Privacy Policy

§ 1 — GENERAL PROVISIONS

1. The controller of personal data collected through the online Shop at www.lawkiorganic.com is Rafał Jacek, who runs the online Shop at www.lawkiorganic.com, place of business and address for service: Ławki 41, 14-405 Wilczeta, Poland, email: shop@lawkiorganic.com, telephone: +48 552 216 003, hereinafter referred to as the "Controller" and also the "Service Provider".
2. Personal data collected by the Controller through the website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
3. All capitalized terms used in this Privacy Policy shall have the meanings as defined in the Terms and Conditions of the online Shop at www.lawkiorganic.com.

§ 2 — TYPE OF PROCESSED PERSONAL DATA, PURPOSE AND SCOPE OF DATA COLLECTION

1. PURPOSE OF PROCESSING AND LEGAL BASIS.

The Controller processes personal data of Users of the Shop www.lawkiorganic.com in the following cases:

1. Account registration — to create and manage an individual account, based on Art. 6(1)(b) GDPR (performance of an electronic service contract),
2. Order placement — to perform the Sales Agreement, based on Art. 6(1)(b) GDPR,
3. Newsletter subscription — to send commercial information electronically, based on Art. 6(1)(a) GDPR (consent),
4. Opinion System — to allow the Customer to express opinions on Products, based on Art. 6(1)(f) GDPR (legitimate interest),
5. Contact Form — to send a message to the Controller, based on Art. 6(1)(f) GDPR (legitimate interest).

2. TYPE OF PROCESSED PERSONAL DATA.

The User provides the following data:

1. Account: email address,
2. Order: full name, address, tax identification number, email address, phone number,
3. Newsletter: full name, email address,
4. Opinion System: full name, email address,
5. Contact Form: full name, email address, phone number.

3. DATA RETENTION PERIOD.

Personal data is stored by the Controller:

1. when processing is based on contract performance — for as long as necessary for the contract, and thereafter for the statute of limitations period (six years, or three years for periodic payments and business-related claims),
2. when processing is based on consent — until consent is withdrawn, and thereafter for the statute of limitations period.

4. During use of the Shop, additional information may be collected, including: IP address, domain name, browser type, access time, operating system type.

5. With separate consent under Art. 6(1)(a) GDPR, data may also be processed for sending commercial information electronically or for direct marketing telephone calls.

6. Navigation data may also be collected, including information about links clicked or other actions taken in the Shop, based on Art. 6(1)(f) GDPR (legitimate interest).

7. Providing personal data is voluntary.

8. The Controller takes special care to protect the interests of data subjects and ensures that collected data is:

1. processed lawfully,
2. collected for specified, legitimate purposes and not further processed in a manner incompatible with those purposes,
3. substantively correct and adequate in relation to the purposes for which it is processed, and stored no longer than necessary.

§ 3 — DISCLOSURE OF PERSONAL DATA

1. Users' personal data is transferred to service providers used by the Controller to operate the Shop, including:
   1. Product delivery companies,
   2. payment system providers,
   3. survey and opinion system providers,
   4. accounting office,
   5. hosting provider,
   6. business software providers,
   7. mailing system providers,
   8. online shop software providers.
2. Service providers — depending on contractual arrangements — either act as data processors following the Controller's instructions, or independently determine the purposes and means of processing (as controllers).
3. Users' personal data is stored exclusively within the European Economic Area (EEA), subject to § 5(5) and § 6 of this Privacy Policy.

§ 4 — RIGHT OF ACCESS, CONTROL AND CORRECTION OF PERSONAL DATA

1. Data subjects have the right to access, rectify, erase, restrict processing, port data, object to processing, and withdraw consent at any time without affecting the lawfulness of prior processing.
2. Legal basis for User requests:
   1. access to data – Art. 15 GDPR,
   2. rectification – Art. 16 GDPR,
   3. erasure (right to be forgotten) – Art. 17 GDPR,
   4. restriction of processing – Art. 18 GDPR,
   5. data portability – Art. 20 GDPR,
   6. objection – Art. 21 GDPR,
   7. withdrawal of consent – Art. 7(3) GDPR.
3. To exercise these rights, send an email to: shop@lawkiorganic.com
4. The Controller shall fulfil or refuse the request without delay, no later than within one month. If the request is complex, the deadline may be extended by an additional two months.
5. If processing violates the GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

§ 5 — COOKIES

1. The Controller's website uses cookies.
2. Cookies are necessary for the proper functioning of the Shop's website. They contain information essential for the site to work correctly and enable general visitor statistics.
3. Two types of cookies are used: "session" and "persistent".
   1. "Session cookies" are temporary files stored until the User logs out (leaves the site),
   2. "Persistent cookies" are stored for the period specified in cookie parameters or until deleted by the User.
4. The Controller uses its own cookies to better understand how Users interact with the website. This information does not record specific personal data but is used to compile usage statistics.
5. The Controller also uses third-party cookies to collect general and anonymous statistical data through Google Analytics (external cookie controller: Google LLC, based in the USA).
6. Cookies may also be used by advertising networks (especially Google) to display ads tailored to the User's browsing behavior.
7. The User has the right to decide on cookie access by:
   1. selecting cookie types upon entering the Shop's website,
   2. changing browser settings.

§ 6 — ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE SHOP

1. The Shop uses social media plugins from Facebook, Instagram and YouTube. When displaying a page containing such a plugin, the User's browser will establish a direct connection with their servers.
2. The plugin content is transmitted directly to the User's browser and integrated with the page.
3. If the User is logged into a social media service, that service may associate the visit to www.lawkiorganic.com with the User's profile.
4. If the User uses a plugin (e.g. "Like" or "Share"), the information will be sent to the service provider's server.
5. The purpose and scope of data collection is described in the privacy policies of:
   1. Facebook
   2. Instagram
   3. Google
6. To prevent social media services from associating browsing data with the User's profile, the User should log out of the service before visiting the site. Plugins can also be completely blocked using browser extensions (e.g. "NoScript").
7. The Controller uses Google Ads remarketing tools. The User can manage cookie settings related to Google Ads.

§ 7 — FINAL PROVISIONS

1. The Controller implements appropriate technical and organizational measures to protect personal data from unauthorized access, removal by unauthorized persons, processing in violation of regulations, and from alteration, loss, damage or destruction.
2. The Controller provides appropriate technical measures to prevent unauthorized acquisition and modification of personal data transmitted electronically.
3. Matters not regulated by this Privacy Policy shall be governed by the provisions of the GDPR and other applicable provisions of Polish law.