Privacy policy
PRIVACY POLICY
PRIVACY POLICY OF THE ONLINE STORE
www.colibra.eu
effective as of January 1, 2021
Respecting your rights and complying with applicable personal data protection regulations, we are committed to ensuring the security and confidentiality of personal data. All employees of the Online Store have been appropriately trained in personal data processing.
- Personal Data Controller:
The controller of personal data of Online Store Customers at colibra.eu is Colibra Polska Sp. z o.o. with its registered office at 25c/221 ks. Bishop Wincenty Tymieniecki Street, 90-350 Łódź, entered in the register of entrepreneurs of the National Court Register kept by the DISTRICT COURT FOR ŁÓDŹ-ŚRÓDMIEŚCIE IN ŁÓDŹ, XX COMMERCIAL DIVISION OF THE NATIONAL COURT REGISTER under the number KRS 0000895650, NIP 5223201287, REGON 38874477700000, with a share capital of PLN 5,000.00 (hereinafter: “Controller”), which processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), (hereinafter: “GDPR”), and in accordance with this Privacy Policy (hereinafter: “Policy”).
Contact with the Controller is possible at the above address and via email at: colibra@colibra.eu
- Information on the processing of your personal data by the Controller:
The Controller processes Customers’ personal data as follows:
- a) for account registration purposes – to provide Electronic Services, the Controller processes personal data provided by Users in the registration form. The legal basis for the Controller’s processing of personal data is Article 6(1)(b) of the GDPR, i.e., for the purpose of performing the agreement regarding the Electronic Service;
- b) for order submission and fulfillment – to conclude and perform the Sales Agreement, the Controller processes personal data provided by Customers in the order form, as well as during order placement and fulfillment. The legal basis for the Controller’s processing of personal data is Article 6(1)(b) of the GDPR, i.e., for the purpose of performing the Sales Agreement;
- c) for direct marketing of own products and services – to inform about offered products and services, the Controller processes the personal data of Customers and/or Users based on Article 6(1)(f) of the GDPR, i.e., in the Controller’s legitimate interest in direct marketing of its products and services;
- d) for sending commercial and marketing information via electronic means – to inform about the products and services offered by the Controller, in particular through sending a newsletter, the Controller processes the personal data of Customers and/or Users based on Article 6(1)(a) of the GDPR, i.e., based on the consent given;
- e) for analytical and statistical purposes – to determine the quality of provided services, the Controller processes the personal data of Customers and/or Users made available during the submission and fulfillment of orders and/or provision of Electronic Services, and made available for the purposes of sending the newsletter, based on Article 6(1)(f) of the GDPR, i.e., in the legitimate interest of the Controller in maintaining high quality of services provided by the Controller;
- f) for the purpose of fulfilling legal obligations – to comply with obligations imposed on the Controller by law, in particular tax law, the Controller processes the personal data of Customers and/or Users based on Article 6(1)(c) and (f) of the GDPR, i.e., in the legitimate interest of the Controller and the Controller’s legal obligation;
- g) for the purpose of defense against claims – to establish, pursue, or defend against claims, the Controller processes the personal data of Customers and/or Users based on Article 6(1)(f) of the GDPR, i.e., in the legitimate interest of the Controller in pursuing or defending against such claims.
III. Personal Data Collected and Processed by the Controller:
The Controller collects and processes the following personal data:
- Name and surname – during order placement, you will be asked to provide your name and surname so that we can send you the order and have the ability to contact you.
- Address of residence/delivery – we need it for shipping the ordered product.
- Phone number – we occasionally call to confirm orders or in the event of unexpected occurrences such as product unavailability, proposing the most beneficial solution.
- Email address – we send you order confirmation via email and communicate with you. If you have subscribed to our Newsletter, we will also send you commercial information once or twice a month. We will contact you based on the consent given, to the provided email address, for the promotion of the Controller’s services or goods, including information about current promotions or marketing campaigns. You can unsubscribe from receiving commercial information from the Controller at any time by withdrawing the given consent.
- Information resulting from general rules of internet connections, such as IP address (and other information contained in system logs) – used by the Controller for technical purposes. IP addresses may also be used for statistical purposes – to collect general demographic information (e.g., about the region from which the connection occurs).
- Cookies – our online store uses Cookies technology to adjust its operation to your individual needs. You may agree to have the data you entered remembered, so that you can use it without re-entering during future visits to the store’s websites. Owners of other websites will not have access to this data. If you do not agree to personalize the Store, we recommend disabling Cookies support in your web browser options. You can change Cookies settings at any time, specifying the conditions for their storage by the web browser you use. You can also delete the Cookies stored on your device at any time. Changing settings regarding Cookies or deleting them may limit access to the Online Store.
Providing personal data is voluntary but necessary to conclude and perform the Sales Agreement and provide Electronic Services by the Controller.
When making a purchase in our Store using the Order Form available on the Store’s website (Order without login/account registration) – after fulfilling such an Order, we delete all data that could identify you (name, surname, address, phone number, email address) from our database. Only the sales document is retained for fiscal purposes.
Registration in the Buyer’s database is voluntary. We store the data you provide in our database to facilitate future purchases in our Online Store.
Newsletter subscription – If you want to be informed about interesting events and commercial offers, you can become a subscriber to our Newsletter. Subscription is voluntary, and you can unsubscribe at any time.
Each user of our Store has the option to choose whether and to what extent they want to use our services and provide information about themselves. If for any reason you do not wish to leave your personal data, you have the right to delete it or not use our Store.
The Controller does not store confidential data such as your credit card numbers or access data to your bank account.
- Information on Profiling:
The personal data of Customers and/or Users will be processed automatically but will not be subject to profiling.
- Information on the Transfer of Personal Data to Third Parties:
Customer and/or User data may be shared with providers of IT or telecommunication services and solutions acting on behalf of the Controller under a valid data processing agreement.
For a Customer who uses postal or courier delivery in the Online Store, the Controller shares the collected personal data with the chosen carrier or intermediary executing shipments on behalf of the Controller.
For a Customer who uses electronic payment or payment card methods in the Online Store, the Controller shares the collected personal data with the chosen entity handling these payments in the Online Store.
The Controller will not transfer personal data of the Customer and/or User to countries outside the European Economic Area.
- Information on the Storage Period of Personal Data by the Controller:
The Controller stores the personal data of Customers and/or Users for no longer than is necessary to achieve the purposes of processing, unless storing the data for a longer period is required or permitted by law. In particular, the Controller will store Customers’ and/or Users’ data:
- a) for the purposes of managing their Account in the Online Store – until the resignation from the account or the end of providing this service by the Controller. This period may be extended by the limitation period for claims specified by law if processing these data is necessary to establish or pursue claims, as well as to defend against such claims;
- b) for the purposes of providing services to Users – for the duration of the contract for the provision of Electronic Services, and this period may be extended by the limitation period for claims specified by law if processing these data is necessary to establish or pursue claims, as well as to defend against such claims;
- c) for the purpose of submitting and fulfilling Orders – for the time necessary to conclude and fulfill the Sales Agreement and, after its execution, termination, or expiration, for the limitation period for claims specified by law if processing these data is necessary to establish or pursue claims, as well as to defend against such claims;
- d) for the purpose of pursuing the Controller’s legitimate interest in direct marketing – for the duration of the legitimate interest, but no longer than 12 months;
- e) for the purpose of pursuing the Controller’s legitimate interests, i.e., for analytical and statistical purposes to improve the quality of services provided by the Controller – for the duration of the Controller’s legitimate interest, but no longer than 12 months;
- e) data processed by the Controller based on the consent of the Customer and/or User given for the purpose of marketing the Controller’s own products and services will be stored until the consent is withdrawn;
- f) for the purpose of fulfilling the Controller’s legal obligations and its legitimate interests for the period resulting from such regulations, in particular tax law, i.e., for five full years from the last day of the calendar year in which the tax obligation related to sales agreements or services provided by the Controller to the Service Providers expired;
- g) for the purpose of pursuing the Controller’s legitimate interests, i.e., establishing and pursuing claims or defending against claims – for the limitation period for claims.
VII. Rights Regarding Personal Data:
The Customer and/or User has the right to withdraw consent to the processing of personal data by the Controller for the purposes of marketing the Controller's own products and services, with such withdrawal not affecting the lawfulness of processing based on consent before its withdrawal. In case of withdrawal of consent, the Controller will immediately cease processing the Customer’s and/or User’s data for this purpose.
The Customer and/or User has the right to object to the processing of their personal data by the Controller. In the event of objection to the processing of personal data, the Controller will stop processing them unless the Controller has compelling legitimate grounds for such processing that override the interests, rights, and freedoms of the data subject, or unless such data are necessary for the Controller to establish, pursue, or defend against claims, in accordance with this Privacy Policy.
The Customer and/or User has the right to access their personal data, correct them, request their deletion, transfer, as well as the right to request the restriction of data processing. If the Customer and/or User believes that their personal data are being processed unlawfully, they have the right to lodge a complaint with the relevant supervisory authority, i.e., the President of the Personal Data Protection Office.
The exercise of rights specified in this document is possible through personal contact with the Controller as described in point I above.
