Privacy policy

§ 1 General provisions

  1. The administrator of personal data collected through the online store cadresmoss.com is Marcin Zubal, conducting business under the name ZOOMPROJEKT MARCIN ZUBAL, registered in the Central Register and Information on Economic Activity of the Republic of Poland, maintained by the minister responsible for the economy, with the place of business and mailing address: ul. Kortowska 49, 80-178 Gdańsk, NIP: 5591902948, REGON: 341176982, email address: info@cadres.pl, phone number: +48 535 888 346, hereinafter referred to as the “Administrator” and also the “Service Provider.”
  2. Personal data collected by the Administrator through the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.
  3. All capitalized terms used in this Privacy Policy shall be understood according to their definitions contained in the Terms and Conditions of the online store cadresmoss.com.

§ 2 Types of data processed, purpose, and scope of data collection

  1. The Administrator processes the personal data of cadres.pl Store Users in the following cases:
    1. account registration in the store: to create an individual account and manage that account based on Art. 6(1)(b) GDPR (performance of a contract for the provision of electronic services as per the Store’s Terms and Conditions),
    2. placing an order in the store: to fulfill a Sales Agreement based on Art. 6(1)(b) GDPR (performance of a sales contract),
    3. newsletter subscription: for sending commercial information electronically. Personal data is processed after separate consent is given, based on Art. 6(1)(a) GDPR,
    4. using the opinion system: to allow the Customer to express their opinion about the purchased product and the Sales Agreement with the Seller, based on Art. 6(1)(f) GDPR (legitimate interest of the business),
    5. using the contact form: to send messages to the Administrator based on Art. 6(1)(f) GDPR (legitimate interest of the business).
  2. Personal data provided by the User includes:
    1. Account: email address,
    2. Order: name, address, NIP (tax number), email address, phone number,
    3. Newsletter: name and email address,
    4. Opinion System: name and email address,
    5. Contact Form: name, email address, phone number.
  3. Personal data of Users is stored by the Administrator:
    1. If the basis for processing is the performance of a contract, as long as necessary to perform the contract and thereafter for the period corresponding to the statute of limitations for claims. Unless a special provision provides otherwise, the statute of limitations is six years, and for periodic benefits or claims related to business activity—three years.
    2. If the basis for processing is consent, as long as the consent is not withdrawn, and after withdrawal for a period corresponding to the statute of limitations for claims that may be raised by the Administrator or against them. Unless a special provision provides otherwise, the statute of limitations is six years, and for periodic benefits or claims related to business activity—three years.
  4. When using the Store, additional information may be collected, such as the IP address assigned to the User’s computer or the external IP address of the Internet provider, domain name, browser type, access time, and the type of operating system.
  5. Upon separate consent, based on Art. 6(1)(a) GDPR, data may also be processed for the purpose of sending commercial information electronically or making marketing calls—accordingly, under Art. 10(2) of the Act of 18 July 2002 on the Provision of Electronic Services or Art. 172(1) of the Telecommunications Law of 16 July 2004, including profiling, if the User has given appropriate consent.
  6. Users’ navigational data, such as information about links and references clicked or other actions taken in the Store, may also be collected. The legal basis for such actions is the Administrator’s legitimate interest (Art. 6(1)(f) GDPR), which involves facilitating the use of services provided electronically and improving their functionality.
  7. Providing personal data by the User is voluntary.
  8. The Administrator takes special care to protect the interests of data subjects, in particular ensuring that the data collected:
    1. is processed lawfully,
    2. is collected for specified, lawful purposes, and is not further processed in a manner inconsistent with those purposes,
    3. is factually correct and adequate concerning the purposes for which it is processed, and
    4. is stored in a form that allows the identification of individuals no longer than necessary for the purposes of processing.

§ 3 Sharing of personal data

  1. Users’ personal data is shared with service providers used by the Administrator for the operation of the Store, specifically:
    1. entities delivering products,
    2. payment system providers,
    3. survey providers,
    4. accounting offices,
    5. hosting providers,
    6. software providers for conducting business,
    7. email service providers,
    8. software providers for managing the online store.
  2. Service providers to whom personal data is shared—depending on the contractual arrangements and circumstances—either act on the Administrator’s instructions regarding the purposes and means of data processing (processors) or independently determine the purposes and means of processing (controllers).
  3. Users’ personal data is stored exclusively within the European Economic Area (EEA), with exceptions described in § 5(5) and § 6 of the Privacy Policy.

§ 4 Right to control, access, and correct personal data

  1. Individuals whose data is processed have the right to access their personal data, rectify it, delete it, limit its processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the legality of the processing carried out based on consent before its withdrawal.
  2. The legal basis for the User’s request:
    1. access to data – Art. 15 GDPR,
    2. rectification of data – Art. 16 GDPR,
    3. deletion of data (the right to be forgotten) – Art. 17 GDPR,
    4. limitation of processing – Art. 18 GDPR,
    5. data portability – Art. 20 GDPR,
    6. objection – Art. 21 GDPR,
    7. withdrawal of consent – Art. 7(3) GDPR.
  3. To exercise the rights mentioned above, an appropriate email can be sent to: info@cadres.pl.
  4. When a User exercises a right under the above regulations, the Administrator shall fulfill the request or refuse to do so without delay, but no later than within one month of receiving the request. However, if the request is complex or there are many requests, the Administrator may extend the response time by two additional months, informing the User within one month of receiving the request of the intended extension and the reasons for it.
  5. If it is found that the processing of personal data violates GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office.
  6. In accordance with the California Consumer Privacy Act (CCPA), customers residing in California have the right to:
    1. Access their personal data
    2. Request its deletion
    3. Object to the sale of their data

To exercise these rights, please contact: info@cadres.pl

§ 5 Cookies

  1. The Administrator’s website uses “cookies.”
  2. The installation of “cookies” is necessary for the proper provision of services on the website of the Store. “Cookies” contain information necessary for the proper functioning of the website and also enable the development of general statistics regarding visits to the website.
  3. The website uses two types of “cookies”: “session” and “persistent.”
    1. session cookies are temporary files stored on the User’s device until logging out (leaving the website),
    2. persistent cookies are stored on the User’s device for the time specified in the parameters of the “cookies” or until they are deleted by the User.
  4. The Administrator uses its own cookies to better understand how Users interact with the content of the website. These files collect information on how the User uses the website, the type of site from which the User was redirected, the number of visits, and the time the User spent on the website. This information does not record specific personal data of the User but is used to compile statistics on website usage.
  5. The Administrator also uses external cookies to collect general and anonymous statistical data through analytical tools such as Google Analytics (external cookies administrator: Google LLC, based in the USA).
  6. Cookies may also be used by advertising networks (particularly the Google network) to display ads tailored to how the User uses the Store. For this purpose, they may retain information about the User’s navigation path or time spent on a given page.
  7. The User has the right to decide the extent to which “cookies” can access their computer by:
    1. selecting the types of cookies they agree to collect immediately upon entering the Store’s website when the cookie-related notification appears,
    2. changing settings in their browser window. Detailed information on the capabilities and methods of handling cookies is also available in the browser’s settings.

§ 6 Additional services related to user activity in the store

  1. The Store uses so-called social plugins (“plugins”) from social networking sites. When viewing the website cadresmoss.com, which contains such a plugin, the User’s browser establishes a direct connection with the servers of Facebook and Instagram.
  2. The content of the plugin is transmitted directly by the service provider to the User’s browser and integrated into the website. This integration allows the service providers to receive information that the User’s browser has displayed the page cadresmoss.com, even if the User does not have a profile with the service provider or is not logged in. This information (including the User’s IP address) is sent directly from the browser to the server of the service provider (some servers are located in the USA) and stored there.
  3. If the User logs into one of these social media platforms, the service provider can directly assign the visit to the cadresmoss.com website to the User’s profile in that social network.
  4. If the User uses a plugin, such as by clicking the “Like” or “Share” button, the relevant information is also transmitted directly to the service provider’s server and stored there.
  5. The purpose and scope of data collection and its further processing and use by the service providers, as well as the rights of the User in this regard and the ability to set options ensuring the protection of the User’s privacy, are described in the privacy policies of the respective service providers:
    1. https://www.facebook.com/policy.php
    2. https://help.instagram.com/519522125107875?helpref=page_content
  6. If the User does not want social networks to associate data collected during visits to the cadresmoss.com website directly with their profile in that service, they must log out of that service before visiting cadresmoss.com. The User can also entirely prevent loading plugins on the website by using appropriate browser extensions, such as script blocking with “NoScript.”
  7. The Administrator uses remarketing tools on its website, such as Google Ads. Their use involves using cookies from Google LLC related to the Google Ads service. As part of the cookie management mechanism, the User can decide whether the Service Provider will be able to use Google Ads (external cookie administrator: Google LLC, based in the USA) for their interactions.

§ 7 Final provisions

  1. The Administrator applies technical and organizational measures to ensure the protection of processed personal data appropriate to the threats and the category of data being protected, in particular securing the data against unauthorized access, acquisition by an unauthorized person, processing in violation of applicable regulations, and modification, loss, damage, or destruction.
  2. The Administrator provides appropriate technical means to prevent unauthorized persons from acquiring and modifying personal data transmitted electronically.
  3. In matters not regulated by this Privacy Policy, the provisions of GDPR and other applicable Polish law provisions shall apply.