SERUM.EU
Privacy Policy
Last updated: [DATE]
This Privacy Policy explains how [COMPANY_NAME], with its registered office at [COMPANY_ADDRESS], NIP: [NIP], REGON: [REGON], KRS: [KRS] (hereinafter referred to as "we", "us", or the "Controller"), collects, uses, stores, and protects your personal data when you visit our website at serum.eu (the "Website") and use our online store (the "Store"). We are committed to protecting your privacy and ensuring that your personal data is handled in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"), the Polish Act of 10 May 2018 on the Protection of Personal Data, and the UK General Data Protection Regulation (UK GDPR) where applicable.
1. Data Controller
The controller of your personal data is [COMPANY_NAME], a company registered under the laws of the Republic of Poland, with its registered office at [COMPANY_ADDRESS]. Company registration details: - Tax Identification Number (NIP): [NIP] - Statistical Number (REGON): [REGON] - National Court Register Number (KRS): [KRS] For all matters relating to the processing of your personal data, including the exercise of your rights as a data subject, you may contact us at: [COMPANY_EMAIL].
2. Types of Personal Data Collected
We collect and process the following categories of personal data: a) Identification Data: first name, last name, and where applicable, company name, tax identification number (NIP), and national identification numbers as required for invoicing. b) Contact Data: email address, telephone number, postal address (shipping and billing addresses). c) Transaction Data: order history, purchase details, payment information (note: full payment card details are processed exclusively by our payment processor, Tpay, and are never stored on our servers), invoicing data, and return/complaint records. d) Technical Data: IP address, browser type and version, operating system, device type, screen resolution, referring website, pages visited, time and duration of visits, click-stream data, and cookie identifiers. This data is collected automatically when you interact with our Website. e) Account Data: username (email), encrypted password hash, saved addresses, communication preferences, and wishlist items. f) Marketing Data: consent records, newsletter subscription status, communication preferences, and interaction history with our marketing emails.
3. Purposes and Legal Basis for Processing
We process your personal data for the following purposes and on the following legal bases under Article 6(1) of the GDPR: a) Performance of a Contract — Article 6(1)(b) GDPR: Processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract. This includes processing your orders, managing your customer account, processing payments, arranging delivery, handling returns and complaints, and providing customer support related to your purchases. b) Compliance with a Legal Obligation — Article 6(1)(c) GDPR: Processing is necessary for compliance with a legal obligation to which we are subject. This includes maintaining accounting and tax records as required by Polish tax law (Ordynacja podatkowa, Ustawa o rachunkowosci), responding to requests from competent authorities, and fulfilling consumer protection obligations under applicable EU and Polish law. c) Legitimate Interests — Article 6(1)(f) GDPR: Processing is necessary for the purposes of our legitimate interests, provided these are not overridden by your fundamental rights and freedoms. Our legitimate interests include fraud prevention and security of our Website and Store, improving our products and services through analysis of usage patterns, enforcing our terms and conditions, and conducting direct marketing to existing customers regarding similar products (subject to your right to object at any time). d) Consent — Article 6(1)(a) GDPR: Where you have given us your explicit consent, we process your data for the specified purpose. This includes sending you marketing communications such as newsletters, promotional offers, and product recommendations, placing non-essential cookies and similar tracking technologies on your device, and processing data for personalized advertising. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by clicking the unsubscribe link in any marketing email, adjusting your cookie preferences through our cookie settings panel, or contacting us at [COMPANY_EMAIL].
4. Data Recipients
Your personal data may be disclosed to the following categories of recipients, who process data on our behalf or as independent controllers where required: a) Payment Processor: Krajowy Integrator Płatności S.A., based in Poznań, Poland (Tpay), processes your payment data to facilitate secure transactions. Tpay acts as an independent data controller for payment processing. For more information, see Tpay's Privacy Policy at https://tpay.com/polityka-prywatnosci. b) Shipping and Logistics Providers: We share your name, delivery address, email, and telephone number with our contracted shipping carriers (including InPost, DPD, DHL, and Poczta Polska) to fulfill and deliver your orders. These providers process your data as independent controllers for delivery purposes. c) Hosting and Infrastructure Provider: Our Website and Store are hosted on servers provided by Hetzner Online GmbH (Germany/Finland, EU). Hetzner processes data as a data processor under a data processing agreement in accordance with Article 28 GDPR. d) Analytics Services: We use privacy-focused analytics tools to understand how visitors use our Website. Data collected for analytics purposes is aggregated and anonymized wherever possible. e) Professional Advisors: We may share your data with our legal, accounting, and tax advisors where necessary for the performance of their professional services, subject to professional confidentiality obligations. We do not sell your personal data to third parties. We require all third-party processors to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party processors to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
5. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention periods are as follows: a) Order and Transaction Data: We retain order records, invoices, and associated transaction data for a period of 5 (five) years from the end of the financial year in which the transaction took place, as required by Polish tax and accounting regulations (Ustawa o rachunkowosci, Art. 74; Ordynacja podatkowa, Art. 86 Section 1). b) Customer Account Data: If you create a customer account, we retain your account information (name, email, address, order history) for as long as your account remains active. You may request deletion of your account at any time by contacting us at [COMPANY_EMAIL]. Upon account deletion, we will erase or anonymize your account data within 30 days, except where we are required to retain certain data for legal compliance purposes (see point a above). c) Marketing and Consent Data: If you have consented to receiving marketing communications, we retain your contact details and consent record for this purpose until you withdraw your consent or unsubscribe. Records of your consent (including the date, time, and method of consent) are retained for a period of 3 (three) years after withdrawal to demonstrate compliance with applicable law. d) Technical and Cookie Data: Session data and cookies expire in accordance with the retention periods specified in Section 7 (Cookies) below. Server logs containing IP addresses and access data are retained for a maximum of 90 days for security and diagnostic purposes. e) Complaint and Return Data: Records relating to consumer complaints and returns are retained for 1 (one) year after the resolution of the complaint or the completion of the return process, or longer where required for the establishment, exercise, or defense of legal claims.
6. Your Rights
Under the GDPR and applicable data protection laws, you have the following rights with respect to your personal data: a) Right of Access (Article 15 GDPR): You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to access the personal data and receive a copy thereof together with information about the processing. b) Right to Rectification (Article 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay, and to have incomplete personal data completed. c) Right to Erasure ("Right to Be Forgotten") (Article 17 GDPR): You have the right to obtain the erasure of your personal data without undue delay where one of the grounds set out in Article 17(1) GDPR applies, for example where the data is no longer necessary for the purposes for which it was collected, or where you withdraw consent and there is no other legal basis for the processing. d) Right to Restriction of Processing (Article 18 GDPR): You have the right to obtain the restriction of processing in certain circumstances, for example where you contest the accuracy of the data, or where the processing is unlawful and you oppose erasure. e) Right to Data Portability (Article 20 GDPR): You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance, where the processing is based on consent or a contract and is carried out by automated means. f) Right to Object (Article 21 GDPR): You have the right to object at any time to processing of your personal data which is based on our legitimate interests (Article 6(1)(f) GDPR), including profiling. Where you object to processing for direct marketing purposes, your personal data shall no longer be processed for such purposes. g) Right to Withdraw Consent (Article 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. h) Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For users in Poland, the competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzedu Ochrony Danych Osobowych — UODO), ul. Stawki 2, 00-193 Warszawa, https://uodo.gov.pl/. For users in the United Kingdom, the competent supervisory authority is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, https://ico.org.uk/. To exercise any of the above rights, please contact us at [COMPANY_EMAIL]. We will respond to your request within one (1) month of receipt. In certain circumstances, this period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.
7. Cookies
Our Website uses cookies and similar tracking technologies to distinguish you from other users and to provide you with a better browsing experience. Cookies are small text files that are placed on your device when you visit our Website. We use the following categories of cookies: a) Strictly Necessary (Essential) Cookies: These cookies are essential for the operation of our Website and Store. They enable core functionality such as security, session management, shopping cart functionality, and checkout. Without these cookies, the Website cannot function properly. These cookies do not require your consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) as they are strictly necessary for the provision of the service you have requested. Examples include session cookies, authentication cookies, and CSRF protection tokens. b) Functional Cookies: These cookies enable enhanced functionality and personalization, such as remembering your language preferences, region/country selection, and display settings. If you do not allow these cookies, some or all of these features may not function properly. c) Analytics Cookies: These cookies allow us to count visits and traffic sources so that we can measure and improve the performance of our Website. They help us understand which pages are the most and least popular and how visitors navigate the site. All information collected by these cookies is aggregated and therefore anonymous. Managing Cookies: You can control and manage cookies through your browser settings. Most browsers allow you to refuse or accept cookies, delete existing cookies, and set preferences for certain websites. Please note that if you choose to block or delete cookies, some features of our Website may not function properly. Instructions for managing cookies in common browsers: - Google Chrome: Settings > Privacy and security > Cookies - Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data - Safari: Preferences > Privacy > Cookies and website data - Microsoft Edge: Settings > Cookies and site permissions You may also withdraw or modify your cookie consent at any time by clicking the cookie settings link in our website footer.
8. International Data Transfers
Your personal data is primarily stored and processed within the European Economic Area (EEA). However, some of our third-party service providers may process data outside the EEA. Where we transfer personal data to a country outside the EEA, we ensure that appropriate safeguards are in place to protect your data in accordance with Chapter V of the GDPR: a) Adequacy Decisions: Where the European Commission has determined that a third country ensures an adequate level of data protection (Article 45 GDPR), we may transfer data to recipients in that country on the basis of the adequacy decision. This includes transfers to the United Kingdom under the EU-UK adequacy decision. b) Standard Contractual Clauses (SCCs): For transfers to countries not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses adopted pursuant to Article 46(2)(c) GDPR (Commission Implementing Decision (EU) 2021/914) as the legal basis for the transfer. These clauses impose contractual obligations on the data importer to protect your data to EU standards. c) Supplementary Measures: Where required by the assessment of the legal framework of the recipient country, we implement supplementary technical, organizational, and/or contractual measures to ensure that the level of protection of personal data is not undermined by the transfer. For more information about the safeguards we have in place for international data transfers, or to request a copy of the relevant safeguards, please contact us at [COMPANY_EMAIL].
9. Changes to This Policy
We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, legal requirements, or business operations. Any material changes to this Privacy Policy will be communicated to you by posting the updated policy on our Website with a revised "Last updated" date. Where changes are significant, we will notify you by email (if you have an account) or by placing a prominent notice on our Website prior to the change becoming effective. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data. Your continued use of the Website and Store after any changes to this Privacy Policy constitutes your acceptance of the revised policy.
10. Contact
If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, or if you wish to exercise any of your rights as a data subject, please contact us at: [COMPANY_NAME] [COMPANY_ADDRESS] Email: [COMPANY_EMAIL] We will endeavor to respond to all legitimate requests within one (1) month. If your request is particularly complex or you have made multiple requests, it may take us longer, but we will notify you and keep you updated.