Privacy policy
WEBSITE
PRIVACY POLICY
osm-gizycko.com.pl
Dear User
We care about your privacy and want you to feel comfortable and safe while using our services.
Therefore, we have prepared this document, where you will find detailed
information regarding the processing of your personal data.
Table of Contents:
1. Introduction
2. Definitions
3. General Information
4. Recipients of Website Personal Data
5. Acquisition, Collection Purpose, Scope, and Activities of Personal Data Processing
6. Rights of Data Subjects
7. Cookies Mechanism, Usage Data, and Analytics
8. Final Provisions
§ 1
Introduction
1. This privacy policy sets out the rules for the processing and protection of personal data
of Users using the website available at the internet address: osmgizycko.com.pl, hereinafter referred to as the Website. This document primarily describes the grounds, purposes, and scope
of personal data processing, indicates the entities to which data is entrusted, and contains information regarding cookies and analytical tools used within the website.
website.
2. The controller of personal data collected through the website, within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection
Regulation) of 27 April 2016 (OJ L 119, p. 1), hereinafter referred to as the GDPR (the text of the regulation can be found here http://eur-lex.europa.eu/legalcontent/PL/TXT/?uri=CELEX%3A32016R0679), is the company Okręgowa Spółdzielnia Mleczarska, entered into the Central Register and Information on Economic Activity, with its principal place of business and service address at: ul. Białostocka 25, 11-500 Giżycko, NIP: 8450001096, REGON: 000439428, contact phone: +48 (87) 4282551, e-mail address: osm@osm-gizycko.com.pl, hereinafter referred to as the Controller and also being the Service Provider of the website.
3. Users’ personal data is processed in accordance with the provisions on the protection of personal data and the Act of 18 July 2002 on the provision of electronic services (Journal of Laws 2002 No. 144, item 1204, as amended).
4. The personal data controller declares that the privacy policy serves an informative role, which means it is not a source of obligations for Website Users. Its purpose is to define the actions taken by the Controller and describe the services, tools, and functionalities related to the website that Users use, e.g., to use the contact form or other activities undertaken within the website.
§ 2
Definitions
1. User – a person using the website; an entity for whom, in accordance with the law, electronic services may be provided or with whom an agreement for the provision of electronic services may be concluded.
2. Controller – the company Okręgowa Spółdzielnia Mleczarska, ul. Białostocka 25, 11-500 Giżycko, NIP: 8450001096, REGON: 000439428.
3. Website (web page) – one of the web pages that are part of the same website, hosted under the domain osmgizycko.com.pl, which can be opened using a web browser. The website
managed by the Controller consists of HTML, CSS, and JavaScript code and may contain, for example, content, graphics, videos, or hyperlinks to other websites or files.
4. Electronic Service – a service provided electronically by the Controller to the User via the website.
5. Contact Form – a form in which Users of the osm-gizycko.com.pl website
provide necessary information and data in order to perform a service/process a submitted request to the Controller.
6. Device – an electronic device through which the User accesses the website.
7. Consumer – a natural person concluding an agreement with the Controller within the website, the subject of which is not directly related to their business or professional activity.
§ 3
General Information
1. The website Controller makes every effort to protect the privacy of Website Users and all data and information obtained from them. With due diligence, the Controller selects and applies technical protection measures, both software and organizational, thereby ensuring complete protection against their disclosure, exposure, loss, destruction, unauthorized modification, or processing in violation of applicable laws.
2. The Controller informs that the website uses a transmission protocol that ensures the security of data transfer on the Internet, namely, it has an SSL (Secure Socket Layer) protocol installed. This is a type of security consisting of encoding data before it is
sent from the User’s browser and decoding it after it safely reaches the website’s server. Information sent from the server to the User is also encoded and decoded upon reaching its destination.
3. Data collected by the Controller is processed lawfully, respecting the principles of fairness and transparency, collected to the minimum extent necessary for specified purposes and processed accordingly, not subjected to further processing incompatible with those purposes, adequate and substantively correct in relation to the purpose, and stored in a way that allows identification of the data subjects. The data storage period depends on the purpose of processing and is limited to the moment the
intended goal is achieved.
4. The website Controller, under the terms specified in the regulations and the privacy policy, has access to the data; however, they may entrust Users’ personal data to external entities cooperating with the Controller. Such entrustment is possible only on the basis of appropriate personal data processing agreements concluded between the Controller and the processor. The agreements contain a provision specifying the scope and conditions of personal data processing necessary to perform the services. The Controller declares that they only cooperate with entities that guarantee the security of personal data processing by implementing safeguards that meet the requirements set out in the GDPR.
5. The Controller has the right, as well as a statutory obligation, to provide information regarding Website Users to public authorities, e.g., in connection with proceedings regarding possible violations of law, or to third parties who submit such a request based on applicable Polish law.
6. Using the services and tools provided within the website, as well as providing personal data by the User, is voluntary. However, providing them may be necessary to conclude and perform an agreement for the provision of electronic services on the website; thus, their absence will prevent the conclusion of such an agreement. The scope of data necessary to conclude the agreement is indicated on the website.
7. A User using the services and tools provided within the website confirms that they have read the provisions of this privacy policy, while simultaneously consenting (if necessary) to the use of their personal data in accordance with these provisions by checking the appropriate checkboxes on the website (the content of the checkboxes specifies the purpose for which the provided personal data will be used).
§ 4
Recipients of Website Personal Data
1. In order to ensure the proper functioning of the website, the Controller uses the services of external entities. The Controller transfers data only when it is necessary to achieve a given purpose of personal data processing and only to the extent necessary to achieve it.
2. Examples of recipients of Website Users’ personal data include:
• carriers, intermediaries, couriers, forwarders – in a situation where a User making a purchase on the Website chooses a courier delivery method,
• entities supporting the functionalities of the Website.
3. Data recipients (external entities) process personal data based on appropriate entrustment agreements signed with the website Controller. These entities collect, process, and store personal data in accordance with their own regulations and privacy
policies.
4. The Controller entrusts the processing of personal data of Service Recipients and Users of the “osmgizycko.com.pl” website to the following entities:
• b.center Bartosz Kaczmarek, ul. Promienna 12U, 64-920 Piła, NIP: 7642435045, REGON: 301172998 – for the purpose of storing data on the server where the Website is installed and for the purpose of providing IT and technical support for the Website, for the purpose of website SEO, for the purpose of providing/handling marketing services, and for the purpose of website SEO.
§ 5
Acquisition, Collection Purpose, Scope, and Processing Activities
1. The Controller acquires information about Users, among others, by collecting server logs, IP addresses, software and hardware parameters, pages viewed, mobile device identification numbers, and other data regarding devices and system usage. The collection of the above information will take place in connection with the use of the website. This data is not used by the Controller to identify the User.
2. Navigation data may also be collected from Users, including information about links and references or other actions taken on the website, to facilitate the use of services provided electronically and to improve the functionality of these services.
3. The Controller reserves the right to filter and block messages sent through the internal messaging system, particularly if they are spam, contain prohibited content, or otherwise threaten the security of Website Users.
4. As part of the website, the Controller processes Users’ personal data for the following purposes:
• contacting Users in response to inquiries sent via the contact form, contacting Users via e-mail in response to submitted inquiries,
• facilitating the use of the website and ensuring the IT security of the website,
• performing the agreement regarding the provision of electronic services.
5. The Controller informs that they collect, process, and store the following User data: e-mail address and optionally first and last name.
6. Personal data collected for the purposes indicated in the privacy policy will be stored for the period of performance of services provided by the Controller and for the period resulting from the statutes of limitations for claims, Consumer rights, or other rights in this regard.
CONTACT WITH THE USER
7. The basis for data processing in connection with User service, which includes contacting the User to respond to an inquiry sent via e-mail or the contact form, is Art. 6(1)(a) GDPR, i.e., consent to processing.
If an agreement is concluded after contact, the data will be processed based on Art. 6(1)(b) GDPR. The legal basis for processing after the eventual termination of contact will be a legitimate purpose in the form of archiving correspondence for the purpose of demonstrating its course in the future (pursuant to Art. 6(1)(f) GDPR).
CONTACT FORM
8. As part of the website’s functionality, the Controller provides the possibility to contact them using an interactive form. Using the form requires providing personal data necessary to contact the User and answer the questions contained in the form. The User may also provide other data to facilitate contact or order a service. Providing data marked as mandatory is required to handle the inquiry, and failure to provide it may result in the inability to handle it. Providing other data is voluntary.
9. The basis for data processing in connection with the use of the contact form is Art. 6(1)(a) GDPR, i.e., consent to processing.
10. For the purpose of identifying the sender and handling their inquiry sent via the provided form – the legal basis for processing is the necessity of processing to perform the service agreement (Art. 6(1)(b) GDPR).
11. The legal basis for processing after the eventual termination of contact will be a legitimate purpose in the form of archiving correspondence for the purpose of demonstrating its course in the future (pursuant to Art. 6(1)(f) GDPR).
FANPAGE
12. The Controller provides Users with their Fanpage via the Facebook platform, the controller of which is the Controller themselves or a person designated (authorized) to perform this function. Through the fanpage, the User can add comments, posts as a guest, and use the “Like” or “Share” functions.
13. Through the fanpage, the User may be redirected to the Controller’s website.
14. The basis for data processing within the functioning of the fanpage, necessary to manage it and for statistical purposes, consisting, among other things, of the analysis of data collected automatically when using the website, including cookies, is the legitimate interest of the controller pursuant to Art. 6(1)(f) GDPR.
15. The basis for processing personal data in connection with posting comments is consent based on Art. 6(1)(a) GDPR.
16. Within the fanpage, the User can stop following it at any time. Stopping following results in content from the Controller related to the fanpage no longer being displayed.
17. The Controller informs that they process the following personal data: first name, last name, and general information that was posted by the User on their profile on the Facebook social network.
18. Personal data will be processed for the period of running the fanpage or until consent is withdrawn.
19. The Controller informs that personal data collected within the fanpage may be transferred to the United States by saving it in a database located on an American server. Facebook, Inc. is an entity based both in a third country – the United States, and in Ireland, which has joined the Privacy Shield program and thus guarantees an adequate level of personal data protection required by European regulations.
SOCIAL TOOLS (FACEBOOK)
20. On the “osm-gizycko.com.pl” website, a plugin and other tools provided by the Facebook social network are used. By displaying a website page on which such a plugin has been placed, the User’s browser establishes a direct connection with the Facebook Controller’s server.
21. The content of the plugin is transferred by the given Service Provider directly to the User’s browser and integrated with the page. This integration allows the Service Provider to receive information that the User’s browser has displayed the osm-gizycko.com.pl page, even if the User does not have a profile on the Facebook social network or is not currently logged into it. If the User is logged into the social network, the Service Provider will be able to directly assign the visit to the page to the given profile on the Facebook social network.
22. In a situation where a Website User uses the “Like” or “Share” button, the corresponding information will also be sent directly to the server of the given Service Provider and stored there. Furthermore, this information will be published on the social network and will appear, for example, on the Facebook wall. The purpose and scope of data collection and its further processing and use by Service Providers, as well as the possibility of contact and the rights of Users in this regard and the possibility of making settings ensuring privacy protection, are indicated in the privacy policy of each Service Provider.
§ 6
Rights of Data Subjects
1. The GDPR grants Users specific rights, a list of which is provided below. They are available without giving a reason, but they are not absolute and will not apply to all activities regarding the processing of personal data. In a situation where a User wants to exercise any of their rights, they may at any time send a statement of will to the website’s e-mail address or the address of the Controller’s registered office.
I. Right of access to data exercised on the basis of Art. 15 GDPR.
The User may at any time contact the Controller to confirm whether their data is being processed, and if so, the User has the right:
• to obtain access to personal data,
• to receive information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of this data, the planned period of storage of the User’s data or the criteria for determining this period (when determining the planned period
of data processing is not possible), about the rights the User/Users are entitled to under the GDPR (when determining the planned period of data processing is not possible), about the rights the User is entitled to under the GDPR and the right to lodge a complaint with a supervisory authority, about the source of this data, about automated decision-making, including profiling, and about the safeguards used in connection with the transfer of this data outside the European Union,
• to obtain a copy of their personal data.
II. Right to rectification of data exercised on the basis of Art. 16 GDPR.
The User has the right to request from the Controller the immediate rectification of their personal data that is incorrect. They also have the right to request the completion of their personal data. To rectify or complete your personal data, please send information to
the website’s e-mail address.
III. Right to erasure (“right to be forgotten”) – exercised on the basis of Art.
17 GDPR.
a) The User may request the Controller to erase all or some of their data,
b) The User has the right to request the erasure of their personal data when:
• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
• they have withdrawn specific consent, to the extent that the personal data was processed based on the User’s consent,
• they have objected to the use of their data for marketing purposes,
• the personal data was processed unlawfully,
• the personal data must be erased to comply with a legal obligation provided for in Union law or the law of a Member State to which the Controller is subject,
• the personal data was collected in connection with the offer of information society services,
c) despite the User’s request for erasure of personal data in connection with an objection or withdrawal of consent, the Controller may retain certain personal data to the extent that processing is necessary for the establishment, exercise, or defense of legal claims, as well as to comply with a legal obligation requiring processing under Union law or the law of a Member State to which the Controller is subject,
d) erasure of personal data or cessation of its processing by the Controller may result in the inability to perform services provided through the website or limit the possibility of using the website’s functionalities.
IV. Giving consent to the processing of personal data and the right to withdraw consent exercised on the basis of Art. 7(3) GDPR
a) By accepting the statements placed by the Controller in the interactive forms available on the website, the User consents to the processing of their data for specific purposes,
b) The User has the possibility to consent to the processing of their data for additional purposes by accepting non-mandatory statements proposed in the forms available on the website,
c) The User has the right to withdraw any consent they have given to the Controller; withdrawal of consent will take effect from the moment of withdrawal,
d) withdrawal of consent will not cause any negative consequences for the User, but it may prevent further use of services or functionalities that the Controller can legally provide only with consent,
e) withdrawal of consent does not affect the processing of personal data carried out by the Controller
lawfully before its withdrawal.
V. Right to object to data processing exercised on the basis of Art. 21 GDPR
a) The User has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data, including profiling, if the Controller processes personal data based on a legitimate interest,
b) resignation from receiving marketing information regarding products and services sent by the User in the form of an e-mail means the User’s objection to the processing of their data, including profiling for these purposes,
c) if the Controller has no other legal basis allowing for the processing of the User’s data and the objection proves to be justified, the personal data against which the objection was raised will be erased.
VI. Right to request restriction of personal data processing exercised on the
basis of Art. 18 GDPR
The User has the right to request the restriction of their personal data when:
a) they contest the accuracy of their personal data – the personal data controller will restrict the processing of personal data for a period allowing for the verification of the accuracy of this data,
b) the processing of the User’s personal data is unlawful, and instead of erasing the personal data, the User requests the restriction of the processing of their personal data,
c) the User’s personal data is no longer needed for the purposes of processing, but it is needed for the
purpose of establishing, exercising, or defending the User’s claims,
d) when the User has objected to the processing of their personal data – then the restriction of processing occurs until it is determined whether the legitimate interests on the part of the personal data controller override the grounds indicated in the User’s objection.
VII. Right to request personal data portability (Art. 20 GDPR)
The User has the right to receive their personal data from the Controller in a structured, commonly used, machine-readable format and to send it to another personal data controller.
The User also has the right to request that the personal data controller send the User’s personal data directly to another controller (as far as technically possible).
VIII. The User also has the right to lodge a complaint with the President of the Personal Data Protection Office regarding the violation of their rights to personal data protection or other rights granted under the GDPR.
§ 7
Cookies Policy, Usage Data, and Analytics
1. The website uses small files called cookies, which are saved and stored on the User’s computer or other end device if the web browser allows it. Cookies typically contain the name of the domain they originate from, their storage time on the Device, and an assigned value.
2. Cookies are used to optimize the website’s usage process, to collect statistical data that allows identifying how Users use the website, which enables improving the website’s structure. They are also necessary to maintain the User’s session after they leave the website.
3. The Administrator uses two types of cookie files:
a) session cookies (temporary): these are stored on the User’s end device and remain there until the end of the given browser session. The saved information is then permanently deleted from the device’s memory. The session cookie mechanism does not allow for the collection of any personal data or confidential information from the User’s device,
b) persistent cookies: these are stored on the User’s device and remain there until they are deleted. Ending a browser session or turning off the device does not remove them from the User’s device. The persistent cookie mechanism does not allow for the collection of any personal data or confidential information from the User’s device.
4. The service Administrator uses third-party cookies to:
a) collect general and anonymous statistical data via analytical tools:
Google Analytics (the cookie administrator is Google Inc. with its registered office in the United States),
b) promote the website using the social media service www.facebook.com
(the third-party cookie administrator: Facebook Inc. with its registered office in the USA or Facebook Ireland with its registered office in Ireland).
5. At any time, the User can change cookie settings using the web browser they are using, including blocking the ability to collect cookies. Such action may hinder or prevent the use of the website’s services and tools, including preventing the placement of an order.
6. If the User decides not to consent to the use of cookies for the purposes described above, they can delete them manually at any time. Detailed instructions and information regarding cookies are contained in the help menu of the web browser currently used by the User. Examples of web browsers that support these cookies include:
Internet Explorer, Mozilla Firefox, Google Chrome, Opera, Safari, Microsoft Edge.
7. Some third parties operating within the website allow Users to withdraw consent for the collection and use of data for advertising purposes based on User activity. More information on this topic and the option to make a choice can be found, for example, on the website: www.youronlinechoices.com.
§ 8
Final Provisions
1. This privacy policy contains links to other websites; it is recommended to familiarize yourself with the privacy policies and terms of those sites.
2. The above privacy policy applies only to the Administrator’s website.
3. It is possible to expand the website’s offerings, which may lead to changes in the content of the privacy policy, about which you will be informed by an appropriate message on the site.
4. For additional questions regarding the website’s privacy policy, please send a message to the email address provided by the Administrator: osm@osm-gizycko.com.pl.
