Information on the processing of personal data (GDPR)

1. Data controller

The data controller is:

DriftZone.pl Patrycja Pawłowska-Szlage, ul. Koskowicka 44, 59-220 Legnica

• Tax ID (NIP): 6912075976
• Business Registry Number (REGON): 363965087

(hereinafter: “Controller”)

Contact with the Controller:

• Email: sklep@driftzone.pl (store matters)
• Email: rodo@driftzone.pl (personal data matters)
• Phone: +48 537 75 75 75
• Address: ul. Koskowicka 44, 59-220 Legnica

The Controller has not appointed a data protection officer.

2. Contacting the store (form, e-mail, phone)

Purpose and legal basis

• replying to an enquiry sent through the contact form: Art. 6(1)(f) GDPR (our legitimate interest in replying to a person who contacts us), and where the enquiry concerns concluding a contract, Art. 6(1)(b) GDPR (steps taken at the request of the person before entering into a contract)
• keeping the contact form secure and protecting it against abuse and spam (technical log): Art. 6(1)(f) GDPR (our legitimate interest in protecting the Website and our mailbox)

Scope of data

• data provided in the contact form: name, e-mail address, selected topic, message content and data provided voluntarily (e.g. part details, order number, technical details, company name)
• technical data of the contact form: date and time of submission, result (accepted or rejected), selected topic and language and a hash of the IP address (not the address itself), without the content of the message

Recipients

• hosting, IT and e-mail service providers who maintain the Website and our mailbox
• public authorities and other entities entitled under the law

Retention period

• enquiries from the form, e-mails and phone calls: until the enquiry has been dealt with, and then for up to 12 months to clarify any disputes

3. Orders and purchases in the store

Purpose and legal basis

• replying to an enquiry sent by e-mail or made by phone: Art. 6(1)(f) GDPR (our legitimate interest in replying to a person who contacts us), and where the enquiry concerns concluding a contract, Art. 6(1)(b) GDPR (steps taken at the request of the person before entering into a contract)
• concluding and performing a sales contract for an order placed in the store, by phone or by e-mail, including delivery: Art. 6(1)(b) GDPR
• keeping accounts and meeting tax obligations, including issuing invoices: Art. 6(1)(c) GDPR (legal obligation)
• handling complaints, statutory warranty claims, returns and exchanges: Art. 6(1)(b) and (c) GDPR

Scope of data

• data from e-mail correspondence and phone calls: contact details and the content of the enquiry

Recipients

• hosting, IT and e-mail service providers who maintain the Website and our mailbox
• the accounting firm and legal and tax advisers
• courier and postal companies, if we send ordered goods by parcel
• public authorities and other entities entitled under the law

Retention period

• technical log of the contact form (IP address hash, date, result): up to 30 days
• data from orders and sales contracts: until the contract is performed, and then until the limitation periods for claims expire (as a rule 3 or 6 years, counted to the end of the calendar year)
• accounting and tax documents, including invoices: for the period required by law, as a rule 5 years counted from the end of the calendar year in which the tax obligation arose

4. Visiting the Website

Purpose and legal basis

• establishing, pursuing and defending legal claims: Art. 6(1)(f) GDPR (our legitimate interest in protecting our rights)
• ensuring the security and proper operation of the Website, including server logs: Art. 6(1)(f) GDPR (our legitimate interest in protecting the Website from abuse and failures)
• compiling Website visit statistics with Google Analytics: Art. 6(1)(a) GDPR and Articles 399 and 400 of the Polish Electronic Communications Law (consent)
• remembering your cookie choices and documenting your consent: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR
• presenting public reviews of the store from Google on the Website: Art. 6(1)(f) GDPR (our legitimate interest in informing about customer reviews)

Scope of data

• data necessary to conclude and perform a sales contract: first and last name, phone number, e-mail address, delivery address, invoice details (if applicable) and information about the goods ordered
• technical data recorded in server logs: IP address, date and time of the request, address of the page visited, browser and system type
• data from analytics cookies (only with your consent): identifiers, information about pages visited and time of visit, device type and approximate location
• data of authors of reviews displayed on the Website: name or nickname, rating, content and date of the review

Recipients

• hosting, IT and e-mail service providers who maintain the Website and our mailbox
• Google (Google Analytics after consent, Google Maps and Google reviews), on the terms described in sections 6, 9 and 10
• public authorities and other entities entitled under the law

Retention period

• complaints, statutory warranty, returns and exchanges: until the limitation periods for claims expire
• server logs: up to 12 months
• Google Analytics analytics cookies: up to 2 years or until you withdraw consent or delete the cookies
• information about your cookie choices: until it is deleted from your browser or you change your choice

Transfers outside the EEA

As a rule, we do not transfer personal data outside the European Economic Area. The exception is the use of Google services (Google Analytics after consent, and Google Maps), which may involve transferring data to the United States.

The transfer takes place on the basis of the European Commission implementing decision of 10 July 2023 finding an adequate level of data protection under the EU-U.S. Data Privacy Framework, provided that the recipient participates in that framework. In other cases, standard contractual clauses approved by the European Commission apply. You can obtain a copy of the safeguards by contacting us.

5. Rights of data subjects

You have the right to:

• access your data and obtain a copy of it
• rectify your data
• erase your data (“right to be forgotten”)
• restrict processing
• data portability, where we process data on the basis of consent or a contract and by automated means
• object to processing based on our legitimate interest, on grounds relating to your particular situation
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
• lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw)

To exercise these rights, write to rodo@driftzone.pl or contact us in another way indicated in section 2. We will reply without undue delay and no later than one month after receiving the request. If we have doubts about the identity of the person making the request, we may ask for additional information to confirm their identity.

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

6. Whether providing data is voluntary

The contact form requires your name, e-mail address, topic and message. Without them we cannot reply to your enquiry. The other fields are optional. Providing the data needed to conclude and perform a sales contract is necessary for it to be carried out. Consent to analytics cookies is voluntary and does not affect access to the Website’s content.