This Privacy Policy relates to the processing and protection of Users’ personal data in connection with their use of the www.lela-beauty.com website.
Our primary aim is to ensure that Users of the Website enjoy a level of privacy protection that at least meets the standards set out in the applicable legislation, in particular the Act of 18 July 2002 on the provision of electronic services (Journal of Laws of 2002, No. 144, item 1204, as amended), and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – GDPR (Official Journal of the EU L 119, p. 1) and the Act of 16 July 2004 – Telecommunications Law (Journal of Laws of 2004, No. 171, item 1800, as subsequently amended).
Anyone using the Website remains anonymous until such time as they disclose their identity. The data controller processes personal data on the basis of, amongst other things, consent, where ‘consent’ is to be understood as ticking the relevant box or any other action that clearly indicates acceptance of the proposed processing.
The Administrator’s website and services are not intended for, nor are they directed at, children under the age of 18.
If you do not accept the terms of this Policy, please stop using the Website immediately.
-
Definitions
-
Service – website www.lela-beauty.com
-
Administrator – Data Controller: Marta Gibus, trading as LeLa Beuty Marta Gibus, 10 Swarzędzka Street, 62-020 Gortatowo, Tax Identification Number (NIP): 6652454210, REGON: 360997939.
-
GDPR – Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;
-
Personal data (or „data”) – this refers to any information relating to an identified or identifiable natural person;
-
Chair of the Office for Personal Data Protection („PUODO”) – this refers to the data protection authority;
-
An identifiable natural person – this is a person whose identity can be determined directly or indirectly, in particular by reference to an identification number or to one or more specific factors relating to their physical, physiological, mental, economic, cultural or social characteristics; information shall not be regarded as enabling the identification of a person if this would involve excessive cost, time or effort;
-
Data processing – this refers to any operations carried out on personal data, such as: collection, recording, storage, processing, modification, disclosure and erasure, and in particular those operations carried out in IT systems;
-
Who is the data controller for my personal data?
The data controller for your personal data is Marta Gibus, trading as LeLa Beauty Marta Gibus, 10 Swarzędzka Street, 62-020 Gortatowo, NIP: 6652454210, REGON: 360997939.
If you have any enquiries regarding your personal data, please contact us at the following email address: lela@lela-beauty.com
-
The legal basis and purposes of data processing depend on the type of Services you use:
Article 6(1)(b) of the GDPR, i.e. the performance of a contract for the provision of electronic services. The performance of the contract for the provision of electronic services for the purpose of carrying out activities on your behalf relating to the functionality of our Website, including ensuring that you are able to make purchases. Users’ data will be processed until the User’s account is permanently deleted
|
Service |
Legal Basis |
Purpose of processing |
Data retention period |
|
Customer Account Registration |
Article 6(1)(b) of the GDPR, i.e. the performance of a contract for the provision of electronic services. |
Performance of the contract for the provision of electronic services for the purpose of carrying out activities on your behalf relating to the functionality of our Website, including ensuring that you are able to make purchases. |
Users’ data will be processed until the User’s account is permanently deleted. |
|
Sale of Goods |
Article 6(1)(b) of the GDPR (i.e. processing is necessary for the performance of a contract to which the data subject is a party) and Article 6(1)(c) of the GDPR (i.e. compliance with a legal obligation) in conjunction with Article 18 of the Act of 18 July 2002 on the provision of electronic services (i.e. Journal of Laws of 2019, item 123, as amended) and the Civil Code. |
|
The data will be processed for the period corresponding to the limitation period for claims arising from the contract and, for the purposes of issuing invoices, for a period of 6 years. |
|
Responses to complaints |
Article 6(1)(c) of the GDPR, i.e. compliance with a legal obligation under the Civil Code (rights arising from the warranty) |
Handling complaints from Users. |
Once we have dealt with an enquiry or complaint, we retain the data for a period not exceeding two years, unless the nature of the enquiry requires a longer retention period. |
|
Marketing |
Article 6(1)(a) of the GDPR, i.e. consent to the processing of personal data, which you may voluntarily give when registering a User profile by ticking the relevant checkbox. |
Sending information about current products and offers by email and by telephone. |
We will continue to send you marketing communications until you opt out. Each marketing communication contains a link which you can use to opt out of receiving marketing communications. |
|
Submitting an enquiry via the contact form or through another communication channel |
Article 6(1)(b) of the GDPR, i.e. the performance of a contract, which involves sending a reply to your enquiry. |
Consideration of the enquiry and the reply. |
The data will be processed for a period of 2 years. |
The periods set out in the table above are calculated from the end of the year in which the Controller commenced data processing, in order to facilitate the technical monitoring of these periods. After this time, personal data is permanently destroyed or deleted.
-
Who do we share your personal data with?
The data controller discloses your personal data to the following categories of recipients:
-
Lela-Beauty staff who have been authorised to process such data and are bound by a duty of confidentiality,
-
accountancy advisers,
-
legal advisers,
-
companies providing hosting and server services,
-
software companies,
-
banks that process payments,
-
courier and transport companies for the purpose of dispatching the ordered Goods,
-
Google – using email services and Analytics to analyse website statistics,
-
Meta – social media plugins, a commenting system, and a pixel to support ad performance measurement and optimisation
The rules governing the processing of personal data as set out by the provider of Facebook, Instagram, Messenger and other products and features offered by Meta Platforms Inc. and Meta Platforms Ireland Limited (Meta) are set out in Facebook’s Privacy Policy, available at: https://www.facebook.com/privacy/policy.>
All external parties may use your data solely for the purpose of providing the relevant service. All persons with access to your data are required to process it with care and to comply with the applicable laws and regulations.
We do not pass on your personal data to third parties for commercial purposes, nor do we sell your data to other companies.
The website may disclose personal data to the relevant authorities, tax authorities and/or law enforcement agencies if required to do so by law.
-
User Permissions
-
The user has the right to request the following from the Controller:
-
access to your personal data – any person exercising this right is entitled to be informed as to whether, and if so what, information the Controller processes about them, and to receive a copy of that data free of charge,
-
data corrections – any person exercising this right is entitled to request that their data be rectified or supplemented,
-
restrictions on processing – Any person exercising this right is entitled to restrict the processing of their data where they contest the accuracy of the data or the lawfulness or necessity of its processing, and to object to such processing.
-
withdrawal of consent to the processing of data – Any person exercising this right is entitled to withdraw their previously given consent to the processing of their data for the purposes specified in that consent. Consent does not have retroactive effect, which means that the processing of data prior to the withdrawal of consent remains lawful.
-
to lodge an objection – any person exercising this right will be able to object to the processing of their data on the grounds of the Controller’s legitimate interest,
-
data transfer – any person exercising this right will be able to request that their data be transferred in PDF format to the designated Data Controller.
-
In addition to the rights set out above, any data subject has the right to lodge a complaint with the President of the Office for Personal Data Protection if they consider that their data is being processed in breach of the applicable legislation. The complaint should be lodged with The President of the Personal Data Protection Office, 2 Stawki Street, 00-193 Warsaw or via the form on the website: https://uodo.gov.pl/pl/83/153.
-
You may exercise the rights set out in point 1 by contacting us using the contact details provided in the „Contact” tab. The Data Controller will fulfil these requests by contacting the data subject via email within a maximum of 30 days of receiving the request. If, due to the specific nature or complexity of the matter, this is not possible within the 30-day period, the Data Controller will fulfil these rights within the following month and will inform the data subject of the extension without delay.
-
In the interests of security, we reserve the right to verify your identity by asking additional questions. This process enables us to verify that you are indeed the data subject.
-
The user may, at any time, change the email address to which the newsletter or commercial information is sent, or unsubscribe from the service providing commercial information free of charge, by clicking on the link in the footer of each commercial communication, entering their email address in the appropriate field, and then selecting the „Unsubscribe” button. From that point onwards, the Controller is obliged to cease sending commercial communications to the email address provided and to cease processing data for marketing purposes.
-
The data controller is entitled to refuse to comply with the rights set out above only where this is lawful and on grounds that override the data subject’s interests. The data controller shall, in each case, inform the data subject of the reasons for refusing to comply with the request.
-
Cookies
-
On the Website, we use cookies, which are small text and numerical files that are stored by the IT system on the User’s IT system (on a computer, phone or other device used by the User to access the Website) whilst browsing the Website; these enable the User to be identified later should they access the Website again from the device (e.g. a computer or phone) on which they were stored.
-
The administrator uses the following types of cookies:
-
session cookies – are stored on your device and remain there until the end of the browser session. The stored information is then permanently deleted from your device’s memory,
-
persistent cookies – are stored on your device and remain there until you delete them. Closing your browser session or switching off your device does not remove them from your device,
-
functional cookies – files necessary for the website to function properly and to ensure its security,
-
our own cookies – those placed by the Website and cookies placed by third parties, as approved by the Controller,
-
marketing cookies – for marketing purposes, we use the services of Meta Platforms Inc. (i.e. Meta Pixel) and Google LLC,
-
analytical cookies – We use the services of Google LLC, namely Google Analytics.
-
For marketing purposes, we use Facebook’s services, namely the Facebook Pixel. This service involves targeting adverts at Users who have already visited our website, as well as analysing the target audience for our services, thereby enabling us to target our adverts at potential customers. Detailed information on how Facebook Pixel works can be found on the following page: the following page: https://pl-pl.facebook.com/business/help/742478679120153?helpref=page_content.
-
We also use a service provided by Google, namely Google Analytics. This service collects information about visits to the website, such as the pages viewed, the time spent on the site and navigation between individual pages. Detailed information on how Google Analytics works can be found on the following page: https://support.google.com/analytics/answer/6004245. By using the link below: https://tools.google.com/dlpage/gaoptout It is possible to disable the tracking of activity by Google Analytics.
-
The above companies guarantee compliance with provisions analogous to those of Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. The Website’s use of their technology when processing personal data remains lawful.
-
Cookies do not store any information constituting the personal data of the Website’s Users. Cookies are not used to identify Users.
-
Cookies are used on the Website with the User’s consent.
-
Users may, at any time, withdraw or amend the scope of their previously given consent to the use of cookies on the Website, and delete them from their browser.
-
Consent may be given by the User via the relevant software settings, in particular those of the web browser, installed on the telecommunications device used by the User to view the content of the Website.
-
A Website User may also, at any time, restrict or disable cookies in their browser by adjusting its settings so that it blocks cookies or alerts the User before cookies are stored on the device they are using to view the Website’s content. In such cases, however, the User may not be able to use all the features of the Website.
-
Below, we provide information on how to disable and enable cookies in the most commonly used web browsers:
-
Browser name
Link:
Chrome
Firefox
Internet Explorer
https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies
Opera
http://www.opera.com/blogs/news/2015/08/how-to-manage-cookies-in-opera/
Safari (iOS)
Safari (macOS)
https://support.apple.com/kb/PH21411?locale=nl_NL&viewlocale=pl_PL
-
Social media plugins
-
Please note that the Website may contain links enabling its Users to access other websites directly, for which the Website owner is not responsible. We have no control over the privacy policies or the use of cookies by the administrators of those websites. We recommend that, before using the services offered by other websites, each User should familiarise themselves with the document concerning the privacy policy and the use of cookies, if such documents are available; if not, they should contact the administration of the relevant website to obtain information on this matter.
-
Privacy policies on third-party websites:
-
FACEBOOK
The Lela-Beauty website features „Like” and „Share” buttons linked to Facebook on its pages. To this end, a button linking to Facebook is displayed in the relevant sections and on the relevant pages. By using the „Like” button, the User logs into Facebook, where Facebook’s privacy policy applies. This policy can be viewed via the following link:
INSTAGRAM
The Lela-Beauty website features plugins that link to Instagram. When using this plugin, the User logs in to Instagram, where Instagram’s privacy policy applies. This policy can be viewed via the following link:
-
How do we protect your personal data?
The data controller does everything possible to ensure that your data is secure. To this end, it implements appropriate technical and organisational measures to ensure that data processing is carried out lawfully and in a manner that ensures security. To this end, we use an SSL certificate and password encryption using MD5 (Message-Digest Algorithm 5).
-
Where can I raise objections or make comments regarding the processing of my personal data?
-
by email: lela@lela-beauty.com
-
by post to the registered office of the Data Controller, LeLa Beauty Marta Gibus, 10 Swarzędzka Street, 62-020 Gortatowo
-
Final provisions
The Data Controller implements technical and organisational measures designed to ensure that the personal data being processed is protected in a manner appropriate to the risks and the categories of data concerned, and, in particular, shall safeguard the data against unauthorised access, unauthorised removal, processing in breach of applicable legislation, and alteration, loss, damage or destruction.
The Controller may update this Policy from time to time by publishing new versions on the Website. The Controller may notify users of changes to this Privacy Policy by email.