Privacy Policy
4Baby Sp. Z o.o.
INFORMATION CLAUSE
In this document, we inform you about the legal basis for the processing of personal data, the methods of their collection and use, as well as the rights of data subjects.
Personal data refers to any information that can identify you, such as your name, phone number, email address, and delivery address.
The purpose of this document is to specify the actions taken by the Data Controller in relation to the protection of processed personal data.
Pursuant to Article 13(1)−(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the EU L 119, p. 1) – hereinafter referred to as GDPR – we inform you:
1. Data Controller:
The data controller is 4Baby Sp. Z o.o., based in Lublin, Kasprowicza 72, 20-232 Lublin, NIP: 9462525954, REGON: 060263112, KRS: 0000286893, email: info@4baby.pl, contact phone: +48 81 746 15 80.
2. Purposes and Legal Bases for Data Processing:
As the data controller, we will process your data for the following purposes:
• Sending commercial offers from the Data Controller and other marketing purposes related to the promotion of the Data Controller’s goods and services, based on the consent of the data subject (marketing, telemarketing) (legal basis: Article 6(1)(a) of GDPR). Withdrawal of consent is possible by contacting the Data Controller at the email address provided above or via the link included in every electronic message containing marketing communications. The withdrawal of consent will not affect the legality of the processing carried out based on your consent before it was withdrawn.
• Marketing products or services not provided by the Data Controller but by a third-party entity cooperating with the Data Controller, based on the consent of the data subject (marketing, telemarketing) (legal basis: Article 6(1)(a) of GDPR). Withdrawal of consent is possible by contacting the Data Controller at the email address provided above or via the link included in every electronic message containing marketing communications. The withdrawal of consent will not affect the legality of the processing carried out based on your consent before it was withdrawn.
• Performing the contract concluded with you, in which the Data Controller is a party (legal basis: Article 6(1)(b) of GDPR).
• Ensuring safety in connection with the execution of the contract – data on health status necessary to provide services properly, based on the consent of the data subject (legal basis: Article 9(2)(a) of GDPR). Withdrawal of consent is possible through direct contact with the Data Controller. The withdrawal of consent will not affect the legality of the processing carried out based on your consent before it was withdrawn.
• Potential determination, pursuit, or defense against claims as part of the Data Controller’s legitimate interest (legal basis: Article 6(1)(f) of GDPR).
• Fulfilling obligations arising from legal regulations, e.g., tax or accounting regulations (legal basis: Article 6(1)(c) of GDPR).
• Ensuring security as part of the Data Controller’s legitimate interest – video surveillance (legal basis: Article 6(1)(f) of GDPR).
Apart from the cases mentioned above, the Data Controller may process personal data of persons contacting them to inquire about the offer, conclude a contract, or provide feedback on the Data Controller’s activities (legal basis: Article 6(1)(b) of GDPR). We kindly ask you not to provide sensitive personal data such as racial or ethnic origin, political opinions, religious or philosophical beliefs, union membership, as well as the processing of genetic data, biometric data for the purpose of identifying a person, or data concerning health, sexuality, or sexual orientation.
3. Automated Decision-Making (Profiling):
Your personal data will not be processed in an automated manner and will not be subject to profiling.
4. Data Retention Period:
The period for which we can process your personal data depends on the legal basis for the processing of personal data by the Data Controller. Accordingly, we inform you that:
• In the case of processing your personal data based on consent, the data processing period lasts until you withdraw your consent.
• Your data obtained for the purpose of concluding a contract will be stored during the contract negotiation period and until the end of the calendar year following the year in which you last contacted us regarding its conclusion.
• Your personal data obtained in connection with the conclusion of the contract will be processed by us for the entire period the contract is being executed.
• In cases where the Data Controller processes personal data because it is necessary in accordance with applicable legal provisions, the data processing periods for this purpose are determined by those provisions, e.g., tax regulations or archival obligations.
• In cases where the Data Controller processes personal data based on the legitimate interest of the data controller, the processing period lasts until the legitimate interest expires (e.g., the statute of limitations for civil claims) or until the data subject objects to further processing, in situations where such an objection is provided by law.
5. Data Recipients:
Your personal data may be shared with the following recipients or categories of recipients:
• Entities providing software delivery services to the Data Controller;
• Entities providing cloud systems where personal data is stored; entities providing hosting services;
• Entities providing transport services;
• Entities providing software or hardware maintenance services;
• Entities providing financial services upon your request.
Your data may also be accessible to law firms, manufacturers of goods offered by the Data Controller, marketing or sales agencies, entities providing survey research services, including NPS (customer satisfaction) surveys, entities involved in processes necessary to fulfill orders placed within the online or physical store. We emphasize that personal data is shared only to the extent necessary to achieve the given purpose.
6. Rights of Data Subjects:
Under the GDPR, you have the right to:
• Access your data and receive a copy of it;
• Correct (rectify) your data;
• Delete your data, restrict the processing of your data;
• Object to the processing of your data;
• Transfer your data;
• Withdraw consent to the processing of personal data;
• Lodge a complaint with the supervisory authority.
Details and instructions on how to exercise your rights can be found in the document "Detailed Rights of Data Subjects," which is Appendix 1 to the information clause.
7. Information about the Requirement/Voluntariness of Providing Data:
Providing data is voluntary, but necessary for concluding a contract and fulfilling other rights of the Data Controller listed above in point II. To the extent that personal data is collected based on consent, providing personal data is voluntary, except for health data necessary to provide services properly, as refusal to provide or withdrawal of consent will result in the refusal to provide services by the Data Controller on your behalf.
8. Complaint to the Personal Data Protection Office (PUODO):
You have the right to file a complaint with the President of the Personal Data Protection Office if you believe that the processing of your personal data violates the provisions of the GDPR.
Office of the President of the Personal Data Protection Office (PUODO)
Stawki 2, 00-193 Warsaw
Phone: 22 860 70 86
9. Rights of the Data Subject:
According to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1) – hereinafter GDPR:
Individuals have certain rights regarding their personal data, and the Data Controller (BUDIREK-CK Cieślikowie Sp. j.) is responsible for ensuring these rights are exercised in accordance with applicable law.
If you have any questions or requests regarding the scope and exercise of rights, or to contact us to exercise a specific data protection right described in detail below, please contact us at the following email address: info@4baby.pl or by phone: +48 81 746 15 80.
We reserve the right to fulfill the following rights after positively verifying the identity of the individual requesting the action.
1. Access to Personal Data:
Individuals have the right to access the data stored by the Data Controller.
The data subject also has the right to obtain a copy of this data. You can download a copy of your data from the Data Controller at any time.
For any additional copies requested by the data subject, the Data Controller may charge a reasonable fee based on administrative costs.
2. Withdrawal of Consent:
When personal data is processed based on consent, the data subject has the right to withdraw this consent at any time.
We inform you of this right at the moment of collecting consents and provide a way to withdraw consent as easily as it was given.
Please note that withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
3. Right to Request Rectification of Personal Data:
If the data is incorrect or incomplete; the right to request data deletion:
The data subject has the right to request from the Data Controller immediate rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to request the completion of incomplete personal data, including by providing an additional statement.
The right to delete data may be exercised:
• When the personal data is no longer necessary for the purposes for which it was collected or otherwise processed by the Data Controller;
• When the data subject withdraws consent for processing given under Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for processing;
• When the data subject objects to processing related to their particular situation based on Article 6(1)(e) GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller) or based on Article 6(1)(f) GDPR (processing necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring protection of personal data, particularly if the data subject is a child), including profiling based on these provisions, and there are no overriding legitimate grounds for processing, or the data subject objects to the processing of their personal data for direct marketing purposes;
• When personal data was processed unlawfully;
• To comply with a legal obligation under law or when personal data was collected in connection with providing information society services as referred to in Article 8(1) GDPR.
We will delete the data if there is no other legal basis arising from financial law or civil law that requires us to continue processing your data.
4. Right to Restrict the Processing of Personal Data:
The data subject has the right to request the restriction of the processing of their personal data:
• When they question the accuracy of personal data, for a period allowing the Data Controller to verify the accuracy of the data;
• When data processing is unlawful, and the data subject opposes the deletion of data, requesting instead the restriction of its use;
• When the Data Controller no longer needs the data for its purposes, but the data is required by the data subject to establish, pursue, or defend legal claims;
• When the data subject has objected to data processing under Article 21(1) GDPR – until it is determined whether the legitimate grounds of the Data Controller override the grounds of the objection made by the data subject.
If processing is restricted based on the above conditions, such personal data may be processed, except for storage, only with the consent of the data subject, or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for important reasons of public interest of the Union or a Member State.
5. Right to Data Portability:
The right to data portability applies when the data processing is based on the data subject's consent or a contract concluded with them, and when the processing is carried out by automated means.
The data subject has the right to receive personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another Data Controller without hindrance from the original Data Controller.
In exercising the right to data portability, the data subject has the right to request that personal data be transmitted by the Data Controller directly to another controller, where technically feasible.
6. Right to Object to the Processing of Personal Data:
The data subject may object to the processing of their personal data:
• Due to reasons related to their particular situation if the processing of personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or if the processing of personal data is based on the legitimate interest of the Data Controller or a third party, including profiling related to such processing. The Data Controller may no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject, or grounds for the establishment, exercise, or defense of legal claims;
• If personal data is processed for direct marketing purposes, including profiling for this purpose.
If the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
english