Privacy policy

PRIVACY POLICY

Of the Inveo Online Store

§1. General Provisions

1. This Privacy Policy sets forth the rules for the processing of personal data of individuals using the online store available at https://sklep.inveo.com.pl.

2. This document has been prepared in accordance with:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 (GDPR),
  • the Polish Act of May 10, 2018, on the Protection of Personal Data,
  • the Polish Act on the Provision of Electronic Services,
  • and other applicable legal provisions.

§2. Data Controller

The controller of personal data is:

Inveo spółka z ograniczoną odpowiedzialnością (LLC)

Rzemieślnicza 21 st.

43-340 Kozy

Poland

VAT ID (NIP): PL9372748283

e-mail: sklep@inveo.com.pl

phone: +48 785 55 22 52

The controller has not appointed a Data Protection Officer. For all matters regarding the processing of personal data, please contact us via the email address provided above.

§3. Scope of Processed Data

The Data Controller may process, in particular:

  • first and last name,
  • business name,
  • business address,
  • shipping address,
  • mailing address,
  • phone number,
  • email address,
  • tax identification number (NIP),
  • EU VAT number,
  • data necessary to issue an invoice,
  • order history,
  • payment history,
  • complaint history,
  • correspondence history,
  • IP address,
  • device identifiers,
  • data stored in cookies,
  • technical information regarding the use of the Store.

The Data Controller does not process special categories of personal data, unless required by applicable law.

§4. Purposes of Data Processing

Personal data is processed for the following purposes:

1. to enter into and perform a sales contract;

2. to maintain a Customer account;

3. to fulfill orders;

4. to accept payments;

5. to issue accounting documents;

6. to comply with tax obligations;

7. to handle complaints;

8. to process returns;

9. conducting correspondence;

10. providing technical support;

11. pursuing claims;

12. defending against claims;

13. ensuring the security of the Store;

14. preventing fraud;

15. compiling statistics regarding the Store’s operations.

§5. Legal Basis for Data Processing

Administrator przetwarza dane osobowe na podstawie:

  • Article 6(1)(b) of the GDPR—performance of a contract,
  • Article 6(1)(c) of the GDPR—legal obligation,
  • Article 6(1)(f) of the GDPR—the Controller’s legitimate interest,
  • Article 6(1)(a) of the GDPR—consent of the data subject (if required).

§6. Customer Account

Creating an account is voluntary.

The data collected in the account is used to:

  • process orders,
  • display purchase history,
  • facilitate future purchases,
  • contact the Customer.

The account may be deleted at the Customer’s request, with the exception of data that must be retained in accordance with applicable law.

§7. Contact form

The Administrator processes data provided via contact forms solely for the purpose of responding to the inquiry submitted and conducting further correspondence related to its content.

§8. Order processing

In order to fulfill an order, the Administrator may transfer personal data to entities providing services necessary for the performance of the contract, in particular:

  • payment processors,
  • carriers,
  • IT service providers,
  • an accounting firm,
  • a hosting provider.

These entities process data only to the extent necessary to perform the services entrusted to them.

§9. Payment Providers

If you choose to pay electronically, your data may be shared with payment providers, specifically:

  • PayPro S.A. (Przelewy24),
  • PayPal.

The scope of the data shared is limited to the information necessary to process the payment.

§10. Shipping Companies

The data necessary for the delivery of the Goods is provided to the carriers handling the shipments, in particular:

  • DHL,
  • InPost.

The data transferred includes only the information necessary to perform the transportation service.

§11. Transfer of Data Outside the European Economic Area

As a general rule, data is processed within the European Economic Area.

When using the services of PayPal or other providers based outside the EEA, data may be transferred to third countries in accordance with the mechanisms provided for in the GDPR, in particular on the basis of standard contractual clauses or a decision by the European Commission confirming an adequate level of protection.

§12. Data Retention Period

Data is retained for the period necessary to fulfill the purpose for which it was collected.

Specifically:

  • data related to a sales contract—for the period required by tax and accounting laws,
  • data regarding complaints—for the period necessary to assert or defend claims,
  • user account data—until the account is deleted,
  • data based on consent—until consent is withdrawn.

After the specified periods have elapsed, the data is deleted or anonymized.

§13. Rights of Data Subjects

Data subjects have the right to:

  • access their data,
  • rectify their data,
  • erase their data,
  • restrict processing,
  • transfer their data,
  • object to processing,
  • withdraw consent at any time,
  • file a complaint with the President of the Personal Data Protection Office.

The exercise of the above rights may be restricted in cases provided for by applicable law.

§14. Data Security

The controller implements appropriate technical and organizational measures to protect personal data against:

  • loss,
  • destruction,
  • unauthorized access,
  • unauthorized alteration,
  • disclosure to unauthorized persons.

Security measures are adapted to the current level of risk and technological developments.

§15. Automated Decision-Making

The Controller does not make decisions regarding users that produce legal effects solely through automated means.

The Controller does not engage in profiling that produces legal effects for data subjects.

§16. Changes to the Privacy Policy

The Controller may amend this Privacy Policy in the event of:

  • changes in the law,
  • technological changes,
  • organizational changes,
  • expansion of the Store’s functionality.

The current version of this document is published on the Store’s website.

§17. Contact

For any matters regarding the processing of personal data, please contact the Data Controller:

Inveo Spółka z Ograniczoną Odpowiedzialnością

ul. Rzemieślnicza 21

43-340 Kozy

Poland

e-mail: sklep@inveo.com.pl

phone: +48 785 55 22 52