Privacy Policy Grabowski Math Cards

https://grabowskimathcards.com/

I. Data Controller:

Karty Grabowskiego
Grabowski i Grabowska-Dybek Spółka jawna
ul. Św. Szczepana 20 A61-465 Poznan (Poland)
E-mail: info@grabowskimathcards.com 

II. How Your Personal Data Is Handled:

1. The Customer’s personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter also referred to as: “GDPR”) and other legal regulations on the protection of personal data in effect throughout the entire period of personal data processing. Personal data refers to any information that identifies or enables the identification of a natural person (hereinafter referred to as: “Personal Data”).
2. The Controller pays special attention to protecting the interests of data subjects; in particular, the Controller ensures that the data it collects is:

• processed in accordance with the law, fairly, and transparently with respect to data subjects;
• collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes;
• adequate, relevant, and limited to what is necessary for the purposes for which they are processed;
• accurate and, where necessary, kept up to date;
• etained in a form that allows for the identification of the data subject for no longer than is necessary for the purposes for which it is processed;
• processed in a manner that ensures the security of personal data, including protection against unauthorized or unlawful processing or accidental loss destruction, or damage, through appropriate technical or organizational measures.

III. What Personal Data We Process:

1. If you order goods or services from us, we need certain information from you to complete your order. Without this information, we would not be able to deliver the goods to you. This information is important to us, so we require it as mandatory information during the order completion or registration process. We need your email address to send order confirmations, which serve as confirmation of the purchase agreement.
2. Providing this information is voluntary but necessary for registration and purchases on the website. Customers may update their information in the Online Store system at any time.
3. A customer who has created an account in the online store may request that the customer service department delete it at any time. Account deletion is irreversible and results in the removal of all customer data. It will not be possible to restore this account.
4. Information we require: First and last name, Shipping address, Phone number, Email address, Business ID (for companies or resellers only).

IV. Why We Collect and Process Personal Data:

1. Personal data is processed for the purposes listed below, and the scope of the personal data processed depends on the specific purpose of the processing. For some processing purposes, personal data may be processed directly on the basis of a legal basis, in which case the customer’s consent to such processing is not required; the second category consists of processing that is permitted only with the customer’s consent.
2. The following legal basis applies to the processing of personal data:
   

• processing to fulfill a contract to which the customer is a party—specifically for the purposes of executing a sales contract, including order fulfillment, creating, managing, and maintaining an account or accounts, performance of the contract, including related communication with the customer, handing over goods for shipment, the final sale of the ordered goods and their delivery to the customer, and billing the applicable purchase price—for the duration of the contractual relationship or for the time necessary to fulfill the purchase contract (Article 6(1)(b) of the GDPR);
• processing to comply with legal obligations imposed on the controller—in particular for the purposes of fulfilling the controller’s accounting and tax obligations—for the period strictly necessary in accordance with the statutory time limits set forth in applicable laws (e.g., invoices issued by the controller are archived in accordance with Section 35 of Act No. 235/2004 Coll., on Value Added Tax, as amended, are archived for a period of 10 years from the end of the tax period in which the transaction took place; furthermore, due to the need to document the legal basis for issuing invoices, concluded purchase agreements and customer orders are also archived for a period of 10 years from the date of termination of the contract (Article 6(1)(c) of the GDPR) ;
• processing for the purposes of protecting the controller’s legitimate interests - this involves the processing of personal data to protect the controller’s rights and legally protected interests, which may be carried out without the customer’s consent, provided that the controller has a legitimate interest, namely the need to process data for the purpose of recording outstanding receivables and enforcing the controller’s claims arising from concluded purchase agreements (judicial or enforcement collection of receivables from the customer and other customer disputes, filing insurance claims, etc.), resolving customer claims (complaints, contract withdrawals, etc.) and future customer inquiries and complaints, including securing evidence in the event of future legal disputes in which the controller is a party (Article 6(1)(f) of the GDPR);
• Posting a review (processing for the purpose of pursuing our legitimate interest in gathering feedback on products and the transaction process in the online store (Article 6(1)(f) of the GDPR));
  

3. Your personal data may also be processed for the purposes of marketing, analytical, and statistical activities, as well as to protect legitimate interests and legal claims. In this case, the legal basis for the processing of your personal data is the legitimate interest of the Controller or a third party pursuant to Article 6(1)(f) of the GDPR.

4. Unless expressly stated otherwise above, personal data is processed only for as long as strictly necessary, in particular for the duration of the contractual relationship or other legal basis that allows the Controller to process the customer’s personal data, and is archived in accordance with the retention periods prescribed by law. Once the legal basis no longer applies, the relevant personal data is deleted. Personal data processed with the customer’s consent is retained only for the duration of the purpose for which consent was granted, and at most for the duration of the consent granted by the customer or until such consent is revoked.

V. Social Media

1. We have profiles on social media (Facebook [Meta], Instagram [Meta]). Personal data is or may be processed for the purpose of maintaining profiles on these websites, including fan pages, in accordance with the regulations applicable to these websites and under the terms set by the administrators of these websites, namely: a) for the purpose of conducting marketing and analytical activities—Article 6(1)(f) of the GDPR; b) for statistical and advertising purposes carried out using tools provided by individual social media platforms. The legal basis for processing personal data for these purposes is necessity for purposes arising from the controller’s legitimate interest in conducting its own marketing and managing its image—Article 6(1)(f) of the GDPR.
2. Joint Management of Personal Data on Social Media:The Administrator, as the owner of the fan page, is a joint controller of personal data with respect to personal data collected for statistical or advertising purposes in the case of: Facebook, Instagram: jointly with Meta Platforms Ireland Limited, Serpentine Avenue, Block J, Dublin 4, Ireland (Meta) Meta’s Privacy Policy regarding the processing of personal data on Facebook is available at https://www.facebook.com/privacy/explanation.
   
   Meta's Privacy Policy regarding the processing of personal data on Instagram is available at https://help.instagram.com/. Information about the agreements between data controllers is available at https://www.facebook.com/legal/terms/page_controller_addendum.

In addition, your personal data may also be processed for as long as necessary to:

• fulfilling the Controller’s obligations under applicable laws;
• protecting legal claims—for the statute of limitations period set forth in applicable laws.

3. Depending on the specific case and the scope of the personal data and the purposes for which it is processed, your personal data may be stored for a different period of time.

VI. RECIPIENTS OF PERSONAL DATA

1. We disclose your personal data only to authorized employees and contractors, or to individual contractually appointed personal data processors, or to other data controllers, but always only to the extent necessary to fulfill the specific purposes of processing and based on an appropriate legal basis for the processing of personal data. We may disclose your personal data primarily to third parties with whom we collaborate in the operation of the Online Store. These may include entities that provide technical support for operating the Online Store, such as hosting service providers or ICT service providers; carriers or intermediaries ensuring the delivery of ordered Products; entities processing electronic or credit card payments, companies providing support for communication with Customers and the implementation of marketing campaigns, as well as providers of legal and consulting services. Third parties to whom the Controller discloses personal data in connection with the Online Store are required to implement appropriate measures to ensure the security and protection of your personal data. Your personal data may also be shared within the group of companies to which the Controller belongs.

2. Your personal data is processed primarily within the European Economic Area (hereinafter referred to as the “EEA”). In connection with the operation of the Online Store, your personal data may also be transferred to countries outside the EEA (e.g., to Google), where a third party cooperating with the Controller manages tools for processing personal data in accordance with the Controller’s instructions. Such transfers of personal data are always carried out only to the extent necessary.
3. In the event of a transfer of personal data to entities based outside the EEA, the Controller ensures compliance with the requirements set forth in Chapter 5 of the GDPR, including the use of appropriate safeguards for such transfers in the form of standard contractual clauses adopted pursuant to a decision of the European Commission. You may obtain a copy of the safeguards for personal data transferred outside the EEA by contacting the Controller at the following email address: info@grabowskimathcards.pl.
4. In connection with the use of services provided by Google LLC, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the United States, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia. The basis for transferring data to the above-mentioned third countries is:

• in the case of the United Kingdom, Canada, Israel, Japan, and South Korea—the European Commission’s decision determining the adequate level of protection of personal data in each of the aforementioned third countries;
• for the United States—Commission Implementing Decision (EU) 2023/1795 of July 10, 2023, based on Regulation (EU) 2016/679 of the European Parliament and of the Council, determining the adequate level of protection of personal data provided by the EU-U.S. data protection framework;
• for Chile, Brazil, Saudi Arabia, Qatar, India, China, Singapore, Taiwan (Republic of China), Indonesia, and Australia—contractual clauses ensuring an adequate level of protection in accordance with the standard contractual clauses set forth in Commission Implementing Decision (EU) 2021/914 of June 4, 2021, on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

5. You can obtain a copy of the data transferred to a third country from the controller.

VII. PROFILING

1. The Administrator may use profiling in the Online Store for direct marketing purposes; however, decisions made by the Administrator based on such profiling do not affect the conclusion or refusal to conclude a Purchase Agreement or the ability to use the Electronic Services in the Online Store. The use of profiling in the Online Store may result, for example, in offering a discount to a specific person, sending a discount code, notifying the person of abandoned carts, suggesting a Product that may match the person’s interests or preferences, or offering better terms than the Online Store’s standard offer. Despite profiling, the individual is free to decide whether to take advantage of the discount or better terms obtained in this way and make a purchase in the Online Store.
2. Profiling in the online store involves the automatic analysis or prediction of the individual’s behavior on the online store’s website, such as adding a specific product to the shopping cart, browsing a specific product page in the online store, or analyzing the individual’s previous purchase history in the online store. A prerequisite for such profiling is that the Controller possesses the individual’s personal data so that it can send them, for example, a discount code.
3. The data subject has the right not to be subject to any decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.

VIII. RIGHTS OF THE DATA SUBJECT

1. The data subject has the right to:

• to access personal data (including, for example, obtaining information about what personal data is being processed);
• to request the correction and restriction of the processing of personal data (e.g., if it is inaccurate);
• to have personal data erased (e.g., if it was processed in violation of the law);
• to have personal data provided to the Controller—which is processed automatically and where such processing is based on consent or on the necessity to fulfill a contract—transferred, for example, to another controller;
• to withdraw consent to the processing of personal data at any time, if consent is the legal basis for the processing of personal data (withdrawal of consent does not affect processing carried out by the Controller in accordance with the law prior to the withdrawal of consent);
• f) to object to the processing of personal data based on the legitimate interests of the Controller or a third party, in particular to processing for marketing purposes;

We would also like to inform you that if you suspect your personal data is being processed unlawfully, you have the right to file a complaint with the President of the Personal Data Protection Office in Poland (www.uodo.gov.pl). However, we would appreciate it if you would first try to resolve any issues with us.You may exercise the above rights by email: info@grabowskimathcards.com.

IX. Cookies

1. Cookies are small files containing letters and numbers that are sent via a web browser to a computer or smartphone, where they are stored on the hard drive. The main purpose of these files is to distinguish and identify individual website users.
2. “Cookies” are part of the HTTP protocol, which is used for communication between a web server and a browser. They consist of: an identification key, a value, and the time after which the browser should delete the cookies. Their functions are mostly standard and are used to configure the browser. Cookies are used to tailor the content of the website to your preferences, including our offers, and to improve and personalize the website’s content.
3. Cookies collect various types of information that generally do not allow for your identification. However, depending on their content and use, some information may be associated with a specific individual and is therefore considered personal data. We may process any cookies, with the exception of strictly necessary cookies, only on the basis of your consent pursuant to Article 6(1)(a) of the GDPR.
   The Online Store uses two basic types of cookies:

• a) temporary (session cookies) – these are temporary files that are stored on your device until you leave the website or close the software (web browser); and
• b) persistent cookies – these are stored on your device for the period specified in the detailed information about cookies in our cookie banner or until you delete them.

5. In addition to essential cookies (which we use to ensure the proper functioning of the website and its secure use), we may also use the following types of cookies in our Online Store:

a) Analytical and functional cookies—cookies designed to analyze how the Online Store is used. They allow us to determine the number of visitors to the Online Store, identify any issues with its operation, and continuously improve it. These cookies also make it easier for you to use the Online Store (e.g., by remembering the information and settings you have provided);

b) Marketing cookies—cookies that are used to display ads tailored to your interests and may also be used to customize the content and ads presented to you by third parties with whom we collaborate.

6. A visitor may object to the Administrator’s activities carried out for the purposes described above. If a visitor consents to the display, creation, targeting, and delivery of advertisements, offers, or promotions (discounts) tailored to their preferences, they may withdraw that consent at any time—however, this does not affect the lawfulness of processing carried out based on consent prior to its withdrawal.

7. Visitors may change how “cookies” are used by managing their consent settings in the privacy settings on our website or in their browser, including blocking or deleting those originating from the Online Store (and other websites). To do so, change your browser settings. The method of deletion varies depending on the web browser used. Information on how to delete cookies should be available in the “Help” section of your chosen web browser. Deleting cookies is not the same as deleting personal data collected via cookies by the Data Controller.

8. Restricting the use of cookies on a given device prevents or significantly hinders the proper use of the Online Store; for example, it may result in login issues.

9. The website you are currently visiting uses Google Analytics, which stores cookies. This allows us to analyze how visitors use our website very accurately and reliably. All data generated regarding website usage, including IP addresses, will be stored on Google’s servers in the United States. Google may disclose this data to third parties if required by law or if the third party processes the data on Google’s behalf. In most cases, Google will use the data for evaluation and analysis purposes on behalf of the website operator. To protect your privacy, Google will not associate IP addresses with the data it holds.

10. All third-party cookies: Google Analytics 4, Google Ads, CookieBot, HotJar, Pinterest, Klaviyo, New Relic,TikTok, Microsoft.