBIESKI PAWEŁ KOLATA, registered in the Central Registration and Information on Business Activity (CEIDG), with its registered office in Kalisz, at ul. Pułaskiego 31/3, 62-800 Kalisz, Poland, Tax Identification Number (NIP): 618-185-33-69; Statistical Number (REGON): 251642669 (hereinafter referred to as the “Controller”).

  3. Users may direct any questions or concerns, particularly those relating to the processing of personal data, to the Controller:

    1. By post, to the Controller’s registered office address;

    2. By email, at sklep@antyksobieski.pl;

    3. Through the website at antyksobieski.pl.

  4. The Controller ensures that entrusted personal data is processed in accordance with applicable laws, particularly Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 119, 4 May 2016, p. 1), hereinafter referred to as the GDPR.

  5. The Controller’s primary objective is to ensure that Users of the Website enjoy a level of privacy protection at least equivalent to that required by applicable law, particularly the GDPR.

  6. Every person using the Website should read this Privacy Policy, which sets out the rules governing the processing of personal data in connection with the use of the Website. Using the Website does not replace separate consent to the processing of personal data in cases where such consent is required by applicable law.

  7. The Controller reserves the right to amend this Privacy Policy where required by law or as a result of changes to the Website’s functionality.

  8. The Controller will notify all Users of relevant amendments and their effective dates, in particular by publishing an appropriate notice on the Website.

II. BASIC DEFINITIONS

  • User – any natural person whose personal data is processed by the Controller.

  • Personal Data – any information relating to an identified or identifiable natural person, identifiable directly or indirectly by reference to one or more factors specific to their physical, physiological, genetic, psychological, economic, cultural or social identity. This also includes device IP addresses, location data, online identifiers, and information collected through cookies and similar technologies.

  • GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

  • Website – the organised IT system available at antyksobieski.pl and, where applicable, at other internet addresses, as well as through applications and other IT tools. It comprises interconnected computer programs, databases and associated elements, such as graphics, combined into a single information and communication system.

  • Processing of Personal Data – any operation performed on personal data, including collection, recording, storage, organisation, alteration, disclosure and erasure, particularly operations carried out using IT systems.

  • Personal Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

III. PURPOSES, LEGAL BASES AND SCOPE OF DATA PROCESSING, AND INFORMATION ABOUT FORMS

1. Legal bases for processing

The Controller processes personal data only where at least one of the following conditions is met:

  • The User of the Website has given consent through the relevant forms available on the Website, for the purpose of taking the actions to which those forms relate (Article 6(1)(a) GDPR).

  • Processing is necessary for the performance of a contract to which the User of the Website is a party (Article 6(1)(b) GDPR).

  • Processing is necessary to handle complaints; the legal basis is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR).

  • Processing is necessary to comply with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR).

  • Processing is necessary for the possible establishment, exercise or defence of legal claims; the legal basis is the Controller’s legitimate interest in protecting its rights (Article 6(1)(f) GDPR).

  • Processing is carried out for the Controller’s marketing purposes, including informing Users about the current offer and new Website features; the legal basis is consent (Article 6(1)(a) GDPR).

  • Processing is necessary to provide an artificial intelligence-based assistant service (chatbot), which processes Users’ queries and generates responses. The legal basis is Article 6(1)(b) GDPR (performance of the service) or Article 6(1)(f) GDPR (the Controller’s legitimate interest in improving User support).

2. Retention period for personal data

Personal data is retained for the period necessary to fulfil the purposes for which it was collected, taking into account statutory obligations, limitation periods for claims and the following rules:

  • Data relating to orders, payments and settlements – for the period required by tax and accounting legislation, generally five years, calculated in accordance with the applicable statutory rules. If the data remains necessary for the establishment, exercise or defence of legal claims, it may be retained for as long as required for that purpose.

  • Data relating to complaints, withdrawal from contracts, returns and other claims – for the period necessary to handle the matter, followed by the applicable limitation period for claims or until the conclusion of proceedings where continued retention is necessary.

  • Customer account data – for as long as the account remains active. After the account is deleted, the data is erased or anonymised unless further retention is necessary to comply with legal obligations, settle transactions, or establish, exercise or defend legal claims.

  • Data processed to send newsletters and other marketing communications – until consent is withdrawn or an effective objection is raised, depending on the applicable legal basis. After a User unsubscribes from the newsletter, the Controller may retain limited information necessary to demonstrate that consent was given or withdrawn and to ensure that the unsubscribe request is respected, for as long as necessary to protect against potential claims.

  • Data contained in email correspondence and contact forms – for the time necessary to respond and resolve the matter, and subsequently for as long as necessary to document the correspondence or to establish, exercise or defend legal claims, where justified.

  • Data submitted through the AI chat – for the period necessary to handle the query and provide the service, taking into account the actual data retention practices of the AI solution provider. If the conversation is needed to handle a complaint, provide a response or defend against claims, it may be retained for as long as necessary for those purposes.

  • Technical data, server logs and data relating to Website security – for the period necessary to ensure the Website’s proper operation, security and diagnostics, taking into account the type of data, the purpose of processing, and technical and legal requirements.

  • Data relating to cookies, analytics and advertising – for the period determined by the duration of individual cookies or similar technologies, the settings of the tools used and the consents granted, subject to the possibility of withdrawing consent earlier where consent is the legal basis for processing.

After the applicable retention periods expire, data is erased or anonymised unless further retention is required by law or necessary to establish, exercise or defend legal claims. The Controller periodically reviews whether continued retention remains justified.

3. Data provided through Website forms

Data provided through forms on the Website is processed for the purpose corresponding to the function of the relevant form and on the appropriate legal basis specified in this Privacy Policy.

Where consent is the legal basis for processing, it is obtained separately, voluntarily and through an unambiguous action by the data subject.

Providing data necessary to fulfil an order or deliver a selected service is not conditional upon giving consent for purposes that are not necessary to carry out those activities.

IV. DATA SECURITY

  1. The Controller continuously conducts risk assessments to identify threats to the secure processing of data and implements appropriate technical and organisational measures to protect the personal data processed.

  2. The Controller ensures that access to personal data is granted only to authorised persons and only to the extent necessary for the performance of their duties.

  3. The Controller maintains a register of persons authorised to process personal data. Such persons are required to maintain strict confidentiality regarding personal data and the methods used to protect it.

V. RECIPIENTS OF PERSONAL DATA

  1. Users’ personal data may be disclosed to entities commissioned by the Controller to perform activities involving the processing of such data, particularly in connection with email services, information and communication technology services, hosting, IT services, administrative support, legal services and consultancy.

  2. Entities receiving personal data process it within the scope and for the purposes arising from the nature of the services they provide or from applicable law. Where an entity processes personal data on behalf of the Controller, the terms of cooperation are governed by a data processing agreement or another appropriate legal instrument. Certain entities, such as payment service providers, carriers and public authorities, may act as independent data controllers or receive data pursuant to applicable law.

  3. Users’ personal data may also be disclosed to entities and authorities legally entitled to receive it, but only in justified cases and on the basis of generally applicable laws.

  4. OpenAI Ireland Ltd. and OpenAI, L.L.C. – in connection with the provision of artificial intelligence services (AI assistant/chatbot), including the processing of the content of Users’ queries as processors of personal data on behalf of the Controller for the purpose of generating responses.

VI. RECEIVING COMMERCIAL INFORMATION

  1. Where the Website provides for this option, a User may consent to receiving commercial information by electronic means of communication.

  2. A User who has consented to receiving commercial information by electronic means of communication has the right to withdraw that consent at any time.

  3. Consent to receiving commercial information may be withdrawn at any time, in particular by clicking the unsubscribe link included in a newsletter or by sending a message to sklep@antyksobieski.pl. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

  4. Withdrawing consent via the unsubscribe link does not require logging into a customer account or providing additional information, where the subscription can be identified using the link itself.

VII. USERS’ RIGHTS

1. Rights of data subjects

Every person whose personal data is processed has the following rights:

- Right of access to personal data and information about its processing (Article 15 GDPR) – upon receiving a request, the Controller provides the data subject with access to their personal data and information about its processing, including the purposes and legal bases of processing, the scope of the data held, the recipients to whom the data is disclosed, and the planned retention or deletion period.

- Right to obtain a copy of personal data (Article 15(3) GDPR) – the Controller provides a copy of the personal data being processed that relates to the requesting individual, insofar as this is possible and does not adversely affect the rights of third parties.

- Right to rectification (Article 16 GDPR) – the User may request the correction of inaccuracies or errors in their personal data, as well as the completion or updating of incomplete or outdated information.

- Right to erasure (Article 17 GDPR) – the User may request the deletion of data where its processing is no longer necessary for any of the purposes for which it was collected.

- Right to restriction of processing (Article 18 GDPR) – the Controller may, on this basis, cease processing operations other than the storage of the data, subject to the applicable conditions, until the reasons for restricting processing have ceased to exist. Such reasons may include, for example, a decision by a supervisory authority permitting further processing.

- Right to data portability (Article 20 GDPR) – where data is processed in connection with a contract or on the basis of consent, the Controller may provide the data supplied by the data subject in accordance with the conditions laid down in the GDPR.

- Right to object to processing for other purposes (Article 21 GDPR) – the data subject may object to the processing of their personal data at any time. An objection on this basis should include reasons and is subject to assessment by the Controller.

- Right to object to processing for direct marketing purposes (Article 21(2) GDPR) – the data subject may object to the processing of their personal data for marketing purposes at any time, without having to provide reasons.

- Right to withdraw consent (Article 7(3) GDPR) – where personal data is processed on the basis of consent, the data subject may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

- Right to lodge a complaint (Article 77 GDPR) – if the data subject considers that the processing of their personal data infringes the GDPR or other data protection laws, they may lodge a complaint with the President of the Polish Personal Data Protection Office (UODO): https://uodo.gov.pl/pl/p/kontakt.

2. How to exercise these rights

A request concerning the exercise of data subject rights may be submitted:

  • In writing, to the Controller’s registered office address;

  • By email, to sklep@antyksobieski.pl.

3. Response time

A response will be provided within one month of receipt of the request. If an extension is necessary, the Controller will inform the applicant of the reasons for the extension.

4. Method of response

The response will be sent to the email address from which the request was submitted. For requests sent by post, the response will be sent by registered mail to the address indicated by the applicant, unless the letter indicates that a response by email is preferred. In that case, the applicant should provide an email address.

VIII. COOKIES AND SIMILAR TECHNOLOGIES

1. Use of cookies

The Website uses cookies.

2. What cookies are

Cookies are IT data, particularly text files, stored on the User’s end device and intended for use with the Website. Cookies typically contain the name of the website from which they originate, their storage duration on the end device and a unique identifier.

3. Who places and accesses cookies

The Controller is the entity that places cookies on the User’s end device and accesses them.

4. Purposes of using cookies

Cookies are used, among other things, for the following purposes:

  1. Generating statistics that help the Controller understand how Users interact with the Website;

  2. Maintaining the User’s session after login, so that the User does not need to re-enter their username and password on every page;

  3. Establishing a User profile in order to display tailored content across advertising networks, particularly the Google advertising network.

5. Types of cookies

The Website uses two main types of cookies: session cookies and persistent cookies.

Session cookies are temporary files stored on the User’s end device until the User logs out, leaves the Website or closes the browser.

Persistent cookies remain on the User’s end device for the period specified in their settings or until the User deletes them.

6. Browser settings

Web browsers generally allow cookies to be stored on the User’s end device by default. Users may change their browser settings to manage cookies.

Browsers also allow Users to delete cookies or configure automatic blocking of cookies. Further information is available in the help section or documentation of the relevant browser.

7. Third-party services

The Controller uses third-party services. The list of such providers may change over time, and these providers may use cookies for purposes including:

  • Monitoring traffic on the Controller’s websites;

  • Collecting anonymous, aggregated statistics to understand how Users use the Controller’s Website;

  • Monitoring how often particular content is displayed to Users;

  • Monitoring how often Users select a particular service;

  • Monitoring newsletter subscriptions;

  • Providing communication tools;

  • Integrating the Website with social networking platforms.

8. Managing cookies

Users may manage cookies used by the Controller or external providers by changing their browser settings. Further information is available in the COOKIE POLICY, published on the Website.

9. Restrictions on cookies

Restricting the use of cookies may affect certain functionalities available on the Website.

10. Google Analytics

The Controller may use Google Analytics to collect statistics. In such cases, data relating to Users visiting the Website may be received by Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States.

Users may prevent Google Analytics from accessing their data by installing the browser add-on available at:

https://tools.google.com/dlpage/gaoptout/

11. Google privacy information

The Controller encourages Users to review Google’s detailed information about data processing through Google Analytics, available at:

https://policies.google.com/privacy?hl=pl

12. Facebook and Meta marketing tools

The Controller may also use marketing tools available through the social networking service Facebook, operated by Meta Platforms. These tools may be used to deliver advertisements on Facebook.

Such activities are carried out on the basis of the Controller’s legitimate interest in marketing its own products and services (Article 6(1)(f) GDPR).

13. Meta Pixel

A Meta Pixel may be installed on the Website to deliver personalised advertisements based on the behaviour of Users visiting the Website. The Pixel automatically collects information about how the Website is used.

The information collected in this way may be transmitted to Facebook’s servers in the United States and stored there.

14. Data collected through Meta Pixel

When the Meta Pixel operates, information about the User’s activity on the Website and online identifiers may be collected and transmitted automatically to Meta Platforms.

Depending on the nature and method of processing, such information may constitute personal data. The Controller may receive aggregated information from Meta concerning Users’ activities on the Website, which may be used to assess the effectiveness of advertising campaigns.

Meta Platforms may combine the information received with other User data, including data associated with the use of Facebook, and process it for its own purposes, including advertising, in accordance with Meta’s policies.

The Controller does not determine all subsequent methods of data processing by Meta and is not responsible for processing operations for which Meta Platforms is independently responsible under applicable law.

Detailed information about data processing by Meta, including privacy settings, is available in Meta’s Privacy Policy:

https://www.facebook.com/privacy/explanation

Meta Platforms is based in the United States and may process data using infrastructure located outside the European Economic Area. Any transfer of data is carried out in accordance with applicable data protection legislation.

 

IX. SOCIAL MEDIA

1. The Controller processes the personal data of Users who visit the Controller’s social media profiles, including Facebook and Instagram.

2. This data is processed to inform Users about the Controller’s activities, promote the services offered and communicate with Users through the tools available on social media platforms.

The legal basis for processing personal data for these purposes is the Controller’s legitimate interest (Article 6(1)(f) GDPR), consisting of promoting its own brand and services and building and maintaining a community associated with the brand.

Further information is available in the FACEBOOK FAN PAGE PRIVACY NOTICE and the YOUTUBE PRIVACY NOTICE.

3. The Website contains links to the Controller’s social media profiles. These platforms have their own privacy policies, which Users may consult by following the relevant links marked with the appropriate icons.

4. The Controller accepts no responsibility for the content of websites linked to the Website that are not owned or controlled by the Controller, nor for the confidentiality and data protection policies applicable to Users of those websites.

When a User opens a webpage containing such a link or embedded social media plugin, the User’s browser establishes a direct connection with the servers of the relevant social media platform or service provider. The plugin content is transmitted directly by the service provider to the User’s browser and integrated into the webpage.

Through this integration, the service provider receives information that the User’s browser has accessed the Controller’s Website, even if the User does not have an account with that provider or is not logged in.

Such information, including the User’s IP address, is transmitted directly by the browser to the service provider’s server, some of which may be located in the United States, and stored there.

If the User is logged in to a social media platform, the provider may associate the visit to the Controller’s Website with the User’s profile on that platform.

If the User interacts with a plugin, for example by clicking a “Like” or “Share” button, the relevant information is also transmitted directly to the service provider’s server and stored there. Furthermore, this information may be published on the relevant social media platform and made visible to people listed among the User’s contacts.

5. The purposes and scope of data collection, further processing and use by service providers, as well as contact details, Users’ rights and available privacy settings, are described in the privacy policies of the respective service providers. The Controller encourages Users to read these policies.

6. If a User does not want a social media platform to associate data collected during a visit to the Controller’s Website with their profile on that platform, the User should log out of the relevant platform before visiting the Website.

7. Users may also completely prevent social media plugins from loading on the Website by using appropriate browser extensions, such as script-blocking tools.

X. SERVER LOGS

1. Using the Website involves sending requests to the server on which the Website is hosted. Each request sent to the server is recorded in the server logs.

2. Server logs include, among other things, the User’s IP address, the server date and time, and information about the web browser and operating system used.

These logs are recorded and stored on the server.

3. Data recorded in server logs is used primarily for technical, administrative, diagnostic and Website security purposes.

The Controller does not generally use this data to identify Users directly. However, such data may constitute personal data if it enables a natural person to be identified or can be linked to an identifiable individual.

4. Server logs are used solely as supporting material for administering the Website. Their contents are not disclosed to anyone other than persons authorised to administer the server.

XI. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

1. The Controller may transfer personal data to countries outside the European Economic Area (EEA) only where the conditions laid down in Chapter V of the GDPR are met.

Such transfers may take place, in particular, on the basis of an adequacy decision issued by the European Commission or through appropriate safeguards, such as standard contractual clauses, subject to the requirements of the GDPR.

Other transfer mechanisms may also apply where permitted by law.

Information about the applicable transfer mechanism will be provided upon request by the data subject, to the extent required by applicable law.

2. The list of countries for which the European Commission has adopted an adequacy decision confirming that the relevant third country ensures an adequate level of data protection is available at:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#relatedlinks.

3. Where no European Commission adequacy decision within the meaning of Article 45(3) GDPR applies, Users’ personal data may be transferred to a third country only on the basis of an appropriate mechanism under Article 46 GDPR, such as:

  • Binding corporate rules;

  • Standard data protection clauses adopted by the European Commission;

  • Standard data protection clauses adopted by the Polish supervisory authority and approved by the European Commission;

  • An approved code of conduct;

  • An approved certification mechanism.

4. Where neither an applicable adequacy decision under Article 45(3) GDPR nor appropriate safeguards under Article 46 GDPR, including binding corporate rules, are available, the Controller will request the User’s explicit consent to the transfer of personal data to the relevant third country or international organisation, after informing the User of the potential risks associated with such a transfer, in accordance with Article 49(1)(a) GDPR.

5. In connection with the use of an artificial intelligence technology provider (OpenAI), Users’ personal data may be transferred to a third country, namely the United States of America.

Such transfers are carried out on the basis of standard contractual clauses approved by the European Commission under Article 46 GDPR and implemented safeguards intended to ensure an appropriate level of data protection.

 

XII. INFORMATION ON AUTOMATED DECISION-MAKING

  1. As part of the Website’s functionality, the Controller may automatically tailor certain content to Users’ needs by carrying out profiling using personal data provided by Users.

    Profiling primarily involves automatically assessing which products a User may be interested in, based on their previous online activities, including activities on the Controller’s websites, and displaying advertisements for products tailored accordingly.

  2. Profiling carried out by the Controller does not result in decisions that produce adverse legal effects concerning the User or similarly significantly affect the User.

XIII. ARTIFICIAL INTELLIGENCE-BASED ASSISTANT

  1. The Website may provide an artificial intelligence-based assistant (chatbot).

  2. The service involves processing Users’ queries, which may contain personal data.

  3. This data is transmitted to an external AI technology provider for the purpose of generating responses.

  4. The Controller does not use conversation content to profile Users in a manner that produces legal effects.

  5. Users should avoid providing special-category personal data, such as sensitive information, unless it is necessary to obtain a response.

  6. Query content may be processed temporarily within the AI provider’s systems to generate responses. The Controller does not use the content of queries to build User profiles and does not permanently store conversation histories, unless such storage is necessary to provide the service.

IMPORTANT SECURITY REMINDERS

  1. Whenever you leave your computer or stop using the online shop, click “Log out” in the upper-right corner of the screen after expanding the “My Account” menu.

  2. Do not share your username or password with anyone.

  3. The shop’s employees will never ask customers to provide their account password.

Language version

This English version of the Privacy Policy has been prepared using automated translation and is provided for information purposes only. In the event of any discrepancy or inconsistency between the English and Polish versions, the Polish version shall prevail.

The original Polish version is available here: Polityka prywatności | Antykwariat internetowy Sobieski