We use cookies and similar technologies on our website that may be used to personalize advertising. Details in our privacy policy. Additional information here

Necessary

Cookies used to provide basic functionalities of our site

Personalization

Cookies used to provide personalized content, like product suggestions

Statistics

Cookies used to monitor our site usage

Marketing

Cookies used to personalize advertising

In accordance with the information obligation under Articles 12 and 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), the Data Controller hereby informs as follows:

1. This Privacy Policy (hereinafter referred to as the “Policy”) is addressed to Users and Purchasers using the website available under the domain https://zatopiona-flora.pl (hereinafter referred to as the “Online Store”) and defines the type, scope, and purposes of personal data processing. This Policy is informational in nature and constitutes an integral part of the Terms and Conditions of the Online Store. All capitalized terms used in this Policy shall have the same meaning as assigned to them in the Terms and Conditions of the Online Store, unless this Policy states otherwise.

2. The administrator of the personal data obtained through the Online Store is the Seller, i.e., Ms. Kamila Górecka, conducting business as a sole proprietor under the name FHU Kamila Górecka, with its registered office at ul. Kościelna 3, 87-213 Ryńsk, Poland, NIP: 8781811096, REGON: 541081011, hereinafter also referred to as the “Administrator”.

3. When placing an Order in the Online Store without registering an Account, and/or registering an Account, and/or contacting the Seller (via email, telephone, or through the contact form), and/or using other services provided electronically by the Seller (password reset, newsletter subscription, adding Products to the wishlist, submitting a Product review), the User provides the Seller with their personal data (such as: full name, address, email address, phone number, company name if applicable, business address, VAT ID, and the IP address of the device used by the User to browse the Online Store or add Products to the wishlist).

4.Purposes and operations related to personal data processing:

4.1. Placing an Order without Account registration – providing personal data (full name, address, contact phone number, and email address, which may contain personal data) is voluntary, but necessary for the purpose of fulfilling the Sales Agreement and delivering the Order to the address specified by the Purchaser. The data provided when placing the Order is used solely to perform the Sales Agreement concluded with the User, and the legal basis for processing is Article 6(1)(b) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR). The data will be processed by the Controller for the time necessary to perform the Sales Agreement; however, the Controller may retain the User’s data in order to defend against potential claims related to withdrawal from the agreement, handling complaints, and for tax settlement purposes, but no longer than 5 years from the date of data collection. This constitutes the legitimate interest of the Controller as referred to in Article 6(1)(f) of the GDPR.

4.2. Account registration – The User may register an Account in order to avoid providing personal data with each subsequent purchase. Providing data (full name, address, contact phone number, and email address which may contain personal data) is voluntary, but necessary for Account registration. The data provided during registration is used to maintain the Account and fulfill Sales Agreements concluded between the Purchaser and the Controller as Seller. The legal basis for processing this data is the User’s consent granted during Account registration (pursuant to Article 6(1)(a) of the GDPR). The data will be processed for as long as the Account is maintained, unless the User decides to delete the Account earlier. However, deleting the Account does not result in the deletion of personal data. The Controller may continue to store the User’s data to defend against potential claims related to Account management, particularly to demonstrate that the User consented to Account registration, but no longer than 5 years from the date the consent was withdrawn. This constitutes the legitimate interest of the Controller as referred to in Article 6(1)(f) of the GDPR.

4.3. Contact between the User of the Online Store and the Controller – when contacting the Controller via email, the contact form, or by telephone using the contact details provided in the "Contact Us" section of the Online Store, the User provides the Controller with their email address as the sender of the message, as well as their full name and contact phone number. Providing this data is voluntary but necessary for the Controller to establish contact with the User of the Online Store. The User's data is processed in this case in order to communicate in response to actions requested and initiated by the User, including responding to reports regarding illegal content identified by the User in the Online Store. The legal basis for processing the data is Article 6(1)(b) of the GDPR. The legal basis for data processing after the contact has ended is the legitimate interest of the Controller in archiving correspondence to demonstrate the course of communication in the future (Article 6(1)(f) of the GDPR). The content of the correspondence may be archived, but no longer than 5 years from the date the data was obtained. The User of the Online Store has the right to request the history of correspondence conducted with the Controller (if archived), as well as to request its deletion, unless the archiving is justified due to the overriding interest of the Controller, such as defending against potential claims from the User of the Online Store.

4.4. Use of the password reset service – providing data (email address, which may contain personal data) is voluntary, but necessary to perform the electronic service agreement by the Controller. The data provided by the User is used to send the password reset instructions by email. The legal basis for processing is the performance of a contract concluded with the User, in accordance with Article 6(1)(b) of the GDPR. The data will be processed by the Controller for the time necessary to perform the electronic service agreement, but no longer than 5 years from the date of collection. After the service is completed, the Controller may continue to store the User's data in order to defend against potential claims related to services provided electronically, including complaint handling, which constitutes the legitimate interest of the Controller referred to in Article 6(1)(f) of the GDPR.

4.5. Newsletter – A User of the Online Store who wishes to subscribe to the newsletter in order to receive commercial, promotional, and marketing information regarding Products via email must provide their email address (which may contain personal data) via the newsletter subscription form or by ticking the appropriate checkbox when placing an Order. Providing data is voluntary but necessary to receive messages from the Controller. The data provided when subscribing to the newsletter is used to send messages to the User. The legal basis for processing is the User’s consent given when subscribing to the newsletter (in accordance with Article 6(1)(a) of the GDPR). The data will be processed by the Controller for the duration of the newsletter service, unless the User unsubscribes earlier. Unsubscribing from the newsletter does not result in complete deletion of the data. The Controller may continue to store the User's data in order to defend against potential claims related to newsletter delivery, in particular to prove the User's consent to receive the newsletter, which constitutes the Controller’s legitimate interest under Article 6(1)(f) of the GDPR. The retention period after unsubscribing is no longer than 5 years.

4.6. Searching for a Product in the Online Store, adding a Product to the wishlist – User data collected in the Online Store's system logs (IP address) is used by the Controller solely for the purpose of displaying relevant information to the User in accordance with their request, which constitutes the legitimate interest of the Controller referred to in Article 6(1)(f) of the GDPR.

4.7. Posting a Product review – providing personal data (email address that may contain personal data) is voluntary but necessary to perform the agreement for electronic service provision by the Controller. The personal data provided by the User is not displayed on the Product page alongside the submitted review. The data provided by the User is used for the purpose of posting a review on the Product page. The legal basis for processing is the performance of an electronic service agreement concluded with the User, in accordance with Article 6(1)(b) of the GDPR. The data will be processed by the Controller for the duration the User’s review remains published on the Product page. After fulfilling the agreement, the Controller may continue to store the User’s data to defend against potential claims related to services provided electronically or for handling complaints, but for no longer than 5 years from the date the data was collected. This constitutes the legitimate interest of the Controller, as referred to in Article 6(1)(f) of the GDPR.

4.8. Analysis and statistics related to the Online Store – the User’s personal data (IP address) collected in the system logs of the Online Store, for example during the addition of Products to the wishlist or product comparison, is used by the Controller to analyze User activity within the Online Store in order to improve its functionalities and technical-administrative support. This constitutes the Controller’s legitimate interest, and the legal basis for processing is Article 6(1)(f) of the GDPR.

4.9. Compliance with the obligations arising from the GPSR Regulation – the User’s personal data (full name, address, contact phone number, and email address that may contain personal data), as well as identification data and information about purchased Products, is processed by the Controller to fulfill the obligations arising from Regulation (EU) 2023/988 of the European Parliament and of the Council on general product safety, amending Regulation (EU) No 1025/2012 and Directive (EU) 2020/1828, and repealing Council Directive 87/357/EEC and Directive 2001/95/EC, dated 10 May 2023 (hereinafter referred to as the “GPSR Regulation”). The Controller’s obligations include identifying and reporting potential product-related hazards, ensuring product compliance with safety requirements, and notifying relevant authorities or Users when safety actions are required. The GPSR Regulation also obliges the Controller to issue notifications if required by law and to provide details of reported safety issues. The legal basis for processing is the necessity of fulfilling a legal obligation incumbent on the Controller in accordance with Article 6(1)(c) of the GDPR.

5. The Controller informs that the User of the Online Store has, at any time, the right to data portability as referred to in Article 20 of the GDPR, the right to access personal data, and the ability to rectify, correct, object to the processing of such data. Any consent given for data processing may be withdrawn by the User at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal. The Controller may refuse to delete the User’s personal data if there are legal grounds to do so. The User also has the right to lodge a complaint regarding the processing of their personal data with the President of the Personal Data Protection Office. User data will not be subject to automated decision-making, including profiling. Personal data is not transferred outside the European Economic Area.

6. The rules governing the exercise of the aforementioned rights by the User are detailed in Articles 15–21 of the GDPR.

7. The Controller also informs that personal data collected from Users is never transferred, sold, or made available to third parties not mentioned in this Policy or in the Terms and Conditions of the Online Store (e.g., payment processing banks, online payment service providers, delivery providers, accounting firms, companies providing technical maintenance of the server hosting the Online Store), unless with the User’s explicit consent or request, or at the request of authorities legally entitled to such access (e.g., courts, law enforcement agencies, the Trade Inspection Authority).

8. The Controller processes the personal data provided by the User in accordance with the scope of the User's consent and the applicable law, including the provisions of the GDPR. In particular, the Controller protects the Users’ personal data from access by unauthorized persons, loss, or damage, and guarantees the confidentiality of all personal data provided. The Online Store uses an SSL certificate to secure the connection.

9. The Online Store website may contain links to other websites not administered by the Controller (e.g., Facebook, Instagram, TikTok). The User may also be redirected to the Online Store from other websites, such as through a tracking pixel from the Facebook social media platform. Therefore, the Controller shall not be held liable for the content of those external sites or the level of data protection implemented by the administrators of those sites. The Controller informs that this Privacy Policy applies solely to the Online Store, and that upon navigating to other websites, the User is advised to read the privacy policy of the relevant site before sharing any personal data. Visiting such third-party websites is done at the User’s own risk.

10. The Online Store uses cookies to identify the User’s browser when using the Store, so that the appropriate page can be displayed. Cookies do not contain any personal data. When entering the Online Store, certain information may be stored on the User’s computer in the form of a cookie file. The most detailed and up-to-date information on this subject is available directly on the producer’s website: http://www.google.pl/intl/pl/policies/technologies/types/

11. "Cookies" are small text files consisting of strings of letters and characters stored on the User’s computer when visiting a given Product page presented in the Online Store. Cookies are used exclusively to tailor the website better to the individual preferences of the User. Additionally, cookies may be used for the following purposes:

a) ensuring proper operation and enhancing the functionality of the Online Store – cookies allow for the retention of information entered by the User, such as remembering the contents of the cart, login credentials, or form data;

b) improving performance and optimizing the Online Store – cookies allow the Controller to analyze how Users navigate the Store, which helps improve its performance;

c) targeting informational and promotional content – cookies aim to automatically tailor the content of the Online Store to the User’s needs;

d) preventing spam.

12. Information collected and generated by cookies in the Online Store does not enable the personalization or identification of the User, and no personal data is stored as a result of their use.

13. Cookies used in the Online Store are safe and do not harm the User’s computer. The User may at any time modify how their browser uses cookies, including withdrawing consent, blocking, or deleting those originating from the Online Store. Most internet browsers allow cookies to be deleted from the hard drive, block all cookies, or alert the User before saving a file. Please consult the user manual or help section of your browser for details. The process of managing and deleting cookies may vary depending on the browser used.

14. If the User does not consent to the use of minimum (essential) cookies, this may result in the improper display of subpages within the Online Store. Lack of consent for other types of cookies may limit certain functionalities. The User may choose to allow only selected groups of cookies.

15. The Controller uses traffic analysis tools, including Google Analytics (by Google Inc., USA), and may also use Google Analytics 4. Detailed information about this tool is available at:

https://support.google.com/analytics/answer/10089681?hl=pl&ref_topic=9143232.

The Online Store also uses Google’s DSA (Dynamic Search Ads). No personal data is shared with these service providers—only anonymized information is used. These services rely on cookies stored on the User’s device. Users can view and edit their Google Ads preferences using:

https://www.google.com/ads/preferences/.

More information on how Google uses data is available at:

https://policies.google.com/technologies/partner-sites,

https://policies.google.com/technologies/cookies,

and https://support.google.com/google-ads/answer/2471185?hl=pl.

16. The Controller has the right to amend this Policy for valid reasons (e.g., changes in legislation, changes to the ordering process in the Online Store). If any changes are made, the User will be informed at least 14 days in advance of the effective date. Appropriate information will be posted in the Online Store, and Users with an Account or newsletter subscription will also be notified by email. If the User does not accept the amended Policy, they have the right to terminate it and thereby request the removal of their personal data.

17. If the User has any questions, comments, requests, or suggestions regarding this Policy, they are encouraged to contact the Controller. The User is also asked to immediately report any detected security breaches related to the use of the Online Store by email at: [email protected] or by phone: +48 537 352 269, on business days from Monday to Friday between 10:00 AM and 6:00 PM, and on Saturdays from 10:00 AM to 4:00 PM (call charges according to the User’s telecom provider).

Ryńsk, 06 May 2025