Privacy Policy

PERSONAL DATA PROTECTION POLICY
jkapatments.eu

§ 1 GENERAL PROVISIONS

  1. The controller of the personal data of users of the website available under the domain www.jkplatinum.eu is J&K SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ SPÓŁKA KOMANDYTOWA, with its registered office at: ul. Grzybowska 87, 00-844 Warsaw, Poland, entered into the National Court Register of Entrepreneurs maintained by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number: 0000782093, NIP (Tax Identification Number): 5272890654 (hereinafter referred to as the “Controller”).
  2. The Controller has designated an electronic contact point intended for direct communication with the authorities of Member States, the European Commission and the Digital Services Board: biuro@jkplatinum.eu. The same contact point may be used by any Customer for direct and prompt communication with the Controller. The Controller may also be contacted in writing at its address: ul. Grzybowska 87, 00-844 Warsaw, Poland, via the contact form available on the website or by telephone at: +48 731 700 186 or +48 731 700 183 (the Controller’s working hours are 8:00–16:00 on business days; the fee is the same as for a standard telephone call according to the tariff package of the service provider used by the Customer). Communication may be conducted in the Polish language.
  3. The purpose of this Privacy Policy is to define the actions undertaken with regard to personal data collected through the Controller’s website and related services and tools used by its users, as well as within the scope of concluding and performing agreements through contacts outside the website.
  4. If necessary, the provisions of this Privacy Policy may be amended. Any changes will be communicated to users by publishing the new content of the Privacy Policy, and in the case of a database of persons who have consented to the processing of their data via e-mail or provided their e-mail address during the performance of agreements, they will also be notified of the changes by e-mail.

§ 2 LEGAL BASIS FOR PROCESSING, PURPOSES AND STORAGE OF PERSONAL DATA

  1. Users’ personal data are processed in accordance with the General Data Protection Regulation, the Act on Personal Data Protection, the Act on Personal Data Protection of 10 May 2018, and the Act on the Provision of Electronic Services of 18 July 2002, together with their subsequent amendments. For the purpose of submitting a notification pursuant to Article 16(1) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act) (Official Journal of the European Union L 2022.277.1, as amended; hereinafter: “DSA”), personal data are also processed on the basis of Article 3(h) of the DSA.
  2. The Controller may collect the following data for the following purposes:

Purpose of data processing

Legal basis for processing and data storage period

Data retention period

 Scope of processed data

Performance of an agreement with the Customer or taking actions at the request of the data subject prior to entering into the above-mentioned agreements

Article 6(1)(b) of the GDPR Regulation (performance of an agreement).

For the duration of the above-mentioned agreement until the expiry of the legal obligation related to accounting. Data will be processed until the expiry of the period during which claims may be pursued.First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); company name; NIP (Tax Identification Number).

Newsletter

Article 6(1)(f) of the GDPR Regulation (legitimate interest of the Controller). The Controller may process data for direct marketing purposes only after obtaining consent and provided that the data subject has not objected to such processing.

Until consent is withdrawn – please remember that you may withdraw your consent at any time. Processing of data until withdrawal of consent remains lawful. Data will be processed until the expiry of the period during which claims may be pursued.

E-mail address; telephone number.

Marketing

Article 6(1)(a) of the GDPR Regulation (consent).

Until consent is withdrawn – please remember that you may withdraw your consent at any time. Processing of data until withdrawal of consent remains lawful. Data will be processed until the expiry of the period during which claims may be pursued and until unsubscribing from the newsletter.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country).

Maintaining accounting records

Article 6(1)(c) of the GDPR Regulation in conjunction with Article 86 §1 of the Tax Ordinance Act of 17 January 2017 (Journal of Laws of 2017, item 201) or Article 74(2) of the Accounting Act of 30 January 2018 (Journal of Laws of 2018, item 395).

Data will be processed until the expiry of the period during which claims may be pursued. Data are stored for the period required by law requiring the retention of tax books (until the expiry of the tax liability limitation period unless tax laws provide otherwise) or accounting records (5 years, calculated from the beginning of the year following the financial year to which the data relates).First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

Issuing a refund

Performance of an agreement or taking actions at the request of the data subject prior to entering into an agreement (Article 6(1)(b) GDPR).

5 years after the end of business relations with the Customer.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); business entity data.

Establishing, pursuing or defending claims that may be raised by the Controller or against the Controller

Article 6(1)(f) of the GDPR Regulation.

Data are stored for the period during which the Controller’s legitimate interest exists, but no longer than until the expiry of the limitation period for claims against the data subject arising from the Controller’s business activity.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

 

Conducting research and analyses in order to improve the operation of available services

Article 6(1)(f) of the GDPR Regulation.

Data will be processed until the expiry of the period during which claims may be pursued and until the expiry or deletion of cookies used for analytical purposes.Company name; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); computer components; settings; installed software.

Providing customer service

Performance of an agreement or taking actions at the request of the data subject prior to entering into an agreement (Article 6(1)(b) GDPR).

5 years after the end of business relations with the Customer.

2 years after the last update of the Customer’s inquiry.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); business entity data.

Proper functioning of the website

Maintaining the performance of the Website and improving it (Article 6(1)(f) GDPR).

5 years after the end of business relations with the Customer.

As specified in the previous section. Information regarding activities performed on the website (button clicks, visit duration, notifications read, and other information depending on a specific business case).

Monitoring compliance with regulations, agreements and the privacy policy

Protection and security of the website, interests of Customers, ensuring Customer security (Article 6(1)(f) GDPR).

5 years after the end of business relations with the Customer.

Transaction data; business entity data.

Handling requests concerning personal data

Article 6(1)(c) GDPR.

The period during which the Controller’s legitimate interest exists, but no longer than the limitation period for claims against the data subject arising from the Controller’s business activity.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

Providing information to law enforcement authorities and other state institutions responsible for enforcement

Article 6(1)(c) GDPR.

The period during which the Controller’s legitimate interest exists, but no longer than the limitation period for claims against the data subject arising from the Controller’s business activity.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

Fulfilling the legal obligation specified in Article 16(1), (4), (5) and (6) of the DSA consisting of:   
  1. accepting a notification concerning the presence on the hosting service of information which, according to the notifier, constitutes illegal content within the meaning of Article 3(h) DSA;
  2. reviewing the notification;
  3. informing about the decision made regarding the submitted notification;
  4. informing about the possibility of appealing against the decision referred to in point 3.

Article 6(1)(c) GDPR.

  1. Until notification of:
  1. the decision made by the Controller regarding the submitted notification;
  2. the possibility of appealing against the decision referred to in point 2).
First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

Processing of personal data to the extent required on the basis of proceedings conducted before authorised public administration authorities, including law enforcement authorities, in matters concerning the purposes or grounds for processing personal data, where the Controller is obliged to process such data

Article 6(1)(c) GDPR.

For the duration of such obligation.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

Taking actions related to the identification and reporting of potential risks associated with products, ensuring product compliance with safety requirements and informing competent authorities or users about the necessity to take safety measures, to the extent required by the GPSR Regulation

Article 6(1)(c) GDPR.

For the duration of such obligation.

First name and surname; e-mail address; telephone number; address (street, house number, apartment number, postal code, town/city, country); NIP; company name.

  1. The Controller may use profiling for direct marketing purposes, however, decisions made by the Controller on the basis of such profiling do not concern the conclusion or refusal to conclude an agreement, nor do they affect the possibility of using electronic services.

    The result of using profiling may include, for example, granting a specific person a discount, sending them a discount code, reminding them about unfinished purchases, sending a proposal for a product that may correspond to the interests or preferences of a given person, or offering better terms compared to the standard offer.

    Despite profiling, the given person independently decides whether they wish to use the discount or better terms received in this way and make a purchase.

    Profiling consists of an automated analysis or prediction of a given person’s behaviour on the Controller’s website, for example by adding a specific product to the shopping cart, browsing a specific product page, or analysing the previous history of activity on the website.

    A condition for such profiling is that the Controller possesses the personal data of the given person in order to subsequently send them, for example, a discount code.

  2. To the extent necessary for the proper functioning of the website and its functionalities, the website may, while being used by the User, collect other information, including, among others:

    a. IP address;
    b. information about the device, hardware and software, such as hardware identifiers, mobile device identifiers (e.g. Apple Identifier for Advertising [“IDFA”] or the advertising identifier on an Android device [“AAID”]);
    c. platform type
    d. settings and components;
    e. data concerning the web browser, including the type of browser and preferred language.

  1. Taking into account the nature, scope, context and purposes of processing, as well as the risk of violating the rights or freedoms of natural persons with varying probability and severity of risk, the Controller implements appropriate technical and organisational measures to ensure that processing is carried out in accordance with the Regulation and to demonstrate compliance with it.

    These measures shall be reviewed and updated where necessary.

    The Controller applies technical measures preventing unauthorised persons from obtaining and modifying personal data transmitted electronically.

§ 3 DATA DISCLOSURE

  1. The Controller ensures that all collected personal data are used to fulfil obligations towards users. This information shall not be disclosed to third parties, except where:
    a. prior explicit consent has been given by the persons concerned for such action; or
    b. the obligation to provide such data results or will result from applicable legal provisions, for example to law enforcement authorities.
  2. Additionally, personal data of service recipients and Customers may be transferred to the following recipients or categories of recipients:a.Providers of services supplying the Controller with technical, IT and organisational solutions enabling the Controller to conduct business activity, including the operation of the website and electronic services provided through it (in particular providers of computer software, marketing agencies, e-mail and hosting providers, providers of software for business management and technical support for the Controller, as well as product delivery operators) – the Controller provides collected Customer personal data to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing consistent with this Privacy Policy.
    b. Providers of accounting, legal and advisory services providing the Controller with accounting, legal or advisory support (in particular accounting offices, law firms or debt collection companies) – the Controller provides collected Customer personal data to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing consistent with this Privacy Policy.
    c. Providers of payment gateways and payment solutions on the website – the Controller provides collected Customer personal data to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing consistent with this Privacy Policy. In the case of the Controller’s business activity, such service is provided by:
    PayPro Spółka Akcyjna, with its registered office in Poznań at ul. Pastelowa 8, 60-198 Poznań, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court Poznań–Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS number 0000347935, NIP number 7792369887, with share capital amounting to PLN 5,476,300.00, fully paid, entered into the register of national payment institutions maintained by the Polish Financial Supervision Authority under number UKNF IP24/2014.
  3. Administrator may make anonymised data available (i.e. data which do not identify specific Users) to external service providers in order to better assess the attractiveness of advertisements and services for users.
    In this regard, due to the registered offices of software providers, data may be transferred – while maintaining data protection principles – to third countries which provide standard contractual clauses approved by the European Commission regarding the processing of personal data or have appropriate authorisation for such actions on the basis of bilateral data processing agreements between the European Union and a given third country, which is not a member of the European Economic Area. For the Controller, these entities are:Google LLC (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for Google Analytics tools used to analyse website statistics, Google Tag Manager used to manage scripts by easily adding code fragments to a website or application and tracking actions performed by users on the website, Google Ads used to display sponsored links in Google search results and on websites cooperating within the Google AdSense programme, and Google Workspace enabling comprehensive website editing and coordination of the work of persons working on it (including Google Drive, Gmail, Google Sheets, Google Forms, Google Looker Studio);


    WordPress     (registered office: CT Corporation System, 330 N Brand Blvd., Glendale, California 91023-2336) for hosting and website construction purposes, as well as for analysing website statistics and tracking actions performed by users on the website;

  4. The Controller always informs about the intention to transfer personal data outside the EEA at the stage of collecting such data.

  5. The Controller continuously conducts risk analysis in order to ensure that personal data processed by it are processed securely – ensuring, above all, that access to data is granted only to authorised persons and only to the extent necessary due to the tasks performed by them. The Controller ensures that all operations involving personal data are recorded and carried out only by authorised employees and associates.

  6. The Controller undertakes all necessary actions to ensure that its subcontractors and other cooperating entities also provide a guarantee of applying appropriate security measures whenever they process personal data on behalf of the Controller.

  7. The Controller’s website may use the functionality of Google Analytics, a website traffic analysis service provided by Google, LLC (“Google”). Google Analytics uses cookies to help website operators analyse how visitors use the website. Information generated by cookies regarding visitors’ use of the website is generally transferred to Google and stored by Google on servers in the United States. In accordance with current IT standards, IP addresses of users visiting the Controller’s website are shortened. Only in exceptional cases is the complete IP address transferred to a Google server in the United States and shortened there. At the request of the Controller, Google will use this information to evaluate the website for its users, prepare reports concerning website traffic and provide other services related to website traffic and Internet use for website operators. Google will not combine the IP address transferred within Google Analytics with any other data held by Google. More information about how Google Analytics collects and uses data can be found on Google’s official website at: www.google.com/policies/privacy/partners. In addition, each User may prevent the collection and processing by Google of data concerning their use of the website by downloading and installing the browser plug-in available at the following link: http://tools.google.com/dlpage/gaoptout.

  8. The Controller, when disclosing data to third parties, makes every effort to ensure that this takes place only with entities meeting the criteria and requirements indicated in Article 46 or Article 49 of the GDPR. Where appropriate, the Controller shall rely on EU Standard Contractual Clauses and other safeguards to enable transfers outside the EEA. In accordance with the judgment of the Court of Justice of the European Union of 16 July 2020, the Controller continues to assess the legal system of countries to which data are transferred and, where necessary, updates measures aimed at ensuring appropriate levels of protection.

  9. With regard to data transferred to the United States, when disclosing data to third parties, the Controller makes every effort to ensure that this takes place, in accordance with the European Commission Decision of 10 July 2023, only to entities and organisations in the USA that ensure compliance with the new EU–US Data Privacy Framework. The list of these organisations has been published by the US Department of Commerce. Transfers of personal data from the EEA to organisations that have joined the EU–US Data Privacy Framework and are included on this list are possible without the need to obtain additional authorisations or apply legal instruments such as Standard Contractual Clauses or Binding Corporate Rules. However, if a given data importer in the USA has not joined the EU–US Data Privacy Framework, the transfer of personal data to such importer is possible and shall take place after fulfilling the conditions specified in Article 46 or Article 49 of the GDPR. In such cases, the Controller shall rely on EU Standard Contractual Clauses and other safeguards enabling transfers outside the EEA.

§ 4 USER RIGHTS

  1. A User whose personal data are processed has the right to:
    a. access, rectification, restriction, deletion or portability – the data subject has the right to request from the Controller access to their personal data, rectification, deletion (“right to be forgotten”) or restriction of processing, and has the right to object to processing, as well as the right to data portability. Detailed conditions for exercising the above-mentioned rights are specified in Articles 15–21 of the GDPR Regulation.
    b. withdrawal of consent at any time – a person whose data are processed by the Controller on the basis of consent granted (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR Regulation) has the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
    c. lodging a complaint with a supervisory authority – a person whose data are processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the provisions of the GDPR Regulation and Polish law, in particular the Act on Personal Data Protection. The supervisory authority in Poland is the President of the Personal Data Protection Office in Warsaw.
    d. objection – the data subject has the right to object at any time – for reasons related to their particular situation – to the processing of personal data concerning them based on Article 6(1)(e) (public interest or tasks) or Article 6(1)(f) (legitimate interest of the Controller), including profiling based on these provisions. In such a case, the Controller may no longer process such personal data unless it demonstrates the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or grounds for establishing, pursuing or defending claims.

 

§ 5 COOKIES

  1. Cookies shall be understood as IT data, in particular text files, stored on Users’ end devices (usually on a computer hard drive or on a mobile device), used to save specific settings and data by the User’s browser in order to use websites.

    These files allow the User’s device to be recognised and the website to be displayed appropriately, ensuring comfort while using it.

    The storage of cookies therefore enables the website and offer to be properly prepared according to the User’s preferences – the server recognises the User and remembers, among others, preferences such as visits, clicks and previous actions.

  2. Cookies contain, in particular, the name of the domain of the website from which they originate, the time they are stored on the end device and a unique number used to identify the browser through which the connection to the website is made.

  3. Cookies are used for the purpose of:

  1. adapting the content of websites to User preferences and optimising the use of websites,

  2. creating anonymous statistics which, by helping to determine how the User uses websites, enable improvement of their structure and content,

  3. providing website Users with advertising content tailored to their interests.

Cookies are not used to identify the User and their identity is not determined on their basis.

  1. The basic division of cookies consists in distinguishing between:

  1. Cookies of an essential nature – they are absolutely necessary for the proper functioning of the website or functionalities which the User wishes to use, because without them we would not be able to provide many services we offer. Some of them also ensure the security of services provided electronically.

  2. cookies of a functional nature – they are important for the operation of the website due to the fact that:

    • they serve to enrich website functionalities; without them the website will operate correctly, however it will not be adapted to User preferences,
    • they serve to ensure a high level of website functionality; without them the level of website functionality may decrease, but their absence should not prevent the User from using the website completely,
    • they serve most website functionalities; blocking them will cause selected functions not to operate correctly.

  1. Business cookies – they enable the implementation of the business model on the basis of which the website is made available; blocking them will not make all functionalities unavailable, but may reduce the level of service provision due to the inability of the website owner to obtain revenues subsidising its operation. This category includes, for example, advertising cookies.

  2. Cookies used for configuring websites – they enable settings of functions and services on websites.

  3. Cookies used for security and reliability of websites – they enable verification of authenticity and optimisation of website performance.

  4. Session state cookies – they enable information about how Users use the website to be stored. They may concern the most frequently visited pages or possible error messages displayed on certain pages. Cookies used to store the so-called “session state” help improve services and increase browsing comfort.

  5. Cookies examining processes occurring on the website – they enable the efficient operation of the website and functions available on it.

  6. Cookies used for analyses, research or website traffic audits – they enable website owners to better understand User preferences and, through analysis, improve and develop products and services. Usually, the website owner or a research company collects information anonymously and processes data regarding trends, without identifying the personal data of individual Users.

  1. The use of cookies for the purpose of adapting the content of websites to User preferences does not, as a rule, involve the collection of any information allowing identification of the User, although such information may sometimes constitute personal data, i.e. data enabling certain behaviours to be assigned to a specific User.

    Personal data collected using cookies may only be collected for the purpose of performing specific functions for the User.

    Such data are encrypted in a manner preventing access by unauthorised persons.

  2. Cookies used by this website are not harmful either to the User or to the end device used by the User, therefore, in order for the website to function properly, it is recommended not to disable their operation in browsers. 

    In many cases, software used for browsing websites (web browsers) by default allows information in the form of cookies and other similar technologies to be stored on the User’s end device.

    The User may change the manner in which cookies are used by the browser at any time.

    For this purpose, the browser settings should be changed.

    The method of changing settings differs depending on the software used (web browser).

    Appropriate instructions can be found on the subpages dedicated to the browser used.

  3. Cookies are also used to facilitate logging into the User account, including through social media, and to enable movement between subpages of websites without the need to log in again on each subpage.

    At the same time, cookies are used to secure websites, for example to prevent access by unauthorised persons.

  4. Within cookie technology, the Controller may use tracking pixels or clear GIF files in order to collect information about how the User uses its services and their response to marketing messages sent by e-mail.

    A pixel is a software code allowing an object, usually an image of pixel size, to be embedded on a website, which enables tracking of Users’ behaviour on websites where it has been placed.

    After granting the appropriate consent, the browser automatically establishes a direct connection with the server storing the pixel; therefore, the processing of data collected by the pixel takes place under the data protection policy of the partner who administers the above-mentioned server.

  5. The Controller may use Internet log files (which contain technical data such as the User’s IP address) in order to monitor traffic within its services, resolve technical problems, detect and prevent fraud, and enforce the provisions of the User Agreement.

  6. The Controller informs that the website does not respond to DNT (Do Not Track) signals.

    However, the User may disable certain forms of online tracking, including certain analytical data and personalised advertisements, by changing cookie settings in their browser or by using our tools for expressing consent to the use of cookies (where applicable).

  7. Detailed information regarding changing cookie settings and their independent deletion in the most popular web browsers is available in the help section of the web browser and on the following pages (simply click on the relevant link):

  1. Detailed information on managing cookies on a mobile phone or another mobile device should be included in the user manual of the respective mobile device.