Privacy Policy
In order to ensure the security of the data entrusted to us, we have developed internal procedures and recommendations aimed at preventing unauthorized access to data. We monitor their implementation and constantly verify their compliance with relevant legal acts – the Personal Data Protection Act, the Act on Provision of Electronic Services, as well as various executive acts and acts of community law.
- Administrator / We - Carpatree Sp. z o.o. with its registered office at ul. Czajkowskiego 15, Bielsko-Biała, 43-300 Bielsko Biała, Tax Identification Number (NIP): 5472221225, National Business Registry Number (REGON): 38727934400000, National Court Register (KRS): 0000864625, email address: info@carpatree.com.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
- Service – an online store operated by the Administrator at the address: carpatree.com.
- User / You – any natural person visiting the Service or using one or more services or functionalities described in the Policy.
- i. the purpose of providing electronic services in the scope of providing Users with content stored on the Service, enabling the creation of an account or concluding a sales contract – in this case, the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) GDPR);
- ii. the purpose of potential establishment and assertion of claims or defense against them – the legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR);
- iii. the purpose of sending commercial information via a newsletter or contacting the User – the legal basis for processing is the User's consent (Article 6(1)(a) GDPR);
- iv. analytical, statistical, and archival purposes – in this case, the legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR) consisting of conducting analyses of Users' activities and preferences to improve the functionalities and services provided;
- For Google Chrome, the instructions can be found here
- For Mozilla Firefox, the instructions can be found here
- For Microsoft Edge, the instructions can be found here
- For Internet Explorer, we suggest switching to one of the above tools, and additionally, the instructions can be found here
- a. access your data and request their correction,
- b. delete data,
- c. limit processing,
- d. data portability,
- e. object to data processing,
- f. lodge a complaint with the supervisory authority - President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw
When you make a purchase in our store, part of the buying and selling process involves collecting personal data that you provide to us, such as your name, address, and email address. These are necessary data for us to process your order.
When you browse the Service, we automatically receive your IP address, which provides us with information about your browser and operating system. Third parties place information in the form of cookies and similar technologies on your end device (e.g., computer, smartphone) and access it on our pages. These are our partners with whom we continuously cooperate to tailor advertisements to your needs and interests on our and their pages, as well as services that we and our partners provide.
All personal data is processed based on your consent and in cases where the law authorizes the Administrator to process personal data.
Personal data of all Users using the Service (including IP address or other identifiers and information collected through cookies) are processed by us for:
Users' activity on the Service, including personal data, is recorded in system logs (a special computer program used for storing a chronological record containing information about events and actions related to the IT system used for providing services by the Administrator). The information collected in logs is processed primarily for service provision purposes. We also process them for technical, administrative purposes, for ensuring the security of the IT system, and managing this system – in this scope, the legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR).
We process your personal data for the purpose of conducting marketing activities, which may involve sending marketing content corresponding to your interests (newsletter), provided that you give your consent. For this purpose, this data (email address) will be transferred to our partner - GetResponse, who will handle the message delivery.
The Administrator does not make automated decisions regarding the User, and the User's personal data is not subject to profiling.
If you wish to contact the Administrator (e.g., to ask a question about the Administrator's offer), you can send a message through messengers available on social media platforms, such as Facebook or Instagram. Sending a message is possible after directing it to the profile managed by the Administrator (links to profiles are provided on the Service).
Upon receiving a message, we process any data provided by the User (as the message sender) voluntarily within our own social media profile and within the message itself. The co-processor of the data is Meta Platforms Ireland Limited, in accordance with the internal regulations of the respective social media service.
The Service uses "cookies." These are short text information stored on the computer, phone, tablet, or other device of Users. They can be read by us, as well as by systems belonging to other entities whose services we use (such as Google). Cookies usually contain the name of the website they come from, the time they are stored on the end device, and a unique number. More information about cookies can be found on the website www.allaboutcookies.org.
We use cookies to identify browser sessions, which allows the use of Service functionalities. The use of cookie techniques does not allow for the collection of any personal or address data or any confidential information from the User's computer.
Cookies are used for the following purposes: maintaining service security and preventing fraud, facilitating Service performance, recording visits for marketing and statistical purposes, using social features, supporting website personalization (e.g., saving language settings). Cookies may also be used and placed by cooperating partners – in such cases, they are subject to the cookie policies or privacy policies of the entities placing them.
The scope and purpose of data collection, as well as the means of contact and exercise of rights or making settings to ensure privacy protection, are described in the privacy policies of individual partners.
You consent to the processing of information contained in cookies by giving consent during the first visit to the Service within the displayed window. The User can agree to the processing of all data or only those necessary for the correct display of the Service page.
A User who does not want cookies to be used for the purpose described above can manually delete them at any time. To familiarize yourself with detailed instructions, please visit the website of the manufacturer of the internet browser used.
We feel obliged to warn you that disabling or limiting cookie support may cause difficulties in using the website and limit its functionality.
External providers, whose services we use, will collect, use, and disclose your data only to the extent necessary to provide the services they provide to us. However, some external service providers, such as payment gateways or other processors of electronic payment transactions, have their own privacy policies regarding information we are obligated to provide them to conduct post-purchase transactions. Regarding these providers, we recommend familiarizing yourself with their privacy policy to understand how they will handle your personal data.
Especially, please remember that some providers may be located or have facilities in a different jurisdiction than ours or yours. Therefore, if you decide to proceed with a transaction that involves the services of external providers, then your data may become subject to the laws of the jurisdiction(s) where the service provider or its facilities are located. Once you leave our store's website or are redirected to a third-party website or application, you are no longer governed by this privacy policy or our site's terms and conditions.
The Administrator informs Users that, apart from the cases indicated above, personal data processing is entrusted to the following entities:
Within the EEA:
Within the Service, User data is processed by entities cooperating with the Administrator, which, according to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, are obliged to comply with privacy standards similar to those contained in the Policy.
Meta Platforms Ireland Limited (registered address: 4 Grand Canal Place, Grand Canal Harbour, Dublin 2, Dublin, Ireland) - provider of Facebook solution
Pixel used for website traffic monitoring. The collected data may allow the identification of specific individuals, and more information about the privacy standards of the tool is available at this link.
Outside the EEA:
Due to the fact that some entities cooperating with the Administrator have headquarters outside the European Union, and therefore, under the provisions of the GDPR, they are treated as so-called third countries, the Administrator ensures that the data are transferred to entities from the United States, which apply standard contractual clauses.
Google Inc. (headquarters address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) - provider of solutions: Google Tag Manager and Google Analytics, used for marketing purposes of the Service, including website traffic monitoring. The collected data generally do not allow the identification of specific individuals, and more information about the privacy standards of the tool is available here: www.google.com/intl/pl/policies/privacy/partners/. Additionally, by using this link, it is possible to opt out of activity measured by Google Analytics.
Microsoft (headquarters address: 1 Microsoft Way, Redmond, WA 98052, United States) - provider of Microsoft Clarity solution, used for analyzing the behavior of Service Users while maintaining the privacy of their data. Through this tool, the Administrator obtains information about users' activities on the website, especially through visualization in the form of so-called "heat maps" of clicks or scrolls, replaying click paths that Users follow (more about the tool: Microsoft Clarity - Free Heatmaps & Session Recordings).
We therefore guarantee compliance with privacy standards analogous to GDPR regarding personal data protection, and our use of their technologies in personal data processing is lawful.
The processing period of data depends on the type of service provided and the purpose of processing. As a general rule, data is processed for the duration of service provision or order fulfillment, until the withdrawal of consent expressed or effective objection to data processing is reported, in cases where the legal basis for data processing is the legitimate interest of the Administrator.
Accounting documents are kept in accordance with regulations for a period of 5 years from the end of the tax year in which the tax obligation arose. During this period, it is not possible to object to data processing or demand data deletion. Such possibility arises after the expiration of the document retention period imposed by applicable laws and after the expiration of the statute of limitations for claims arising from the concluded contract.
The content of correspondence may be subject to archiving, and determining a clear deadline for its deletion in advance is not possible (Art. 6(1)(f) of the GDPR). You may request the presentation of the correspondence history that was conducted with us (if subject to archiving) and request its deletion, unless its archiving is justified due to our overriding interests, such as defense against potential claims.
The processing period of other data (e.g., order history) may be extended if processing is necessary for the establishment, exercise, or defense of legal claims, and after this time only if and to the extent that legal provisions require it. After the processing period expires, the data is irreversibly erased or anonymized.
As a User, you have the right to:
To the extent that data is processed based on consent, it can be withdrawn at any time by contacting us, for example, at the email address: info@carpatree.com.
You have the right to object to the processing of data for marketing purposes, if the processing is carried out in connection with our legitimate interest, as well as - for reasons related to the User's particular situation in other cases (e.g., in connection with the realization of analytical and statistical purposes).
Contact with the Administrator is possible via email: info@carpatree.com or in writing to the Administrator's address (ul. Czajkowskiego 15, 43-300 Bielsko Biała).
The policy is regularly reviewed and updated as needed. The current version of the Policy was adopted and is effective from 22.03.2024.
