§ 1. General Provisions

1. This Website Privacy and Cookies Policy  https://ekspozytory.stalmika.com/, https://displayrack.stalmika.com/, 
https://pflastersteinverkaufsstander.stalmika.com/ hereinafter: the “Policy”) has been prepared and adopted by Stalmika Sp. z o.o.

2. Terms used herein shall have the following meanings:

1) Website, On-Line Store: https://ekspozytory.stalmika.com/, https://displayrack.stalmika.com/, 
https://pflastersteinverkaufsstander.stalmika.com/

2) User: an entity using the generally available Website;

3) Owner: Stalmika Sp. z o.o., ul. Henryka Sienkiewicza 21, 32-400 Myślenice, Poland, VAT Reg. No. (NIP): 6812066274;

4) Cookies: text files sent by the Website and saved on the User’s end device which the User uses to browse websites. The files contain information necessary for correct operation of the Website. Cookies most frequently contain the name of the website domain from which they derive, the time of storage on the end device and a number.

3. The purpose of the Policy is, in particular:

1) to provide the Users with information about the use of Cookies on the Website, required under legal provisions, including the ICT Law;

2) to offer protection of privacy to the Users within a scope corresponding to standards and requirements specified in the applicable legal provisions.

4. The Owner shall limit the collection and use of the information about the Users to the necessary minimum, required for the provision of services to them.

5. To obtain full access to the content and services offered by the Owner via the Website, acceptance of the principles resulting from the Policy is recommended. Such acceptance may be done with the use of settings of the software installed in the device used by the User or as service configuration.

6. Pursuant to Art. 6(1)(f) of the Regulation referred to in Section 7(3) of this clause, the Owner has legitimate interest in analysing the users’ activity with the aim of optimising both own Internet offer and its advertisement. Acting for the aforementioned purpose, the Owner uses Google Analytics, Facebook Pixel and Google Ads.

7. The following legal provisions shall be applicable:

1) ICT Law of 16 July 2005 (Polish Journal of Laws Dz.U. 2017.1907 uniform text, as amended);

2) Act on electronic provision of services of 18 July 2002 (Polish Journal of Laws Dz.U. 2017.1219 uniform text, as amended);

3) Regulation 2016/679 of the European Parliament and of the Council (EU) of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Journal of Laws L 119 of 04.05.2016) along with Polish provisions on personal data protection;

4) Act on the protection of personal data of 10 May 2018 (Polish Journal of Laws Dz.U.2019 item 1781 consolidated text).

§ 2. Privacy and Personal Data Protection

1. Data pertaining to the Users are processed by the Owner in compliance with legal provisions. The Users’ personal data procured by the Owner are processed on the basis of a consent granted by the User or occurrence of another premise allowing for the processing of data according to the provisions, in particular the Regulation.

2. The Owner shall exercise any effort to protect the interests of the data subjects and in particular shall make sure that such data are:

1) processed in compliance with the law, reliably and in a manner transparent for the Clients and other data subjects;

2) collected for specific, explicit and legitimate purposes and are not processed further in a way incompatible with these purposes;

3) adequate, relevant and limited to what is necessary for the purposes for which they are processed;

4) correct and, if necessary, updated;

5) stored in a form that permits the identification of the data subject, for a period not longer than it is necessary for the purposes for which the data are processed;

6) processed in a manner that ensures adequate security of personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, with the use of appropriate technical or organisational measures.

3. The Owner shall apply proper technical and organisational measures to guarantee protection of processed personal data adequate to the nature, scope, context and purposes of processing, as well as the risk of violation of rights and freedoms of natural persons.

4. The Owner shall aim for systematic upgrades of the applied IT, technical and organisational measures of data protection; in particular, the Owner shall guarantee updates of IT protection measures allowing for protection against viruses, unauthorised access and other threats resulting from the operation of the IT system and ICT networks.

5. The Owner may - apart from other cases resulting from legal provisions - process the following data of the Client that are necessary to establish, prepare the content, amend or terminate the contract:

1) Client’s first name and surname;

2) permanent address of residence;

3) correspondence address, if other than the address of residence;

4) object to the processing or limitation of processing;

5) Client’s e-mail addresses;

6) phone number.

6. The Owner may process, upon the Client’s consent and for advertising purposes, market polls and Clients’ conduct and preference surveys with the aim of assigning the results of such studies to the improvement of the quality of services provided by the Owner, as well as other data pertaining to the Client, which are necessary for providing services electronically.

7. Every User who provided his/ her personal data to the Owner shall be given access to the data by the Owner and shall exercise other rights of data subjects, in compliance with legal provisions applicable in this respect; in particular, such persons shall have a right to:

1) withdraw the consent for the processing of personal data;

2) receive information pertaining to their personal data;

3) control the processing of data, including supplementation, updating, rectification and removal of data;

4) object to the processing or limitation of processing;

5) file a complaint to a supervisory authority and to use other legal measures with the aim of protecting one's rights.

8. The Owner may process the personal data in an automated mode, including profiling, upon principles resulting from the Regulation. In such case, the aim of the Owner’s activities shall be marketing purposes or the necessity of personalising the communications sent to the Users (including adjustment of the information to the User’s needs or expectations). The User shall have a right to object with respect to such processing of his/ her data - such objection may be expressed by sending a message to the Owner’s address.

9.  A person who has access to the personal data processes them exclusively on the basis of the Owner’s authorisation or a data processing outsourcing agreement and exclusively upon the Owner’s instruction.

10. In relation to the operation of the Website, the User shall use services of other entities, including with the aim of performing a contract with the User. The Users’ personal data may be provided to:

1) a hosting company;

2) a supplier of software for Website servicing;

3) a supplier of IT services;

4) companies providing courier or postal services;

5) a supplier of electronic payment platform;

6) a supplier of invoice issue software;

7) entities providing accounting services;

8) a supplier of marketing or advertising services.

§ 3. Twisto Purchase Formula

1. This clause constitutes information of the data controller prepared pursuant to Art. 13(1) and (2) of the General Data Protection Regulation (GDPR) related to the payment service in the Twisto formula offered via the Website.

2. The Website processes your personal data for the following purposes:

a) processing payments offered on the Website;

b) providing your personal data to ING Bank Śląski S.A. (“Bank”) in relation to the provision by the Bank of an infrastructure for servicing on-line payments for the On-Line Store (legal basis: Art. 6(1)(f) of the Regulation).

c) servicing and clearance by the Bank of payments made by the On-Line Store clients with the use of payment instruments (legal basis: Art. 6(1)(f) of the Regulation).

d) for the purpose of verification, by the Bank, of proper performance of contracts concluded with the On-Line Store, in particular to ensure protection of interests of payers in relation to the complaints lodged by them (legal basis: Art. 6(1)(f) of the Regulation).

e) to provide your personal data to Twisto Polska Sp. z o.o. in relation to the possibility of offering payment for the acquired goods or services by Twisto Polska Sp. z o.o. as part of a contract of mandate encompassing the “Buy with Twisto” purchase formula, and making such formula available by the On-Line Store, as well as for the purpose of verification, by Twisto Polska Sp. z o.o. of correct performance of such contracts of mandate (legal basis: Art. 6(1)(f) of the Regulation).

3. In relation to the processing of personal data for the purposes specified in Section 1a, your personal data may be made available by the On-Line Store to other recipients or categories of personal data recipients, which may include:

a) ING Bank Śląski S.A.

b) Twisto Polska sp. z o.o.

4. In case the provision of personal data takes place with the aim of transferring your data to Twisto Polska Sp. z o.o. before conclusion of a goods (or service) sale contract purchased in the On-Line Store, the provision of such data shall be the condition precedent for entering into the sale contract in relation to the business model of operation adopted by the On-Line Store. 

5. In case of provision of your personal data to the Bank in relation to the processing and clearance of payments made by you for the benefit of the On-Line Store via the Internet with the use of payment instruments, provision of data is required for the purpose of processing payments and provision of confirmation of such payment by the Bank for the benefit of the On-Line Store.

6. In case your personal data are provided to the Bank for the purpose of verification, by the Bank, of correct performance of contacts concluded with the On-Line Store, in particular protection of payer’s interests in relation to complaints filed by them, provision of such data is required for the purpose of allowing performance of a contract concluded between the On-Line Store and the Bank.

7. In case of provision of your personal data to Twisto Polska Sp. z o.o. in relation to the possibility of paying the price for the goods or services purchased by you by Twisto Polska Sp. z o.o. as part of a contract of mandate encompassing the “Buy with Twisto” purchase formula and making such formula available by the On-Line Store, provision of such data and their processing to this aim is required in relation to the business model of conducting operation adopted by the On-Line Store and for the purpose of performing the contract concluded between the On-Line Store and Twisto Polska Sp. z o.o.

§ 4. Cookies

1. Cookies identify the User, which allows for adjusting the content of the website that is used to the User’s needs. By remembering the User's preferences, the cookies allow for correct adjustment of the content addressed to the User, including advertisements. The Owner makes use of Cookies in order to guarantee a proper standard of convenient use of the Website and the collected data are used exclusively within the company for the purpose of optimisation of activities.

2. The cookies are used to:

1) adjust the content of the Website to the User’s preferences;

2) optimise the use of the Website, in particular by recognition of the User’s end device;

3) prepare statistics;

4) maintain the User’s session;

5) deliver advertising content to the User.

3. The Owner processes statistical information pertaining to the use of the Website, including information about the session, the IP number, the amount of time spent at individual pages and sub-pages, use of individual service functionalities, information about the device and the Internet browser. Such data are processed in line with Art. 6(1)(f) of the Regulation for legitimate interests of the data controller consisting in facilitated use of the Website, improvement of quality and functionalities of the provided services, whereas the processing of such data does not violate the Users’ rights and freedoms. Information about the Users is not used for any additional purposes.

4. Such data are processed as part of ongoing operation of the Owner, however not longer than for 60 days from receipt of information. After such time, the Owner may continue to process the general statistical data which shall be devoid of any information pertaining to the individual Users.

5. It must be remembered that in some cases the software installed by the User on the end device, used for browsing the Internet (e.g. an Internet browser), has default storage of Cookies on the User’s end device. The Users may change the settings pertaining to the Cookies at any moment in time. Such settings may be changed, among others, in a manner that blocks the automatic Cookie settings or informs about every placement of Cookies on the User's end device. Detailed information in this respect is available in settings and in software manuals (Internet browser).

6. The User may, at any moment, switch off or restore the option of compiling Cookies by changing the settings of the User’s device and Internet browser within the scope of application of Cookies or other similar technologies.

7. A change of settings is an expression of objection which, in the future, may cause problems with using the Website. Swiching off the Cookies acceptance option in full does not entail no possibility of browsing the content placed on the Website with the reservation of the content that can be accessed after log-in.

8. No change of settings means that the data shall be placed on the User’s end device (use of the Website will result in automatic placement of Cookies on the User’s end device).

9. Cookies are stored on the User’s devices not longer than for 12 months.

10. Stored data placed on the User's end device do not cause configuration changes on the User’s end device or software installed on such device.

11. Information about the Cookies is also applicable to other similar technologies applied as part of the Website.

§ 5. Complaints

1. Complaints can be submitted to the Owner in an electronic form to the following address: [email protected]

2. It is possible to use out-of-court modes of complaint settlement and seek claims in legal relationships with Consumers, including:

1) possibility of dispute resolution electronically via the ODR website (on-line dispute resolution), available at the following address: https://ec.europa.eu/consumers/odr/main/index.cfm?event=main.home2.show&lng=PL;

2) possibility of carrying out arbitration procedure before a common court or other authorities.

3. The Owner shall examine a complaint within 14 days.

4. If the complaint has been acknowledged, the Owner shall take proper action.

5. With the aim of complaint settlement, the Owner shall process the personal data of the Users filing a complaint, in particular the e-mail address, first name and surname, content of the complaint, circumstances of the event which is the cause of the complaint, information procured during the processing of the complaint, including clarifications of the event which caused it. During the complaint processing, the Owner may process other information, including information about the User’s use of Services, Cookies or other similar technologies, information about devices. Such data are processed in compliance with Art. 6(1)(b) of the Regulation for the purpose of examining the complaint and are processed for a period of time necessary for complaint processing and after the end of the complaint procedure for archiving purposes in line with the Accounting Act and, if necessary, to defend against potential claims against the service provider.

6. In case a clarification procedure pertaining to potential violation of the provisions of the Regulations, the Policy or legal provisions, principles of social co-existence or best practice has been initiated, the Owner may process the User’s personal data until the end of a pending procedure and until the expiry of claims, which usually amounts to 3 years, yet in special cases foreseen by the law such period may be longer. In such case, the data shall be processed and also made available, in line with Art. 6(1)(f) of the Regulation, i.e. for a legitimate interest of the data controller consisting in seeking own claims against the User. The data controller’s legitimate interest shall then be the overriding purpose as compared to the rights and freedoms of the User.

§ 6. Final Provisions

1. The Policy was adopted pursuant to the Owner’s regulation and enters into force on 14.04.2020. Any amendments in the content of the Policy shall be made in the mode specified above.

2. Any divergences from the Policy require written form under pain of nullity.

3. The law governing the Policy shall be the law of the Republic of Poland.

4. Any issues not regulated herein shall be governed by proper legal provisions.