Privacy Policy

1. Data Controller and Definitions

1. The controller of the personal data of Customers / Users of the Online Store, also referred to as the Seller, is: MODUS PAWEŁ BUL, telephone: +48 577 712 775, Tax Identification Number (NIP): 6760004691, REGON: 351396256.
2. The Data Controller may be contacted:
   1. by post at: GRODZKA 59, 31-001 KRAKÓW;
   2. by email at: bok@harpers.pl.
3. User - a natural person visiting the Online Store website or using the services or functionalities described in this Privacy and Cookie Policy.
4. Customer - a natural person with full legal capacity, a natural person acting as a Consumer, a legal person or an organisational unit without legal personality to which legal capacity is granted by law, who enters into a Distance Sales Agreement with the Seller.
5. Online Store - the website operated by the Seller and available at: https://harpers.pl, through which the Customer/User may obtain information about Goods and their availability, purchase Goods or order a service.
6. Newsletter - information, including commercial information within the meaning of the Polish Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws of 2020, item 344), originating from the Seller and sent electronically to the Customer/User. Receiving the Newsletter is voluntary and requires the consent of the Customer/User.
7. Account - a set of data stored in the Online Store and in the Seller's IT system relating to a specific Customer/User, their orders and agreements, through which the Customer/User may place orders and enter into agreements.
8. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

2. Purposes, Legal Bases and Duration of Data Processing

1. For the purpose of performing a Distance Sales Agreement, the Seller processes:
   1. information relating to the User's device in order to ensure the proper functioning of the services: the computer's IP address, information contained in cookies or other similar technologies, session data, web browser data, device data and data concerning activity on the Website, including individual subpages;
   2. geolocation information, where the User has consented to the service provider accessing their geolocation. Geolocation information is used to provide more personalised product and service offers;
   3. Users' personal data: first name, surname, registered office address, correspondence address, email address, telephone number, Tax Identification Number (NIP), bank account number or other personal data required to complete a purchase and requested by the Controller during the purchasing process.
2. This information does not in itself include information identifying Users; however, when combined with other information, it may constitute personal data. Therefore, the Controller provides it with the full protection afforded under the GDPR.
3. The data is processed pursuant to Article 6(1)(b) GDPR for the purpose of providing the service, i.e. performing the agreement for the provision of electronic services in accordance with the Terms and Conditions, and pursuant to Article 6(1)(a) GDPR in connection with consent to the use of specific cookies or other similar technologies expressed through appropriate web browser settings in accordance with telecommunications law, or in connection with consent to geolocation. The data is processed until the Customer/User ceases using the Online Store.
4. The Controller undertakes to implement all measures required under Article 32 GDPR. Taking into account the state of the art, the costs of implementation and the nature, scope and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, the Controller implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
5. a. REVIEWS IN THE ONLINE STORE
   1.1. A Customer of the Online Store may voluntarily and free of charge submit a review concerning purchases made in the Online Store. The review may also include a rating, photograph or review of a product purchased in the Online Store.
   1.2. Following a purchase in the Online Store, the Seller provides the data required to create an email invitation to the company responsible for the review survey process. The sending of surveys and collection of reviews through forms is fully handled by TrustMate SA, with its registered office at Bartoszowicka 3, 51-641 Wrocław. TrustMate SA sends the Customer an email requesting a review and containing a link to an online form through which the review can be submitted. The online form enables the Customer to answer the Seller's questions concerning the purchase, rate it, add their own review description and upload a photograph of the purchased product. If no review is submitted after the first invitation, TrustMate may send another invitation.
   1.3. A review may only be submitted by a Customer who has made a purchase in the Seller's Online Store.
   1.4. Reviews submitted by Customers are published by the Seller in the Online Store and on the TrustMate.io profile.
   1.5. The Customer may not use the review functionality for unlawful activities, including acts of unfair competition against the Seller or activities infringing personal rights, intellectual property rights or other rights of the Seller or third parties.
   1.6. A review may only relate to products actually purchased in the Seller's Online Store. Entering into fictitious or sham sales agreements for the purpose of submitting a review is prohibited. The Seller or its employees, regardless of the basis of their employment, may not be the authors of reviews.
   1.7. A review may be deleted by its author at any time.

3. Marketing Activities of the Controller

1. The Data Controller may publish marketing information about its products or services on the Online Store website. Such content is displayed by the Data Controller pursuant to Article 6(1)(f) GDPR, i.e. on the basis of the Controller's legitimate interest in publishing content relating to the services provided and promotional activities in which the Controller is involved. At the same time, this activity does not infringe the rights and freedoms of Customers/Users, as Customers/Users expect to receive content of this nature, may expressly expect it or may visit the Online Store specifically for this purpose.

4. Recipients of User Data

1. The Data Controller discloses Users' personal data exclusively to processors acting under personal data processing agreements for the purpose of providing services to the Data Controller, such as hosting and website maintenance, IT services, marketing and PR services.

5. Transfer of Personal Data to Third Countries

1. Personal data will not be processed in third countries.

6. Rights of Data Subjects

1. Every data subject has the right to:
   1. access (Article 15 GDPR) - to obtain confirmation from the Data Controller as to whether personal data concerning them is being processed. Where such data is being processed, the data subject is entitled to access it and obtain information concerning the purposes of processing, categories of personal data, recipients or categories of recipients to whom the data has been or will be disclosed, the period for which the data will be stored or the criteria used to determine that period, and the right to request rectification, erasure or restriction of processing and to object to such processing;
   2. receive a copy of the data (Article 15(3) GDPR) - to obtain a copy of the personal data undergoing processing. The first copy is free of charge, while for additional copies the Data Controller may charge a reasonable fee based on administrative costs;
   3. rectification (Article 16 GDPR) - to request the rectification of inaccurate personal data concerning them or completion of incomplete personal data;
   4. erasure (Article 17 GDPR) - to request the deletion of personal data where the Data Controller no longer has a legal basis for processing it or the data is no longer necessary for the purposes for which it was processed;
   5. restriction of processing (Article 18 GDPR) - to request restriction of the processing of personal data where:
      1. the data subject contests the accuracy of the personal data – for a period enabling the Data Controller to verify the accuracy of the data;
      2. the processing is unlawful and the data subject opposes the erasure of the personal data and requests restriction of its use instead;
      3. the Data Controller no longer requires the personal data for processing purposes, but the data is required by the data subject for the establishment, exercise or defence of legal claims;
      4. the data subject has objected to processing – pending verification of whether the legitimate grounds of the Controller override those of the data subject;
   6. data portability (Article 20 GDPR) - to receive personal data concerning them, which they have provided to the Data Controller, in a structured, commonly used and machine-readable format and to request the transmission of such data to another controller where the processing is based on consent or on a contract and the processing is carried out by automated means;
   7. object (Article 21 GDPR) - to object, on grounds relating to their particular situation, to the processing of personal data based on the Controller's legitimate interests, including profiling. The Data Controller will then assess whether there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. If the data subject's interests are found to prevail over those of the Controller, the Data Controller will cease processing the data for those purposes;
   8. withdraw consent at any time and without giving any reason. Processing of personal data carried out before consent is withdrawn will remain lawful. Withdrawal of consent will result in the Data Controller ceasing to process personal data for the purpose for which the consent was given.
2. To exercise the rights referred to above, the data subject should contact the Data Controller using the contact details provided and indicate which right they wish to exercise and to what extent.

7. President of the Personal Data Protection Office

1. A data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, with its registered office at ul. Stawki 2, Warsaw. The authority may be contacted as follows:
2. by post: ul. Stawki 2, 00-193 Warsaw, Poland;
3. via the electronic contact form available at: https://www.uodo.gov.pl/pl/p/kontakt;
4. Helpline: 606-950-000.

8. Data Protection Officer

1. In all cases, the data subject may also contact the Controller's Data Protection Officer directly by email or in writing at the Data Controller's address specified in Section 1 point 2 of this Privacy and Cookie Policy.

9. Changes to the Privacy Policy

1. The Privacy and Cookie Policy may be supplemented or updated in accordance with the Controller's current needs in order to provide Customers/Users with up-to-date and reliable information.

10. Cookies

1. The Online Store obtains information about Customers, Users and their behaviour in the following ways:
   1. through information voluntarily entered into forms for purposes resulting from the function of the relevant form;
   2. through cookies stored on users' end devices;
   3. through web server logs collected by the Online Store's hosting provider, which are necessary for the proper functioning of the website.
2. Cookies are IT data, in particular text files, stored on the Customer's/User's end device and intended for use with the Online Store website. Cookies usually contain the name of the website from which they originate, the period for which they are stored on the end device and a unique number.
3. The Online Store uses cookies only after the Customer/User has given prior consent to their use. Consent to the use of all cookies by the Online Store is given by clicking the “Close” button when the Online Store's cookie notice is displayed or by closing that notice.
4. If the Customer/User does not consent to the Online Store's use of cookies, they may select the “I do not consent” option, also available in the Online Store's cookie notice, or change the settings of the web browser they currently use. This may, however, result in the Online Store website not functioning correctly.
5. To manage cookie settings, select your web browser/system from the list and follow its instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.
6. The legal basis for processing personal data obtained from cookies is the legitimate interests of the Data Controller, consisting in ensuring a high quality of services and the security of those services.
7. The Online Store uses two main types of cookies: “session cookies” and “persistent cookies”. Session cookies are temporary files stored on the User's end device until the User logs out, leaves the Online Store or closes the software (web browser). Persistent cookies are stored on the Customer's/User's end device for the period specified in the cookie parameters or until they are deleted by the Customer/User.

8. Cookies are used for the following purposes:
   1. creating statistics that help us understand how Customers/Users use the Online Store website, enabling us to improve its structure and content;
   2. maintaining the Customer's/User's session after login, so that they do not have to re-enter their login details and password on every page of the Online Store;
   3. determining the Customer's/User's profile in order to display product recommendations and personalised advertising materials in advertising networks, in particular the Google network.
9. Web browsing software (web browsers) generally allows cookies to be stored on the Customer's/User's end device by default. Customers/Users may change these settings. Web browsers allow cookies to be deleted. It is also possible to block cookies automatically.
10. Restrictions on the use of cookies may affect some functionalities available on the Online Store website.
11. Cookies placed on the Customer's/User's end device may also be used by advertisers and partners cooperating with the Online Store.
12. Cookies may be used by the Google network to display advertisements tailored to the way in which the Customer/User uses the Online Store. For this purpose, cookies may retain information about the User's browsing path or the amount of time spent on a particular page: https://policies.google.com/technologies/partner-sites.
13. We recommend that Customers/Users read the privacy policies of these companies to learn about the rules governing the use of cookies for statistical purposes, including the Google Analytics Privacy Policy.
14. With regard to information about Customer/User preferences collected by the Google advertising network, the Customer/User may review and edit information resulting from cookies using the following tool: https://www.google.com/ads/preferences/.
15. The Online Store website contains plugins that may transfer Customer/User data to controllers such as: .
16. For the proper performance of a Distance Sales Agreement, the Data Controller may share Customer/User data with courier companies. The currently available delivery methods in the Online Store are available at: https://harpers.pl/en/delivery.
17. For the proper performance of a Distance Sales Agreement, the Controller may share Customer/User data with online payment systems. The currently available prepaid payment methods in the Online Store are available at: https://harpers.pl/en/payments.
18. Further information about Google's terms and privacy rules is also available at: Google Privacy & Terms.

11. Newsletter

1. The Customer may consent to receiving commercial information electronically by selecting the relevant option in the registration form or at a later date in the appropriate section. Where such consent is given, the Customer/User will receive information from the Online Store (Newsletter), as well as other commercial information sent by the Seller, at the email address provided.
2. The Customer may unsubscribe from the Newsletter at any time by deselecting the relevant option in their Account, by using the form available at https://harpers.pl/en/newsletter.html, by clicking the relevant link contained in each Newsletter or by contacting Customer Service.

12. Account

1. The Customer/User may not publish in the Online Store or provide the Seller with unlawful content, including unlawful reviews or other unlawful data.
2. The Customer/User gains access to the Account after registration.
3. REVIEWS IN THE ONLINE STORE
   1.1. A Customer of the Online Store may voluntarily and free of charge submit a review concerning purchases made in the Online Store. The review may also include a rating, photograph or review of a product purchased in the Online Store.
   1.2. Following a purchase in the Online Store, the Seller provides the data required to create an email invitation to the company responsible for the review survey process. The sending of surveys and collection of reviews through forms is fully handled by TrustMate SA, with its registered office at Bartoszowicka 3, 51-641 Wrocław. TrustMate SA sends the Customer an email requesting a review and containing a link to an online form through which the review can be submitted. The online form enables the Customer to answer the Seller's questions concerning the purchase, rate it, add their own review description and upload a photograph of the purchased product. If no review is submitted after the first invitation, TrustMate may send another invitation.
   1.3. A review may only be submitted by a Customer who has made a purchase in the Seller's Online Store.
   1.4. Reviews submitted by Customers are published by the Seller in the Online Store and on the TrustMate.io profile.
   1.5. The Customer may not use the review functionality for unlawful activities, including acts of unfair competition against the Seller or activities infringing personal rights, intellectual property rights or other rights of the Seller or third parties.
   1.6. A review may only relate to products actually purchased in the Seller's Online Store. Entering into fictitious or sham sales agreements for the purpose of submitting a review is prohibited. The Seller or its employees, regardless of the basis of their employment, may not be the authors of reviews.
   1.7. A review may be deleted by its author at any time.
4. During registration, the Customer/User provides the account type or gender, first name, surname, company name, Tax Identification Number (NIP), details required for issuing a sales document, delivery details, email address and selects a password. The Customer/User confirms that the data provided in the registration form is accurate. Registration requires the Customer/User to carefully read the Terms and Conditions and select the relevant checkbox in the registration form confirming that they have read the Terms and Conditions and fully accept all of their provisions.
5. When the Customer/User is granted access to the Account, an agreement for the provision of electronic services relating to the Account is concluded between the Seller and the Customer for an indefinite period. A Consumer may withdraw from this agreement in accordance with the rules set out in the Terms and Conditions.
6. Registration of an Account on one of the Online Store's websites simultaneously constitutes registration enabling access to the other websites through which the Online Store is available.
7. The Customer/User may terminate the agreement for the provision of electronic services at any time with immediate effect by informing the Seller by email or in writing at the Data Controller's address specified in Section 1 point 2 of this Privacy and Cookie Policy.
8. The Seller may terminate the agreement for the provision of services relating to the Account if the Online Store service is discontinued or transferred to a third party, if the Customer/User breaches applicable law or the provisions of the Terms and Conditions, or if the Customer/User remains inactive for a period of 6 months. The agreement will be terminated subject to a seven-day notice period. The Seller may stipulate that re-registration of the Account requires the Seller's consent.