Privacy Policy

  1. his Privacy Policy sets out the rules for the processing of personal data obtained via the online store www.produktynaturalne.pl (hereinafter referred to as the “Online Store”).
  2. The owner of the Online Store and the data controller is PRODUKTY NATURALNE BEREZIŃSCY spółka jawna with its registered office in Tuszynek Majorancki (95-080 Tuszyn), ul. Starościańska 19A, NIP: 7710010939, REGON: 590066795, KRS: 0000707803, hereinafter referred to as NATURALIS.
  3. Personal data collected by NATURALIS via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also known as the GDPR.
  4. NATURALIS takes special care to respect the privacy of customers visiting the Online Store.

§ 1 Type of data processed, purposes and legal basis

  1. NATURALIS collects information on natural persons performing legal acts not directly related to their business activity, natural persons conducting business or professional activity on their own behalf, and natural persons representing legal persons or organizational units that are not legal persons, to which the law grants legal capacity, conducting business or professional activity on their own behalf, hereinafter collectively referred to as Customers.
  2. Customers’ personal data are collected in the following cases:
    a) registering an account in the Online Store, in order to create and manage an individual account. Legal basis: necessary for the performance of the Account service agreement (Article 6, paragraph 1, letter b of the RODO/GDPR);
    b) placing an order in the Online Store, in order to perform the sales contract. Legal basis: necessary for the performance of the sales contract (Article 6, paragraph 1, letter b of the RODO/GDPR);
    c) subscribing to the Newsletter, in order to perform the contract for the provision of services electronically. Legal basis: consent of the data subject to the performance of the Newsletter service agreement (Article 6, paragraph 1, letter a of the RODO/GDPR).
  3. When registering an account in the Online Store, the Customer provides:
    a) email address.
  4. When registering an account in the Online Store, the Customer independently sets a unique password for their account. The Customer may change the password at a later time, as described in §5.
  5. When placing an order in the Online Store, the Customer provides the following information:
    a) email address;
    b) address details:
    • postal code and city;
    • country (state);
    • street with house/apartment number.

    c) name and surname;
    d) telephone number.

  6. In the case of Entrepreneurs, the above scope of data is additionally extended to include:
    a) the Entrepreneur’s business name;
    b) the Tax Identification Number (NIP).
  7. When using the Newsletter service, the Customer only provides his/her e-mail address.
  8. When using the Store Website, additional information may be downloaded, in particular: the IP address assigned to the Customer’s computer or the external IP address of the Internet provider, domain name, browser type, access time, type of operating system.
  9. Navigational data may also be collected from Customers, including information about the links and hyperlinks they choose to click or other actions they take in our Online Store. Legal basis: legitimate interest (Article 6, paragraph 1, letter f, GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of these services.
  10. For the purpose of establishing, pursuing, and enforcing claims, certain personal data provided by the Customer when using the Online Store’s functionalities may be processed, such as: first name, last name, data regarding the use of services if the claims arise from the Customer’s use of services, and other data necessary to prove the existence of the claim, including the extent of the damage suffered. Legal basis – legitimate interest (Article 6, paragraph 1, letter f of the GDPR), consisting in the establishment, pursuit, and enforcement of claims, as well as defense against claims in proceedings before courts and other state authorities.
  11. The provision of personal data to NATURALIS is voluntary in connection with concluded sales contracts or the provision of services via the Online Store Website, provided, however, that failure to provide the data specified in the data forms in the Registration process prevents Registration and establishment of a Customer Account, and in the case of placing an order without Registration of the Customer Account, placement and fulfilment of the Customer order will be impossible.

§ 2 Who is the data shared or entrusted to and how long is it stored?

  1. Customers’ personal data is transferred to service providers used by NATURALIS to operate the Online Store. Depending on contractual arrangements and circumstances, these service providers are either subject to NATURALIS’s instructions regarding the purposes and methods of processing such data (processors) or independently determine the purposes and methods of processing (controllers).
    a) Processors. NATURALIS uses suppliers who process personal data exclusively at NATURALIS’s request. These include, among others, providers of hosting services, accounting services, marketing systems, systems for analyzing traffic in the Online Store, and systems for analyzing the effectiveness of marketing campaigns.
    b) Controllers. NATURALIS uses suppliers who do not act solely on instructions and independently determine the purposes and methods of using Customers’ personal data. They provide electronic payment and banking services.
  2. Location. Service providers are based primarily in Poland and other countries in the European Economic Area (EEA).
  3. Customers’ personal data are stored:
    a) If consent is the basis for personal data processing, then NATURALIS processes the Customer’s personal data until consent is revoked, and after revocation, for a period corresponding to the limitation period for claims that NATURALIS may raise and that may be brought against it. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to business operations, three years.
    b) If the basis for data processing is the performance of a contract, then NATURALIS processes the Customer’s personal data for as long as necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to business operations, three years.
  4. If you make a purchase in the Store, your personal data may be transferred to R2G Polska Sp. z o.o. with its registered office in Warsaw and its contractually bound courier companies for the purpose of delivering the ordered goods.
  5. If the Customer chooses payment via the Shoper PAYMENTS system, his/her personal data is transferred to the extent necessary to process the payment to Dreamcommerce S.A. with its registered office in Kraków (31-280), at 79 Władysława Łokietka Street, entered into the register of entrepreneurs maintained by the District Court for Kraków Śródmieście in Kraków, 11th Commercial Division of the National Court Register under the KRS number 0000395171.
  6. Navigation data may be used to provide Customers with better service, analyze statistical data and adapt the Online Store to Customer preferences, as well as to administer the Online Store.
  7. If the Customer subscribes to the newsletter (Newsletter), NATURALIS will send electronic messages to his/her e-mail address containing commercial information about promotions and new products available in the Online Store.
  8. In the event of a request, NATURALIS makes personal data available to authorized state authorities, in particular organizational units of the Prosecutor’s Office, the Police, the President of the Office for Personal Data Protection, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.

§ 3 Cookie mechanism, IP address

  1. The Online Store uses small files called cookies. They are stored by NATURALIS on the end device of the Online Store visitor, if the web browser allows it. A cookie file typically contains the name of the domain from which it originates, its expiration time, and an individual, randomly selected number identifying the file. Information collected using this type of file helps tailor the products offered by NATURALIS to the individual preferences and actual needs of Online Store visitors. They also enable the development of general statistics on visits to the products presented in the Online Store.
  2. NATURALIS uses two types of cookies:
    a) Session cookies: after the browser session ends or the computer is turned off, the stored information is deleted from the device’s memory. The session cookie mechanism does not allow the collection of any personal data or any confidential information from Customers’ computers.
    b) Persistent cookies: these are stored in the Customer’s end device’s memory and remain there until they are deleted or expire. The persistent cookie mechanism does not allow the collection of any personal data or any confidential information from Customers’ computers.
  3. NATURALIS uses its own cookies for the following purposes:
    a) authenticating the Customer in the Online Store and maintaining the Customer’s session in the Online Store (after logging in), so that the Customer does not have to re-enter their login and password on every subpage of the Online Store;
    b) conducting analyses, research, and audience audits, in particular to create anonymous statistics that help us understand how Customers use the Store’s Website, which allows us to improve its structure and content.
  4. The cookie mechanism is safe for the computers of Online Store Customers. In particular, it is impossible for viruses or other unwanted software or malware to enter Customers’ computers this way. However, Customers have the option of limiting or disabling cookie access to their computers in their browsers. If this option is used, the Online Store will still be available for use, except for functions that, by their nature, require cookies.
  5. Below, you can change the cookie settings of popular web browsers:
    a) Internet Explorer;
    b) Microsoft EDGE;
    c) Mozilla Firefox;
    d) Chrome;
    e) Safari;
    f) Opera.
  6. NATURALIS may collect Customer IP addresses. An IP address is a number assigned to the computer of a visitor to the Online Store by the Internet service provider. The IP number allows access to the Internet. In most cases, it is assigned to the computer dynamically, meaning it changes with each Internet connection. The IP address is used by NATURALIS to diagnose technical problems with the server, create statistical analyses (e.g., to determine which regions receive the most visits), as information useful in administering and improving the Online Store, as well as for security purposes and to identify server-intensive, unwanted automated programs browsing the Online Store’s content.
  7. The Online Store contains links  and references to other websites. NATURALIS is not responsible for the privacy policies applicable therein.

§ 4 Rights of data subjects

  1. Right to withdraw consent – legal basis: Article 7, Section 3 of the GDPR.
    a) The Customer has the right to withdraw any consent granted to NATURALIS.
    b) Withdrawal of consent is effective from the moment of withdrawal.
    c) Withdrawal of consent does not affect the processing carried out by NATURALIS in accordance with the law prior to its withdrawal.
    d) Withdrawal of consent does not entail any negative consequences for the Customer; however, it may prevent further use of services or functionalities that, according to the law, NATURALIS can only provide with consent.
  2. Right to object to data processing – legal basis: Article 21 of the GDPR.
    a) The Customer has the right to object at any time – for reasons related to his/her particular situation – to the processing of his/her personal data, including profiling, if NATURALIS processes his/her data based on a legitimate interest, e.g. marketing of NATURALIS products and services, keeping statistics on the use of individual functionalities of the Online Store and facilitating the use of the Online Store, as well as satisfaction surveys.
    b) Unsubscribing via e-mail from receiving marketing communications regarding products or services will mean the Customer’s objection to the processing of his or her personal data, including profiling for these purposes.
    c) If the Customer’s objection proves to be justified and NATURALIS has no other legal basis for processing personal data, the Customer’s personal data will be deleted to the processing of which the Customer has objected.
  3. Right to erasure (“right to be forgotten”) – legal basis: Article 17 of the GDPR.
    a) The Customer has the right to request the erasure of all or some of their personal data.
    b) The Customer has the right to request the erasure of their personal data if:
    • personal data are no longer necessary for the purposes for which they were collected or processed;
    • withdrew specific consent to the extent that personal data were processed based on his consent;
    • has objected to the use of his data for marketing purposes;
    • personal data are processed unlawfully;
    • personal data must be erased in order to comply with a legal obligation under Union law or the law of the Member State to which NATURALIS is subject;
    • personal data were collected in connection with the provision of information society services.

    c) Despite a request to delete personal data, in connection with an objection or withdrawal of consent, NATURALIS may retain certain personal data to the extent that processing is necessary to establish, pursue, or defend legal claims, as well as to comply with a legal obligation requiring processing under EU or Member State law to which NATURALIS is subject. This applies in particular to personal data including: first name, last name, and email address, which are retained for the purpose of handling complaints and claims related to the use of NATURALIS services, and additionally, residential/mailing address and order number, which are retained for the purpose of handling complaints and claims related to concluded sales contracts or the provision of services.

  4. Right to restrict data processing – legal basis: Article 18 of the GDPR.
    a) The Customer has the right to request the restriction of the processing of their personal data. Submitting a request, until it is resolved, prevents the use of certain functionalities or services whose use will involve the processing of the data covered by the request. NATURALIS will also not send any communications, including marketing communications.
    b) The Customer has the right to request the restriction of the use of personal data in the following cases:
    • when he/she questions the accuracy of his/her personal data – then NATURALIS limits their use for the time needed to check the accuracy of the data, but no longer than for 7 days;
    • when the processing of data is unlawful and instead of deleting the data, the Customer requests the restriction of their use;
    • when personal data are no longer necessary for the purposes for which they were collected or used but are still needed by the Client to establish, pursue or defend claims;
    • when he has objected to the use of his data – then the restriction takes place for the time needed to consider whether – due to the specific situation – the protection of the Client’s interests, rights and freedoms outweighs the interests pursued by the Controller in processing the Client’s personal data.
  5. Right of access to data – legal basis: Article 15 of the GDPR.
    a) The Customer has the right to obtain confirmation from the Controller whether or not personal data is being processed, and if so, the Customer has the right to:
    • access your personal data;
    • obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of this data, the planned period of storage of the Customer’s data or the criteria for determining this period (when it is not possible to determine the planned period of data processing), the Customer’s rights under the GDPR and the right to lodge a complaint with the supervisory authority, the source of these data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of these data outside the European Union;
    • obtain a copy of your personal data.
  6. Right to rectification – legal basis: Article 16 of the GDPR.
    a) The Customer has the right to request immediate rectification of inaccurate personal data concerning them from the Controller. Taking into account the purposes of processing, the Customer whose data is processed has the right to request the completion of incomplete personal data, including by providing an additional declaration, by sending a request to the email address specified in §6 of the Privacy Policy.
  7. Right to data portability – legal basis: Article 20 of the GDPR.
    a) The Customer has the right to receive their personal data provided to the Controller and then transmit it to another personal data controller of their choice. The Customer also has the right to request that the Controller transmit their personal data directly to such controller, if technically feasible. In such a case, the Controller will transmit the Customer’s personal data in the form of a CSV file, which is a commonly used, machine-readable format that allows the data received to be transmitted to another personal data controller.
  8. If the Customer exercises the above rights, NATURALIS will either comply with the request or refuse to comply with it immediately, but no later than one month after receiving it. However, if – due to the complex nature of the request or the number of requests – NATURALIS is unable to comply within one month, it will comply within the next two months, informing the Customer within one month of receiving the request of the intended extension and the reasons therefor.
  9. The Customer may submit complaints, inquiries and requests to the Administrator regarding the processing of his or her personal data and the exercise of his or her rights.
  10. The Customer has the right to request from NATURALIS a copy of the standard contractual clauses by sending an inquiry in the manner indicated in §6 of the Privacy Policy.
  11. The Customer has the right to lodge a complaint with the President of the Personal Data Protection Office regarding a violation of his or her rights to personal data protection or other rights granted under the GDPR.

§ 5 Security management – password

  1. NATURALIS provides Customers with a secure and encrypted connection when transmitting personal data and logging into their Customer Account on the Website. NATURALIS uses an SSL certificate issued by one of the world’s leading companies in the field of security and encryption of data transmitted over the internet.
  2. If a Customer with an Online Store account has lost their password in any way, the Online Store allows them to generate a new password. NATURALIS does not send password reminders. The password is stored in an encrypted form, making it unreadable. To generate a new password, enter your email address in the form available under the “Forgot your password” link in the Online Store account login form. The Customer will receive an email at the email address provided during registration or saved in the last account profile change, redirecting you to a dedicated form available on the Store’s website, where you will be able to set a new password.
  3. NATURALIS never sends any correspondence, including electronic correspondence, asking for login details, in particular the access password to the Customer’s account.

§ 6 Changes to the Privacy Policy

  1. The Privacy Policy may be subject to change, of which NATURALIS will inform Customers 7 days in advance.
  2. Please send any questions regarding the Privacy Policy to the following address: naturalis@produktynaturalne.pl
  3. Last modified on: June 8, 2020