Privacy policy

# PRIVACY POLICY

For the Controller of this website, the protection of Users’ personal data is a matter of the utmost importance. The Controller makes every effort to ensure that Users feel safe when entrusting their personal data in the course of using the website.

A User is a natural person, a legal person or an organizational unit without legal personality to which a statute grants legal capacity, who uses the electronic services available through the website.

This privacy policy explains the principles and scope of the processing of the User’s personal data, the rights to which the User is entitled and the obligations of the Controller of that data, and also provides information on the use of cookies.

The Controller applies state-of-the-art technical measures and organizational solutions that ensure a high level of protection of the personal data being processed and safeguard it against access by unauthorized persons.

## I. PERSONAL DATA CONTROLLER

The personal data controller is Piniata Management sp. z o.o., with its registered office at: ul. Wadowicka 6, 31-415 Kraków, NIP: 6793228042, REGON 520596770, KRS 0000935011 (hereinafter: the “Controller”).

## II. PURPOSES OF THE PROCESSING OF PERSONAL DATA

The Controller processes the User’s personal data for the purpose of:

1. Performing the contract for the sale of goods offered on the decomura.com website. Personal data is processed on the basis of Art. 6(1)(b) GDPR, which permits personal data to be processed where it is necessary for the performance of a contract or for taking steps prior to entering into a contract.
2. Handling the User’s account on the website. Personal data is processed on the basis of Art. 6(1)(b) GDPR.
3. Handling complaints, asserting claims and defending against claims. Personal data is processed on the basis of Art. 6(1)(f) GDPR as a legitimate interest of the Controller.
4. The User’s use of the contact form. Personal data is processed on the basis of Art. 6(1)(f) GDPR as a legitimate interest of the Controller.
5. The User’s subscription to the Newsletter for the purpose of sending commercial information by electronic means. Personal data is processed after separate consent has been given, on the basis of Art. 6(1)(a) GDPR.
6. Ensuring security and protection against fraud. Personal data is processed on the basis of Art. 6(1)(f) GDPR as a legitimate interest of the Controller.

This means that this data is needed in particular for:
- entering into the contract;
- settling accounts;
- delivering the goods ordered by the User or performing the services;
- the User’s exercise of all consumer rights (e.g. withdrawal from the contract, statutory warranty).

The User may also consent to receiving information about new products and promotions, which means that the Controller will also process personal data for the purpose of sending the User commercial information concerning, among other things, new products or services, promotions or sales.

Personal data is also processed in order to fulfill the legal obligations incumbent on the Controller and to carry out tasks in the public interest, among other things in order to perform tasks related to security and defense or to the storage of tax documentation.

Personal data may also be processed for the purposes of direct marketing of products, securing and asserting claims or protecting against claims of the User or a third party, as well as marketing of the services and products of third parties or own marketing that is not direct marketing.

## III. TYPES OF DATA

The Controller processes the following personal data, the provision of which is necessary for:

1. Making purchases via the website:
   - first and last name;
   - delivery address;
   - telephone number;
   - e-mail address;

2. Data provided by the User on an optional basis:
   - date of birth;
   - PESEL number (where an invoice is requested);
   - NIP number (where an invoice is requested for a business).

In the event of withdrawal from the contract or acceptance of a complaint, where the refund is made directly to the User’s bank account, we also process information concerning the bank account number in order to make the refund.

In addition, the Controller may automatically collect certain information about the User’s interaction with the Services (“Usage Data”). For this purpose it may use cookies, pixels and similar technologies. Usage Data may include, among other things, information about the use of the website, information about the device, browser and IP address, and other technical data concerning the User’s interaction with the Services.

## IV. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

Personal data is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, p. 1–88, hereinafter referred to as the “GDPR”.

The Controller processes personal data only after first obtaining the User’s consent at the time a transaction made on the website is confirmed, or on the basis of other conditions for the lawfulness of processing personal data set out in Arts. 6 and 9 GDPR.

Giving consent to the processing of personal data is entirely voluntary; however, failure to give it makes it impossible to make purchases through the website.

## V. RIGHTS TO WHICH THE USER IS ENTITLED

In connection with the processing of personal data, the User is entitled to the following rights:

1. The User may at any time request information from the Controller on the scope of the processing of personal data.
2. The User may at any time request the correction or rectification of their personal data.
3. The User may at any time withdraw their consent to the processing of their personal data, without giving a reason. A request not to process data may relate to a specific purpose of processing indicated by the User, e.g. withdrawal of consent to receive commercial information, or may relate to all purposes of data processing. Withdrawal of consent with regard to all purposes of processing will result in the User’s account being deleted from the website, together with all of the User’s personal data previously processed by the Controller. Withdrawal of consent will not affect actions already taken.
4. The User may at any time, without giving a reason, request that the Controller delete their data. A request for deletion of data will not affect actions taken to date. Deletion of data means the simultaneous deletion of the User’s account, together with all personal data saved and processed by the Controller to date.
5. The User may at any time object to the processing of personal data, both with regard to all of the User’s personal data processed by the Controller and only to a limited extent, e.g. with regard to the processing of data for a specifically indicated purpose. An objection will not affect actions taken to date. Lodging an objection will result in the deletion of the User’s account, together with all personal data saved and processed to date by the Controller.
6. The User may request restriction of the processing of personal data, whether for a specified period of time or without a time limit but within a specified scope, and the Controller will be obliged to comply with that request. This request will not affect actions taken to date.
7. The User may request that the Controller transfer the User’s processed personal data to another entity. To do so, the User should send a request to the Controller, indicating to which entity (name, address) the User’s personal data is to be transferred and which specific data the User wishes the Controller to transfer. After the User confirms their wish, the Controller will transfer the User’s personal data, in electronic form, to the indicated entity. Confirmation of the request by the User is necessary for the security of the User’s personal data and in order to ensure that the request comes from an authorized person.

The Controller informs the User of the action taken within one month of receiving any of the requests listed in the preceding points.

## VI. RETENTION PERIOD OF PERSONAL DATA

As a rule, personal data is stored only for as long as is necessary to fulfill the contractual or statutory obligations for which it was collected. This data will be deleted immediately once its storage is no longer necessary for evidentiary purposes in accordance with civil law or in connection with a statutory obligation to retain data.

Information concerning the contract is stored for evidentiary purposes for a period of three years, starting from the end of the year in which the business relationship with the User ended. The data will be deleted after the statutory limitation period for asserting contractual claims has expired.

In addition, the Controller may retain archival information concerning concluded transactions, as its retention is connected with claims to which the User is entitled, e.g. under the statutory warranty.

If no contract has been concluded between the User and the Controller, the User’s personal data is stored until the User’s account on the website is deleted. The account may be deleted as a result of a request made by the User, withdrawal of consent to the processing of personal data, or lodging an objection to the processing of that data.

## VII. ENTRUSTING THE PROCESSING OF DATA TO OTHER ENTITIES

The Controller may entrust the processing of personal data to entities cooperating with the Controller, to the extent necessary for the completion of a transaction, e.g. in order to prepare the ordered goods and deliver shipments, or to transmit commercial information originating from the Controller (the latter applies to Users who have consented to receiving commercial information).

The Controller informs Users that it entrusts the processing of personal data to the following entities:
- Shopify Inc. - for the purpose of operating the online store and processing payments;
- Courier service providers - for the purpose of delivering orders;
- Payment service providers - for the purpose of processing payments.

The personal data of the website’s Users is not transferred outside the European Union. Where data is transferred outside the European Economic Area, we apply appropriate mechanisms ensuring data protection, e.g. the Standard Contractual Clauses approved by the European Commission.

This Privacy Policy complies with the provisions arising from Art. 13(1) and (2) of the GDPR.

## VIII. COOKIES

The website uses cookie files (cookies) or similar technology (hereinafter collectively referred to as: “cookies”) to collect information about the User’s access to the website (e.g. by means of a computer or smartphone) and the User’s preferences. They are used, among other things, for advertising and statistical purposes and to adapt the website to the User’s individual needs.

Cookies are pieces of information containing a unique reference code, which the website sends to the User’s device for the purpose of storing, and sometimes tracking, information about the device being used. They do not usually make it possible to identify the User as a person. Their main purpose is to better adapt the website to the User.

Some of the cookies present on the website are available only for the duration of a given web session and expire when the browser is closed. Other cookies are used to remember the User, who is recognized on the website upon returning to it. They are then retained for a longer period of time.

All cookies present on the website are set by the Controller.

All cookies used by this website comply with applicable European Union law.

Most Users and some mobile browsers automatically accept cookies. If the User does not change the settings, cookies will be saved in the memory of the device.

The User may change their preferences regarding the acceptance of cookies or change their browser in order to be able to receive an appropriate notification each time the cookie function is set. To change the cookie acceptance settings, the settings in the browser should be adjusted.

It is worth remembering that blocking or deleting cookies may make it impossible to make full use of the website.

Cookies will be used for necessary session management, including:
- Creating a special login session for the User of the website, so that the website remembers that the User is logged in and the User’s requests are delivered effectively, securely and consistently;
- Recognizing a User who has previously visited the website, which makes it possible to identify the number of unique users who have used the service and to make sure that the capacity of the service is sufficient for the number of new users;
- Recognizing whether a person visiting the website is registered on the website;
- Recording information from the User’s device, including: cookies, IP address and information about the browser used, in order to be able to diagnose problems and to administer and track use of the website;
- Adjusting elements of the graphic layout or the content of the website;
- Collecting statistical information on how the User uses the website, in order to be able to improve the website and to determine which areas of the website are the most popular among Users.

## IX. CONTACT

In the event of any questions regarding our privacy practices, this Privacy Policy, or in order to exercise any of the rights to which the User is entitled, please contact us:

E-mail: contact@decomura.com
Correspondence address: Piniata Management sp. z o.o., ul. Wadowicka 6, 31-415 Kraków

## X. COMPLAINTS

In the event of complaints concerning the processing of personal information, please contact the Controller. If the User is not satisfied with the response, the User may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa.

Date of preparation: 24.02.2025
Date of last update: 24.02.2025