Privacy policy - hurtel.com

§ 1 Personal data Controller

1. The Controller of the personal data of the Customers/Users of the Internet Shop, also referred to as the Seller, is HURTEL Sp. z o.o., Phone No.: (+48) 68 300 01 56, NIP: PL9731008073, REGON: 081016920.
2. The Data Controller can be contacted:
   1. At the mailing address: ul. Międzyrzecka 12, 65-127 Zielona Góra;
   2. At the following e-mail address: biuro@hurtel.com.
3. User – a natural person entering the website/websites of the Online Store or using the services or functionalities described in this Privacy and Cookies Policy.
4. Customer – a natural person with full legal capacity, a natural person who is a User, a legal person or an organisational unit without legal personality to which the law grants legal capacity, who concludes a distance sales agreement with the Seller.
5. Online shop - the Website operated by the Seller, available at the following website addresses (sites): https://hurtel.com/ , through which the Customer/User can obtain information about the Goods and their availability and buy the Goods or order services. za pośrednictwem, którego Klient/Użytkownik może uzyskać informacje o Towarze i jego dostępności oraz kupić Towar lub zlecić świadczenie usługi.
6. Newsletter - information, including commercial information within the meaning of the Act of 18 July 2002 on the provision of electronic services (Journal of Laws of 2020, item 344) originating from the Seller sent to the Customer/User electronically; its receipt is voluntary and requires the Customer/User's consent.
7. Account - a set of data stored in the Online Store and in the Seller's IT system concerning a given Client/User and the orders they place as well as contracts they conclude, using which the Client/User may place orders and conclude contracts.
8. GPDR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

§ 2 Objectives, legal basis and time of data processing

1. To perform the Distance Sales Contract, the Seller processes:
1. Information regarding the User's device to ensure the correct operation of the services: IP address of the computer, cookie information or other similar technologies, session data, browser data, device data, data regarding activity on the Website, along with data on individual sub-pages;
2. Geolocation information, if the User has consented to the service provider's access to geolocation. Geolocation information is used to provide more customised offers of products and services;
3. The Users' personal data: name, surname, registered address, correspondence address, e-mail address, telephone number, Tax Identification Number, bank account number or other personal data which is necessary to complete the purchase and which the Controller requires to be provided during the purchase process. This information does not contain data concerning the identity of the Users, but when combined with other information, it may constitute personal data, and consequently, the Data Controller covers it with full protection under GDPR.
2. This information does not contain data concerning the identity of the Users, but when combined with other information, it may constitute personal data, and consequently, the Data Controller covers it with full protection under GDPR.
3. This data is processed in accordance with Art. 6 item 1(b) GDPR to provide the service, i.e. the contract for the provision of electronic services in accordance with the Terms and Conditions, pursuant to Art. 6 item 1(c) GDPR to fulfil a legal obligation, i.e. to keep accounting and tax records; pursuant to Art. 6 item 1(f) GDPR for the purpose of the legitimate interests of the Controller, i.e. the establishment, investigation or defence of claims made; pursuant to Art. 6 item 1 (a) GDPR concerning the consent to the use of certain cookies or other similar technologies, expressed by the relevant settings of the web browser under the Telecommunications Law or in connection with the consent to access geolocation information.
4. The data is processed until the end of the Customer/User's use of the Online Shop. Personal data is kept for the duration of the performance and archiving of the contract and otherwise until consent is withdrawn.
5. The Controller undertakes to take all measures required under Art. 32 GDPR, i.e., taking into Account the state of technical knowledge, the cost of implementation and the nature, scope and purposes of processing, as well as the risk of violating the rights or freedoms of natural persons of varying likelihood and severity, the Controller implements appropriate technical and organisational measures to ensure a degree of security corresponding to this risk.

§ 3 Data Controller's marketing activities

The Data Controller may post-market information about the products or services on the Website of the Online Shop. The display of this content is carried out by the Data Controller in accordance with Art. 6 item 1(f) GDPR, i.e. in accordance with the legitimate interest of the Data Controller to publish content related to the services provided and promotional content of campaigns in which the Data Controller is involved. Simultaneously, this action does not infringe on the rights and freedoms of Customers/Users, Customers/Users expect to receive content similar to this, or even expect it, or it is their direct purpose for visiting the Website (s) of the Online Shop.

At the same time, the Administrator may send surveys on customer satisfaction questionnaires. The Data Protection Authority has recognized that customer satisfaction surveys are part of direct marketing. This is because it helps "in determining the company's strategy and increasing influence and market share." It also pointed out that the controller did not need to obtain customer approval in this situation, as it was processing data for marketing purposes on the basis of the need to fulfill the legitimate interest of the administrator (Article 6(1)(f) of the GDPR).

§ 4 Recipients of User Data

The Data Controller shall only disclose users' personal data to processors under concluded personal data processing entrustment agreements to perform services for the Data Controller, e.g. hosting and maintenance of the Site, IT services, marketing and PR services.

§ 5 Transfer of personal data to third countries

Personal data will not be processed in third countries.

§ 6 Rights of data subjects

1. Every data subject has the right:
1. Of access (art. 15 GDPR) - to obtain confirmation from the Data Controller as to whether his/her personal data are being processed. If data about a person are being processed, he or she shall be entitled to have access to them and to obtain the following information: the purposes of data processing, the categories of personal data, the recipients or categories of recipients to whom the data have been or will be disclosed, the period for which the data will be stored or the criteria for determining it, the right to request rectification, deletion or limitation of the processing of personal data, and to object to such processing;
2. To receive a copy of the data (Art. 15 item 3 GDPR) - to obtain a copy of the data undergoing processing, the first copy being free of charge and for subsequent copies, the Data Controller may charge a reasonable fee based on administrative costs;
3. To rectify data (Art. 16 GDPR) - to request the rectification of personal data concerning him/her that is inaccurate or the completion of incomplete data;
4. To delete data (Art. 17 GDPR) - request the erasure of her personal data where the Controller no longer has a legal basis for the processing or the data are no longer necessary for the purposes of the processing;
5. To restrict processing (Art. 18 GDPR) - to request the restriction of the processing of personal data when:
   1. The accuracy of the personal data is contested by the data subject, for a period, enabling the Controller to verify the accuracy of the personal data;
   2. The processing is unlawful and the data subject objects to the erasure by requesting a restriction of use;
   3. The Data Controller no longer needs the data, but it is needed by the data subject to establish, assert or defend a claim;
   4. The data subject has objected to the processing - until it is determined whether legally justified grounds on the part of the Controller prevail over the grounds of objection of the data subject;
6. To transfer data (Art. 20 GDPR) - to receive in a structured, commonly used machine-readable format the personal data concerning him or her which he or she has provided to the Controller, and to request that these data be sent to another Controller where the data are processed on the basis of the data subject's consent or a contract with him or her and where the data are processed by automated means;
7. To object (Art. 21 GDPR) - to object to the processing of his/her personal data for the legitimate purposes of the Controller, on grounds relating to his/her particular situation, including profiling. The Controller shall then assess the existence of valid legitimate grounds for the processing which override the interests, rights and freedoms of the data subjects, or grounds for the establishment, exercise or defence of claims. If, according to the assessment, the interests of the data subject override the interests of the Controller, the Controller will be obliged to cease processing the data for these purposes;
8. To withdraw consent to the processing of personal data (Art. 7 item 3 GDPR) - where processing is based on the data subject's consent, the data subject has the right to withdraw his or her consent at any time, but this does not affect the lawfulness of the processing carried out on the basis of consent prior to its withdrawal; to withdraw consent at any time and without stating a reason, but the processing of personal data carried out before the withdrawal of consent will continue to be lawful.
9. Withdrawal of consent will cause the Data Controller to cease processing of personal data for the purpose for which the consent was given.
2. To exercise the aforementioned rights, the data subject should contact, using the contact details provided, the Data Controller and inform him/her of which right and to what extent he/she wishes to exercise it.

§ 7 President of the Office for Personal Data Protection

1. The data subject shall have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Office for Personal Data Protection with the seat in Warsaw, at ul. Stawki 2 who can be contacted in the following way:
1. By letter: ul. Stawki 2, 00-193 Warsaw;
2. Via the electronic mailbox available at: https://www.uodo.gov.pl/pl/p/kontakt ;
3. Via hotline: 606-950-000.

§ 8 Data Protection Officer

The Data Protection Officer is Rafał Wielgus, e-mail contact: iod@bhpex.pl, phone no.: 68 411 40 00. In any case, the data subject may also directly contact the Data Protection Officer of the Controller by e-mail or in writing to the address of the Controller as set out in section 1, point 2 of this Privacy and Cookies Policy.

§ 9 Changes to the Privacy Policy

The Privacy and Cookies Policy may be supplemented or updated according to the current needs of the Controller to provide up-to-date and reliable information to Customers/Users.

§ 10 Cookies

1. The online shop performs the functions of obtaining information about Customers, Users and their behaviour in the following ways:
   1. Through the information voluntarily entered in the forms for purposes arising from the function of the specific form;
   2. By storing cookie files (so-called "cookies") on User's devices;
   3. Through the collection of web server logs by the webshop's hosting operator (necessary for the correct operation of the Website).
2. Cookies are IT data, in particular text files, which are stored on the Customer's/User's equipment and are intended for the use of the Website of the Online Shop. Cookies usually contain the name of the Website from which they originate, the time for which they are stored on end devices and a unique number.
3. The online shop uses cookies only after the Customer/User of the shop has given their prior consent in this respect. You consent to the Online Shop's use of all cookies by clicking on the button: "Close" when the message about the use of cookies by the Online Shop is displayed or by closing the message.
4. If the Customer/User of the Online Store does not agree to the Online Store's use of cookies, he/she can use the option: "I do not give my consent", also available in the message about the use of cookies by the Online Shop or make changes in the settings of the Internet browser he/she is currently using (however, this may result in incorrect operation of the Online Shop website).
5. To manage your cookie settings, select your browser/system from the list and follow the instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.
6. The legal basis for the processing of personal data derived from cookies is the legitimate interests of the Data Controller to provide high-quality services, to ensure the security of the services.
7. The Online Shop uses two main types of cookies: "session" (session cookies) and "permanent" (persistent cookies). "Session" cookies are temporary files that are stored on the User's terminal equipment until the User logs out, leaves the Online Shop or switches off the software (web browser). "Permanent" cookies are stored on the Client/User's device for the period of time specified in the parameters of the cookies or until they are deleted by the Client/User.

8. The cookie files are used for the following purposes:
   1. To create of statistics which help us to understand how the Customers/Users of the Internet Shop use the websites, which enables us to improve their structure and content;
   2. To maintain a Customer/User session (after logging in), so that the Customer/User does not have to re-enter his/her login and password on each sub-page of the Online Shop;
   3. To profile the Customer/User to display product recommendations and tailored material to him/her on advertising networks, in particular the Google network.
9. The web browsing software (web browser) usually allows cookies to be stored on the Customer/User's device by default. Customers/Users can change their settings in this respect. Web browsers allow the users to delete cookies. Cookies may also be blocked automatically.
10. Restrictions on the use of cookies may affect some of the functionality available on the web pages of the Online Shop.
11. Cookies are placed on the Customer's/User's device and may also be used by advertisers cooperating with the Online Shop and the Online Shop's partners.
12. Cookies may be used by the Google network to display advertisements tailored to the way the Customer/User uses the Online Shop. For this purpose, they may retain information about the User's navigation path or the time they stayed on a particular page: https://policies.google.com/technologies/partner-sites/ .
13. We recommend that you read the privacy policies of these companies to understand the use of cookies used in statistics: Google Analytics Privacy Policy.
14. With regard to the information about the Customer/User's preferences collected by the Google advertising network, the Customer/User can view and edit the information resulting from the cookies using the tool: https://www.google.com/ads/preferences/ .
15. The Website of the Online Shop contains plug-ins that may transmit Customer/User data to Controllers such as Google Maps, Google Analytics, Meta (Facebook), Google Ads, PayPal, Google reCAPTCHA, IdoAccounts, IdoSell, IAI S.A., Google.
16. To properly perform the Distance Selling Agreement, the Data Controller may share the Customers/Users' data with delivery companies. The currently available delivery methods in the Online Shop are available at: https://hurtel.com/en/delivery.html .
17. To properly perform the Distance Selling Agreement, the Controller may share the Customers'/Users' data with online payment systems. The currently available prepaid payment methods in the Online Shop are available at: https://hurtel.com/pl/payments.html .

§11 Newsletter

1. The Controller of the personal data of the Customers/Users of the Internet Shop, also referred to as the Seller, is HURTEL Sp. z o.o., phone no.: (+48) 68 300 01 56, NIP: PL9731008073, REGON: 081016920.
2. The Customer may agree to receive commercial information by e-mail by ticking the appropriate option in the registration form or at a later date in the relevant tab. In the case of giving such consent, the Customer/User will receive to the e-mail address provided by him information (Newsletter) of the Online Shop, as well as other commercial information sent by the Seller.
3. The Customer may unsubscribe from the Newsletter at any time on his/her own by unchecking the relevant box on his/her Account page or by going to the form https://hurtel.com/pl/newsletter.html, clicking on the relevant link in the content of each Newsletter or via the Customer Service.

§ 12 Account

1. The Customer/User may not post content, including opinions and other data of an unlawful nature, on the Online Shop or provide the Seller with such content.
2. The Customer/User gains access to the Account after registration.
3. As part of the registration, the Customer/User enters the account type or gender, first name, surname, company name, TIN, details for the sales document, shipping details, e-mail address and selects a password. The Customer/User warrants that the data provided by him/her in the registration form is correct and true. Registration requires careful reading of the Terms and Conditions and indicating on the registration form that the Customer/User has read the Terms and Conditions and fully accepts all of their provisions.
4. At the moment of granting the Customer/User access to the Account, an agreement for the provision of electronic services concerning the Account is concluded between the Seller and the Customer for an indefinite period of time. The User may withdraw from this contract under the terms of the Terms and Conditions.
5. Account registration on one of the pages of the Online Shop simultaneously means registration enabling access to other pages at which the Online Shop is available.
6. The Customer/User may terminate the contract for the provision of electronic services at any time with immediate effect by informing the Seller by e-mail or in writing to the Data Controller's address as set out in section 1, item 2 of this Privacy and Cookies Policy.
7. The Seller has the right to terminate the service contract concerning the Account in the event of discontinuation of the provision or transfer of the Online Shop service to a third party, violation of the law or the provisions of the Terms and Conditions by the Customer/User, as well as in the event of inactivity of the Customer/User for a period of 6 months. The contract is terminated with a seven-day notice period. The Seller may stipulate that re-registration of the Account will require the Seller's permission.