Privacy Policy
This privacy policy describes how we process information about you, including personal data and cookies.
General information
Internet florist AFANNAFLEUR ANNA TRENCHUK, address of correspondence: Gorzelnicza 9 , 04-212, Warsaw, identifying itself with the numbers NIP 1133080056 and REGON 523877534.(hereinafter: Administrator). According to the regulations, we are the administrator of your personal data. This means that we are responsible for the use of your personal data in a secure manner, in accordance with the agreement and the applicable regulations.Therefore, we would like to inform you about the introduction of changes to the privacy policy.
The change is due to the need to adapt our operations to the new requirements of the European Data Protection Regulation.
You can contact the Administrator by telephone at +48575768035 or by email at annafleur.trenchuk@gmail.com.
If you do not agree to the processing of your data, please send an email stating "NO" to annafleur.trenchuk@gmail.com.
The provision of your personal data, as well as your consent to its processing, is completely voluntary. All personal data provided to us is processed only to the extent and for the purpose for which you have given your consent. If you do not give your consent to the processing of your personal data during registration, we will unfortunately not be able to guarantee you access to all functions of our shop - including placing orders for the shop range.
Please note that you have the right to update or delete your personal data at any time. For registered customers of the shop, changes can be made by editing in the Customer Panel. For unregistered customers or if you wish to delete your data, please contact us.
We assure you that our company adheres to our data security policy. Your data is safe with us and we make every effort to ensure that the level of service we provide is of the highest possible standard and guarantees the greatest possible security.
The Administrator informs you that it stores correspondence for statistical purposes and for the improvement of the support system in the scope of RODO, as well as for the resolution of complaints and possible decisions on administrative interventions made on the basis of notifications in the designated Customer Account. The addresses and data collected in this way will not be used for communication for any purpose other than the fulfilment of the request, in particular they will not be used for marketing purposes and passed on to third parties.
When contacting the Administrator to perform a specific action (e.g. making a complaint, making a return), the Administrator may again ask the person concerned to provide data, including personal data, e.g. in the form of name, surname, home address, e-mail address, in order to confirm his/her identity and enable a return contact on the matter and perform the requested action. The provision of this data is not obligatory, but may be necessary in order to carry out an activity or obtain information of interest to the person concerned.
ACQUISITION OF DATA AND PURPOSE OF PROCESSING
1.We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repeal of Directive 95/46/EC, (hereinafter: RODO) and other data protection legislation currently in force at the time of processing of certain data.
2.According to the content of the indicated legal acts, personal data is considered to be information about an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by means of an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.
3.We ensure that the data we obtain from you is confidential, secure and only processed when necessary. We process data lawfully, fairly and transparently to the data subject. We process only such data and only of such content as is necessary for the legitimate purpose, i.e. the reason for processing. Personal data is collected with due care and adequately protected against access by unauthorised persons. We use appropriate and adequate security measures and state of the art technology to protect personal data against accidental loss and unauthorised access, use, alteration or disclosure. We keep personal data in a way that enables the identification of the data subject for no longer than is necessary for the purposes for which the data are processed.
4.The controller obtains personal data information in the following ways:
(a)through the making of a purchase in the Shop (online shop) by the Customer;
b)through the registration of a Customer Account;
c)through voluntarily entered information in the e-mail message in the form
contact form or Livechat;
d)through voluntary subscription to the Newsletter;
e)through voluntary posting of opinions in the Online Shop;
f)by sending a complaint, request, enquiry or letter of any other nature;
g)by voluntarily sending information in an e-mail or via a
telephone or other communication channel in connection with a desire to cooperate,
by voluntarily entering information in forms.
h)through cookies, pixels or similar internet technologies.
i) through the additional collection of information about the connection parameters (IP address).
5.We inform you that the purpose and scope of the data processed by the Administrator derives from the consent of the Website Visitor or the Customer or from the provisions of the law and, in selected cases, is further specified as a result of the actions taken by these persons in the Online Shop or through other communication channels.
6.The provision of personal data by the Website Visitor or Customer of the Online Shop is voluntary, but necessary in order to use certain functionalities of the Online Shop (e.g. placing an Order by the Customer and its settlement, registering a Customer Account or using contact forms).
7.Each time the scope of data required to conclude a relevant agreement is indicated beforehand in the Online Shop (we mark the data whose submission is necessary to conclude an agreement/use a specific functionality), within the framework of other communication channels with the Visitor or the Customer or in the Terms and Conditions. The consequence of failing to provide personal data may be the inability to effectively use the functionality of the Website, e.g. the inability to place an order.
8.Your personal data is obtained by the Administrator for the following purpose:
- To keep statistics.Article 6(1)(f) of the RODO.To have information about the statistics of our activities, which allows us to improve our business operations.
- in order to provide the services available on the Website, i.e. to browse the Website's webpages; to execute an order; to issue a sales document; to store it in documentation (electronic or paper) of the performance of contracts, accounting and tax; to use it for profiling (we write about profiling later in this information); to use it for marketing activities, such as sending you our commercial information; to use it for various loyalty programmes related to the use of our services; to use it to create compilations, analyses and statistics for our internal needs, in particular reporting, marketing research, planning of the development of sales of goods and services, development work in IT systems, creation of statistical models
- in order to collect and analyse statistics on the use of particular functionalities available on the Website, data provided in the order form, to facilitate the use of the Website and to ensure the IT security of the Website, we process personal data concerning your activity on the Website and the amount of time spent on each subpage of the Website, your search history, location, IP address, device ID/cookies, data concerning your Internet browser and operating system. The provision of certain data is a condition for the use of particular Services and functionalities.
- for the establishment, investigation and enforcement of claims and for the defence of claims in court proceedings and before other enforcement authorities, we may process your personal data provided at the time of ordering the Services and other data necessary to prove the existence of a claim or which arises from a legal requirement, court order or other legal procedure;
- for the purpose of dealing with complaints, claims and requests and responding to your enquiries, we process the personal data you provide in your complaints, claims and requests, or in order to respond to your enquiries in another form and certain personal data provided by you, as well as the data relating to the Services provided by us which are the cause of the complaint, claim or request and the data contained in the documents accompanying the complaint, claim or request;
- for the purpose of sending an electronic promotional newsletter concerning the novelties, promotions and offers of the Service (data provided in the consent to receive the newsletter, expressed in the Service);
- for the marketing of our Services and the services of our partners, including remarketing, we process data relating to your activity on the Website including activity that is recorded and stored via cookies, in particular your activity history, the services you have requested, your search history, your clicks on the Website, your history and your activity relating to our communication with you. In the case of remarketing, we use your activity data to reach you with our marketing communications outside of the Website and we use third-party providers for this purpose. These services involve displaying our communications on websites other than the Website. Please refer to the Cookie records for details;
- for market research and opinion surveys by us or our partners, i.e. information about the Services, your data provided during the use of the Services, your email address. The data collected for market and opinion research is not used by us for advertising purposes. Exact instructions are given in the information about the respective survey or where you enter your data.
9. CATEGORIES OF PERSONAL DATA
The personal data controller may process the following categories of personal data:
a)personal data provided in the form when registering a Customer Account, placing an Order in the Online Shop, in particular: e-mail address, telephone number, first and last name, address of residence;
b)personal data provided by the user during the use of the Customer Account, in particular: name and surname; e-mail address; contact telephone number; address of residence [street, house number, apartment number, postal code, town, country], and in the case of Customers who are not consumers, additionally company name and NIP number;
c)personal data necessary to place an order, in particular: name and surname; e-mail address; contact telephone number; address of residence [street, house number, apartment number, postal code, town, country], and in the case of non-consumers, additionally company name and NIP number;
d)personal data provided for the purposes of using the newsletter; provided when using the contact form; sent by e-mail; or provided when filing complaints, claims or requests, in particular: name and surname; e-mail address; contact telephone number; address [street, house number, premises number, postal code, town, country], bank account number;
e)personal data provided for the purpose of participating in competitions/promotional events: name and surname; e-mail address; contact telephone number; address [street, house number, apartment number, postal code, town, country;
f)personal data contained in the opinion;
g)other data, in particular, obtained on the basis of the Customer's activity on the Internet, including that obtained through the Internet Shop or other channels of communication with the Customer, using cookies and similar technologies.
10. RECIPIENTS OF YOUR PERSONAL DATA
1.Your personal data may be processed by our partners and subcontractors, i.e. entities whose services we use to process your data and provide services to you. To the best of our knowledge, all entities to whom we entrust the processing of your personal data guarantee the application of appropriate measures for the protection and security of your personal data as required by law.
2.Your personal data may be transferred by the Administrator to:
(a)to state authorities or other entities authorised by law, in order to fulfil the obligations incumbent on us;
b)The Administrator's partners may be involved in the processing of your personal data to a limited extent, in particular those who technically assist in the smooth running of the Internet Shop, providers of hosting or ICT services, carriers or intermediaries carrying out the shipment of the Order or the Order, entities handling electronic payments or payment card payments in the Internet Shop, companies who service the software, support the Administrator in marketing campaigns, as well as providers of legal and advisory services and external accountants;
c)in addition, we may share fully anonymised data (data that cannot identify you) with entities with whom we cooperate.
3.As part of its marketing (advertising) activities, the Administrator uses third parties that use cookies, pixels or marketing functions similar to cookies on the Online Shop.
4.Our providers are mainly based in Poland or in other countries of the European Economic Area (EEA), as well as, for example, in the case of Google Analytics, based outside the EEA. Due to the content of the CJEU ruling Schrems II (C-311/18), we have anonymisation of your IP numbers enabled - we do not transfer this data to the USA. Other data sent to Google does not have the characteristics of personal data, i.e. it is not possible to identify a specific natural person from it.
11. ARCHIVING OF PERSONAL DATA
The Administrator will only retain your personal data for as long as is necessary for the purposes set out in this Privacy Policy and/or to comply with legal and regulatory requirements. After this period, the Administrator will securely delete your personal data.
We will retain your data for the periods indicated below:
- Data linked to a sales procedure.6 years
- Data for marketing purposes.In case of processing based on consent - until the consent is withdrawn.
- In case of data processing on the basis of a legitimate purpose - until you object.
- Data provided using contact form, email.For a period of 3 years to maintain accountability.
- Personal Data linked to cookies and similar functions.Until the deletion of these files using the settings of the website / browser / device (whereby the deletion of files is not always the same as the deletion of Personal Data obtained through these files - in which case the Personal Data will be deleted until an objection is raised).
- Data provided in the course of complaints and other procedures relating to Customer claims.6 years.
- The remaining category of data (with the exception of data from cookies, about which more in our Cookies Policy)5 years.
In any case, personal data will also be stored if legal regulations (e.g. accounting or tax regulations) oblige the Administrator to process them; we will store personal data for longer in case the Customer has any claims against the Administrator, in order for the Administrator to assert claims, or in order to assert or defend against third-party claims, for the period of their limitation period specified by law, in particular the Civil Code.
Depending on the scope of the personal data and the purposes for which they are processed, they may therefore be stored for different periods. In each case, the longer period for which personal data are stored shall be decisive.
12. ENTITLEMENTS, ACCESSING AND UPDATING PERSONAL DATA, COMPLAINTS
Pursuant to Article 15 of the DPA, you have the right to obtain information from the Controller as to whether your personal data is being processed.
If the Controller is processing your personal data, then you have the right to:
(a)access your personal data;
b)be informed about the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients of that data, the intended period of storage of your data or the criteria for determining that period, your rights under the RODO and your right to lodge a complaint with a supervisory authority, the source of that data, automated decision-making, including profiling, and the safeguards applied in relation to the transfer of that data outside the European Union;
(c)obtain a copy of your personal data.
In addition, you may request the rectification of your personal data (Article 16 RODO), the erasure of your personal data (Article 17 RODO), object to the processing of your personal data (Article 21 RODO) and, where technically feasible, request the transfer of the personal data provided to another organisation (Article 20 RODO).
In relation to the right to be forgotten, the Controller will update or delete your data, unless it has a legal obligation to retain it for business purposes or to comply with the law. In some cases, you have the right to request the restriction of the processing of your personal data (Article 18 RODO). You may also contact the Controller if you have concerns about the collection, storage or use of your personal data.
The Controller shall endeavour to deal promptly with all requests concerning the above-mentioned operations on your personal data, but no later than 30 days after receipt of the request. Due to the complex nature of the request, the Administrator has the right to consider your requests in a period exceeding 30 days, of which it will inform you in advance.
The Administrator shall strive to resolve complaints conclusively, but if you are still dissatisfied with the response you receive, you may lodge a complaint with your local data protection supervisory authority. In Poland, the supervisory authority under the RODO is the President of the Office for Personal Data Protection.