Privacy policy.

1. The Data Controller for the website available at www.orodeoro.com, hereinafter referred to as the Online Store, is Dariusz Król, conducting business under the name P.H.U. “KRÓL” Dariusz Król, with the main establishment at ul. Funkcyjna 3, 15-587 Białystok, Poland, registered in the Central Registration and Information on Business, VAT No: 5421004498, REGON: 050296186.

2. Respecting your rights as data subjects and adhering to applicable legal provisions, especially the European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR, the Act of 10 May 2018 on Personal Data Protection (Journal of Laws 2018, item 1000), and other relevant personal data protection regulations, we commit to maintaining the security and confidentiality of the personal data obtained from you. All employees have been properly trained in the processing of personal data, and as the Data Controller, we have implemented appropriate security measures and technical and organizational measures to ensure the highest degree of personal data protection. We have implemented procedures and policies for personal data protection in accordance with GDPR, ensuring legal compliance and reliability of data processing processes, as well as enforceability of all your rights as data subjects. Additionally, if necessary, we cooperate with the supervisory authority in Poland, i.e., the President of the Office for Personal Data Protection (PUODO).

3. In our Online Store, we collect the following personal data: a) Name and surname – processed when users of our Online Store (including customers or potential customers) provide them via email, registration form, order form, contact form available in our Online Store, traditional mail, or telephone contact, to use the offer of our Online Store, and to properly address the shipment containing the ordered product and to provide other services on your behalf, b) Residence or correspondence address – necessary for the proper shipping of ordered Products; indicating it is necessary when making purchases in our Store, c) Telephone number – processed in case of telephone contact from your side (including as customers or potential customers), and also when you provide it via email, registration form, order form, contact form available in our Online Store or traditional mail, to enable us to contact you if necessary in connection with the shipment of the ordered Product, and also to respond to questions related to our offer, d) Email address – processed when users of our Online Store (including customers or potential customers) provide it in case of contact via email, registration form, order form, or contact form available in our Online Store, as well as via traditional mail or telephone contact; through the email address, we send confirmation of the placed order, contact you if necessary related to the order processing, and respond to questions related to our offer; if you have consented to receive marketing content and have subscribed to our newsletter, we will also send you commercial information several times a month, e) NIP (Tax Identification Number) – collected from entrepreneurs and individuals who request an invoice and have a NIP number, f) IP address of the device or browser identifier – information resulting from the general principles of internet connections, such as the IP address (and other information contained in system logs), used for technical and statistical purposes, including in particular to collect general demographic information (e.g., about the region from which the connection is made), g) Other data may be collected as part of specific cases or may be provided by you as users of our Online Store (including as customers or potential customers) via email, contact form available in the Store, traditional mail, or telephone contact.

4. Providing data indicated in the preceding point is necessary in the cases specified therein, in particular: a) To use the offer of our Online Store by placing an order via the order form, including placing such an order without the need to register (create an Account) in the Online Store, b) To ship the Products ordered by you in our Online Store, c) To respond to your questions and enable contact via email, contact form available in the Online Store, traditional mail, or telephone contact, d) For voluntary registration – creating an Account in our Online Store by you; in this case, we store the data provided by you to facilitate your future use of our Online Store until you unregister (delete the Account), e) To implement the newsletter subscription service – if you want to be informed about interesting events and commercial offers, you can subscribe to our newsletter; subscription is voluntary, and you can unsubscribe at any time.

5. Our Online Store uses Cookie technology to adapt its functioning to your individual needs. You may agree to the data and information entered by you being remembered, so that it will be possible to use them during your next visits to our Online Store without the need to re-enter them. Owners of other websites will not have access to this data and information. If, however, you do not agree to personalize the Online Store, we suggest disabling the use of Cookies in your web browser options.

6. Each of you as a person using our Online Store has the option to choose whether and to what extent you want to use our services and share information and data about yourself, within the scope specified in the content of this Privacy Policy.

7. In accordance with the principle of minimization, we process only those categories of personal data that are necessary to achieve the objectives mentioned in points 3 and 4 above.

8. Personal data is processed for the period necessary to achieve the objectives mentioned in points 3 and 4 above. Personal data may be processed for a longer period if such entitlement or obligation imposed on us as the Data Controller results from specific legal provisions, from the legally justified interest of the Controller, referred to in point 10 c) below (i.e., for the period of limitation of claims or the end of relevant proceedings, if they were initiated during the limitation period) or when the service we perform is continuous (e.g., newsletter subscription).

9. The source of the Personal Data processed by the Controller is you, i.e., the data subjects.

10. The legal basis for processing your personal data is: a) Article 6 (1)(b) of the GDPR, i.e., the necessity of processing data to perform a contract to which you are a party, or to take actions at your request before entering into a contract, or b) Article 6 (1)(c) of the GDPR, i.e., the necessity to fulfill the legal obligations incumbent on the Controller, or c) Article 6 (1)(f) of the GDPR, i.e., the legally justified interest of the Controller, which is the establishment, pursuit, or defense of claims until they expire or until the relevant proceedings are concluded, if they were initiated during this period, or d) Article 6 (1)(a) of the GDPR, i.e., your consent to the processing of personal data for specific purposes, when other legal bases for processing personal data do not apply – for example, in the case of newsletter service.

11. Your personal data is not transferred to a third country or international organization within the meaning of the GDPR provisions. If personal data were transferred to a third country or international organization, you would be informed in advance, and the Controller would apply the necessary safeguards referred to in Chapter V of the GDPR.

12. No personal data is disclosed to third parties without the explicit consent of the data subject. Personal data may be disclosed without the consent of the data subject only to public law entities, i.e., authorities and administration (e.g., tax authorities, law enforcement agencies, and other entities empowered in universally applicable legal provisions).

13. Personal data may be entrusted for processing to entities processing such data on our behalf as the Personal Data Controller. In such a case, as the Personal Data Controller, we conclude a personal data processing entrustment agreement with the processing entity. The processing entity processes the entrusted personal data only for the needs, within the scope, and for the purposes specified in the entrustment agreement mentioned in the preceding sentence. Without entrusting your personal data for processing, we would not be able to conduct our activity within the Online Store or deliver parcels with ordered Products to you. As the Personal Data Controller, we entrust personal data for processing, in particular, to the following entities: a) Providing hosting services for the website on which our Online Store operates, b) Providing postal, courier, and transport services – to deliver parcels with ordered Products, c) Providing other services on our behalf, which are necessary for the current functioning of the Online Store.

14. Personal data is not profiled by us as the Administrator within the meaning of the GDPR provisions.

15. In accordance with the GDPR provisions, each person whose personal data we process as the Data Controller has the right to: a) Be informed about the processing of personal data, as referred to in Article 12 of the GDPR, b) Access their personal data, as referred to in Article 15 of the GDPR, c) Correct, supplement, update, rectify personal data, as referred to in Article 16 of the GDPR, d) Delete data (the right to be forgotten), as referred to in Article 17 of the GDPR, e) Limit processing, as referred to in Article 18 of the GDPR, f) Transfer data, as referred to in Article 20 of the GDPR, g) Object to the processing of personal data, as referred to in Article 21 of the GDPR, h) In the case of the legal basis referred to in point 10 d) above – the right to withdraw consent at any time without affecting the legality of the processing carried out on the basis of consent before its withdrawal, i) Not be subject to profiling, as referred to in Article 22 in conjunction with Article 4(4) of the GDPR, j) Lodge a complaint with the supervisory authority (i.e., to the President of the Office for Personal Data Protection), as referred to in Article 77 of the GDPR, considering the principles of using and exercising these rights resulting from the provisions of the GDPR.

16. If you want to exercise your rights mentioned in the preceding point, please use the appropriate tabs in the Online Store, which allow you to delete your account and data collected in our Online Store, or please send a message via email or in written form to the correspondence address mentioned in point 17 below.

17. All inquiries, requests, and complaints concerning the processing of personal data by the Controller, hereinafter referred to as Reports, should be directed to the following email address: contact@orodeoro.com or in written form to the following address: P.H.U. “KRÓL” Dariusz Król, ul. Funkcyjna 3, 15-587 Białystok, Poland.

18. The content of the Report should clearly indicate: a) The data of the person or persons to whom the Report relates, b) The event that is the reason for the Report, c) Present your requests and the legal basis for these requests, d) Indicate the expected way of resolving the matter.

19. Each identified case of a security breach is documented, and in the event of one of the situations specified in the GDPR or the Act, about such a violation of data protection regulations, the persons whose data are concerned, and – if applicable – the PUODO are informed.

20. All words written in capital letters have the meaning given to them in the Regulations of our Online Store unless something else arises from the content of this Privacy Policy.

21. The provisions of this Privacy Policy apply to the extent possible to all persons with whom we remain in legal relations and for whom we are also the Administrator of their personal data, including in particular our customers, contractors, newsletter subscribers.

22. In matters not regulated by this Privacy Policy, the appropriate provisions of universally applicable law apply. In the event of a conflict between the provisions of this Privacy Policy and the above provisions, these provisions take precedence.