Privacy policy
This Privacy Policy (hereinafter referred to as the “Policy”) contains information regarding the processing of your personal data in connection with the use of the online store “adsystem.” operating at the internet address: adsystem.pl (hereinafter referred to as the “Store”).
All capitalized terms not otherwise defined in this Policy shall have the meaning assigned to them in the Terms and Conditions available at: Terms and Conditions.
Personal Data Controller
The controller of your personal data is Adsystem spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Bielany Wrocławskie (registered address: ul. Atramentowa 11, 55-040 Bielany Wrocławskie), entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register under KRS number: 0000229449, NIP (Tax ID): 8942678597, REGON: 93266059700000, with a fully paid-up share capital of PLN 58,500 (fifty-eight thousand five hundred zloty) (hereinafter referred to as the “Controller”).
Contacting the Controller
For all matters related to the processing of personal data, you can contact the Controller via email at: office@adsystem.pl.
Personal Data Protection Measures
The Controller uses modern organizational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”), the Polish Personal Data Protection Act of 10 May 2018, and other applicable data protection regulations.
Information on the Processing of Personal Data
The use of the Store requires the processing of your personal data. Below you will find detailed information on the purposes and legal bases for processing, as well as the data retention period and whether the provision of data is mandatory or voluntary.
Purpose of Processing
Conclusion and performance of the Agreement for the provision of the Account Service.
Processed Personal Data
Full name, email address, phone number, and data provided by the User on the Facebook or Google platform in the event of concluding the Agreement for the provision of the Account Service via these platforms.
Legal Basis
Article 6(1)(b) of the GDPR (processing is necessary for the performance of a contract for the provision of the Account Service to which the data subject is party or in order to take steps at the request of the data subject prior to entering into such a contract).
The provision of the above-mentioned personal data is a condition for concluding and performing the agreement for the provision of the Account Service (providing the data is voluntary, but failure to do so will result in the inability to conclude and perform the agreement, including the creation of an Account). The Controller will process the above-mentioned personal data until the expiration of claims arising from the agreement for the provision of the Account Service.
Purpose of Processing
Conclusion and performance of the Sales Agreement.
Processed Personal Data
Full name, email address, phone number, residential/business address (street, building number, apartment number, city, postal code, country), delivery address (if different from the residential/business address), and optionally – company name and tax identification number (NIP) if the Buyer is an Entrepreneur or an Entrepreneur with consumer rights.
Legal Basis
Article 6(1)(b) of the GDPR (processing is necessary for the performance of the Sales Agreement to which the data subject is party or in order to take steps at the request of the data subject prior to entering into such an agreement).
The provision of the above-mentioned personal data is a condition for concluding and performing the Sales Agreement (providing the data is voluntary, but failure to do so will result in the inability to conclude and perform the Sales Agreement). The Controller will process the above-mentioned personal data until the expiration of claims arising from the Sales Agreement.
Purpose of Processing
Conclusion and performance of the Agreement for the provision of the Newsletter Service.
Processed Personal Data
1) First name, 2) Email address
Legal Basis
Article 6(1)(b) of the GDPR (processing is necessary for the performance of the Newsletter Service Agreement to which the data subject is party or in order to take steps at the request of the data subject prior to entering into such an agreement) and Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – informing about news and promotions available in the Store).
The provision of the above-mentioned personal data is voluntary but necessary to receive the Newsletter (failure to provide the data will result in the inability to receive the Newsletter). The Controller will process the above-mentioned personal data until a valid objection is raised, the purpose of processing is achieved, or the claims arising from the Newsletter Service Agreement become time-barred (whichever of these events occurs first).
Purpose of Processing
Handling the complaint procedure.
Processed Personal Data
Full name, email address, phone number, residential/business address (street, building number, apartment number, city, postal code, country), delivery address (if different from the residential/business address), and optionally – company name and tax identification number (NIP) if the Buyer is an Entrepreneur or an Entrepreneur with consumer rights.
Legal Basis
Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case: the obligation to respond to a complaint – pursuant to Article 7a of the Consumer Rights Act; and the obligation to fulfill the Customer’s rights arising from the Controller’s liability in the event of non-conformity of a physical Product with the Sales Agreement or of a Digital Service with the relevant agreement).
The provision of the above-mentioned personal data is a condition for receiving a response to a complaint or for exercising the Customer’s rights arising from the Controller’s liability in the event of non-conformity of a physical Product with the Sales Agreement or of a Digital Service with the relevant agreement (providing the data is voluntary, but failure to do so will result in the inability to receive a response to the complaint or to exercise the aforementioned rights). The Controller will process the above-mentioned personal data for the duration of the complaint procedure, and in the case of exercising the Customer’s rights – until the expiry of the relevant limitation period.
Purpose of Processing
Conducting a verification procedure and handling appeals against decisions related to the processing of inadmissible content.
Processed Personal Data
Full name/company name, contact details including email address.
Legal Basis
Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case: the obligation to provide a mechanism for reporting illegal content – Article 16 of Regulation (EU) 2022/2065 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act – “DSA”), and the obligation to handle complaints – Article 20 of the DSA).
The provision of the above-mentioned personal data is a condition for receiving a response to the report or for exercising the User’s rights under the provisions of the DSA (providing the data is voluntary, but failure to do so will result in the inability to receive a response or to exercise the aforementioned rights). The Controller will process the above-mentioned personal data for the duration of the complaint procedure, and in the case of exercising the User’s rights – until the expiration of the relevant limitation period.
Purpose of Processing
Sending email notifications.
Processed Personal Data
Email address.
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – informing Customers about actions taken in connection with the performance of Agreements concluded with them).
The provision of the above-mentioned personal data is voluntary but necessary to receive information about actions related to the performance of Agreements concluded with Customers (failure to provide the data will result in the inability to receive such information). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved (whichever of these events occurs first).
Processed Personal Data
First name, email address, and any other data included in the message sent to the Controller.
Processed Personal Data
First name, email address, and any other data included in the message sent to the Controller.
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – responding to the inquiry received).
The provision of the above-mentioned personal data is voluntary but necessary to receive a response to the inquiry (failure to provide the data will result in the inability to receive a response). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved (whichever of these events occurs first).
Purpose of Processing
Publishing Product Reviews.
Processed Personal Data
Email address, and optionally – other data included in the Review.
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – publishing Reviews for informational and promotional purposes).
The provision of the above-mentioned personal data is voluntary but necessary to submit a Review (failure to provide the data will result in the inability to add a Review). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved (whichever of these events occurs first).
Purpose of Processing
Informing Customers about the availability of previously unavailable Products.
Processed Personal Data
Email address.
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – informing Customers about the availability of previously unavailable Products).
The provision of the above-mentioned personal data is voluntary but necessary to receive a notification about the availability of a previously unavailable Product (failure to provide the data will result in the inability to receive such a notification). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved (whichever of these events occurs first).
ChatGPT powiedział:
Purpose of Processing
Fulfillment of tax obligations (including issuing VAT invoices and storing accounting documentation).
Processed Personal Data
Full name/company name, residential/registered address, tax identification number (NIP).
Legal Basis
Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case – obligations arising from tax law).
The provision of the above-mentioned personal data is voluntary but necessary for the Controller to fulfill their tax obligations (failure to provide the data will result in the Controller being unable to meet these obligations). The Controller will process the above-mentioned personal data for a period of 5 years from the end of the year in which the deadline for payment of the tax for the previous year expired.
Purpose of Processing
Compliance with obligations related to personal data protection.
Processed Personal Data
Full name and the contact details you provided (email address, correspondence address, phone number).
Legal Basis
Article 6(1)(c) of the GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case – obligations arising from personal data protection regulations).
The provision of the above-mentioned personal data is voluntary but necessary for the proper fulfillment by the Controller of obligations arising from personal data protection regulations, including the exercise of the rights granted to you under the GDPR (failure to provide such data will result in the inability to properly exercise these rights). The Controller will process the above-mentioned personal data until the expiration of the limitation periods for claims related to violations of personal data protection regulations.
Purpose of Processing
Fulfillment of obligations related to personal data protection.
Processed Personal Data
Full name/company name, email address, residential/registered address, PESEL number, tax identification number (NIP).
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – the establishment, exercise, or defense of claims that may arise in connection with the performance of agreements concluded with the Controller).
The provision of the above-mentioned personal data is voluntary but necessary for the establishment, exercise, or defense of claims that may arise in connection with the performance of agreements concluded with the Controller (failure to provide such data will result in the Controller being unable to undertake these actions). The Controller will process the above-mentioned personal data until the expiration of the limitation periods for claims that may arise in connection with the performance of agreements concluded with the Controller.
Purpose of Processing
Analyzing your activity in the Store.
Processed Personal Data
Date and time of visit, IP address of the device, type of device operating system, approximate location, type of internet browser, time spent in the Store, products viewed, subpages visited, and other activities undertaken within the Store.
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – obtaining information about your activity in the Store).
The provision of the above-mentioned personal data is voluntary but necessary for the Controller to obtain information about your activity in the Store (failure to provide such data will result in the Controller being unable to obtain this information). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved.
Purpose of Processing
Administration of the Store.
Processed Personal Data
IP address, server date and time, information about the internet browser, information about the operating system.
The above data is automatically recorded in so-called server logs each time the Store is used (administration of the Store would not be possible without the use of server logs and automatic recording).
Legal Basis
Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case – ensuring the proper functioning of the Store).
The provision of the above-mentioned personal data is voluntary but necessary to ensure the proper functioning of the Store (failure to provide such data will result in the inability to ensure the proper functioning of the Store). The Controller will process the above-mentioned personal data until a valid objection is raised or the purpose of processing is achieved.
Profiling
In order to create your profile for marketing purposes and to deliver direct marketing tailored to your preferences, the Controller will process your personal data in an automated manner, including profiling. However, this will not produce any legal effects concerning you or similarly significantly affect your situation.
The scope of the profiled personal data corresponds to the data referred to above in relation to the analysis of your activity in the Store and the data you save in your Account.
The legal basis for processing personal data for this purpose is Article 6(1)(f) of the GDPR, which allows the Controller to process personal data to pursue its legitimate interests – in this case, conducting marketing activities tailored to the recipients' preferences. Providing the above-mentioned personal data is voluntary but necessary for the achievement of this purpose (failure to provide the data will result in the Controller being unable to conduct marketing activities tailored to your preferences).
The Controller will process personal data for profiling purposes until a valid objection is raised or the processing purpose is achieved.
Recipients of Personal Data
The recipients of personal data will be the following external entities cooperating with the Controller:
1. Hosting provider;
2. Logistics operator and courier companies;
3.Providers of online payment systems;
4. Provider of the platform for publishing and verifying reviews;
5.Provider of the newsletter service;
6.Companies providing tools for analyzing activity in the Store and directing direct marketing to Store users (including Google Analytics);
7.Accounting services provider;
8.Legal services provider.
Additionally, personal data may also be disclosed to public or private entities if such an obligation arises from generally applicable legal provisions, a final court judgment, or a final administrative decision.
Transfer of Personal Data to Third Countries
In connection with the use of services provided by Meta Platforms Ireland Limited and Google LLC, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia.
The legal basis for transferring data to these third countries is:
1.For the United Kingdom, Canada, Israel, Japan, and South Korea – European Commission adequacy decisions confirming an adequate level of personal data protection in each of these third countries;
2.For the USA – Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 based on Regulation (EU) 2016/679, recognizing an adequate level of protection under the EU-U.S. Data Privacy Framework;
3.For Chile, Brazil, Saudi Arabia, Qatar, India, China, Singapore, Taiwan (Republic of China), Indonesia, and Australia – contractual clauses ensuring an adequate level of protection, compliant with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
You may obtain a copy of the data transferred to a third country from the Controller.
Your Rights
In connection with the processing of your personal data, you have the following rights:
1.The right to information about which personal data concerning you is being processed by the Controller and to receive a copy of that data (the so-called right of access). The first copy is free; a fee may be charged for subsequent copies;
2.The right to request the rectification of your data if it becomes outdated, incomplete, or otherwise incorrect;
3.In certain situations, the right to request the erasure of your personal data, for example, if:
the data are no longer necessary for the purposes the Controller informed you about;
you have effectively withdrawn your consent (provided the Controller has no other legal basis to process your data);
the processing is unlawful;
the data must be erased to comply with a legal obligation;
4. If the personal data are processed based on your consent or for the performance of a contract, the right to transfer your data to another controller;
5.If your personal data are processed based on your consent, you have the right to withdraw that consent at any time (withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal);
6.The right to request the restriction of processing, for example, if you contest the accuracy of the personal data or the lawfulness of processing, or if you need the data for the establishment, exercise, or defense of claims;
7.The right to object to the processing of your personal data where the basis for processing is the Controller’s legitimate interest. Upon a valid objection, the Controller will cease to process your personal data for that purpose;
8.The right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of your personal data violates the GDPR.
Cookies
1.The Controller informs you that the Store uses "cookies" installed on your end device. These are small text files that can be read by the Controller’s system and systems belonging to other entities whose services the Controller uses.
2.The Controller uses cookies for the following purposes:
Ensuring the proper functioning of the Store – cookies enable the Store to operate efficiently, use its functionalities, and navigate smoothly between subpages;
Improving browsing comfort – cookies help detect errors on certain subpages and continually improve the Store;
Creating statistics – cookies are used to analyze how users use the Store, allowing continuous improvements and adjustments to user preferences;
Conducting marketing activities – cookies allow the Controller to direct advertisements tailored to user preferences.
3.The Controller may place both persistent and session cookies on your device. Session cookies are usually deleted upon closing the browser, while persistent cookies are not deleted automatically.
4.Information about the cookies used by the Controller is displayed in the panel located at the bottom of the Store's website. Depending on your decision, you can enable or disable cookies for specific categories (except necessary cookies) and change these settings at any time.
5.The data collected through cookies does not allow the Controller to identify you.
6.Detailed information about the types of cookies used by the Controller can be found in the panel at the bottom of the Store's website.
7.Through most commonly used browsers, you can check whether cookies have been installed on your device, delete installed cookies, and block future installations by the Store. However, disabling or limiting cookies may cause significant difficulties in using the Store, such as requiring you to log in on each subpage, longer loading times, and restricted access to some functionalities.
Final Provisions
In matters not regulated by this Policy, generally applicable provisions on personal data protection shall apply.
This Policy is effective as of 11 September 2024.