Privacy Policy

1. 1The controller of personal data is:

(hereinafter: the “Controller” or the “Seller”).

1. 2The Controller has not appointed a Data Protection Officer. For all matters relating to the processing of personal data and the exercise of your rights, you can contact us by email at [email protected].

Personal data is processed for the following purposes and on the following legal bases:

1. 1Concluding and performing the sales contract and fulfilling the order (including delivery, payment and customer service) — Art. 6(1)(b) GDPR. Period: for the duration of the contract and until the limitation period for claims expires.
2. 2Maintaining the Customer account — Art. 6(1)(b) GDPR. Period: until the Customer deletes the account.
3. 3Handling complaints, returns and withdrawals from the contract — Art. 6(1)(b) and (c) GDPR. Period: for as long as necessary to handle and archive them.
4. 4Meeting accounting and tax obligations (issuing and storing sales documents) — Art. 6(1)(c) GDPR. Period: 5 years from the end of the year in which the tax obligation arose.
5. 5Sending the newsletter — Art. 6(1)(a) GDPR (consent). Period: until consent is withdrawn.
6. 6Marketing our own products and services, including remarketing — Art. 6(1)(f) GDPR (legitimate interest) or Art. 6(1)(a) GDPR (consent — for marketing cookies and electronic communication). Period: until an objection is raised or consent is withdrawn.
7. 7Publishing and managing product reviews — Art. 6(1)(a) and (f) GDPR. Period: until consent is withdrawn or an objection is raised.
8. 8SMS notifications about order fulfilment — Art. 6(1)(b) GDPR; marketing SMS messages — Art. 6(1)(a) GDPR (consent).
9. 9Establishing, pursuing and defending claims, ensuring security, and compiling statistics and analyses — Art. 6(1)(f) GDPR (the Controller's legitimate interest).

1. 1Personal data may be entrusted or disclosed to the following categories of recipients, solely to the extent necessary for the purposes stated:

– the online payment operator mElements S.A. (Paynow service, mBank Group) — to process payments; – the carrier InPost S.A. — to deliver shipments; – the provider of hosting services and IT infrastructure — to run the shop; – Cloudflare, Inc. — to ensure the availability, performance and security of the website (CDN, protection against attacks); – the provider of email services and the messaging system — to communicate with the Customer; – the accounting office and providers of accounting and legal services; – entities entitled to receive data under applicable law.

1. 2The Controller entrusts processing only to entities that provide appropriate data protection guarantees, on the basis of data processing agreements.

1. 1As a rule, personal data is processed within the European Economic Area (EEA).
2. 2To the extent that some service providers (e.g. network infrastructure providers) may process data outside the EEA, data is transferred only with the appropriate safeguards required by the GDPR, in particular on the basis of standard contractual clauses approved by the European Commission. A copy of the safeguards applied can be obtained by contacting the Controller.

1. 1The data subject has the following rights:

– the right of access to the data and to obtain a copy; – the right to rectification (correction) of the data; – the right to erasure of the data (the “right to be forgotten”); – the right to restriction of processing; – the right to data portability; – the right to object to processing based on legitimate interest, including profiling for direct marketing purposes; – the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

1. 2To exercise these rights, please contact the Controller at: [email protected].
2. 3The data subject also has the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

1. 1Providing personal data is voluntary but necessary to conclude and perform the sales contract (fulfil the order). Without the data required in the order form, the order cannot be placed.
2. 2Providing data to subscribe to the newsletter, receive marketing communication and publish reviews is entirely voluntary.

1. 1The Controller may analyse Customers' activity and shopping preferences in order to tailor the content and offers presented (marketing profiling).
2. 2The Controller does not make decisions about Customers based solely on automated processing, including profiling, that would produce legal effects concerning them or similarly significantly affect them.

1. 1The shop uses cookies, i.e. small pieces of text information stored on the User's end device.
2. 2The following categories of cookies are used:

– essential — necessary for the shop to work properly (e.g. cart, session, login); processed on the basis of the Controller's legitimate interest; – functional — remember the User's preferences (e.g. language, country); – analytical/statistical — make it possible to measure traffic and website performance; – marketing — make it possible to show tailored content and advertising, including remarketing.

1. 3Cookies other than essential ones are used on the basis of the User's consent, given through the banner or browser settings.
2. 4The User may change cookie settings and delete stored cookies at any time using the web browser's functions. Restricting cookies may affect some features of the shop.
3. 5The website may use third-party cookies (e.g. from the payment operator or security provider), in accordance with their own privacy policies.

1. 1Using the shop involves the automatic recording in server logs of technical data such as the IP address, the date and time of the request, and the browser and operating system type.
2. 2This data is processed for technical and diagnostic purposes and to keep the website secure (Art. 6(1)(f) GDPR), and as a rule is not linked to the data of specific individuals.

The Controller applies appropriate technical and organisational measures to protect the personal data processed, suited to the risks and categories of data, in particular connection encryption (TLS protocol), control of access to data, and infrastructure safeguards, including protection against unauthorised access and attacks.

1. 1The Controller reserves the right to make changes to this Privacy Policy, in particular if the law or the scope of the services provided changes.
2. 2The current version of the Privacy Policy is always published at essentiqa.pl and applies from the moment it is published.