Privacy policy

§ 1 GENERAL INFORMATION

1. The Privacy Policy of the Online Store does not create any obligations for Visitors (including Guests) or Customers of the Online Store. It is for information purposes only and is neither a contract nor terms and conditions.
   
   
2. All capitalized terms and words (e.g. Online Store, Customer, etc.) have the meaning given to them in the Terms and Conditions of the Online Store.
   
   
3. In the event of any discrepancy between this Privacy Policy and the consents to the processing of personal data given by a natural person, the legal basis for determining the scope of the Controller's activities shall be the voluntarily given consents or the provisions of law applicable in the given factual situation.

§ 2 PERSONAL DATA CONTROLLER

1. The controller of your personal data is YZEE Sp. z o.o., with its registered office in Kraków at ul. Piłsudskiego 28/6, 31-111 Kraków, Poland, KRS: 0000806297, NIP (Tax ID): 6762571856, REGON: 38448280800000 (hereinafter: the Controller).
   
   
2. For all matters related to the protection of personal data, please contact us at the address above or by email at: sklep@ainsinpl.com.
   
   
3. You may also send to this address a request for information about what personal data concerning you we hold and for what purposes we process it.
   
   
4. The Controller stores correspondence for statistical purposes and to improve its GDPR support system, as well as in connection with complaint decisions and any administrative interventions in a given Customer Account taken on the basis of such requests. Addresses and data collected in this way will not be used for communication for any purpose other than handling the request; in particular, they will not be used for marketing purposes or disclosed to third parties.
   
   
5. If you contact the Controller in order to carry out specific actions (e.g. filing a complaint or making a return), the Controller may ask you again to provide data, including personal data such as your first name, last name, residential address or email address, in order to confirm your identity, contact you back regarding the matter and carry out the requested action. Providing this data is not mandatory, but it may be necessary to carry out the action or obtain the information you are interested in.
   
   
6. If you have given additional consent to our use of cookies, our trusted partners may also be controllers of data obtained on the basis of your online activity.

§ 3 HOW WE OBTAIN DATA AND THE PURPOSE OF PROCESSING

1. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), as well as other personal data protection laws in force at the time the data is processed.
   
   
2. Under these legal acts, personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
   
   
3. We ensure that the data we obtain from you is confidential, secure and processed only when necessary. We process data lawfully, fairly and in a transparent manner in relation to the data subject. We process only such data, and only such content, as is necessary for a legitimate purpose, i.e. the reason for processing. Personal data is collected with due care and adequately protected against access by unauthorized persons. We apply appropriate and adequate security measures and the current state of the art to protect personal data against accidental loss and unauthorized access, use, alteration or disclosure. We store personal data in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data is processed.
   
   

4. The Controller obtains personal data in the following ways:

   1. when a Customer makes a purchase in the Store (online store);
      
      
   2. when a Customer Account is registered;
      
      
   3. through voluntary subscription to the newsletter or text message (SMS) service;
      
      
   4. through information voluntarily provided in an email;
      
      
   5. when a complaint, request, inquiry or other correspondence is sent;
      
      
   6. through information voluntarily provided in an email sent in connection with a collaboration inquiry;
      
      
   7. when a product review is posted;
      
      
   8. through cookies, pixels or similar web technologies.
      
      
5. The purpose and scope of the data processed by the Controller result from the consent of the Website Visitor or Customer or from the provisions of law, and in certain cases are specified further as a result of actions taken by these persons in the Online Store or through other communication channels.
   
   
6. Providing personal data by a Visitor or Customer of the Online Store is voluntary, but necessary to use certain functions of the Online Store (e.g. for the Customer to place and pay for an Order, register a Customer Account or use contact forms).
   
   
7. The scope of data required to conclude a given contract is always indicated in advance in the Online Store (we mark the data that must be provided to conclude the contract or use a specific function), through other channels of communication with the Visitor or Customer, or in the Terms and Conditions. Failure to provide personal data may make it impossible to use the functions of the Website, e.g. to place an order.
   
   
8. The Controller obtains your personal data for the following purposes:
   
   
   

   Purpose of processing	Legal basis	Legitimate interest, if applicable
   Keeping statistics.	Art. 6(1)(f) GDPR.	Having statistical information about our activities, which allows us to improve our business.
   Marketing our own products and services without the use of electronic means of communication.	Art. 6(1)(f) GDPR.	Carrying out marketing activities to promote our business.
   Marketing our own products and services using electronic means of communication, including profiling.	Art. 6(1)(f) GDPR; due to other applicable laws, in particular the Polish Telecommunications Law and the Act on Providing Services by Electronic Means, these activities are carried out only on the basis of consents obtained (Art. 6(1)(a) GDPR).	Carrying out marketing activities to promote our business using email addresses. Displaying ads, tailoring discounts and promotions.
   Posting reviews in the Online Store.	Art. 6(1)(a) GDPR.	Measuring satisfaction with our products.
   Handling requests submitted via the contact form, email, complaints and other requests.	Art. 6(1)(a) GDPR; Art. 6(1)(c) GDPR.	Responding to requests and inquiries submitted via the contact form or in any other form, including storing key requests and the responses given in order to comply with the accountability principle. Handling requests and responding to consumer complaints. Pursuing claims, including against third parties, and defending against them.
   Maintaining the Customer Account.	Art. 6(1)(a) GDPR.	Concluding and performing the Service Agreement (Account) or taking steps at the request of a prospective Customer prior to entering into it.
   Concluding and performing the Sales Agreement.	Art. 6(1)(b) GDPR.	Concluding and performing the Sales Agreement or taking steps at the request of a prospective Customer prior to entering into it.
   Archiving sales documents.	Art. 6(1)(c) GDPR.	Fulfilling legal obligations, e.g. under tax and accounting laws, especially in the case of paid contracts.

9. Newsletter. If you would like to subscribe to our newsletter, you must provide your email address via the newsletter sign-up form. Providing this data is voluntary, but necessary to use the newsletter service. You can also subscribe to the newsletter when creating a Customer Account or placing an Order.
   The data you provide when subscribing to the newsletter is used to send you the newsletter, in which we inform you about the company's activities, the current collection, promotions and discounts. The legal basis for processing in this case is your voluntary consent given when subscribing to the newsletter.
   In this case, your data is processed in order to send you the newsletter on a regular basis, and the legal basis for processing is Art. 6(1)(a) GDPR, i.e. your consent resulting from your wish to receive the service. The data will be processed for as long as the newsletter is in operation, unless you unsubscribe earlier, which will result in your data being permanently deleted from the database. In addition, you may at any time correct your data stored in the newsletter database or request its deletion by unsubscribing from the newsletter. You also have the right to data portability under Art. 20 GDPR.
   The newsletter database is adequately secured by the Controller. The newsletter database is operated by an external provider. The emails we send contain links to hidden images (so-called tracking pixels). In addition to its basic function of counting email opens, a tracking pixel may also be used to identify the Customer and carry out marketing activities.
   
   
10. Email contact. When you contact us by email, you provide us with your email address as the sender's address. You may also include other personal data in the content of your message. Providing this data is voluntary, but necessary to contact us.
    In this case, your data is processed in order to communicate with you, and the legal basis for processing is Art. 6(1)(a) GDPR, i.e. your consent resulting from your wish to contact us. The legal basis for processing after the contact has ended is the legitimate purpose of archiving correspondence for internal purposes (Art. 6(1)(c) GDPR).
    The content of the correspondence may be archived, and we are unable to state precisely when it will be deleted; however, this will be no later than 5 years. You have the right to request a copy of your correspondence history with us (if it has been archived) and to request its deletion, unless its archiving is justified by our overriding interests.
    
    
11. Text messages (SMS). If you would like to subscribe to the text message service, you must provide your mobile phone number via the sign-up form on our website or by ticking the relevant box when placing an order. Providing this data is voluntary, but necessary to use the text message service.
    
    The data provided when subscribing to the text message service is used solely to send you commercial and marketing information about products and services offered by us and our partners, including information about the current offer, promotions, discounts and marketing campaigns. The legal basis for processing is your voluntary consent under Art. 6(1)(a) GDPR, given when subscribing to the text message service.
    
    Your data will be processed in order to send text messages for as long as the service is in operation or until you withdraw your consent to receive them, which will result in your data being permanently deleted from the text message database. You have the right at any time to correct your data stored in the text message database, to request its deletion and to unsubscribe from the service by sending a request to stop sending text messages to the contact details provided in the terms and conditions or via the following page: https://ainsinpl.com/rezygnacja-sms
    
    The Controller ensures that the text message database is adequately secured and processed in accordance with applicable laws. External providers supporting the sending of text messages may be used to operate this service.
    
    
12. Customer Account. When you create a Customer Account on our Website, you provide us with your email address, first name, last name and phone number. This is voluntary, but necessary to successfully register a Customer Account. You can then also provide your address details in the Customer Panel.
    In this case, your data is processed in order to maintain your Customer Account, and the legal basis for processing is Art. 6(1)(a) GDPR, i.e. your consent resulting from your wish to create the account. The data will be processed for as long as you have a Customer Account, unless you ask us to delete it earlier, which will result in your data being deleted from the database. You may at any time correct the data assigned to your Customer Account or request its deletion. You also have the right to data portability under Art. 20 GDPR.
    When creating a Customer Account, you may, but do not have to, consent to subscribing to the newsletter.

§ 4 CATEGORIES OF PERSONAL DATA

1. The personal data controller may process the following categories of personal data:
   
   
   1. personal data provided in the form when registering a Customer Account or placing Orders in the Online Store, in particular: email address, first and last name, phone number;
      
      
   2. personal data added by the user while using the Customer Account, in particular: first and last name; email address; residential address [street, building number, apartment number, postal code, city, country], and in the case of Customers who are not consumers, also the company name and tax identification number [NIP];
      
      
   3. personal data necessary to place an order, in particular: first and last name; email address; contact phone number; residential address [street, building number, apartment number, postal code, city, country], and in the case of Customers who are not consumers, also the company name and tax identification number [NIP];
      
      
   4. personal data provided in order to use the newsletter, provided when posting reviews and sent by email, or provided when filing complaints, grievances or requests, in particular: first and last name; email address; contact phone number; address [street, building number, apartment number, postal code, city, country], bank account number;
      
      
   5. personal data provided in order to take part in contests/promotional campaigns: first and last name; email address; contact phone number; residential address [street, building number, apartment number, postal code, city, country];
      
      
   6. other data, in particular data obtained on the basis of the Customer's online activity, including data obtained through the Online Store or other channels of communication with the Customer, using cookies and similar technologies.
      
      

§ 5 RECIPIENTS OF PERSONAL DATA

1. Your personal data may be processed by our partners and subcontractors, i.e. entities whose services we use to process data and provide services to you. To the best of our knowledge, all entities to which we entrust the processing of personal data guarantee the use of appropriate personal data protection and security measures required by law.
   
   
2. The Controller may transfer your personal data to:
   
   
   1. state authorities or other entities authorized by law, in order to fulfill our obligations;
      
      
   2. the Controller's partners, who may take part in the processing of personal data to a limited extent, in particular those who provide technical support for running the Online Store (e.g. support us in sending emails and, in the case of advertising activities, also in marketing campaigns), providers of hosting or ICT services, carriers or intermediaries delivering Orders, entities handling electronic payments or card payments in the Online Store, companies that maintain software or support the Controller in marketing campaigns, as well as providers of legal and advisory services and external accounting;
      
      
   3. in addition, we may share fully anonymized data (data that cannot identify you) with entities we work with.
      
      
3. As part of its marketing (advertising) activities, the Controller uses the services of third parties that use cookies, pixels or cookie-like marketing functions in the Online Store. A detailed list of these entities is provided in § 8 of this Policy.
   
   
4. Our providers are based mainly in Poland or in other countries of the European Economic Area (EEA), and in some cases, e.g. Google Analytics, outside the EEA. In light of the CJEU judgment in Schrems II (C-311/18), we have enabled the anonymization of your IP addresses, so we do not transfer this data to the USA. Other data sent to Google does not constitute personal data, i.e. it cannot be used to identify a specific natural person.

§ 6 RETENTION OF PERSONAL DATA

1. The Controller will store your personal data only for as long as necessary for the purposes set out in this Privacy Policy and/or to comply with legal and regulatory requirements. After this period, the Controller will securely delete your personal data.
   
   
2. We store data for the periods indicated below:
   
   

   Data related to the sales process.	8 years
   Data for marketing purposes.	Where data is processed on the basis of consent: until consent is withdrawn. Where data is processed on the basis of a legitimate interest: until an objection is raised.
   Data provided via the contact form or email.	For 3 years in order to comply with the accountability principle.
   Data contained in reviews.	Where data is processed on the basis of consent: until consent is withdrawn. Where data is processed on the basis of a legitimate interest: until an objection is raised.
   Personal data related to cookies and similar functions.	Until these files are deleted using the website, browser or device settings (however, deleting the files is not always the same as deleting the Personal Data obtained through them; in that case, the personal data will be deleted when an objection is raised).
   Data provided during the complaint procedure and other procedures related to the Customer's claims.	6 years.
   Other categories of data (except data from cookies, described in more detail in our Cookie Policy).	5 years.

   
   
   
3. In any case, personal data will also be stored where the law (e.g. accounting or tax law) requires the Controller to process it. We will store personal data for longer in case the Customer has any claims against the Controller, for the purpose of pursuing claims by the Controller, or for the purpose of pursuing or defending against third-party claims, for the limitation period specified by law, in particular the Polish Civil Code.
   
   
4. Depending on the scope of personal data and the purposes of processing, data may therefore be stored for different periods. In each case, the longer retention period applies.

§ 7 YOUR RIGHTS, ACCESS TO AND UPDATING OF PERSONAL DATA, COMPLAINTS

Under Art. 15 GDPR, you have the right to obtain confirmation from the personal data controller as to whether your personal data is being processed.

If the Controller processes your personal data, you have the right to:

1. access your personal data;
   
   
2. obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of the data, the planned period for which your data will be stored or the criteria used to determine that period, your rights under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of the data outside the European Union;
   
   
3. obtain a copy of your personal data. In addition, you may request the rectification of personal data (Art. 16 GDPR) or the erasure of personal data (Art. 17 GDPR), object to the processing of personal data (Art. 21 GDPR) and, where technically feasible, request that the personal data you provided be transferred to another organization (Art. 20 GDPR).
   
   

In connection with the right to be forgotten, the Controller will update or delete your data, unless it has a legal obligation to retain it for business purposes or to comply with the law. In certain cases, you have the right to request the restriction of processing of your personal data (Art. 18 GDPR). You may also contact the Controller if you have concerns about how your personal data is collected, stored or used.

The Controller endeavors to handle all requests concerning the above operations on your personal data without undue delay, and in any case no later than within 30 days of receiving the request. Due to the complex nature of a request, the Controller may handle it within a period exceeding 30 days, of which it will inform the User in advance.

The Controller strives to resolve complaints conclusively, but if you remain dissatisfied with the response, you may lodge a complaint with the local data protection supervisory authority. In Poland, the supervisory authority within the meaning of the GDPR is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

§ 8 AUTOMATED PROCESSING OF PERSONAL DATA, COOKIE POLICY

1. Like almost every other website, our Website uses cookies. The cookie policy applies both to Customers of the Online Store and to Visitors of the Online Store, i.e. users who browse the Store but do not make purchases.
   
   
2. The Cookie Policy is an integral part of this Privacy Policy. You can read the Cookie Policy here.

§ 9 CHANGES TO THE PRIVACY POLICY

1. This Privacy Policy 2.0 is effective as of 01.03.2023.
   
   
2. The Controller reserves the right to amend this document for important reasons, including:
   
   
   1. changes to applicable laws, in particular those concerning the GDPR, telecommunications law, services provided by electronic means and consumer rights, which affect the rights and obligations of the Controller or of the data subject;
      
      
   2. the development of functions or electronic services driven by advances in internet technology, including the implementation of new IT, technological or technical solutions on the Website, affecting the scope of this Privacy Policy.
      
      
3. The Controller undertakes to inform Users of any changes sufficiently in advance to allow them to read the amended document, e.g. by posting the consolidated text of the Privacy Policy on the home page of the Website.
   
   
4. For users of the newsletter, if the Controller makes material changes to the Privacy Policy, it will inform Users by email. If the User has any objections to the change of the Policy, the User has the right to stop using the newsletter by sending a request to unsubscribe from the newsletter or by requesting the deletion of their personal data.