PRIVACY POLICY
OF THE COMEBAG.PL ONLINE STORE

Table of contents:

  1. GENERAL PROVISIONS
  2. THE GROUNDS FOR DATA PROCESSING
  3. PURPOSE, BASIS AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE
  4. THE RECIPIENTS OF THE DATA IN THE ONLINE SHOP
  5. PROFILING IN AN ONLINE SHOP
  6. THE RIGHTS OF THE DATA SUBJECT
  7. COOKIES IN THE WEBSHOP AND ANALYSTS
  8. POSTANOWIENIA KOŃCOWE
  1. GENERAL PROVISIONS
    1. This Internet Shop’s privacy policy is for information purposes only, which means that it does not constitute a source of obligations for the Users or Customers of the Internet Shop. The Privacy Policy contains, first of all, rules concerning the processing of personal data by the Administrator in the Internet Shop, including the basis, purposes and period of personal data processing and the rights of data subjects, as well as information on the use of cookies and analytical tools in the Internet Shop.
    2. The administrator of personal data collected through the Internet Shop is MARTA SULIMA SAMUJŁŁO conducting business activity under the name MARTA SULIMA SAMUJŁŁO COME BAG, PROJECT WORK “SULIMA” entered into the Central Records and Information on Economic Activity of the Republic of Poland conducted by the minister in charge of economy, having: address of place of business and address for delivery: ul. Ehrenberga 24A, 31-309 Kraków, NIP: 6781408318, REGON: 123194173 and e-mail address: shopcomebag@gmail.com – hereinafter referred to as “Administrator” and being at the same time the Service Provider of the Internet Shop and the Seller.
    3. Personal data in the Online Shop are processed by the Administrator in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as “RODO” or “RODO Regulation”. The official text of the RODO Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
    4. The use of the Internet Shop, including shopping, is voluntary. Similarly, the provision of personal data by the Customer or the Client using the Online Shop is voluntary, subject to two exceptions: (1) concluding agreements with the Administrator – failure to provide personal data necessary to conclude and perform a Sales Agreement or an agreement for the provision of an Electronic Service with the Administrator in the cases and to the extent indicated on the website of the Online Shop and in the Terms and Conditions of the Online Shop and in this privacy policy results in the impossibility to conclude such an agreement. In such a case, providing personal data is a contractual requirement and if the data subject wishes to conclude a given agreement with the Administrator, he or she is obliged to provide the required data. Each time the scope of data required to conclude an agreement is indicated in advance on the website of the Internet Shop and in the Rules of the Internet Shop; (2) statutory obligations of the Administrator – providing personal data is a statutory requirement resulting from universally applicable provisions of law imposing on the Administrator the obligation to process personal data (e.g. processing data for the purpose of keeping tax or accounting books) and failure to provide such data will prevent the Administrator from performing such obligations.
    5. The controller shall take particular care to protect the interests of the persons to whom the personal data processed by him/her relate, and in particular shall be responsible for and shall ensure that the data collected by him/her are kept: (1) lawfully processed; (2) collected for specified, legitimate purposes and not further processed in a way incompatible with those purposes; (3) factually correct and adequate in relation to the purposes for which they are processed; (4) stored in a form which permits identification of the data subjects no longer than is necessary to achieve the purpose of the processing and (5) processed in such a way as to ensure adequate personal data protection, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, by appropriate technical or organisational measures.
    6. Taking into account the nature, scope, context and purposes of the processing and the risk of any violation of the rights or freedoms of natural persons with varying degrees of probability and seriousness of threat, the controller shall implement appropriate technical and organisational measures to ensure that the processing is carried out in accordance with this Regulation and to demonstrate this. Those measures shall be reviewed and updated as necessary. The controller shall apply technical measures to prevent personal data transmitted electronically from being acquired and modified by unauthorised persons.
    7. All words, expressions and acronyms contained in this Privacy Policy and commencing with a capital letter (e.g. Seller, Online Shop, Electronic Service) shall be understood in accordance with their definition in the Terms and Conditions of the Online Shop available on the websites of the Online Shop.

  2. THE GROUNDS FOR DATA PROCESSING
    1. An admin is entitled to process personal data if and to the extent that at least one of the following conditions is met: (1) the data subject has consented to the processing of his personal data for one or more specified purposes; (2) the processing is necessary for the performance of a contract to which the data subject is a party or for taking action at the request of the data subject prior to the conclusion of the contract; (3) the processing is necessary for the fulfilment of a legal obligation incumbent on the Administrator; or (4) processing is necessary for purposes based on legitimate interests pursued by the Administrator or by a third party, except where the interests or fundamental rights and freedoms of the data subject requiring protection of personal data prevail over these interests, in particular where the data subject is a child.
    2. The processing of personal data by the Administrator requires each time at least one of the grounds indicated in point B of the present Privacy Policy. 2.1 of the Privacy Policy. Specific grounds for the processing of personal data of Shop Users and Customers by the Administrator are indicated in the next section of the Privacy Policy – in relation to the given purpose of personal data processing by the Administrator.

  3. THE GROUNDS FOR DATA PROCESSING
    1. Each time the purpose, basis, period and recipient of personal data processed by the Administrator results from actions taken by the given Customer or Service Recipient in the Online Shop or by the Administrator. For example, if a Customer decides to make a purchase in the Online Shop and chooses to personally collect the purchased Product instead of a courier service, his/her personal data will be processed in order to perform the concluded Sales Agreement, but will no longer be made available to the carrier carrying out the shipment on behalf of the Administrator.
    2. The Administrator may process personal data within the framework of the Internet Shop for the following purposes, on the basis and in the periods indicated in the table below:
  4. THE RECIPIENTS OF THE DATA IN THE ONLINE SHOP
    1. For the proper functioning of the Internet Shop, including the implementation of concluded Sales Agreements, it is necessary for the Administrator to use the services of external entities (such as software providers, couriers or payment service providers). The Administrator uses only the services of such processing entities, which provide sufficient guarantees of implementation of appropriate technical and organizational measures so that the processing meets the requirements of the RODO Regulation and protects the rights of data subjects.
    2. The transfer of data by the Administrator does not take place in every case and not to all recipients or categories of recipients indicated in the privacy policy – the Administrator transfers data only if it is necessary for the realization of a given purpose of personal data processing and only to the extent necessary for its realization. For example, if the Customer uses personal collection, his data will not be transferred to a carrier cooperating with the Administrator.
    3. The personal data of the Users and Customers of the Online Shop may be transferred to the following recipients or categories of recipients:
      1. carriers / forwarders / courier brokers / entities operating the warehouse and/or shipping process – in the case of a Customer who uses the method of Product delivery in the Online Shop by mail or courier mail, the Administrator provides the collected personal data of the Customer to a selected carrier, forwarder or intermediary carrying out shipments on behalf of the Administrator, and if the shipment is from an external warehouse – entity operating the warehouse and/or shipping process – to the extent necessary to carry out the delivery of the Product to the Customer.
      2. entities handling electronic payments or payment card– in the case of a Customer who uses electronic payment method or payment card in the Internet Shop, the Administrator shall make the collected personal data of the Customer available to a selected entity handling the above payments in the Internet Shop on behalf of the Administrator to the extent necessary to handle the payment made by the Customer.
      3. service providers supplying the Administrator with technical, IT and organizational solutions enabling the Administrator to conduct business activity, including the Internet Shop and Electronic Services provided through it (in particular the computer software provider for running the Internet Shop, the e-mail and hosting provider and the software provider for managing the company and providing technical assistance to the Administrator) – the Administrator shall make the collected personal data of the Client available to a selected provider acting on his behalf only in the case and to the extent necessary to achieve a given purpose of data processing in accordance with this privacy policy.
      4. suppliers of accounting, legal and advisory services providing the Administrator with accounting, legal or advisory support (in particular accounting office, law firm or debt collection company) – the Administrator shall make the collected personal data of the Client available to the selected provider acting on his behalf only in the case and to the extent necessary to achieve the given purpose of data processing in accordance with this privacy policy.
  5. PROFILING IN AN ONLINE SHOP
    1. The RODO Regulation imposes on the Administrator the obligation to inform about automated decision making, including profiling referred to in Article 22(1) and (4) of the RODO Regulation, and – at least in these cases – important information about the principles of making such decisions, as well as about the significance and expected consequences of such processing for the data subject. Bearing this in mind, the Administrator shall provide in this section of the Privacy Policy information on possible profiling.
    2. The Administrator may use profiling in the Internet Shop for the purposes of direct marketing, but the decisions made on its basis by the Administrator do not concern the conclusion or refusal to conclude a Sales Agreement or the possibility of using Electronic Services in the Internet Shop. The effect of using profiling in the Internet Shop may result in e.g. granting a discount to a given person, sending them a discount code, reminding them of unfinished purchases, sending a proposal for a Product that may correspond to the interests or preferences of a given person or offering better conditions compared to the standard offer of the Internet Shop. Despite profiling, the person concerned is free to decide whether they want to take advantage of the discount or better terms and conditions and make a purchase in the Online Shop.
    3. Profiling in the Internet Shop consists in an automatic analysis or forecast of a given person’s behaviour on the website of the Internet Shop, e.g. by adding a specific Product to a basket, browsing the website of a specific Product in the Internet Shop or by analysing the previous history of purchases made in the Internet Shop. The condition of such profiling is that the Administrator has personal data of a given person, in order to be able to send him/her a discount code for example.
    4. The data subject has the right not to be subject to a decision which is based solely on automated processing, including profiling, and which produces legal effects or similarly significantly affects the data subject.
  6. THE RIGHTS OF THE DATA SUBJECT
    1. The right of access, rectification, restriction, deletion or transfer of the data – subject has the right to demand from the Controller access, rectification, deletion (“the right to be forgotten”) or restriction of the processing and has the right to object to the processing and the right to transfer his or her data. Detailed conditions for exercising the aforementioned rights are specified in Articles 15-21 of the RODO Ordinance.
    2. Right to withdraw consent at any time – the person whose data are processed by the controller on the basis of his or her consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the RODO Regulation), he or she shall have the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal.
    3. The right to lodge a complaint to the supervisory authority – a person whose data is processed by the Administrator has the right to lodge a complaint to the supervisory authority in the manner and procedure specified in the provisions of the Ordinance on the Protection of Personal Data and Polish law, in particular the Act on the Protection of Personal Data. The supervisory authority in Poland is the President of the Office for the Protection of Personal Data.
    4. Right of objection – the data subject shall have the right to object at any time, on grounds relating to his or her particular circumstances, to the processing of personal data relating to him or her based on Article 6(1)(e) (public interest or tasks) or (f) (legitimate interest of the controller), including profiling pursuant to those provisions. The controller shall in that case no longer be allowed to process such personal data unless he proves that there are compelling legitimate grounds for the processing, overriding interests, rights and freedoms of the data subject or grounds for establishing, pursuing or defending claims.
    5. Right to object to direct marketing – if personal data are processed for the purposes of direct marketing, the data subject has the right at any time to object to the processing of personal data relating to him/her for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing.
    6. In order to exercise the rights referred to in this section of the Privacy Policy, the Administrator may be contacted by sending an appropriate message in writing or by e-mail to the Administrator’s address indicated at the beginning of the Privacy Policy or by using the contact form available on the website of the Internet Shop.
  7. COOKIES IN THE WEBSHOP AND ANALYSTS
    1. Cookies are small text information in the form of text files, sent by a server and stored on the website of a person visiting the Internet Shop (e.g. on the hard drive of a computer, laptop or smartphone memory card – depending on which device a visitor to our Internet Shop uses). Detailed information about cookies, as well as the history of their creation can be found here: cookies
    2. The Administrator may process the data contained in cookies when visitors use the website of the Internet Shop for the following purposes:
      1. identify Service Recipients as logged in to the Online Shop and show that they are logged in
      2. remember the Products added to your cart in order to place an Order;
      3. remember data from filled in Order Forms, questionnaires or logging in to the Online Shop;
      4. adjust the content of the Online Shop’s website to the Client’s individual preferences (e.g. concerning colours, font size, page layout) and optimise the use of the Online Shop’s websites;
      5. keep anonymous statistics presenting the use of the website of the Internet Shop;
      6. remarketing, i.e. investigating the behavioural characteristics of visitors to the Online Shop through an anonymous analysis of their activities (e.g. repeated visits to specific websites, keywords, etc.) in order to create their profile and provide them with advertisements tailored to their anticipated interests, including when they visit other websites in the advertising network of Google Ireland Ltd. and Facebook Ireland Ltd.
    3. By default, most web browsers on the market accept cookies by default. Everyone has the possibility to set the terms of use of cookies through the settings of their own web browser. This means that you can, for example, partially limit (e.g. temporarily) or completely disable the possibility of storing cookies – in the latter case, however, this may affect some of the functionality of the Internet Shop (for example, it may be impossible to follow the Order path through the Order Form due to the failure to remember Products in the basket during the subsequent steps of placing an Order).
    4. Your browser’s cookie settings are important for your consent to the use of cookies by our Online Shop – this consent can also be given in accordance with the regulations of your Internet browser. If you do not agree to this, you must change your browser’s cookie settings accordingly.
    5. Detailed information on how to change and delete cookies in the most popular web browsers is available in the help section of your web browser and on the following pages (just click on the link):
      w Chrome browser
      w Firefox browser
      w Internet Explorer browser
      w Opera browser
      w Safari browser
      w Microsoft Edge browser
    6. Administrator may use in the Online Shop Google Analytics, Universal Analytics provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help Administrator maintain statistics and analyze traffic in the Online Store. The data collected is processed by the above services to generate statistics to assist in the administration of the Online Shop and the analysis of the traffic in the Online Shop. These data are aggregated. Using these services in the Online Shop, the Administrator collects data such as the source and medium of obtaining visitors to the Online Shop and how they behave on the Online Shop website, information about the devices and browsers from which they visit the website, IP and domain, geographical data and demographic data (age, gender) and interests.
    7. You may refuse the use of Google Analytics by selecting the appropriate settings on your browser, for example, by installing the browser add-on provided by Google Ireland Ltd. here: https://tools.google.com/dlpage/gaoptout?hl&hl=en-GB
  8. FINAL PROVISIONS
    1. The Online Shop may contain links to other websites. The Administrator urges the user to read the privacy policy of other websites after going to them. This privacy policy applies only to the Administrator’s Internet Shop.