Privacy policy

 

THE MISAGA STORE PRIVACY POLICY

 

This Privacy Policy (hereinafter: "Policy") contains information on the processing of your personal data in connection with the use of the "THEMISAGA" online store, operating at the Internet address www.maisonmisaga.com (hereinafter: "Store").

 

All capitalized terms that are not otherwise defined in the Policy have the meaning given to them in the Regulations, available at: https://thenmisaga.com/pl/policies/terms-of-service.

 

Personal data administrator

 

The administrator of your personal data is Misaga Sp. o. o. with its headquarter in Katowice Sowińskiego 4 street, 40-018 Poland, KRS number: 0000897445, NIP: 9542826072, REGON number: 388795119, with share capital in the amount of PLN 10,000.00 (ten thousand zlotys) paid in full (hereinafter: "Administrator").

 

Contact with the Administrator

 

In all matters related to the processing of personal data, you can contact the Administrator via:

  1. a) e-mail - at: customercare@themisaga.com;
  2. b) traditional mail - at the address: ul. Sowińskiego 4, 40-018 Katowice.

 

 

Personal data protection measures

 

The administrator applies modern organizational and technical security measures to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with with the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation) (hereinafter: "GDPR"), the Act of May 10, 2018 on the protection of personal data and other provisions on the protection personal data.

 

Information about processed personal data

 

Using the Store requires the processing of your personal data. Below you will find detailed information about the purposes and legal grounds for processing, as well as the processing period and the obligation or voluntarily to provide them.

 

 

Purpose of processing

Processed personal data

Legal Basis

Conclusion and performance of the Agreement for the provision of the Account Service

1)     Name and Surname

2)     email

article 6 sec. 1 lit. b GDPR

 

(processing is necessary to perform the Agreement for the provision of the Account Service concluded with the data subject, or to take action to conclude it)

Application of the above personal data is a condition for concluding and performing the contract for the provision of the Account Service (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above-mentioned contract, including creating an Account).

The administrator will process the above. personal data until the statute of limitations for claims under the Agreement for the provision of the Account Service.

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Conclusion and performance of the Sales Agreement

1)     Name and surname

2)     Email adress

3)     Phone number

4)     Delivery adress (street, house number, local number, city, postal code, country)

article 6 sec. 1 lit. b GDPR

 

(processing is necessary to perform the Agreement for the provision of the Account Service concluded with the data subject, or to take action to conclude it)

 

Application of the above the provision of personal data is a condition for the conclusion and performance of the Sales Agreement (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the Sales Agreement).

 

The administrator will process the above. personal data until the claims under the Sales Agreement expire.

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Conclusion and performance of the Agreement for the delivery of the Newsletter

Email adress

article 6 sec. 1 lit. b GDPR

 

(processing is necessary to perform the Newsletter Agreement concluded with the data subject, or to take action to conclude it)

 

and

 

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case informing about new products and promotions available in the Store)

 

Application of the above providing personal data is voluntary, but necessary in order to receive the Newsletter (the consequence of not providing them will be the inability to receive the Newsletter).

 

The administrator will process the above. personal data from the time of effective objection or achievement of the purpose of processing, or until the statute of limitations for claims under the Agreement for the provision of the Newsletter (depending on which of the above-mentioned events occurs first).

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Carrying out the complaint procedure

1)     name and surname

2)     e-mail address

article 6 sec. 1 lit. c GDPR

 

(processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case the obligations:

- responding to a complaint - art. 7a of the Consumer Rights Act;

-      -implementation of the Customer's rights under the provisions on the Administrator's liability in the event of non-compliance of the Goods with the Sales Agreement or the Subject of digital service with the Agreement relating to it)

 

Application of the above personal data is a condition for receiving a response to a complaint or exercising the Customer's rights under the provisions on the Administrator's liability in the event of non-compliance of the Good with the Sales Agreement or the Subject of digital service with the Agreement related to it (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and exercise of the above-mentioned rights).

 

The administrator will process the above. personal data for the duration of the complaint procedure, and in the case of implementation of the above-mentioned the Customer's rights - until they expire.

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Sending email notifications

Email adress

Email address art. 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case informing Customers about the actions taken related to the performance of Agreements concluded with Customers)

 

Application of the above personal data voluntary, but necessary in order to receive information on activities related to the performance of Agreements concluded with Customers (the consequence of not providing them will be the inability to receive the above-mentioned information).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved (depending on which of the above-mentioned events occurs first).

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

Handling inquiries submitted by customers using the contact form

1)     name and surname

2)     e-mail address

3)     telephone number

4)     other data contained in the message to the Administrator

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case, to answer the received inquiry)

Application of the above providing personal data is voluntary, but necessary in order to receive an answer to the inquiry (the consequence of not providing it will be the inability to receive an answer).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved (depending on which of the above-mentioned events occurs first).

 

 

 

Purpose of processing

Processed personal data

Legal Basis

Handling inquiries submitted by customers using the Messenger application

1)     name and surname/profile name

2)     other data contained in the message to the Administrator

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case, to answer the received inquiry)

Application of the above providing personal data is voluntary, but necessary in order to receive an answer to the inquiry (the consequence of not providing it will be the inability to receive an answer).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved (depending on which of the above-mentioned events occurs first).

 

 

 

Purpose of processing

Processed personal data

Legal Basis

Handling and correspondence via e-mail

1)     name and surname

2)     official position/function

3)     e-mail address

4)     phone number

article 6 sec. 1 lit. f GDPR

 

(processing is necessary to implement the Administrator's legitimate interest, in this case correspondence via e-mail)

Application of the above providing personal data is voluntary, but necessary in order to conduct correspondence with the Administrator via e-mail (the consequence of not providing them will be the inability to conduct the above-mentioned correspondence).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved (depending on which of the above-mentioned events occurs first).

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Recruitment of employees

1)     name and surname

2)     date of birth

3)     contact details provided by the candidate (e.g. address, e-mail address, telephone number)

4)     education

5)     professional qualifications;

6)     the course of previous employment

article 6 sec. 1 lit. c GDPR

 

(processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case the obligations related to the recruitment of employees, set out in Article 22(1) § 1 of the Labor Code)

 

and

 

article 6 sec. 1 lit. and the GDPR

 

(personal data processing is based on consent)

 

Application of the above personal data is mandatory and necessary to carry out the recruitment procedure.

 

The administrator will process the above. personal data until the end of the recruitment procedure or the candidate's resignation from applying for employment, unless the candidate agrees to the processing of his personal data also for the purposes of possible future recruitment.

 

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

 

Recruitment of associates

1)     name and surname

2)     date of birth

3)     contact details provided by the candidate (e.g. address, e-mail address, telephone number)

4)     education

5)     professional qualifications;

6)     the course of previous employment

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case the proper conduct of the recruitment procedure)

 

 

Application of the above providing personal data is voluntary, but necessary to conduct the recruitment procedure (the consequence of not providing them will be the inability to participate in the recruitment procedure).

 

The administrator will process the above. personal data until the end of the recruitment procedure or the candidate's resignation from applying for employment, unless the candidate agrees to the processing of his personal data also for the purposes of possible future recruitment.

 

 

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Organization of competitions

1)     name and surname

2)     e-mail address

3)     other data necessary to conduct the competition

article 6 sec. 1 lit. and the GDPR

 

(processing is based on the consent given by the competition participant)

 

Application of the above providing personal data is voluntary, but necessary to participate in the competition (the consequence of not providing them will be the inability to participate in the competition).

 

The administrator will process the above. personal data until the end of a given competition or withdrawal of consent to the processing of personal data (depending on which of the above-mentioned events occurs first).

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Fulfilling tax obligations (e.g. issuing a VAT invoice, storing accounting documentation)

1)     1name and surname/company

2)     Address of residence/registered office

3)     tax identification number

article 6 sec. 1 lit. c GDPR

 

(processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case obligations arising from tax law)

 

Application of the above providing personal data is voluntary, but necessary for the Administrator to meet his tax obligations (the consequence of not providing them will be the Administrator's inability to meet the above-mentioned obligations).

 

The administrator will process the above. personal data for a period of 5 years from the end of the year in which the deadline for payment of tax for the previous year expired.

 

 

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Fulfillment of obligations related to the protection of personal data

1)     name and surname

2)     contact details provided by you (e-mail address, correspondence address, telephone number)

article 6 sec. 1 lit. c GDPR

 

(processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case the obligations arising from the provisions on the protection of personal data)

 

Application of the above personal data is voluntary, but necessary for the proper performance by the Administrator of the obligations arising from the provisions on the protection of personal data, including exercising the rights granted to you by the GDPR (the consequence of not providing the above-mentioned data will be the inability to properly exercise the above-mentioned rights).

 

The administrator will process the above. personal data until the expiration of the limitation periods for claims for violation of the provisions on the protection of personal data.

 

 

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Determination, investigation or defense against claims

1)     name and surname/company

2)     e-mail address

3)     address of residence/registered office

4)     PESEL number

5)     tax identification number

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case to establish, investigate or defend against claims that may arise in connection with the performance of Agreements concluded with the Administrator)

 

Application of the above personal data is voluntary, but necessary to determine, investigate or defend against claims that may arise in connection with the performance of Agreements concluded with the Administrator (the consequence of failure to provide the above-mentioned data will be the Administrator's inability to take the above-mentioned actions)

Administrator będzie przetwarzał ww. dane osobowe do czasu upływu terminów przedawnienia roszczeń mogącymi powstać w związku z wykonywaniem Umów zawartych z Administratorem.

 

 

 

 

 

 

Purpose of processing

Processed personal data

Legal Basis

 

Analysis of your activity in the Store

1)     date and time of the visit

2)     device IP number

3)     type of operating system of the device

4)     approximate location

5)     type of web browser

6)     time spent in the Store

7)     viewed Goods

8)     visited subpages and other actions taken within the Store

article 6 sec. 1 lit. f GDPR

 

(processing is necessary in order to implement the Administrator's legitimate interest, in this case obtaining information about your activity in the Store)

 

Application of the above personal data is voluntary, but necessary for the Administrator to obtain information about your activity in the Store (the consequence of not providing them will be the Administrator's inability to obtain the above-mentioned information).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved.

 

 

 

 

 

 

urpose of processing

Processed personal data

Legal Basis

 

Store administration

1)     IP address

2)     server date and time

3)     information about the web browser

4)     information about the operating system

5)      

6)     The above data is automatically saved in the so-called server logs, each time you use the Store (administrating it without the use of server logs and automatic saving would not be possible).

article 6 sec. 1 lit. f GDPR

 

(processing is necessary to implement the Administrator's legitimate interest, in this case to ensure the proper operation of the Store)

 

Application of the above providing personal data is voluntary, but necessary to ensure the proper operation of the Store (the consequence of not providing them will be the inability to ensure the correct operation of the Store).

 

The administrator will process the above. personal data until the objection is successfully raised or the purpose of processing is achieved.

 

 

Profiling

 

In order to create your profile for marketing purposes and to direct direct marketing to you tailored to your preferences, the Administrator will process your personal data in an automated manner, including profiling - however, this will not have any legal effects on you or in a similar way significantly affect your situation.

The scope of profiled personal data corresponds to the scope indicated above in relation to the analysis of your activity in the Store and the data that you will save in the Account.

 

The legal basis for the processing of personal data for the above purpose is art. 6 sec. 1 lit. f of the GDPR, according to which the Administrator may process personal data in order to pursue its legitimate interest, in this case conducting marketing activities tailored to the preferences of recipients. Application of the above personal data is voluntary, but necessary for the implementation of the above. purpose (the consequence of not providing them will be the Administrator's inability to conduct marketing activities tailored to the preferences of recipients).

 

The administrator will process personal data for the purpose of profiling until the objection is successfully raised or the purpose of processing is achieved.

 

Recipients of personal data

 

The recipients of personal data may be the following external entities cooperating with the Administrator:

 

  1. a) hosting service providers;
  2. b) software providers;
  3. c) consulting, auditing and law firms;
  4. d) postal and courier companies;
  5. e) banks;
  6. f) online payment system providers;
  7. g) newsletter service provider;
  8. h) companies providing tools for analyzing activity in the Store and directing direct marketing to people using it (including Google Analytics);
  9. i) a company providing accounting services.

 

In addition, personal data may also be transferred to public or private entities, if such an obligation results from generally applicable provisions of law, a final court judgment or a final administrative decision.

 

Transfer of personal data to a third country

 

In connection with the use by the Administrator of the services provided by Google LLC, your personal data may be transferred to the following third countries: Great Britain, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for the transfer of data to the above-mentioned third countries are:

 

- in the case of Great Britain, Canada, Israel and Japan - decisions of the European Commission stating the appropriate level of personal data protection in each of the above-mentioned third countries;

- for the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia and Australia, adequacy contractual clauses in line with the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council.

You can obtain from the Administrator a copy of the data transferred to a third country.

 

Permissions

 

In connection with the processing of personal data, you have the following rights:

 

1) the right to information what personal data concerning you are processed by the Administrator and to receive a copy of this data (the so-called right of access). The release of the first copy of the data is free of charge, the Administrator may charge a fee for the next ones;

2) if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request their rectification;

3) in certain situations, you can ask the Administrator to delete your personal data, e.g. when:

  1. a) the data will no longer be needed by the Administrator for the purposes of which he informed;
  2. b) you have effectively withdrawn your consent to data processing - unless the Administrator has the right to process data on a different legal basis;
  3. c) the processing is unlawful;
  4. d) the need to delete the data results from the legal obligation imposed on the Administrator;

4) in the event that personal data is processed by the Administrator on the basis of consent to processing or in order to perform the Agreement concluded with him, you have the right to transfer your data to another administrator;

5) if personal data is processed by the Administrator on the basis of your consent to the processing, you have the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal);

6) if you decide that the processed personal data are incorrect, their processing is unlawful, or the Administrator no longer needs the specific data, you can request that the Administrator does not make any data, no operations, but only stored them;

7) you have the right to object to the processing of personal data, the basis for which is the legitimate interest of the Administrator. In the event of an effective objection, the Administrator will stop processing personal data in the above-mentioned manner. purpose;

8) you have the right to lodge a complaint with the President of the Office for Personal Data Protection when you consider that the processing of personal data violates the provisions of the GDPR.

 

 

Cookies

 

  1. The administrator informs that the Store uses "cookies" (cookies) installed on your end device. These are small text files that can be read by the Administrator's system, as well as by systems belonging to other entities whose services the Administrator uses (e.g. Facebook, Google).
  2. The administrator uses cookies for the following purposes:
  3. a) ensuring the proper operation of the Store - thanks to cookies, it is possible to operate the Store efficiently, use its functions and conveniently move between individual subpages;
  4. b) increasing the comfort of browsing the Store - thanks to cookies, it is possible to detect errors on some subpages and improve them constantly;
  5. c) creating statistics - cookies are used to analyze how users use the Store. Thanks to this, it is possible to constantly improve the Store and adapt its operation to the preferences of users;
  6. d) conducting marketing activities - thanks to cookies, the Administrator can direct advertisements to users tailored to their preferences.
  7. The administrator can place both permanent and temporary (session) files on your device. Session files are usually deleted when the browser is closed, while closing the browser does not delete persistent files.
  8. Information about cookies used by the Administrator is displayed in the panel located in the central part of the Store's website. Depending on your decision, you can enable or disable cookies for specific categories (except essential cookies) and change these settings at any time.
  9. Data collected using cookies do not allow the Administrator to identify you.
  10. The administrator uses the following cookies or tools that use them:

 

TOOL

PROVIDER

FUNCTIONS AND SCOPE OF DOWNLOADED DATA

OPERATION PERIOD

Necessary cookies

Administrator

The operation of these files is necessary for the proper functioning of the Store's website, so you cannot disable them. Thanks to these files (retrieving, among others, the IP number of your device), it is possible to e.g. informing you about cookies operating on the Store's website

Most of the necessary cookies are session cookies, but some remain on your end device for about 12 months or until they are deleted.

Google Analytics

Google LLC

This tool enables the collection of statistical data on the use of the Store by Customers, including about the number of visits, duration of visits, search engine used, location. The collected data helps to improve the Store and make it more customer-friendly.

Up to 2 years or until they are deleted (whichever comes first).

YouTube

Google LLC

This tool allows you to play videos embedded on the Store's website and measure statistics related to their playback,

Up to approximately 12 months or until they are deleted (whichever occurs first).

Facebook Pixel

Meta Platforms Ireland Limited

This tool makes it possible to determine that you have visited the Store, and to direct advertisements displayed on Facebook and Instagram social networks to you and measure their effectiveness.

From 7 days to approximately 12 months or until they are deleted (whichever comes first).

PayPal

PayPal Holdings, Inc.

This tool allows you to make payments for the Goods available in the Store.

Up to approximately 12 months or until they are deleted (whichever occurs first).

 

 

  1. Through most commonly used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block their installation in the future by the Store. Disabling or limiting the use of cookies may, however, cause quite serious difficulties in using the Store, e.g. in the form of the need to log in on each subpage, longer loading time of the Store page, restrictions on the use of some functionalities.

 

Final Provisions

 

To the extent not regulated by the Policy, generally applicable provisions on the protection of personal data shall apply.

 

The policy is valid from 01/01/2023.