PRIVACY POLICY FOR PERSONAL DATA (GDPR)

www.ore4x4.pl

Effective from: December 20, 2021

§1

Identity of the Data Controller

1. The Controller of personal data provided during the use of the Website and Store operated at www.ore4x4.pl is Dariusz Dworzyński, conducting business under the name: ORE4X4 Sp. z o. o. with its registered office at Laski 41, 05-660 Warka, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0001084092, Tax ID: 7972085631, e-mail: biuro@ore4x4.pl, tel. 730 010 745.
2. The rules for processing cookies have been made available in the Cookies Policy at: https://ore4x4.pl/pl/content/polityka-cookies
3. The following Privacy Policy covers the principles of processing data of Website Users, customers using the services, and Followers on the Facebook Fanpage named "@ORE4x4" and Instagram named "@ORE4x4", as well as data collected through contact via email (email address or telephone).
4. Personal data is processed in accordance with currently applicable legal regulations; i.e., Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), the Act of May 10, 2018 on the protection of personal data, as well as the Act of July 18, 2002 on the provision of electronic services.

§2

Definitions Used

The following definitions are used in this policy:

1. Website/Store - a website available at www.ore4x4.pl, through which the User can browse its content, purchase selected Products, subscribe to the newsletter, or contact the data controller using the telephone/address details available on the site.
2. Personal Data Controller - an entity that decides on the purpose and means of processing data of Users and Buyers, i.e.: ORE4X4 Sp. z o. o. with its registered office at Laski 41, 05-660 Warka, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0001084092, Tax ID: 7972085631, e-mail: biuro@ore4x4.pl, tel. 730 010 745
3. User - a natural person whose data is concerned and who uses the services available on the Website, as well as customers and persons contacting via messages sent on the Facebook Fanpage named "@ORE4x4" and Instagram named "@ORE4x4", as well as data collected through contact via email (email address or telephone).
4. Personal data - all information that can lead to the identification of a natural person without excessive time and cost, including their identification, address and contact details.

§3

Purposes of Data Processing

1. The Personal Data Controller processes Users' personal data for the following purposes: a. performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, i.e., conclusion and performance of a sales contract or service agreement, based on Article 6(1)(b) of the GDPR, b. providing a response to a question asked via the telephone/address details available on the Website, contact form, or through social media, based on Article 6(1)(b) of the GDPR, i.e., the necessity of data for the performance of a contract or before its conclusion, at the request of the data subject, c. registration and creation of an Account in the Store, in particular for the purpose of adding Products to favorites, viewing order history, remembering identification and address data to facilitate making subsequent orders in the Store, etc. Creation of an Account for this purpose is based on Article 6(1)(a) of the GDPR, i.e., the consent of the data subject, d. documenting the performance of services, including issuing an invoice or receipt for a natural person, maintaining accounting and tax documentation, based on Article 6(1)(c) of the GDPR, i.e., for the purpose of fulfilling legal obligations incumbent on the Personal Data Controller, based on Article 70 of the Act of August 29, 1997 - Tax Ordinance, e. sending commercial and marketing information by the data controller (newsletter) to the email address provided by the User during newsletter subscription, with the consent of the data subject, based on Article 6(1)(a) of the GDPR, i.e., the consent of the person, f. marketing of the Data Controller's own products and services by traditional means, based on Article 6(1)(f) of the GDPR, i.e., for the purpose of pursuing the legitimate interests of the data controller or the data subject, g. pursuing rights and claims by the data controller or the data subject, based on Article 6(1)(f) of the GDPR, i.e., for the purpose of pursuing the legitimate interests of the data controller or the data subject.
2. Providing data is necessary for the conclusion and performance of sales and service contracts, maintaining accounting and tax documentation, pursuing claims, and providing answers to questions.
3. Providing personal data for the purpose of sending a newsletter is voluntary, but necessary for this purpose if the User wishes to receive the newsletter.
4. Failure to provide the required data makes it impossible to properly perform the contract (including order fulfillment and delivery, issuing an invoice or receipt, or making contact at the request of the data subject).

§4

Scope of Processed Data

1. The scope of processed personal data has been limited to the minimum necessary to achieve the purpose for which the data is processed, i.e.: a. for the purpose of issuing an invoice or receipt: first and last name or entity name, registered office address, Tax ID, other billing data, b. for the purpose of performing a sales contract: first name, last name, address, telephone number, email address, optionally bank account number from which payment was made or other billing data, as well as other data disclosed while using the services of the personal data controller, c. for the purpose of submitting an inquiry using the telephone/address details available on the site: email address, telephone number, first name, any other data voluntarily provided by the data subject, and in the case of placing an order by this route, also address data and other data necessary to fulfill the order and delivery, d. for the purpose of sending a newsletter (email, first name or User name).

§5

Data Retention Period

The data retention period depends on the purpose for which the data was collected and is:

a. for the purpose of performing contracts and services, as well as issuing accounting documents - 5 years, counting from the end of the calendar year in which the tax payment deadline expired - based on Article 70 of the Act of August 29, 1997 - Tax Ordinance,

b. for the purpose of pursuing claims by the data controller or the data subject - based on Article 118 of the Act of April 23, 1964 - Civil Code. Unless a special provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to conducting business activity - three years,

c. for the purpose of providing a response through electronic means of communication (inquiries, course information, etc.) - data is processed only for the period necessary to provide a response, but no longer than 6 months from the date of receiving the inquiry,

d. for the purpose of sending a newsletter - until consent is withdrawn, without affecting the lawfulness of processing carried out before its withdrawal.

§6

Data Source

1. Personal data is collected directly from the data subjects.
2. Personal data is provided through direct contact with the data controller using the telephone/address details available on the Website/Store site or through forms used to collect data or in traditional form.

§7

Data Recipients

1. The User's personal data may be disclosed only to entities authorized to do so on the basis of separate legal provisions or with their consent.
2. The User's personal data, in particular Buyers', may also be disclosed to online payment operators serviced in the Store or banks that maintain the Seller's bank account,
3. The User's personal data may be entrusted to other entities for the purpose of performing services on behalf of the data controller or delivering software that the data controller uses in data processing, including for the purpose of: a. hosting the website and maintaining email - hosting provider, b. accounting services and tax settlement of the data controller by an external entity (accounting office), c. courier services broker, in particular for the purpose of delivering Products according to the selected carrier, d. issuing accounting documents through specialized platforms and IT systems, e. maintaining and sending newsletters (newsletter system).
4. The Controller is the data controller for followers who use electronic communication means on the Facebook Fanpage named "@ORE4x4" and Instagram named "@ORE4x4", during contact through them. In other respects, the data controller for users of these social networks is Facebook, Inc., with its headquarters at 1 Hacker Way, Menlo Park, CA 94025, USA, and the processing of this data is carried out according to the rules described in the terms and privacy policies of users of these services, including at: https://www.facebook.com/privacy.
5. Data processing may take place outside the European Economic Area, in particular in the United States of America, in connection with the use of tools from providers located in that country (Google, Facebook, etc.) and will be based on standard contractual clauses concluded between the Personal Data Controller and the service provider. Data processing will not violate the privacy of natural persons. The data controller and service provider will provide the highest guarantees for the protection of entrusted data.
6. In other respects, the User's personal data is not processed outside the European Economic Area.

§8

Rights of Data Subjects

1. Users, including Buyers, have the right to:
   • access the content of personal data, including receiving the first copy of personal data free of charge,
   • rectify data, to delete or restrict processing (provided that further processing is not required by law),
   • withdraw consent to the processing of personal data, in particular for the purpose of sending newsletters or creating an Account in the Store. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
   • object to the processing of data - for reasons related to their particular situation with regard to processing of personal data based on Article 6(1)(e) or (f) of the GDPR,
   • information about who is the data controller, as well as obtaining information about the purpose, scope and manner of data processing, the content of this data, the source of data, and the manner of disclosure, including recipients or categories of data recipients,
   • lodge a complaint with the Personal Data Protection Office (UODO), if data processing violates the provisions of the General Data Protection Regulation (GDPR). A complaint may be submitted in electronic or traditional form to the address: Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.
2. To exercise the right to information, access to data content, its correction, and other rights, you can contact the data controller. Contact details can be found in the Contact tab on this website.

§9

Final Provisions

In the event of a change to the applicable privacy policy, particularly when technical solutions used or changes in privacy legislation regarding data subjects require it, appropriate modifications will be made to the above provisions, which will become effective within 14 days of their publication on the Website.