Privacy Policy

grzechhair.com Security Policy

Our aim is to ensure you feel secure on our website, which is why your privacy and the protection of your personal rights are important to us. We therefore ask you to read the following summary carefully, which explains how our website operates. You can rest assured that your data will be processed in a transparent and fair manner, and that we will make every effort to ensure your data is handled with care and responsibility. The Privacy Policy below is intended to inform you about how we use your personal data, in respect of which we comply with the strict requirements of the German Data Protection Act and the General Data Protection Regulation (GDPR).
 
Details of the data
controller and data protection officer The data controller for the purposes of the GDPR, other legislation in force in EU Member States and other data protection regulations is:
 
GrzechHair Grzegorz Grzech
, ul. Przebendowskich 49a, 81-526 Gdynia
, VAT No.: 5882354581
, email: rodo@grzechhair.com The Data Protection
Officer at the controller’s company can be contacted at: rodo@grzechhair.com


Scope of personal
data processing We
collect and process your personal data only to the extent is necessary to ensure the functioning of the website, the content we present and the services we provide; for example, when you register on our website, log in to an existing customer account or order products. Your personal data is collected and used only with your consent. An exception to this rule applies in situations where it is not possible to obtain prior consent due to the circumstances, and the processing of data is permitted by law. The security of your personal data is a high priority for us. We therefore take technical and organisational measures to ensure the protection of your data stored by us, in order to effectively prevent its loss and misuse by third parties.
 
Our staff involved in the processing of personal data are, in particular, bound by a duty of confidentiality and must comply with it. Your personal data is protected by ensuring it is transmitted in encrypted form; for example, we use SSL (Secure Sockets Layer) when communicating with your web browser. A padlock symbol will appear in your browser to indicate when an SSL connection has been established.
  
To ensure your data remains protected at all times, our technical security measures are regularly reviewed and, where necessary, adapted to new technological standards. These principles also apply to companies to which we outsource the processing and use of data in accordance with our instructions.
 
Purposes of processing and the legal basis governing the processing of your personal
data We
collect, process and use your personal data for the following purposes: · Concluding and fulfilling contracts · Sending out newsletters · Marketing activities, such as prize draws · Customer service and support · Provision of broadcasting services, e.g. for the purpose of processing orders for goods and services offered by us online
.
Your personal data may be processed on the basis of the following legal grounds:
· Article 6(1)(a) of the GDPR provides the legal basis for processing activities for which we obtain your consent for a specific processing purpose.
· Article 6(1)(b) of the GDPR states that personal data may be processed for the purpose of performing a contract, e.g. when purchasing a product. The same applies to any processing activities necessary to take steps prior to entering into a contract, such as handling enquiries regarding products or services.
· Article 6(1)(c) of the GDPR applies in cases where we have a legal obligation requiring the processing of personal data, for example to fulfil tax obligations.
· Article 6(1)(d) of the GDPR states that personal data may be processed to protect your vital interests or those of another natural person.
· Article 6(1)(f) of the GDPR applies in relation to our legitimate interests, for example when engaging service providers to fulfil orders (e.g. delivery services), when completing surveys for statistical purposes and carrying out statistical analyses, and when attempting to log in or ensuring website security. Our interest lies in providing a user-friendly, attractive and secure website and in optimising it to achieve both our business objectives and to meet your expectations.
 
Retention period and procedure for the erasure of personal
data We
process and store your personal data only for as long as is necessary to fulfil the purpose for which it is held, or for as long as we are required to do so by law or regulation. As soon as the purpose no longer applies or has been fulfilled, your personal data will be deleted or its processing restricted. In the event of a restriction on data processing, such data will be deleted as soon as the data retention periods imposed by law, a contract, the company’s articles of association or contractual provisions no longer prevent such deletion, provided there is no reason to believe that such deletion would jeopardise legitimate interests and provided that such deletion would not require a disproportionate amount of effort due to the specific nature of the storage.
 
Collection of general data and information (log records)

In accordance with Article 6(1)(f) of the GDPR, our website collects a range of general data and information each time it is accessed, which is temporarily stored in server logs. The log entry is created as part of the automatic logging carried out by the processing computer system.
The following data may be
collected:
· Access to the website (date, time and frequency)
· How you arrived at the website (referring site, hyperlink, etc.)
· Volume of data transferred·
The browser you are using and its
version· The
operating system you are using· Your internet service provider·
The IP address assigned to your computer by your internet service provider when you connect to the internet
. The collection
and storage of this data is necessary for the website to function, to ensure the website’s functionality and the correct display of our website’s content. We also use this data to optimise our website and to ensure the security of our IT systems. Therefore, this data is stored for a period of seven days for technical and precautionary reasons.
 
We also use this data for marketing purposes, market research and analysis, and to structure our services to meet demand by creating and analysing pseudonymous usage profiles, however, only if you have not exercised your right to object or to withdraw your consent to the use of your data in this way (see the notes on your right to object in the ‘Your rights’ section).
 
This includes the ‘Remember me’ function, which you can also deactivate in your customer account under the ‘Personal data’ tab.
 
In order to optimise the marketing of our products and services and to display the ‘Trusted Shop’ quality mark, a service is integrated into our website – a web server automatically stores a log file containing data such as your IP address, the date and time of access, the amount of data transferred, and the requesting provider. This access data is not analysed and will be automatically deleted by being overwritten no later than seven days after the end of your visit to the website
.
Cookies (cookies), web analytics and social
media
On our website, we use cookies, web analytics services and social media plugins, for which there is a separate Privacy Policy Cookies »

Sharing information about our products and services, special offers and other news, such as newsletters
We use
your data to send you the information you request regarding our products, services and other special offers to the email address you have provided. This will only take place with your prior consent, or where permitted by law. Consent to such communication is governed by Article 6(1)(a) and Article 7 of the GDPR. a) Registration on our website to receive newsletters You can subscribe to a free newsletter on our website. When you register to receive the newsletter, the data from the registration form – i.e. at least your email address – will be sent to us. Registration takes place using the ‘double opt-in’ procedure, whereby, after registering, you will receive an email asking you to confirm your registration. This confirmation is necessary to prevent people from registering using email addresses that do not belong to them. Your consent to the processing of your data will be obtained during the registration process, and this privacy policy will be referenced therein. b) Registration with the shop If you register on the website of a specific retail outlet to receive information by email, we will store your email address together with the name of that regional retail outlet so that we can provide you with information about our products and services relevant to that region. c) Deliveries relating to the sale of products and services. If you purchase products or services on our website, we may send you information about our own similar products and services to the email address you have provided, even without your consent. d) Postal mailings. We may also use your data to send you information about our products, services and special offers by post.
 
We want you to enjoy reading our emails, so we try to ensure they contain only information that you are likely to find interesting. We therefore measure and store the frequency of visits and clicks on your user profile, within the scope of the Controller’s legitimate interest (Article 6(1)(f) of the GDPR). This information includes details of whether and when you open our emails, what content you click on within these emails and when, and whether and why our emails may not reach you. We also use this data for statistical purposes.
 
Of course, you can also unsubscribe to stop receiving such emails, i.e. withdraw your consent with future effect; for this purpose, a link to unsubscribe is included in every email and newsletter. You will then be asked to confirm your unsubscription on our website.
 
You may also contact us to withdraw your consent at any time
: - by email: rodo@grzechhair.com
- by post: GRZECH HAIR, ul. Przebendowskich 49a, 81-526 Gdynia
. It is not
possible to unsubscribe from certain informational messages required for the performance of contracts and for the functioning of our website, including service-related emails (e.g. registration confirmations, customer service information) or information regarding purchases (e.g. order confirmations, contract-related documents, and payment processing details). You will receive these notifications in accordance with the contact details you have provided.
 
Processing of personal data when contacting us, after registration and when placing orders without registration

a) Establishing contact Information you provide to us when contacting us by telephone, email or via the contact form will be stored by us on the basis of Article 6(1)(a) of the GDPR, for the purpose of responding to your enquiries. The contact will be recorded in a log so that we can prove that the contact took place in accordance with legal requirements. When you complete the contact form, your consent will be obtained, and this Privacy Policy is referenced therein. The data collected in this context will be deleted by us once the relevant correspondence has been concluded and the matter in question has been finally resolved.

b) Registration On our website, we offer you the option to register by providing personal data. This data is entered into the data form, transmitted to us and stored by us. Registration is carried out for the purpose of performing a contract or taking steps to enter into a contract; the legal basis for this is therefore Article 6(1)(b) of the GDPR. In order to conclude and fulfil contracts, we require contact details depending on the specific case, for example, your full name, delivery address, billing address, email address and information about your chosen payment method. We also use your data to maintain our customer records, where only the most essential data is stored. To prevent typographical errors and ensure that the products you have ordered are actually delivered to you, we check the completeness and accuracy of your address as you enter it.
 
c) Orders placed without registration You can place an order as a guest, i.e. without registering. If you choose this method of ordering, you do not need to register before placing your order. Please note that in this case, when placing orders in the future, you will need to re-enter your details. For orders placed without registration, we collect, process and use the data you provide for the purpose of fulfilling the contract, in accordance with Article 6(1)(b) of the GDPR. We store the information you provide for the duration of the processing and fulfilment of your order. Your data will then be deleted, unless you decide to activate your customer account within 14 days of placing your order. The processing of data which we are obliged to retain in accordance with statutory requirements, the articles of association or contractual requirements will be restricted to prevent its use for other purposes; however, it will not be deleted.
 
d) Miscellaneous provisions Pursuant to Article 6(1)(c) and (f) of the GDPR, we use and store your personal data and – where necessary – technical information, to prevent the misuse of data or other unlawful conduct on our website, or to investigate such cases, e.g. to ensure data security in the event of attacks on our IT systems. This may be carried out on the basis of orders from public authorities or the courts, insofar as we are required to do so by law, as well as to protect our rights and interests and to enable us to defend ourselves in court.
 
Transfer of personal data to third
parties
When transferring your personal data, we ensure that security is always maintained at the highest possible level; therefore, your data is only transferred to service providers and partner companies that have been carefully selected in advance and are bound by contractual obligations. We transfer your data exclusively to entities located within the European Economic Area and therefore subject to strict EU data protection regulations, or to those that adhere to an equivalent standard of security. The transfer of data to third countries is not currently practised or planned.
 
a) Transfer of data to suppliers of goods with whom we collaborate, in accordance with Article 6(1)(b) of the GDPR In connection with the services and products offered on our website, we collaborate with various contractors responsible for certain product groups. If you order products from these business partners, we will transfer the data you provided to us during registration and, if you have made other purchases, your additional personal data specified in the ‘My Account’ section, for the purpose of concluding and fulfilling contracts (in particular: your email address, delivery address and billing address). The relevant partner for you will be specified on the relevant product pages, in the General Terms and Conditions and in the Legal Notice. Please note that your contracting party is solely responsible for its own data security measures, and that additional or different privacy policies may apply to these product pages.
 
b) Transfer of data to service partners, in accordance with Article 6(1)(b) and (f) of the GDPR In order to operate and optimise our website and to fulfil contracts, we commission various service providers to act on our behalf, e.g. the provision of central IT services, hosting of our website, processing of payments and dispatch of products, installation of equipment or delivery of newsletters. We transfer to service partners the information required for the specific purpose (e.g. surname, address). The recipients of personal data will be external entities processing data on behalf of the Controller under data processing agreements (e.g. the web host) and, where consent has been given: - Ceneo Sp. z o.o., with its registered office in Poznań (60-166), ul. Grunwaldzka 182, - Opineo Sp. z o.o., with its registered office in Wrocław (53-333), ul. Powstańców Śląskich 2–4, for the purpose of sending electronic surveys assessing customer satisfaction with purchases made at the GrzechHair.com shop as part of the ‘Trusted Reviews’ and ‘Reliable Review’ programmes.
  
Some of these companies act on our behalf in connection with the processing and fulfilment of orders and are therefore permitted to use the data provided solely in accordance with our instructions. In this case, we bear legal responsibility for ensuring that appropriate measures are taken to safeguard data security. We therefore agree specific data security measures with these entities and regularly monitor these arrangements.

Notwithstanding the requirements regarding external processing, we transfer data to third parties for the purpose of fulfilling the contract in the following cases, in which case these entities are themselves responsible for the use of this data:
 
- When dispatching goods, data is transferred to the logistics companies or postal service providers specified in the order. - With regard to payments for ordered goods, data is transferred to the payment processor or financing bank specified in the order. When a credit card is provided as a payment method, a security check for the transaction in question will be carried out by the payment processor to prevent credit card fraud.
With regard to payments, we do not collect or store payment information such as credit card numbers or account details. These are sent exclusively and directly to the relevant payment processor. In the case of credit card payments, the exception is the ‘pseudo-card number’. To save you from having to re-enter your credit card number with every payment, a pseudo-card number is stored in your customer account. This pseudo-card number enables you to purchase products and services only on our website, ordered via your customer account, and is not identical to your credit card number.
  

c) Disclosure to other third parties in accordance with Article 6(1)(c) and (f) of the GDPR Finally, we may disclose your data to third parties or public authorities in accordance with current data protection regulations if we are required to do so by law (e.g. on the basis of an order issued by a public authority or a court), or if we are entitled to do so (e.g. because it is necessary for the investigation of criminal offences or for the assertion and defence of our rights and interests). Credit checks, in accordance with Article 6(1)(b) and (f) of the GDPR: If you select ‘eRaty’ or ‘In-store instalments’ as your payment method, our financial partner may obtain information regarding your creditworthiness using statistical and mathematical methods in order to protect its legitimate interests. Please direct any enquiries regarding the above to our financial partner. Data


d) The transfer of your personal data to ING Bank Śląski S.A. (‘the Bank’) in connection with:
    *. the Bank providing the Online Shop with infrastructure for processing online payments (legal basis: Article 6(1)(f) of the Regulation).
    *. the Bank’s processing and settlement of payments made by customers of the Online Shop via the internet using payment instruments (legal basis: Article 6(1)(f) of the Regulation).
    *. for the Bank to verify the proper performance of contracts concluded with the Online Shop, in particular to ensure the protection of payers’ interests in connection with complaints they submit (legal basis: Article 6(1)(f) of the Regulation).

e) to transfer your personal data to Twisto Polska sp. z o.o. in connection with the possibility of Twisto Polska sp. z o.o. offering to make payment for the goods or services purchased under a contract of mandate covering the ‘Buy with Twisto’ and the provision of this payment method by the Online Shop, as well as for the purpose of verification by Twisto Polska Sp. z o.o. of the proper performance of such service agreements (legal basis: Article 6(1)(f) of the Regulation).

In connection with the processing of personal data for the aforementioned purposes, your personal data may be disclosed by the Online Shop to other recipients or categories of recipients of personal data, which may include:

a) ING Bank Śląski S.A.
    b) Twisto Polska sp. z o.o.

9. Where you provide your personal data for the purpose of entering into a contract with the Online Shop, the provision of your personal data is a condition for the conclusion of that contract. Providing personal data in this situation is voluntary; however, failure to provide such data will result in the inability to enter into a contract with the Online Shop.

Where you provide your personal data for the purpose of transferring youryour personal data to Twisto Polska sp. z o.o. prior to the conclusion of a contract for the sale of goods (or services) purchased from the Online Shop, the provision of such data is a condition for the conclusion of the sales contract in accordance with the business model adopted by the Online Shop.

Where your personal data is transferred to the Bank in connection with the processing and settlement of payments made by you to the Online Shop via the internet using payment instruments, the provision of such data is required for the purpose of processing the payment and for the Bank to send confirmation of the payment to the Online Shop.

Where your personal data is transferred to the Bank for the purpose of the Bank verifying the proper performance of contracts concluded with the Online Shop, in particular to ensure the protection of payers’ interests in connection with complaints they submit, the provision of this data is required to enable the performance of the contract concluded between the Online Shop and the Bank.

Where your personal data is transferred to Twisto Polska sp. z o.o. in connection with the possibility of Twisto Polska sp. z o.o. offering you the option to pay for the goods or services you have purchased via Twisto Polska sp. z o.o. under a contract of mandate covering the ‘Buy with Twisto’ payment scheme and the Online Shop making this option available, the provision of this data and its processing for this purpose is required in accordance

with your rights
.
Naturally, you have certain rights in relation to the collection of your data, which we are pleased to inform you of here. If you wish to exercise any of these rights free of charge, simply send us a message.
 
You may use the following contact details at no cost to you other than any charges your telecoms provider may levy for sending the message:
- by email: rodo@grzechhair.com
- by post: GRZECH HAIR, ul. Przebendowskich 49a, 81-526 Gdynia

For your security, we reserve the right to request further information when responding to your enquiry, in order to verify your identity. If identification proves impossible, we also reserve the right to refuse to respond to your enquiry.
a) Right of access to data You have the right to request information from us regarding the personal data we hold about you.
b) Right to rectification You have the right to request the immediate rectification and/or completion of the personal data we hold about you.
c) Right to restriction of processing You have the right to request that the processing of your personal data be restricted if you contest the accuracy of the data held about you, if the processing is unlawful, and we no longer need this data, but you do not wish for the data to be erased and require it to establish, exercise or defend legal claims, or if you have objected to its processing.
d) Right to erasure You have the right to request the erasure of your personal data held by us, provided that the retention of the data is not necessary to safeguard freedom of expression, freedom of access to information, to fulfil a legal obligation, for reasons of public interest, to assert or defend against claims, or to exercise rights under the law.
e) Right to information If you have exercised your right to rectification, erasure or restriction of processing, we will notify all recipients of your personal data of the rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort.
f) Right to data portability You have the right to receive a copy of the data you have provided to us, which will be sent to you or to a third party in a structured, standardised and machine-readable format. If you request that this data be transferred to another data controller, this will be carried out provided that it is technically feasible.
g) Right to object If your personal data is processed on the basis of a legitimate interest under Article 6(1)(f) of the GDPR, you have the right to object to the processing at any time, in accordance with Article 21 of the GDPR. h) Right to withdraw consent You have the right to withdraw your consent to the collection of data at any time, with effect for the future. This will not affect the data collected to date. We hope you understand that, for technical reasons, processing your withdrawal of consent may take some time, and that you may continue to receive messages from us during this period.
h) Right not to be subject to a decision based on automated processing, including profiling You have the right not to be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal effects concerning you or similarly significantly affects you. j) The right to lodge a complaint with a supervisory authority If the processing of your personal data breaches data protection regulations or if your data protection rights have been infringed in any other way, you may lodge a complaint with a supervisory authority.
 
The quickest, easiest and most convenient way to exercise your right to rectification and erasure is to log in to your customer account and edit or delete the data stored there directly.
 Please note that once you have deleted your data, you will no longer have access to services related to our products via our website. This may also include services for re-downloading your data from the internet before exercising your right to erasure.
 
Links to third-party
websites
Our website contains links to third-party websites. We are not responsible for the measures taken to ensure data security on other websites accessible via these links. Please refer to these external websites for information regarding their respective privacy policies.
 
Changes to the Privacy
Policy
To ensure that our Privacy Policy complies with current legal requirements at all times, we reserve the right to amend it at any time. This also applies in cases where the Privacy Policy needs to be amended to cover new or modified products or services.