Privacy

Sure, here’s the full translation of the provided Privacy Policy:

Privacy Policy of the www.anotherone.com.pl Website

This Privacy Policy outlines the rules for collecting and processing Users’ data who use the www.anotherone.com.pl website for the purpose of providing electronic services by the Website Administrator. By using the Website, the User agrees to the rules described in this Policy. The Privacy Policy also implements Article 13 of the Regulation of the European Parliament and the Council (EU) No. 2016/679 of April 27, 2016, on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as GDPR) (Official Journal of the EU L119 of 4.05.2016, p. 1).

I. Definitions (alphabetically)

The following terms, written with a capital letter in this Privacy Policy, have the following meanings:

• Administrator – Karolina Kupczak and Wioleta Kołton, entrepreneurs operating as partners of the civil company Another One Karolina Kupczak, Wioleta Kołton S.C., headquartered at ul. Wielopole 13, 31-072 Kraków, with tax identification number (NIP): 6762665669, REGON: 528148277, email address: contact@anotherone.com.pl, providing services, storing, and accessing information on the User’s devices.
• Cookie – text data collected in the form of files placed, among others, on the User’s device.
• Payment Operator – Tpay payment system, owned by Krajowy Integrator Płatności S.A., based in Poznań at plac Andersa 3, 17th floor, 61-894 Poznań.
• Website – the website operating at www.anotherone.com.pl, where the Administrator runs, among other things, the Online Store.
• External Website – partner websites, service providers, or contractors of the Administrator, to which links may be found on the Website or which the Administrator uses in the creation and operation of the Website. The Administrator is not responsible for the privacy policy of External Websites, to which links can be found on the Website pages.
• Online Store – an online platform run by the Administrator, available on the Website, through which the User can obtain information about the goods and services offered by the Administrator and purchase these goods and services.
• Device – an electronic device with software, through which the User gains access to the Website.
• User – a person for whom the Administrator provides electronic services through the Website.

II. Purpose of collecting and processing data

The Administrator, as the owner of the Website, respects the rights and freedoms of the Website Users and makes every effort to protect their data, with particular emphasis on the right to privacy.

The Website processes personal data to ensure the proper operation of the Website and the Online Store, including:

1. Entering into and fulfilling contracts (including notifying the User of order statuses, payments, and delivery, inquiries regarding warranty claims or guarantees, and the obligation to inform about necessary updates).
2. Maintaining the User’s account and using the data collected there, including handling future orders, managing complaints.
3. Facilitating communication with Website Users concerning payment services by the Payment Operator (e.g., verifying creditworthiness, handling complaints, and submissions regarding payment processes, contacting regarding security and fraud warnings).
4. Communicating with Website Users regarding contact form inquiries.
5. Statistical analysis of the Website’s usage for further improvement and creating the best content and increasing its functionality.
6. Fulfilling legal obligations reserved for data administrators.
7. Pursuing claims and defending against claims.
8. Marketing the Administrator’s services and those of its business partners, including sending newsletters.

III. Method and scope of collected data

The Website collects and processes personal and technical data necessary for the proper functioning of the Website, which are not personal data. Depending on how the Website is used and the type of data, collection is initiated by the User through voluntary submission of contact details in the relevant form fields or automatically through mechanisms used in Cookies.

III.1. Data collected by User’s initiative

Users of the Website, in order to enter into a contract or contact the Administrator via the website, fill out the appropriate form fields. The data collected directly results from the fields filled in.

Required fields are marked as such, as they pertain to data necessary to fulfill an order, and without them, the Online Store cannot fulfill it. After the contract is executed, the processing of the User’s data will be limited, and after the storage periods required by tax and accounting laws expire, the data will be deleted (Article 6(1)(c) GDPR), unless the User provides explicit consent (Article 6(1)(a) GDPR) for further use of the data for other purposes, or the Website reserves the right to further use them in legally permissible cases.

Besides contact via the form on the Website, the User may also contact the Administrator using the provided email addresses and phone numbers. Using any of these direct contact methods also involves providing personal data in the form of an email address or phone number. Providing these data is not mandatory, but they are necessary to respond to the User’s inquiry via email or phone. By providing contact details, the User agrees to their processing to handle the inquiry and to share these data with processors where necessary (e.g., telecommunication operators, postal services, courier services, license-related services, hosting providers). The User has the right to provide additional consents for electronic marketing (such as subscribing to the newsletter).

III.2. Data collected automatically

During a User’s visit to the Website, data regarding the visit is automatically collected in the form of Cookies. These data include the User’s IP address, screen resolution, browser type, operating system, domain name, and more – these data do not allow for unequivocal identification of the User and are collected solely to ensure proper Website functionality, session continuity, and statistical purposes. Automatically collected data can be used to analyze User activity on the Website and improve its usability, stability, and functionality. More information on Cookie data collection is available further in this Policy.

IV. Legal basis for processing personal data

The Website processes personal data based on the following legal principles:

1. Art. 6(1)(a) GDPR as the legal basis for processing activities where the Administrator obtains the User’s consent for a specific processing purpose.
2. Art. 6(1)(b) GDPR as the legal basis for processing in relation to actions required to perform a contract, e.g., when purchasing a product or service. This also applies to any actions necessary before entering into a contract, such as handling inquiries about products or services.
3. Art. 6(1)(c) GDPR applies when the Administrator is under a legal obligation requiring the processing of personal data, such as fulfilling tax obligations.
4. Art. 6(1)(d) GDPR allows personal data processing in order to protect the vital interests of the User or another individual.
5. Art. 6(1)(f) GDPR applies to legitimate interests pursued by the Administrator or a third party, for example, in relation to electronic payment services, employing service providers to fulfill orders (e.g., delivery services), login attempts, ensuring security on the Website, and handling newsletter subscriptions.

V. Payments on the Website

The provider of payment services on the Website is the Payment Operator – the Tpay system, owned by Krajowy Integrator Płatności S.A. based in Poznań, at plac Andersa 3, 17th floor, 61-894 Poznań. The Payment Operator is a recipient of the User’s personal data and, in the context of payment processing, also acts as an independent data controller.

When processing payments via Tpay, the following personal data are shared with the Payment Operator: order number, payment description, payment amount, name, company name, email address, correspondence address, VAT ID (NIP), phone number, and IP address.

For purchases made via installment payments, additional personal data may be shared with the Payment Operator, including the date of birth, gender, and other necessary transaction data (e.g., article, invoice amount, due date, total amount, invoice number, taxes, currency, order date and time). These data are provided for processing the transaction and confirming its completion. To verify the creditworthiness of a User making an installment purchase, the Payment Operator may check and collect information from publicly available databases and from credit reporting agencies.

All information regarding the protection of personal data applied by the Payment Operator is available on its website at https://tpay.com/privacy-policy.

VI. Data retention period

The Administrator processes and stores the User’s personal data only for the period necessary to fulfill the purpose for which the data were stored or until legally required. Once the purpose is no longer applicable or has been fulfilled, the User’s personal data will be deleted or processing will be restricted. In cases where processing is restricted, the data will be deleted once retention periods mandated by law, contract, or company bylaws expire, provided there is no reason to believe that deletion would harm legitimate interests and that it would not require disproportionate effort due to the specific nature of the storage.

Even after unsubscribing from the Newsletter, the User’s personal data may still be stored in the Administrator’s database for archival purposes, to defend, establish, or pursue claims related to the Newsletter, and to ensure compliance with legal regulations when conducting activities related to the Newsletter (e.g., obtaining consent, respecting opt-outs). This is a legitimate interest pursued by the Administrator under Article 6(1)(f) GDPR. These data will be deleted after the statute of limitations for claims related to the contract and after the period during which the Administrator may be subject to audit by a supervisory authority regarding compliance with legal regulations related to the Newsletter.

VII. Data subject rights

In connection with the processing of personal data made available on the Website, the User has several rights, which may sometimes depend on the legal grounds for processing in a specific case. Below, the Administrator outlines information about the User’s rights in connection with the processing of their data.

VII.1. Right of access to personal data

The data subject has the right to obtain confirmation from the Administrator as to whether their personal data is being processed.

If the Administrator processes personal data, the data subject has the right to access them and to receive information about the processing of their data.

If personal data are transferred to a third country or international organization, the data subject has the right to be informed about the appropriate safeguards concerning the transfer.

The data subject has the right to obtain a copy of the personal data undergoing processing.

VII.2. Right to rectification of data

The data subject has the right to request that the Administrator promptly correct any inaccurate personal data concerning them.

The data subject has the right to request the completion of incomplete personal data, including by submitting an additional statement.

VII.3. Right to erasure of data

The data subject has the right to request that the Administrator promptly erase their personal data if:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed.
• The data subject withdraws the consent on which the processing is based, and there is no other legal ground for processing.
• The data subject objects to the processing, and there are no overriding legitimate grounds for processing.
• The personal data have been unlawfully processed.
• The personal data must be erased to comply with a legal obligation required by law.
• The personal data have been collected in connection with the offer of information society services.

VII.4. Right to restriction of processing

The data subject has the right to request that the Administrator restrict the processing of data in the following cases:

• The data subject contests the accuracy of the personal data – for a period allowing the Administrator to verify the accuracy of the data.
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead.
• The Administrator no longer needs the personal data for processing purposes, but the data are required by the data subject for establishing, exercising, or defending legal claims.
• The data subject has objected to processing – pending verification of whether the legitimate grounds of the Administrator override those of the data subject.

VII.5. Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to the Administrator, in a structured, commonly used, and machine-readable format, provided that:

• The processing is based on consent or on a contract.
• The processing is carried out by automated means.

The data subject has the right to transmit those personal data to another controller and to request that the Administrator transmit the personal data directly to another controller, where technically feasible.

VII.6. Right to object to the processing of personal data

The data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them. The Administrator shall no longer process the personal data unless they demonstrate compelling legitimate grounds for processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.

Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

VII.7. Right to withdraw consent

Where personal data are processed based on the data subject’s consent, the data subject has the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

VII.8. Right to lodge a complaint with a supervisory authority

The data subject also has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office. The office is located in Warsaw at ul. Stawki 2, 00-193 Warszawa. In addition to submitting a complaint by traditional mail, the complaint can be submitted via email to kancelaria@uodo.gov.pl, as well as via the Electronic Submission Box.

VIII. Exercising the rights of data subjects

To exercise the above rights, except for the right to lodge a complaint with the supervisory authority, the User may submit an appropriate request by traditional mail to the Administrator’s registered address or by email to contact@anotherone.com.pl.

IX. Security

The Website has been equipped with security measures to protect personal data from loss, misuse, and alteration. The Administrator also has appropriate documentation and has implemented procedures related to the protection of personal data in the company.

The Administrator ensures that all disclosed information is protected in accordance with applicable laws and security standards, and in particular:

1. Access to personal data collected by the Administrator is only granted to authorized employees or collaborators of the Administrator, in accordance with Article 29 GDPR, and to authorized individuals handling the Website, who have been granted appropriate authorizations.
2. The Administrator declares that when entrusting other entities with the provision of services, it requires partners to ensure, in accordance with Article 28 GDPR, that a sufficiently high standard of protection of entrusted personal data is applied, signing appropriate data processing agreements, in which the partners confirm compliance with the standards and the right to monitor their compliance.
3. Due to the public nature of the Internet, using services provided electronically may involve risks, regardless of the Administrator’s due diligence.

X. Cookies

Cookies are files containing computer data that serve an important function by making Internet use easier, faster, safer, and more convenient. A Cookie file is automatically created during a visit to a website and stored on the end device (computer, smartphone, tablet), while a copy is sent to the web server. Cookies allow the device to be recognized and the website’s appearance and behavior to be tailored to the User’s individual needs. Cookies are also needed when the User needs to log in. Cookies allow the storage and retrieval of information regarding how the User navigates the website. The data collected by Cookies, however, are quite limited and mainly serve to manage the visit to the website and for statistical purposes. These include data such as the IP address connecting to the site, the website name, time of storage on the end device, the data of the browser used, applied resolution, duration of the visit, and the type of terminal used to visit the site, etc. Data such as the User’s name, surname, postal address, phone, etc., are not obtained. The www.anotherone.com.pl website does not automatically collect any information except for that contained in Cookie files.

We cooperate with Microsoft Clarity and Microsoft Advertising to record how you interact with our Website using behavioral indicators, heat maps, and session replay to improve and promote our products/services. Data on the use of the Website is captured using first-party and third-party Cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information to optimize the Website for fraud/security purposes and advertising. For more information on how Microsoft collects and uses your data, visit Microsoft’s Privacy Statement.

XI. Use of Cookies on the Website

Cookies are used on the Website for the following purposes:

1. Customizing the content of the Website to the User’s preferences and optimizing the preparation of displayed information. In particular, Cookies allow the device to be recognized and the website’s display to be tailored to the operating system, browser type, resolution, and screen proportions, as well as the type of device.
2. Creating statistics and reports that help the Administrator understand which materials are most popular, which subpages are most frequently visited, how long Users spend on the Website, and what devices they use. All this allows the Administrator to continually improve the structure of the Website and its content.
3. Logging – the Administrator uses Cookies for the purpose of maintaining the User’s session (after logging into the User’s account). Thanks to this solution, the User does not have to re-enter their login and password on each subpage of the Website and can navigate smoothly between subpages.
4. Social services – the Administrator and External Websites use Cookies to support social services.
5. Marketing and advertising – the Administrator and External Websites use Cookies for marketing purposes and serving ads to Users.

XII. Cookie security

The mechanisms for storing and reading Cookies do not allow for the retrieval of any personal data or any confidential information from the User’s Device. The transfer of viruses, Trojan horses, or other worms to the User’s Device is practically impossible. The internal Cookies used by the Administrator are safe for the User’s Devices. The Administrator is not responsible for the security of Cookies from External Websites. The Administrator cooperates with the following External Websites, which may place Cookies on the User’s Devices: Google Analytics, Google AdSense, Google Ads, Facebook.

XIII. What Cookies we use

XIV. How Cookies are deleted

Cookies can be divided into two types based on their expiration period. The first type of cookie is called session cookies, which are automatically deleted after closing the web browser window, and the data stored in them is permanently lost. The second type of cookie is persistent cookies, which remain stored for longer, e.g., a day, a month, a year. The expiration time of Cookies is strictly related to their purpose, and the content is automatically deleted after this time.

Devices by default allow for the storage of Cookies. These settings can be changed by the User at any time to block automatic Cookie handling or to notify the User whenever Cookies are sent to the User’s device. Detailed information on the possibility and methods of handling Cookies can be found in the settings of the web browser (software). It should be noted that imposing restrictions on the processing of Cookies may have a negative impact on the operation of the Website.

XV. Changes to the Privacy Policy

The functionality and scope of the Website evolve over time, adapting to User expectations. Therefore, the Administrator reserves the right to make changes to the Privacy Policy at any time, especially when it becomes necessary due to new legal regulations, new guidelines from state or EU authorities, or a change in technology used to process personal data on the Website. Each time a new version of the Privacy Policy will appear on the Website, along with a relevant notice of the date the updated Privacy Policy comes into effect. The previous version of the Privacy Policy will be available upon request. The Administrator reserves the right to make any changes to this Privacy Policy without having to inform Users directly. The changes come into effect on the day of publication of the Privacy Policy.

Version: 1.1 – effective from April 8, 2024.