WEBSITE PRIVACY POLICY

WWW.LAVITA.PL

1. DOMINO POLSKA spółka z ograniczoną odpowiedzialnością, with its registered office at ul. Rzeźnicza 4, 58-200 Dzierżoniów, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Wrocław-Fabryczna in Wrocław, 9th Commercial Division of the National Court Register, under KRS number 0000931550, NIP: 8821005310, REGON: 890277850, correspondence address: ul. Popiełuszki 14, 58-260 Bielawa, hereinafter referred to as the Controller, is the controller of the personal data of users of the website available at www.lavita.pl, hereinafter referred to as the Website.
2. The Controller has implemented appropriate safeguards as well as technical and organisational measures, including a Personal Data Protection Policy and relevant procedures. The Controller has also trained employees who process your personal data as part of their duties in order to ensure an appropriate level of personal data protection, taking into account the applicable laws, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the GDPR, the Polish Act of 10 May 2018 on the Protection of Personal Data, hereinafter referred to as the Act, and other applicable personal data protection regulations.
3. The Controller has appointed a Data Protection Officer, namely legal counsel Martyniusz Rak, e-mail address: iod@domino.pl.
4. The following personal data are collected through the Website:
   1. first name and surname, e-mail address and telephone number – these data may be processed when you provide them as users of our Website (including customers or prospective customers) by e-mail, traditional mail or telephone for the following purposes:
      • to enable us to contact you if necessary in connection with the fulfilment of an order,
      • to answer questions concerning the Website's offer;
   2. NIP tax identification number and residential address/registered office/principal place of business – these data are collected from entrepreneurs and natural persons who request an invoice and hold a NIP number, for the purpose of issuing an invoice; in the case of natural persons who are consumers, a residential address is sufficient;
   3. the IP address of the device or browser identifier – information arising from the general principles governing Internet connections, such as an IP address and other information contained in system logs, is used for technical and statistical purposes, in particular to collect general demographic information (e.g. the region from which the connection is made);
   4. where applicable, other data may be collected in connection with the handling of specific matters or may be provided by you as users of the Website (including customers or prospective customers) by e-mail, traditional mail or telephone.
5. The Website uses cookies to adapt its operation to your individual needs. You may therefore consent to the data and information you enter being stored so that they can be used during subsequent visits to the Website without having to be entered again. The owners of other websites will not have access to these data and information. If you do not agree to the use of such features, please disable cookies in your web browser settings.
6. The source of the personal data processed by the Controller is you, i.e. the data subjects.
7. The legal basis for the processing of your personal data is:
   1. Article 6(1)(b) GDPR, i.e. processing is necessary for the performance of a sales or service agreement to which you are a party, or in order to take steps at your request prior to entering into such an agreement with the Controller; or
   2. Article 6(1)(c) GDPR, i.e. processing is necessary for compliance with legal obligations to which the Controller is subject, in particular obligations arising from accounting, tax and archiving regulations; or
   3. Article 6(1)(f) GDPR, i.e. the legitimate interest pursued by the Controller in establishing, pursuing or defending claims until they become time-barred or until the relevant proceedings have been concluded, provided that such proceedings were initiated within the limitation period; this applies in particular to any claims you may have in connection with an order placed or the Controller's business activities; or

   – where the above legal bases do not apply –

   4. Article 6(1)(a) GDPR, i.e. your consent to the processing of personal data for specified purposes.
8. Providing personal data is voluntary, and each user of the Website decides whether and to what extent they wish to use the Controller's offer and services and provide their personal data, taking into account the principles set out in this Privacy Policy. Nevertheless, providing personal data is necessary to achieve the purposes referred to in point 4 above and is also a condition for entering into and performing a sales or service agreement. Failure to provide such data will therefore make it impossible to enter into such an agreement.
9. In accordance with the data minimisation principle referred to in Article 5(1)(c) GDPR, the Controller processes only those categories of personal data that are necessary to achieve the purposes referred to in point 4 above.
10. The Controller does not disclose personal data to third parties without your express consent. Without your consent, personal data may be disclosed only to entities duly authorised under applicable laws, in particular public administration authorities, tax authorities, law enforcement authorities and other authorised entities.
11. The Controller may entrust the processing of your personal data to:
    1. IT companies providing hosting services, managing Internet domains or maintaining the computer systems used by the Controller,
    2. companies providing the Controller with other services necessary for the Controller's ongoing business activities,

    hereinafter jointly referred to as Processors.

    In such a case, the Controller enters into personal data processing agreements with the Processors. The Processors process the personal data entrusted to them solely for the needs, within the scope and for the purposes specified in the relevant processing agreement.

12. Your personal data are not transferred to third countries or international organisations within the meaning of the GDPR. Should such a transfer take place, you will be informed in advance, and the Controller will apply the safeguards referred to in Chapter V of the GDPR.
13. The Controller processes personal data for the period necessary to achieve the purposes set out in point 4 above. Personal data may be processed for a longer period than indicated in this point where such an obligation imposed on the Controller arises from specific provisions of law (e.g. regarding the retention of accounting and tax records) or from the Controller's legitimate interest referred to in point 7(c) above (i.e. for the limitation period applicable to claims or until the relevant proceedings have been concluded, provided that they were initiated within the limitation period), as well as where the service provided by the Controller is continuous in nature.
14. As data subjects, you have the right to:
    1. be informed about the processing of personal data in accordance with Article 12 GDPR,
    2. access your personal data in accordance with Article 15 GDPR,
    3. correct, supplement and update your personal data in accordance with Article 16 GDPR,
    4. have your data erased (the right to be forgotten) in accordance with Article 17 GDPR,
    5. restrict processing in accordance with Article 18 GDPR,
    6. data portability in accordance with Article 20 GDPR,
    7. object to the processing of personal data in accordance with Article 21 GDPR,
    8. not be subject to profiling in accordance with Article 22 in conjunction with Article 4(4) GDPR,

    subject to the principles governing the exercise and implementation of these rights under the GDPR.

15. Where the legal basis referred to in point 7(d) above applies, the Customer has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
16. In addition to the rights referred to in the two preceding points, you have the right to lodge a complaint with the supervisory authority pursuant to Article 77 GDPR (i.e. the President of the Polish Personal Data Protection Office – address: ul. Stawki 2, 00-193 Warszawa, e-mail: kancelaria@uodo.gov.pl, tel. +48 606 950 000) if you believe that the Controller's processing of your personal data infringes the GDPR.
17. Your personal data will not be subject to automated decision-making, including profiling, by the Controller within the meaning of the GDPR.
18. All enquiries, requests and complaints relating to the Controller's processing of personal data and the exercise of the rights referred to in points 14–15 above, hereinafter referred to as Submissions, should be sent to the following e-mail address of the Data Protection Officer: iod@domino.pl, or in writing to the following address of the Controller: ul. Popiełuszki 14, 58-260 Bielawa.
19. A Submission should contain: the details of the person or persons concerned, the event giving rise to the Submission and, where possible, the content of the request, the legal basis for the request and the expected manner of resolving the matter.
20. Every identified security breach is documented. Where required under the GDPR or the Act, the affected data subjects (i.e. you) and the President of the Polish Personal Data Protection Office will be informed of such a breach of personal data protection regulations, where applicable.
21. The provisions of this Privacy Policy apply, to the extent possible, mutatis mutandis to all persons with whom the Controller has legal relations and in respect of whose personal data the Controller is also the controller, in particular customers, contractors and participants in competitions, loyalty programmes or partner programmes organised by the Controller.
22. In matters not regulated by this Privacy Policy, the relevant provisions of generally applicable law shall apply accordingly. In the event of any inconsistency between the provisions of this Privacy Policy and the aforementioned laws, those laws shall prevail.