§1. General Provisions
- This document defines the Privacy Policy of the online platform “wallcolors.com” operating at wallcolors.com, managed by wallcolors sp. z o.o., based in Trzebinia, ul. Przemysłowa 8, 32-540 Trzebinia, registered in the National Court Register under number KRS 0000964370, NIP 6282286943, REGON 52179221300000, with a share capital of PLN 100,000.00. It specifically includes regulations regarding the protection of personal data and the security of other data entered into the Service by the User.
- The Privacy Policy constitutes an integral annex to the Terms and Conditions of the wallcolors.com website.
§2. Definitions
- The terms used in this document shall mean:
- Personal Data Administrator (also referred to as the Administrator) – wallcolors sp. z o.o., based in Trzebinia, ul. Przemysłowa 8, 32-540 Trzebinia, registered in the National Court Register under number KRS 0000964370, NIP 6282286943, REGON 52179221300000, with a share capital of PLN 100,000.00.
- Service – the website at wallcolors.com and all its subpages.
- User – a natural person using the Service and sharing their personal data through it.
- Personal Data – information about an identified or identifiable natural person based on one or more factors such as physical, genetic, economic, or social data, etc.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data.
- Terms and Conditions – the Terms and Conditions of the "wallcolors.com" website operating at wallcolors.com
§3. Personal Data Protection
- The Administrator is the personal data administrator within the meaning of the GDPR.
- The Administrator collects and processes personal data in accordance with applicable legal regulations, in particular with the GDPR, and according to the principles set out in these regulations.
- The Administrator informs about data processing at the time of their collection. The Administrator processes data within the scope, duration, and purposes indicated each time in the content provided under the forms used to collect personal data from the User.
- The Administrator transfers Personal Data only to trusted subcontractors of the Administrator, i.e., couriers, providers responsible for IT system maintenance, entities such as banks and payment operators, entities providing accounting and legal services, marketing agencies (for marketing services), and entities providing other IT and programming services.
- The Administrator has the right to transfer selected Personal Data of the User to competent authorities and third parties if such an obligation arises from applicable legal provisions and if those entities request access based on a relevant legal basis.
- The Administrator ensures the security and confidentiality of the processed personal data and allows the User access to information about data processing. If, despite the implemented security measures, a breach of personal data protection occurs (e.g., a data “leak” or loss) and such a breach may result in a high risk of violating the rights or freedoms of the User, the Administrator shall inform the User about the incident in accordance with the law.
- The User may contact the personal data administrator. Contact details are as follows:
- Correspondence address: wallcolors sp. z o.o. 32-540 Trzebinia, Przemysłowa 8, POLAND
- Phone: +48 788 777 865 +48 692 775 025
- Email: hello@wallcolors.com
- In order to offer you Klarna’s payment options, we may provide your personal data in the form of contact and order details to Klarna during the purchase process, so Klarna can assess whether you qualify for their payment methods and tailor them to you. Your transferred personal data will be processed in accordance with Klarna’s privacy policy.
§4. Security of Personal Data
- The Administrator uses all available technical and organizational means to ensure the security of the User’s personal data and to protect it from accidental or intentional destruction, accidental loss, modification, unauthorized disclosure, or access. Users' personal data is stored and processed on highly secure servers, with appropriate security measures in place that meet Polish legal requirements.
- The entrusted data is stored on top-class equipment and servers in properly secured data storage centers, accessible only to authorized personnel.
- The Administrator performs personal data processing activities in compliance with all legal and technical requirements imposed by data protection regulations. The Administrator continuously analyzes the risks associated with the processing of personal data and ensures that only authorized persons have access to the data and only to the extent necessary to fulfill their duties.
- The Administrator takes all necessary steps to ensure that its subcontractors and other cooperating entities provide guarantees of applying appropriate security measures whenever they process personal data on behalf of the Administrator.
- The Administrator undertakes to store backup copies containing the User's personal data.
§5. User Rights
- In the event of a change in personal data, the User should update it by sending an appropriate message to the Administrator.
- The User has the following rights:
- the right to be informed about the processing of personal data,
- the right to obtain a copy of the personal data processed by the Administrator,
- the right to rectify personal data,
- the right to delete personal data (on this basis, one can request the deletion of data that is no longer necessary for any of the purposes for which it was collected),
- the right to restrict the processing of personal data,
- the right to transfer personal data,
- the right to object to the processing of personal data for marketing purposes (the User may object to the processing of personal data for marketing purposes at any time without the need to justify such an objection),
- the right to object to other purposes of data processing (the User may object at any time – for reasons related to their particular situation – to the processing of personal data that takes place based on the legitimate interest of the Administrator; such an objection requires justification),
- the right to withdraw consent if personal data is processed based on expressed consent (withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal),
- the right to lodge a complaint with the supervisory authority for the processing of personal data, competent for the User’s habitual residence, place of work, or the place of the alleged violation. In Poland, the supervisory authority is the President of the Personal Data Protection Office.
- The Administrator may refuse to delete the User’s personal data if its retention is required due to a legal obligation imposed on the Administrator.
- The User has the right to submit a request regarding the exercise of the rights listed above by postal mail or electronically (via e-mail). The contact details of the Administrator are indicated in § 3 section 7.
- If, based on the request referred to in section 4, the Administrator is unable to determine and identify the natural person to whom the request relates, the Administrator will ask the applicant for additional information. Failure to provide additional information will result in the denial of the applicant’s request.
- The Administrator shall respond to the request within one month of receiving it. If it is necessary to extend this period, the Administrator will inform the applicant of the reasons for the delay and the expected response time.
§6. Legal basis, purpose and duration of personal data processing
- Personal data is processed for the following purposes and on the following legal grounds:
- Use of the Service:
- Personal data of all individuals using the Service (including IP address or other identifiers and information collected via cookies or similar technologies) is processed by the Controller for the purpose of:
- providing electronic services (legal basis: necessity of processing for the performance of a contract - Article 6(1)(b) of the GDPR),
- analytical and statistical purposes (legal basis: consent – Article 6(1)(a) of the GDPR),
- establishing and pursuing claims or defending against claims (legal basis: legitimate interest of the Controller - Article 6(1)(f) of the GDPR, namely the protection of the Controller's rights).
- Registration on the Website, order form:
- To create, manage and maintain a User Account, the User is asked to provide Personal Data indicated in the registration form. Providing data is not obligatory, but refusal will result in the inability to create a User Account. To place an order on the Website, the User is asked to provide the Personal Data indicated in the order form. Providing data is not obligatory, but refusal will result in the inability to place an order. The Personal Data provided by the User is processed by the Controller for the purpose of:
- providing electronic services (legal basis: necessity of processing for the performance of a contract - Article 6(1)(b) of the GDPR),
- analytical and statistical purposes (legal basis: consent – Article 6(1)(a) of the GDPR),
- establishing and pursuing claims or defending against claims (legal basis: legitimate interest of the Controller - Article 6(1)(f) of the GDPR, namely the protection of the Controller's rights).
- Newsletter and SMS/MMS marketing service:
- Users who have expressed such a will to the Controller receive emails, SMS or MMS messages with advertising content. Signing up for the Newsletter and SMS/MMS marketing services involves providing the Controller with the User’s Personal Data. Providing data is not obligatory, but refusal will result in the inability to provide the Newsletter and SMS/MMS marketing services. The Personal Data provided by the User is processed by the Controller for the purpose of:
- providing electronic services (legal basis: necessity of processing for the performance of a contract - Article 6(1)(b) of the GDPR - for the data necessary to send the Newsletter, SMS and MMS; for optional data - legal basis: consent – Article 6(1)(a) of the GDPR),
- analytical and statistical purposes (legal basis: consent – Article 6(1)(a) of the GDPR),
- establishing and pursuing claims or defending against claims (legal basis: legitimate interest of the Controller - Article 6(1)(f) of the GDPR, namely the protection of the Controller's rights),
- marketing purposes of the Controller – sending marketing content via Newsletter, MMS and SMS (legal basis: legitimate interest of the Controller - Article 6(1)(f) of the GDPR, based on the User’s consent to use the Newsletter and SMS/MMS marketing services).
- Marketing
- The Controller processes Users’ Personal Data to carry out marketing activities, which may include displaying marketing content tailored to the User’s interests or sending commercial information electronically for the purposes of direct marketing of goods and services. In such cases, the User’s Personal Data is processed by the Controller on the basis of the User's consent (Article 6(1)(a) of the GDPR), which may be withdrawn. The Controller's marketing activities may involve profiling, i.e., automated processing of Personal Data and its evaluation to analyze user behavior and forecast future behavior, enabling the display of content in line with the User’s individual preferences and interests.
- Contact form, traditional and electronic correspondence (email)
- The User may send messages to the Controller using the contact details provided on the Website, in the Terms and Conditions, or in this Privacy Policy, as well as through the contact form available on the Website. Personal data contained in this correspondence is used by the Controller solely for communication and handling the matter to which the correspondence relates. The legal basis for processing the data is the legitimate interest of the Controller - Article 6(1)(f) of the GDPR - involving the maintenance of correspondence in connection with the Controller's business activities, and in the case of contact related to provided services or a contract - the necessity of processing to perform the contract - Article 6(1)(b) of the GDPR.
- Telephone contact
- The User may contact the Controller by phone for matters related to the services provided or the concluded contract, as well as for other matters. If the telephone contact concerns issues unrelated to the contract or service, the Controller may request Personal Data only if necessary to handle the reported issue. The legal basis for processing Personal Data is the legitimate interest of the Controller - Article 6(1)(f) of the GDPR - involving the need to resolve the issue related to the Controller's business activities, and in the case of contact related to services or a contract - the necessity of processing to perform the contract - Article 6(1)(b) of the GDPR.
- Social media profiles
- The Controller operates social media profiles (e.g., Facebook). The Controller processes Personal Data provided by individuals interacting with these profiles, such as comments or internet identifiers. The Controller uses this data to effectively manage the profiles, enable interaction, and for analytical or statistical purposes. The legal basis for processing Personal Data is the legitimate interest of the Controller - Article 6(1)(f) of the GDPR - involving the promotion of its business and services, or potentially pursuing or defending against third-party claims. The above does not apply to the processing of Personal Data by the social media platforms themselves. To understand how social media platforms process data, please refer to their respective privacy policies.
- The period of data processing depends on the service provided, the purpose, and the legal basis for processing. As a rule, data is processed for the duration of service provision or order fulfillment. If the legal basis for processing Personal Data is consent, the data is processed until such consent is effectively withdrawn. If the basis is the Controller's legitimate interest, the data is processed until a valid objection is raised.
- The processing period referred to in point 2 may be extended if the data is necessary to establish, pursue, or defend against claims. After that time, Personal Data may only be processed if and to the extent required by applicable law.
- After the personal data processing period expires, the Personal Data is deleted or irreversibly anonymized.
§7. Cookie Policy
- The Controller uses cookies. Cookies are small text files sent (stored) by the Website on the User's end device (e.g., computer, smartphone).
- The Controller uses cookies to provide electronic services, improve them and their quality, and for marketing, advertising, analytical, and statistical purposes, as well as to tailor the Website to the needs of its Users. By using cookies, the Controller personalizes content and ads. The Controller shares information about how Users use the Website with trusted social, advertising, and analytics partners to ensure the highest quality of services related to the operation of the online store, analytics, personalization, and customization.
- The Website uses two types of cookies: "session" cookies and "persistent" cookies. Session cookies are temporary files stored on the User's device until logging out, leaving the website, or closing the software (web browser). Persistent cookies are stored on the User's device for the time specified in the cookie parameters or until they are deleted by the User.
- The Controller uses the following types of cookies on the Website:
- necessary – enable the use of services and functionalities available on the Website, e.g., user authentication or maintaining a shopping cart during online purchases;
- analytical and statistical – allow obtaining various information, such as the number of visits and traffic sources on the Website. The collection of this data helps identify the most frequently visited pages and generate Website traffic statistics. The Controller uses this data to improve Website performance. The data collected is processed in anonymized form;
- marketing and advertising – enable matching the content displayed on and off the Website, including ads, to the User's interests. Personalized content may use data such as browsing history, activity on the Website (e.g., purchase history, service usage patterns, types of viewed content and ads), or geolocation data. A User interest profile is built based on activity on the Website and other platforms;
- unclassified – includes cookies that could not be assigned to the previous categories.
- Marketing, analytical/statistical, and unclassified cookies may be installed by the Controller and its trusted partners via the Website.
- The legal basis for processing data in connection with the use of necessary cookies is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR). For other cookies, the legal basis is the Controller’s legitimate interest or the User’s consent (Article 6(1)(a) and (f) of the GDPR). The Controller must obtain the User’s consent to use analytical/statistical, marketing, and unclassified cookies.
- The consent referred to in point 6 is given via a form displayed during the User’s first visit to the Website. The consent may be withdrawn or modified at any time. To change or withdraw given consent, please contact the Controller.
- The User can change cookie settings in their web browser.
- Changing cookie settings or similar technologies may affect the operation of the Website and its services.
- The Website uses third-party tools for collecting cookies. These third parties process cookies according to their own privacy policies and documentation regarding cookie standards:
- Google Ads:
- https://support.google.com/adspolicy/answer/54817?hl=pl
- https://support.google.com/google-ads/answer/12929169?hl=pl
- Meta (Facebook):
- https://pl-pl.facebook.com/privacy/policy/?entry_point=facebook_help_center_ig_data_policy_redirect
- https://www.meta.com/pl/legal/quest/cookies-pixels-and-other-technologies/
§8. Logs
- In accordance with the practice of most websites, the Controller stores HTTP requests directed to its server (server logs). As a result, the Controller stores the following information:
- IP addresses from which users browse the informational content of our website;
- time of the request;
- time of the response;
- name of the client station – identification carried out via the HTTP protocol;
- information about errors that occurred during the execution of HTTP transactions;
- URL address of the page previously visited by the user (referer link);
- information about the user's browser.
- The collected logs are stored for an indefinite period as auxiliary material used to administer the Website. The information contained in them is not disclosed to anyone except those authorized to administer the Website. Based on the log files, statistics may be generated to assist in the administration of the Website. Summaries in the form of such statistics do not contain any features identifying visitors to the Website.
- The information contained in the logs is processed by the Controller for technical and administrative purposes, to ensure the security of the IT system and manage that system, as well as for analytical and statistical purposes – in this respect, the legal basis for processing Personal Data is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR).
§9. Transfer of Data Outside the EEA
- As part of the Controller’s use of tools supporting ongoing operations provided, for example, by Google, Users’ Personal Data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States of America (USA) or another country where a partner entity maintains tools used to process Personal Data in cooperation with the Controller. The Controller transfers Personal Data outside the EEA only when necessary and with an adequate level of protection, primarily through the use of standard contractual clauses issued by the European Commission.
§10. Final Provisions
- This privacy policy is subject to updates due to the ongoing analysis of the technical and legal conditions related to personal data processing.
- This privacy policy is effective as of 01.01.2024.
