I. WHO IS THE ADMINISTRATOR OF YOUR PERSONAL DATA?
The administrator of personal data collected:
via the Online Store (including the use of cookies or similar technology) or other channels of communication with the Customer;
obtained based on the Customer’s activity on the Internet or in stationary stores belonging to GENTILOUOMO MILANO sp. z o.o. based in Warsaw, is GENTILOUOMO MILANO sp. z o.o. based in Warsaw, at the following address: ul. Ostródzka 195F/5, 03-289 Warszawa (which is also the address for service), entered into the Register of Entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000821926, NIP 5242896072, REGON 385250112, with share capital of PLN 5,000.00, paid in full (“Administrator”).
Contact with the Administrator is possible at the above-mentioned address. address, e-mail address: gentiluomomilano@gmail.com.
II. HOW DO WE CARE FOR YOUR PERSONAL DATA?
The Administrator attaches great importance to the security and legality of the processing of Customers’ personal data. The Customer’s personal data are processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU No. 119, page 1) (“GDPR”) and other currently applicable provisions of law on the protection of personal data.
Personal data means information relating to an identified or identifiable natural person (“Personal Data”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, the economic, cultural or social identity of the individual.
III. FOR WHAT PURPOSES AND ON WHAT BASIS IS YOUR DATA PROCESSED?
Your Personal Data may be processed for various purposes and on various legal bases depending on which functionalities of the Online Store you use, in particular for the purpose of concluding and implementing contracts concluded with you, conducting marketing activities, market and statistical analyses, improving the quality of services, fulfillment of relevant legal obligations imposed on the Administrator, or identification of ad fraud. Details below.
1. ONLINE STORE ACCOUNT
The administrator of your Personal Data is the entity indicated in point I of this Policy.
Your Personal Data provided by you in connection with the registration of the Account, but also other data collected in connection with your activity in the Online Store and the use of our services (in particular: name and surname; e-mail address; contact telephone number; address [street, number house, apartment number, postal code, city, country], address of residence/business/registered office [if different from the delivery address], bank account number, and in the case of Customers who are not consumers, additionally the company name and tax identification number [NIP]) are or may be processed for the following purposes:
maintaining your account so that you can enjoy the benefits it offers (e.g. placing orders without having to fill out forms every time, access to your purchase history, managing your consents on the website, etc.) and enabling you to use other services available on our website – the basis legal: 6 section 1 letter b) GDPR, i.e. necessity to perform the contract you conclude by creating an Account and accepting the Regulations of the Online Store;
marketing, analytical and statistical activities of the Administrator or its partners or other so-called third parties with whom we cooperate, e.g. presenting you advertisements and offers (discounts), also tailored to your interests based on profiling (in a simplified way, we analyze your activity (e.g. the history of your purchases and behavior on our website) so that we can better adapt not only to specific, general groups of our clients, but also to your preferences)). However, our actions do not significantly affect your decisions, e.g. purchasing – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest of the Administrator or a third party;
determining, defending and pursuing claims that may arise as part of the relationship between you and the Administrator and other purposes that are necessary to implement the legally justified interests of the Administrator or a third party – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest pursued by the Administrator or a third party.
Providing Personal Data is voluntary, but necessary to register in the Online Store and Application.
We will generally process your data for the period of your use of the Account (but for greater protection, they may be deleted after three years from your last activity in the Online Store), and in the case of marketing activities – until you raise an objection, unless that legal provisions will oblige us to process this data longer or we will store it longer in case of potential claims, for the period of limitation specified by law, in particular the Civil Code, or for other purposes arising from the implementation of our legitimate interests. In each case, the longer period of storage of Personal Data is decisive.
Information about the recipients of Personal Data is described in detail in point IV of this Policy.
Information about the possible transfer of your Personal Data to third countries (outside the European Economic Area) is described in detail in point V of this Policy.
The rights you have in connection with the processing of your Personal Data are described in detail in point VI of this Policy.
2. PLACING AN ORDER
The administrator of your Personal Data is the entity indicated in point I of this Policy.
Your Personal Data provided by you in connection with placing an order, but also other data collected in connection with your activity in the Online Store and the use of our services (in particular: name and surname; e-mail address; contact telephone number; address [street, number house, apartment number, postal code, city, country], address of residence/business/registered office [if different from the delivery address], bank account number, and in the case of Customers who are not consumers, additionally the company name and tax identification number [NIP]) are or may be processed for the following purposes:
execution of your order and performance of the concluded contract – in particular confirmation of its submission and booking (if such an option is available and you have chosen it) or sending to you or to the collection point of the selected product, as well as, if necessary, contacting you in this matter – the basis legal: 6 section 1 letter b) GDPR, i.e. the necessity to perform the sales contract that you conclude after placing the order or reservation contract (if such an option is available and you have chosen it);
marketing, analytical and statistical activities of the Administrator or its partners (third parties listed in 11 Cookie Policy) or other so-called third parties with whom we cooperate, e.g. presenting you advertisements and offers (discounts), also tailored to your interests based on profiling (in a simplified way, we analyze your activity (e.g. the history of your purchases and behavior on our website) so that we can better adapt not only to specific, general groups of our clients, but also to your preferences)). However, our actions do not significantly influence your decisions, e.g. purchasing – legal basis: art. 6 section 1 letter f) GDPR, i.e. legitimate interest of the Administrator or a third party;
determining, defending and pursuing claims that may arise as part of the relationship between you and the Administrator and other purposes that are necessary to implement the legally justified interests of the Administrator or a third party – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest pursued by the Administrator or a third party.
Providing Personal Data is voluntary, but necessary to place an order.
In order to complete the order, we will process your data for the period of execution of the contract, as well as for the time required by law (e.g. tax, accounting), in the case of marketing activities – until you raise an objection, unless a longer period results from their storage. in the event of any claims, for the limitation period specified by law, in particular the Civil Code, or for other purposes resulting from the implementation of our legitimate interests. In each case, the longer period of storage of Personal Data is decisive.
Information about the recipients of Personal Data is described in detail in point IV of this Policy.
Information about the possible transfer of your Personal Data to third countries (outside the European Economic Area) is described in detail in point V of this Policy.
The rights you have in connection with the processing of your Personal Data are described in detail in point VI of this Policy.
3. COMPLAINT FORM
The administrator of your Personal Data is the entity indicated in point I of this Policy.
Your Personal Data provided by you in connection with submitting a complaint (Complaint Form) and collected in any further communication are or may be processed for the following purposes:
consideration of your complaint, keeping accounting books and settlements for considered complaints – legal basis: 6 section 1 letter c) GDPR, i.e. necessity to fulfill the legal obligation imposed on the Administrator;
determining, defending and pursuing claims that may arise as part of the relationship between you and the Administrator and other purposes that are necessary to implement the legally justified interests of the Administrator or a third party – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest pursued by the Administrator or a third party.
Providing Personal Data is voluntary, but necessary to submit a complaint.
We will process your data for the duration of your complaint, unless legal provisions (e.g. accounting) oblige us to process this data longer or we will store it longer in case you have any claims against us, for the period of limitation specified by law, in particular the Civil Code, or for other purposes resulting from the implementation of our legitimate interests. In each case, the longer period of storage of Personal Data is decisive.
Information about the recipients of Personal Data is described in detail in point IV of this Policy.
Information about the possible transfer of your Personal Data to third countries (outside the European Economic Area) is described in detail in point V of this Policy.
The rights you have in connection with the processing of your Personal Data are described in detail in point VI of this Policy.
4. CONTACT FORM
The administrator of your Personal Data is the entity indicated in point I of this Policy.
Your Personal Data provided by you via the Contact Form and collected in any further communication are or may be processed for the following purposes:
communication with you and replying to your message – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest pursued by the Administrator;
depending on the content of the communication, taking action at your request before concluding the appropriate contract – legal basis: 6 section 1 letter b) GDPR, i.e. the necessity to take action before concluding a contract;
depending on the content of your message, marketing, analytical and statistical activities of the Administrator or partners or other so-called third parties with whom we cooperate – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest of the Administrator or a third party;
determining, defending and pursuing claims that may arise as part of the relationship between you and the Administrator and other purposes that are necessary to implement the legally justified interests of the Administrator or a third party – legal basis: 6 section 1 letter f) GDPR, i.e. legitimate interest pursued by the Administrator or a third party.
Providing Personal Data is voluntary, but necessary to communicate with us effectively.
We will generally process your data until communication with you ends, and in the case of marketing activities – until you raise an objection, unless the law obliges us to process this data for a longer period or we store it for a longer period in the event of potential claims, for a period their limitation period specified by law, in particular the Civil Code, or for other purposes resulting from the implementation of our legitimate interests. In each case, the longer period of storage of Personal Data is decisive.
Information about the recipients of Personal Data is described in detail in point IV of this Policy.
Information about the possible transfer of your Personal Data to third countries (outside the European Economic Area) is described in detail in point V of this Policy.
The rights you have in connection with the processing of your Personal Data are described in detail in point VI of this Policy.
IV. WHO CAN BE THE RECIPIENT OF YOUR DATA?
Each time, the list of recipients of Personal Data processed by the Administrator results primarily from the scope of services used by the Customer.
The catalog of data recipients also results from the Customer’s consent or from legal provisions, and is clarified as a result of actions taken by him in the Online Store.
The Administrator’s partners may participate in the processing of Personal Data to a limited extent, in particular entities that technically help run the Online Store efficiently, including communication with our Customers (e.g. they support us in sending e-mails, and in the case of advertising activities – also in marketing campaigns), providers of hosting or ICT services, carriers or intermediaries carrying out shipments of Orders, entities handling electronic payments or card payments in the Online Store, entities offering the conclusion of consumer credit agreements, companies that service software, support the Administrator in marketing campaigns, as well as providers of legal and advisory services.
V. IS YOUR DATA ALSO TRANSFERRED TO THIRD COUNTRIES (OUTSIDE THE EUROPEAN ECONOMIC AREA)?
As part of the Administrator’s use of tools supporting its current operations, provided e.g. by Google, the Customer’s Personal Data may be transferred to a country outside the European Economic Area in which the entity cooperating with it maintains tools for the processing of Personal Data in cooperation with the Administrator.
Appropriate security of the transferred Personal Data has been ensured by the Administrator through the use of standard data protection clauses adopted pursuant to decisions of the European Commission and data entrustment agreements for processing, which meet the requirements of the GDPR. If data is transferred to countries outside the European Economic Area, we make every effort to ensure that our partners provide an appropriate level of protection by taking additional security measures for Personal Data.
The Customer has the right to obtain a copy of the security measures used by the Administrator regarding the transfer of Personal Data to a third country by contacting us (contact details in point I of the Policy).
VI. WHAT RIGHTS DO YOU HAVE?
Each Customer has the right at any time to:
submit a complaint to the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw);
transferring Personal Data that has been provided to the Administrator and that is processed in an automated manner, and the processing is based on consent or on the basis of a contract, e.g. to another administrator;
access to Personal Data (including, for example, receiving information about which Personal Data are being processed or a copy thereof);
request rectification and restriction of processing (e.g. if Personal Data is incorrect) or deletion of Personal Data (e.g. if they have been processed unlawfully);
withdrawal of any consent given to the Administrator at any time, provided that the withdrawal of consent does not affect the processing carried out by the Administrator in accordance with the law before its withdrawal;
object to the processing of Personal Data concerning him carried out in order to pursue the legitimate interests of the Administrator or a third party (if there are no other valid legitimate grounds for processing overriding the interests of the Customer). If Personal Data are processed for the purposes of direct marketing, the Customer has the right to object at any time to the processing of Personal Data concerning him for the purposes of such marketing, including profiling, to the extent that the processing is related to such direct marketing – in such a case the Personal Data Personal data may no longer be processed for such purposes.
VII. WILL COMMERCIAL INFORMATION BE SENT TO YOU (E.G. TO YOUR E-MAIL ADDRESS)?
The Administrator has the technical ability to communicate with the Customer remotely (e.g. e-mail, text message).
Commercial information related to the commercial activities conducted by the Administrator or entities cooperating with him may be sent after the Customer consents to receiving commercial information.
VIII. HOW DO WE SECURE YOUR DATA?
Taking into account the state of technical knowledge, implementation costs and the nature, scope, context and purposes of processing as well as the risk of violating the rights and freedoms of natural persons with varying probability of occurrence and threat severity, the Administrator applies appropriate technical and organizational measures to ensure protection of the processed Personal Data appropriate to the threats and categories of data. protected, and in particular protects data against disclosure to unauthorized persons, removal by an unauthorized person, processing in violation of applicable regulations and change, loss, damage or destruction. Sharing external information about the technical and organizational measures used to protect processing may weaken their effectiveness, thereby compromising the proper protection of Personal Data.
The Administrator appropriately provides, for example, the following technical measures to prevent unauthorized persons from obtaining and modifying Personal Data sent electronically:
- securing the data set against unauthorized access;
- encryption of data used to authorize a person using the functionality of the Online Store;
- access to the Account only after providing an individual login and password.
IX. LINKS TO OTHER WEBSITES
The Online Store may contain links to other websites. The Administrator encourages you to read the regulations and privacy policies applicable to other websites. This Policy applies only to the indicated activities of the Administrator.
X. CAN THIS POLICY BE CHANGED AND HOW WILL YOU FIND OUT ABOUT IT?
The Administrator may change the Policy in the future. Each time, it will post information about such a change on the Online Store website and in the Application. With each change, a new version of the Policy will appear with a new date.
XI. FROM WHEN IS THIS VERSION OF THE POLICY APPLICABLE?
This version of the Policy is valid from November 24, 2023.
