Privacy Policy

I. General Provisions

  1. This Privacy Policy specifies the method of collecting, processing, and storing personal data necessary to provide services electronically via the website in the egobags.pl domain (hereinafter: Website).
  2. The Controller of Users' personal data is Arwena On-Line (hereinafter: Controller).
  3. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: GDPR).
  4. Data collected by the Controller will be:
    • processed lawfully,
    • processed for clearly specified purposes and not further processed incompatible with those purposes,
    • substantively correct and adequate in relation to the purposes for which they are processed,
    • stored no longer than necessary to achieve the purpose of processing.

II. Purpose and legal basis of data processing

  1. The Administrator processes personal data necessary to provide and develop the services offered via the Website and its individual functionalities.
  2. Personal data will be processed for the following purposes:
    1. account registration, User identity verification, and performance of the agreement for the provision of electronic services in accordance with the Act of 18 July 2002 on the provision of electronic services, including in particular by ensuring the ability to use the User's account – based on acceptance of the Terms and Conditions (Article 6, paragraph 1, letter b of the GDPR);
    2. communication with the User in order to provide them with necessary information and build positive and reliable relationships with them, which constitutes the legitimate interest of the Administrator (Article 6, paragraph 1, letter f of the GDPR);
    3. promotion by the Administrator of its own products and/or services and those of its Partners by sending Marketing Information electronically (newsletter) provided that the User has consented to receiving such notifications via email (Article 6, paragraph 1, letter a of the GDPR);
    4. providing access to information about news from the industry directly related to the Controller's activities, provided that the User has consented to receiving such notifications via email (Article 6, paragraph 1, letter a of the GDPR),
    5. for analytical and statistical purposes based on the Controller's legitimate interest in verifying Users' activities and their preferences to optimize services and products and the functionalities of the Website (Article 6, paragraph 1, letter f of the GDPR);
    6. possible establishment, exercise or defense against claims based on the Controller's legitimate interest in protecting its rights (Article 6, paragraph 1, letter f of the GDPR).
  3. In each of the cases mentioned above (paragraph 2), the provision of data is voluntary, but necessary to conclude a contract or use other functionalities of the Website.

III. Period of personal data processing

  1. Personal data will be processed for the period during which the person remains an active User of the Website (has a User Account), and after that time for the period necessary to comply with legal provisions, pursue or defend against potential claims, but no longer than 3 years from the date of termination of the agreement for the provision of electronic services.
  2. Data processed on the basis of consent will be processed until the consent is withdrawn, provided that the withdrawal of consent does not affect the lawfulness of data processing carried out before such withdrawal.

IV. Information about processing

  1. Depending on the purpose of processing, personal data may be disclosed to:
    1. entities associated with the Controller,
    2. entities cooperating with the Controller,
    3. subcontractors, in particular entities providing and operating selected IT systems and solutions,
    4. entities handling online payments,
    5. entities providing courier and postal services,
    6. law firms.
  2. Personal data processed by the Controller will/shall not be transferred outside the European Economic Area or to international organizations.

V. Rights of data subjects

  1. The Website User has the right to:
    • access their personal data
    • rect their data
    • delete their data
    • restrict data processing
    • port data
    • object to processing based on the legitimate interest of the controller
    • withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal
  2. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that the processing violates their rights and freedoms.
  3. There is no automated decision-making, including profiling, in the data processing process.

VI. Final Provisions

  1. The Administrator reserves the right to make changes to this Privacy Policy and ensures that the rights of Users arising from this document will not be limited.
  2. The User will be informed of any changes to the Privacy Policy via a notice available on the Website.