Hello!

If you have found this page, it means that the protection of your personal data is important to you. We would like to assure you that we care about your privacy and that it is important to us. For this purpose, we have implemented not only legal, but also technical measures to further strengthen its protection.

In accordance with the GDPR, below we present the principles of our processing of your personal data. Please read the most important questions regarding your personal data, and if you have any doubts regarding the Privacy Policy, please contact us at: hello@lillyandswan.pl

PRIVACY POLICY

§1 Who is the Administrator of your personal data?

The data Administrator is Lilly and Swan Małgorzata Ługowska, ul. Startowa 2, 02-248 Warszawa, NIP 5222713772, REGON 360232941. You can contact the Administrator by writing to the e-mail address: hello@lillyandswan.pl or by calling the telephone number: +48 576 604 874.

§2 For what purpose do we collect your data and how long do we store it?

We may process your data for the following purposes:

1. Communicating with you, including answering questions submitted via the contact form, e-mail, etc.;

The data will be processed based on the legitimate interest of the Administrator, in the form of communication with the Website Users (art. 6 sec. 1 point f of the GDPR). Your data will be processed no longer than until you raise an objection or the business purpose ceases. Providing this data is voluntary, but necessary for communication with you. Data may also be processed during the archiving process for internal purposes, based on the legitimate interest of the Administrator (art. 6 sec. 1 point f of the GDPR), until an objection is raised or the business purpose ceases.

2. Conclusion of the contract and its implementation (placing an order);
3. Establishing, defending and pursuing claims;
4. Fulfillment of legal obligations imposed on the Administrator (including tax and archiving obligations);

The data necessary for the conclusion and implementation of the contract will be processed for the duration of the contract, including the period of exercising the rights arising from the contract, such as the right to make a warranty complaint (art. 6 sec. 1 point b and f of the GDPR). Providing this data is voluntary, but at the same time necessary for the conclusion and implementation of the contract.

Additional data provided for the purpose of, among others: to improve the implementation of the contract will be processed no longer than until you raise an objection or the business purpose ceases, based on the legitimate interest in customer service (art. 6 sec. 1 point f of the GDPR).

After this time the data will be processed for the period of limitation of claims, based on the legitimate interest of the Administrator in order to defend against claims, as well as to establish and pursue claims (art. 6 sec.1 point f of the GDPR).

If the data is necessary to fulfill the legal obligations imposed on the Administrator (such as issuing and storing invoices, implementing procedures under the Digital Services Act) - the data will be processed for this purpose for no longer than 6 years (archiving obligations regarding accounting documents), unless legal provisions provide otherwise (art. 6 sec. 1 point c of the GDPR).

Data may also be archived for internal and statistical purposes, until you raise an objection or the business purpose ceases, based on the Administrator's legitimate interest (art. 6 sec.1 point f of the GDPR).

5. Providing marketing/commercial information (hereinafter referred to as "Marketing Information"), including, but not limited to, sending newsletters and information about services, products, promotions, and free content through other tools (e.g., SMS, phone);

a) Data will be processed based on the legitimate interest of the Administrator, in the form of marketing of the Administrator's products and services (art. 6 sec.1 point f of the GDPR).

According to Article 398 of the Electronic Communications Law, your consent is required for the purpose of maintaining commercial/marketing communication. You can withdraw it at any time:

-  by writing to us at the address provided above - in the case of sending messages in the form of email;

Providing data is voluntary, but necessary to receive Marketing Information. Opting out of receiving Marketing Information will prevent us from sending you Marketing Information.

b) Data processed in connection with your consent to deliver Marketing Information, including data automatically collected (e.g., IP address), will also be processed based on the legitimate interest of the Administrator (Article 6(1)(f) GDPR), specifically for analyzing behavior to optimize marketing activities. The data will be processed for analytical and statistical purposes.

c) Your data may also be archived for the purpose of potential determination, pursuit, or defense of claims, including to ensure the possibility of proving that marketing activities were conducted in compliance with the law based on Article 6(1)(f) GDPR.

d) Data processed based on Article 6(1)(f) GDPR will be processed no longer than until you object or the business purpose ceases – whichever occurs first.

6. Administration and management of the website and groups on social media platforms Facebook (Meta), Instagram (Meta) and Pinterest in the case of data processing on social media platforms, including communication and directing marketing content;

This data will be processed only if you decide to: like the page / join the group / select the "Follow" option or otherwise leave your data on the platform managed by us, e.g. by posting an entry or comment. The data will be processed for the duration of the existence of the page/group or until you raise an objection, which may be done by unclicking the "Like", "Follow" option, deleting a comment/entry or in any other way provided for within the platform/site or by contacting with us. We would like to inform you that the rules relating to the website/fanpage/group are set by the Administrator, while the rules for using the social networking site on which the website/fanpage/group is located are set by the entity managing these portals.

7. Analytical and statistical;

Data processing for analytical and statistical purposes consists in particular in analyzing data obtained automatically when using the website, including cookies. The data is processed based on the Administrator's legitimate interest, in the form of adapting the content of the Website to the User's preferences and optimizing the use of the Website; creating statistics that help understand how Users use the Website, which allows improving its structure and content (art. 6 sec.1 point f of the GDPR). Data may also be archived for internal and statistical purposes, based on the legitimate interest of the Administrator (art. 6 sec. 1 point f of the GDPR), until you raise an objection or the business purpose ceases.

8. Promotion and marketing;

If you provide us your data, in particular in the form of an opinion regarding a product or service, including data regarding your image, it will be processed based on the Administrator's legitimate interest in the form of marketing, for the purpose of improving the quality of services and products and promoting Administrator’s services and products. This data will be processed for the period necessary to achieve business purposes or until an objection is raised. Providing data is voluntary.

9. Collection of sensitive data;

Sensitive data is collected for the purpose of implementing the contract and its proper performance - based on your informed and voluntary consent (art. 9 sec. 2 point a of the GDPR) - until the business purpose ceases or the consent is withdrawn. Providing data is voluntary, but necessary for the proper implementation of the contract.

10. Recruitment;

The data may be processed for the time necessary for the recruitment process and conclusion of the contract (art. 6 sec. 1 point b and art. 6 sec. 1 point c of the GDPR), and in the case of additional data provided voluntarily - based on your consent. They may also be used for future recruitment purposes - based on your consent - for a maximum period of 3 years (this period is counted from the end of the year in which the application was obtained). Providing personal data is voluntary, however, the provision of some data may be necessary to carry out recruitment as well as to conclude a contract. The consequence of not providing this data will be failure to undertake the above-mentioned activities.

§3 Who can we transfer your data to?

We transfer your data to other entities only when it is necessary to achieve the processing purposes referred to in §2 and only to the extent necessary to achieve this purpose. As a rule, we collect and process only the data that you have provided to us, excluding automatically collected data (cookies). You can find more about cookies in §7.

If necessary, your data may be transferred to entities with which we cooperate to achieve the above-mentioned purposes, in particular a hosting company, the administrator of the Shoper.pl platform, a company providing accounting and bookkeeping services, a company providing an invoicing program, a company handling online payments, a company providing newsletter services, a company providing cloud services, entities providing marketing services, entities providing consulting services, subcontractors, lawyers, couriers or postal operators, social media platform, other entities that support the Administrator in achieving the processing purposes.

As a rule, data will not be transferred outside the EEA, except for the situations described below. In other cases, if data will be transferred outside the EEA, it will be based on your consent, standard contractual clauses or other safeguards provided for in the GDPR, after meeting - among others - information obligation.

Services provided by Google, Facebook (META) or Instagram (META) are generally provided by entities based in the European Union. However, due to the global nature of the operations of these entities, your data may be transferred to the USA due to their storage on American servers (in whole or in part). Regardless, Google and Facebook have implemented safeguards consistent with GDPR requirements to protect personal data through the use of standard contractual clauses. More information about the principles of data processing by the above-mentioned providers can be found in the Privacy Policies of each of the entities.

§4 What are your rights?

In connection with the GDPR, you have the right to access your personal data, correct personal data, delete personal data, limit the processing of personal data, object to the processing of personal data, transfer personal data, withdraw consent to data processing; withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. Detailed information regarding the above-mentioned rights can be found in the GDPR Regulation, i.e. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).

If you believe that your personal data is being processed contrary to applicable law, you have the right to complain to the President of the Personal Data Protection Office. In such a case, we encourage you to contact us in advance to clarify your doubts.

§5 Is your data profiled?

The Administrator analyzes personal data in an automated manner, using tools provided by software suppliers (e.g. statistics, history), only to the extent that it does not produce any legal effects for you or does not significantly affect your situation, including your guaranteed rights. and freedom. The purpose of data processing in an automated manner is to learn about User preferences (more information about the analysis can be found in §7 Cookie Policy).

§6 Legal regulations applicable to personal data

In unregulated matters, the relevant provisions of law, including European law (including GDPR), shall apply.

§7 Cookie policy

The website does not automatically collect any information, except for information contained in cookies from the Shoper.pl platform on which the Online Store is based. This data is collected in a way that makes it impossible to identify the User, the so-called anonymous data.

Cookies (so-called "cookies") are IT data, in particular text files, which are stored on the Website User's end device and are intended for using the Website. These are both "session" cookies, stored on the User's end device until logging out, turning off the website or turning off the web browser, and "persistent" cookies, stored on the User's end device for the time specified in the cookie parameters (or until they are deleted by User). Cookies usually contain the name of the website they come from, their storage time on the end device and a unique number.

Cookies are used: to adapt the content of the Website to the User's preferences and to optimize the use of the Website, as well as to create statistics that help understand how Users use the Website, which allows improving its structure and content.

You can make changes to your cookie settings yourself. In many cases, the web browser allows cookies to be stored on the User's end device by default. Detailed information about the possibilities and methods of handling cookies is available in the software (web browser) settings. Failure to consent to cookies may limit the operation of some functionalities on the Website.

The Administrator uses technologies that monitor actions taken by the User on the Website:

- Facebook conversion pixel (Meta) provided by Meta Platforms Ireland Limited - to manage ads on Meta and conduct remarketing activities; Facebook Pixel is a piece of code published on a website that allows you to reach the target group based on the data of people who used the website. As part of the Facebook Pixel function, it is therefore possible to display published ads on portals belonging to Meta only to portal users who have shown interest in products or services or have common factors with the above-mentioned people. These data are processed based on the legitimate interest of the Administrator (art. 6 sec. 1 point f of the GDPR). Detailed information regarding the Facebook Pixel can be found on Facebook Privacy Policy (Meta) page.

- Google tools, including Google Analytics and Google Ads provided by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA. We use the data obtained by using the above-mentioned tools to analyze website statistics. Google Analytics uses its own cookies to analyze the activities and behaviors of Website Users. These files are used to store information, e.g. from which website the User came to the current website. They help to improve the Website. These data are processed based on the legitimate interest of the Administrator (art. 6 sec. 1 point f of the GDPR). Detailed information about Google Analytics and Google Ads can be found on the website: rules for using Google tools.

§8 Social plug-ins

The Website uses plug-ins, widgets and other social tools provided by portals such as Facebook (Meta), Instagram (Meta), Pinterest. The rules regarding the processing of personal data are described directly on the websites of the above-mentioned Service Providers.

§9 Co-administration

Data processed for the purposes of statistics collected on the Facebook (Meta) platform and the Instagram (Meta) platform are co-administered by the Administrator and Meta Platforms Ireland Limited, based at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, hereinafter referred to as Co-administrator. Detailed rules regarding co-administration of data, including information about your rights, are described on the Privacy Policy website.

Data processed for the purposes of statistics collected on the Pinterest platform are co-administered by the Administrator and Pinterest Europe Ltd. and Pinterest, Inc (651 Brannan St., San Francisco, CA 94107, USA) and Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland) hereinafter referred to as the Co-administrator. Detailed rules regarding co-administration of data, including information about your rights, are described on the Privacy Policy | Pinterest Policy.

The Administrator processes data based on the Administrator's legitimate interest, consisting in conducting analyzes of Users' activity, as well as their preferences, in order to improve the functionalities used and the services provided. In matters relating to personal data, you can contact both the Administrator and the Co-administrator.