Privacy policy

Privacy Policy

Pursuant to Art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter as GDPR), we are obliged to fulfill the information obligation towards persons whose personal data we process. This information covers the main aspects related to the processing of personal data of Users of the website https://https://gsmok.com and persons contacting them in any other matter related to the Administrator's activities.

This document contains the rules for the processing of your personal data in connection with the use of the website https://https://gsmok.com (hereinafter also referred to as the "Website"), in connection with cooperation with GSMOK Sp. z o.o., and in the scope of other situations described below.

General information

The controller of personal data in accordance with the GDPR is

GSMOK Sp. z o.o.

St. Przasnyska 6b, 01 - 756 Warsaw

VAT Number: PL5252820337, REGON: 385909746

entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number 0000837213

(hereinafter also referred to as the 'Administrator').

If you have any questions related to this document, as well as the processing of your personal data, you can contact the Administrator at any time at the correspondence address GSMOK Sp z o.o.

St. Przasnyska 6b, 01 - 756 Warsaw

e-mail address shop@https://gsmok.com or telephone number 22 257 05 00.

Top rules

The Administrator makes every effort to ensure that your personal data remains confidential and safe, in particular properly protected against access by unauthorized persons.

The Administrator processes your personal data only to the extent necessary for the operation of the Website, registration and logging in to your Account, and making purchases via the GSMOK online store available at https://https://gsmok.com (hereinafter referred to as “ Store”) and perform other activities described in this document. The Administrator processes your personal data only to the extent and in the manner specified in the provisions of applicable law, including the GDPR.

Providing your personal data is voluntary in most cases. However, failure to provide specific personal data indicated in the Privacy Policy will result in the inability to use the electronic services offered by the Administrator, conclude a contract, contact the Administrator and submit a complaint.

The website https://https://gsmok.com uses cookies for its proper operation. Detailed information on this subject can be found in the Cookie Policy section.

What is personal data and what constitutes its processing?

According to the provisions of the GDPR, "personal data" means any information relating to an identified or identifiable natural person.

An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more specific factors ;in determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.

The processing of personal data should be understood as essentially any activity involving personal data, regardless of whether it is performed in an automated manner or not, e.g. collecting, storing, recording, organizing, modifying, viewing, using, sharing, restricting, deleting or destroying.

Purposes of personal data processing

In order to enable you to use the Store, your personal data is or may be processed by the Administrator for the following purposes:

1. registration and logging in to the Customer's account in the Store, using the Store's functionalities.
   The legal basis for processing is the necessity to conclude and perform the contract (in accordance with Article 6(1)(b) of the GDPR). Creating an account in the Store is tantamount to concluding a contract for the provision of electronic services. In order to conclude this contract, you are obliged to complete the electronic registration form and provide your personal data in the form of: name and surname, e-mail address, telephone number, login and password, and in the case of entrepreneurs, also name and tax identification number. Providing personal data is voluntary, but necessary to conclude a contract (register an account) and use the services provided in the Store.
   During the implementation of the contract (having an account in the Store), the Administrator may obtain further personal data about you, including bank account number from which the payment is made, delivery address, business addresses, purchase history. Providing this data is voluntary, but necessary to perform sales contracts concluded via the Store;
   
   
2. placing orders and concluding sales contracts via the Store
   The legal basis for processing is the conclusion and performance of a contract (in accordance with Article 6(1)(b) of the GDPR). If you have a registered account in the Store, for the purpose of implementing the contract, the Administrator will use your data provided during registration and/or available in the Customer's account. During the execution of the contract, the Administrator also processes the bank account number (in connection with the payment made). Providing data is voluntary, but necessary to conclude a contract via the Store;
   
   
3. withdrawal from the sales contract
   The legal basis for processing is the performance of contractual obligations arising from the right to withdraw from a distance contract (Article 6(1)(b) of the GDPR). The administrator processes the data indicated in the declaration of withdrawal (name and surname, residential or registered office address and e-mail address or telephone number, bank account number). This data is used to analyze your right to withdraw from the contract and to refund the price and costs of delivering the goods or replacing the goods, or to inform you that the withdrawal cannot be accepted. Providing data is voluntary, but necessary to effectively withdraw from the sales contract;
   
   
4. handling complaints related to the concluded sales contract
   The legal basis for processing is (i) performance of contractual obligations arising from the warranty for physical and legal defects of the sold items and from the warranty upon sale (in accordance with Article 6(1) letter b of the GDPR), as well as (ii) implementation of the legitimate interest of the Administrator, which is defense against unjustified claims and ensuring high quality of customer service (Article 6(1)(f) of the GDPR). The administrator processes the data provided in the complaint (name and surname, address and e-mail address or telephone number, bank account number, in order to refund the price). This data is used to analyze the validity of the complaint, contact you to solve the problem or inform you that the complaint cannot be considered or accepted. Detailed conditions for submitting and considering complaints are described in the Store Regulations. Providing data is voluntary, but necessary to effectively submit a complaint;
   
   
5. handling complaints regarding the operation of the Store
   The legal basis for processing is the implementation of the legitimate interest of the Administrator, ensuring a high level of service provision through the Store and proper relations with Customers (Article 6(1)(f) of the GDPR). The administrator processes the data provided in the complaint (name and surname, name, e-mail address or telephone number). This data is used to analyze the validity of the complaint, contact you to solve the problem or inform you that the complaint cannot be considered or accepted. Providing data is voluntary, but necessary to effectively submit a complaint.

The Administrator also processes personal data for other purposes related to the functioning of the Website, i.e. for the following purposes:

1. enabling newsletter subscription
   The legal basis for the processing of personal data is consent to receive commercial information electronically (in accordance with Article 6(1)(a) of the GDPR). Via the Website, you have the opportunity to subscribe to the newsletter service, under which the Administrator sends current information on your business, including commercial information, to the e-mail address you provide. Providing data is voluntary, but necessary to subscribe to the newsletter;
   
   
2. analyzing data collected automatically when using the Website
   Your personal data are processed pursuant to Art. 6 section 1 letter f GDPR, i.e. the legitimate interest of the Administrator, expressed in ensuring the proper functioning of the Website and maintaining its viewing statistics. As part of the analysis, the server automatically saves only the so-called server logs, such as the name of the requested file, your data regarding the IP number of the device from which you use the Website, date and time of access, the amount of data transferred and the Internet service provider making the request (access data), and documents the page access
   
   
3. Use of Google Analytics for web analytics purposes
   Our website uses Google Analytics, a web analytics tool from Google Inc. (www.google.com). The above serves to protect our legitimate interest in the optimal presentation of our offer. Google Analytics uses methods that enable analysis of your use of the website. for example cookies. Details of the service are available at the following link:
   https://developers.google.com/analytics/learn?hl=en
   Automatically collected information regarding your use of this website website are usually transferred to a Google server in the United States and stored there. Google ensures that it uses data protection mechanisms provided for by European regulations. Details on data protection by Google are available at the following link:
   https://support.google.com/analytics/answer/6004245?hl=en
   You can prevent the recording of data collected by cookies regarding your use of our website (including your IP address) by Google, as well as the processing of this data by Google, if you download and install the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en
   
   
4. use of cookies on the Website
   The legal basis for processing is the content of Art. 6 section 1 letter a GDPR, i.e. your consent. The detailed purposes of processing are described in the Cookie Policy section.

Outside the Website, your personal data may be processed by the Administrator for the following purposes:

1. conducting correspondence or other forms of communication
   Your personal data may be processed by the Administrator for the purposes of written, telephone or electronic contact, correspondence or communication. In such a situation, the basis for processing is the legitimate interest of the Data Controller, consisting in maintaining good relations and satisfaction of Customers, Contractors, Business Partners and any other persons contacting the Controller (Article 6(1)(f) GDPR). If you initiated the conversation, your personal data will be processed on the basis of the consent resulting from the initiation of contact (Article 6(1)(a) of the GDPR). Providing personal data is voluntary, but necessary for correspondence or communication;
   
   
2. processing of personal data for marketing purposes
   An element of the Administrator's relationship with business clients is presenting marketing offers regarding the Administrator's products and services. You may voluntarily consent to receiving commercial information containing commercial information regarding the Administrator to the provided e-mail address or telephone number. The processing of personal data in the above scope is based on your consent, and it is also an expression of the legitimate interest of the Administrator (Article 6(1)(a) and (f) of the GDPR). Expressing consent and providing personal data is voluntary, but necessary to receive commercial information from the Administrator.
   The Administrator also undertakes marketing activities that do not require your consent, in particular creates and maintains customer databases and conducts other activities promoting the business. Administrator and brands included in the Administrator's commercial offer;
   
   
3. administrating the Administrator's profiles on Facebook and Instagram
   Your personal data may be processed by the Administrator in the event of any of your activities on the Administrator's profiles on Facebook and Instagram (including liking the Administrator's profile, posting a comment, liking, etc.).
   The legal basis for processing is the legitimate interest of the administrator consisting in collecting via the above-mentioned data portals regarding activity on the Administrator's profile, interests, data allowing for anonymous analysis of user groups and interactions and presenting marketing offers regarding the Administrator's products and services (in accordance with Article 6(1)(f) of the GDPR), as well as your consent resulting from your activity on the Administrator's profiles on Facebook or Instagram (pursuant to Article 6(1)(f) .a GDPR). Through the portal, the Administrator may receive the following data divided into user categories: total number of visits, reactions to posts, comments, proportion of visitors divided into men and women, source of the visit, information on clicks on specific content on the website, such as maps or contact information, range of the Administrator's posts.
   Your activity on the Administrator's profiles on Facebook or Instagram is completely voluntary, but doing so is tantamount to the processing of personal data. The administrator has no influence on the creation and display of analyzes and cannot stop the collection or processing of data for this purpose. If you want to limit the connection to the Administrator's profile on Facebook or Instagram, you can use the functions offered on these platforms to unfollow or subscribe to the Administrator's profile.
   Notwithstanding the above, Facebook and Instagram may use your data for their own purposes. purposes, in particular for market research and advertising. Cookies may be stored on your computer which analyzes your usage behavior. Other information, including about your devices and internet connection, may be collected and associated with your account. The platforms listed may create your profile even if you are not logged in or do not have a registered account on the platform. These profiles can be used to display targeted advertising on specific platforms.
   The provider of Facebook and Instagram is Facebook Ireland Ltd., 4 Grand Canal Square, Dublin, Ireland with its parent company Facebook, Inc. 1601 Willow Road Menlo Park, California 94025.
   The details of the processing of personal data on Facebook are regulated in the privacy documents available at https://www.facebook.com/about/privacy/update.
   The details of the processing of personal data on Instagram are regulated in the privacy documents available at https://help.instagram.com/519522125107875?helpref=page_content
   
   
4. fulfilment of obligations imposed by law
   Your data may also be processed in order to fulfill the obligations imposed on the Administrator, provided for by law, in particular in order to transfer your data for the purposes of possible court or administrative proceedings or other proceedings before state authorities, as well as to fulfill the obligations arising from accounting and tax law provisions (Article 6(1)(c) of the GDPR). In these cases, the processing of personal data is an obligation arising from legal provisions;
   
   
5. archival and evidentiary purposes
   Your data may be processed for archival and evidentiary purposes, for the purpose of securing information that may be used to demonstrate facts, which constitutes the legitimate interest of the Administrator (in accordance with Article 6(1) .1 letter f GDPR). The data archived in this way may be used to determine, pursue or defend against claims or allegations.
   
   
6. Your personal data may also be processed for other purposes, in which case you will each time receive information on this subject in a manner consistent with the information obligation arising from the GDPR (Articles 13 and 14 of the GDPR).

Personal data processing period

Your personal data will be processed for an appropriate period of time, depending on the purpose for which the personal data was collected:

1. data processed for the purpose of registering and logging in to the Customer's account in the Store and using the Store's functionalities – until the account in the Store is deleted;
2. data processed for the purpose of concluding and performing a contract - until the limitation period for claims arising or likely to arise from the contract expires or for the period of mandatory storage of accounting documents relating to the contract required by law. depending on which of these events will last longer
3. data processed for the purpose of withdrawing from the sales contract - until the limitation period for claims arising or likely to arise from the contract expires or for the period of mandatory storage of accounting documents regarding withdrawal from the contract required by law - depending on which of these events lasts longer
4. data processed in order to handle possible complaints related to the concluded contract or complaints regarding the operation of the Store - until the limitation period for claims arising or likely to arise from the complaint;
5. data processed in order to enable the use of the newsletter service - for the period necessary to provide the newsletter service, until your resignation or discontinuation of the provision of this service by the Administrator;
6. analyzing data collected automatically when using the Website - access data is deleted within 365 days from the end of your visit to the website;
7. data processed for the purpose of using cookies on the Website for the period indicated in the Cookies Policy section
8. data processed for the purpose of correspondence or other forms of communication - for the duration of the correspondence and after its completion, for the period of existence of the Administrator's legally justified interest, but no longer than until the limitation period for any claims related to the correspondence;
9. data processed for marketing purposes — until the implementation of a specific type of marketing activities is discontinued or you object to the processing of data for marketing purposes. To the extent necessary to send commercial information, your personal data will be processed until the consent expressed in this connection is withdrawn;
10. data processed for the purpose of administering profiles on Facebook and Instagram - until you perform the following actions (i) unlike the Administrator's profile and (ii) delete all your activities on this profile. The processing of your data will also be stopped if you delete your account from Facebook or Instagram or delete the Administrator's profile from these websites. Performing the described activities does not constitute deletion of archived data regarding activity on the portal;
11. data processed in order to fulfill the obligations imposed by law - for the period of storage of evidence confirming the fulfillment of these obligations, but no longer than the limitation period for these obligations
12. data processed for archival and evidentiary purposes - until the limitation period for any claims expires or the archiving of documents required by law depending on which event will last longer.

From what sources does the Administrator obtain personal data?

The personal data held by the Administrator come primarily from you.

If you have not provided the data, it comes from the following sources:

1. from other entities that will provide your data, e.g. in correspondence,
2. from publicly available sources, in particular from data posted on websites, including publicly available records, registers and databases, including VIES.

Recipients of personal data

1. The Administrator carefully selects the entities with which it cooperates or whose services it uses when processing personal data, striving to provide your data with maximum protection.
2. The Administrator does not share your data with third parties, unless it is necessary to ensure the proper processing of personal data and the conduct of business by the Administrator. The recipients of personal data in such a case are:
   1. authorized employees of the Administrator,
   2. entities that may potentially gain access to your personal data when providing the Administrator with hosting and website services, e-mail and other electronic means of communication, as well as IT systems
   3. persons who may potentially gain access to your personal data when providing legal assistance services to the Administrator;
   4. entities providing postal and courier services to the Administrator;
   5. banks (for monetary settlements);
   6. entities intermediating in electronic payments;
   7. entities providing accounting or auditing services to the Administrator;
   8. entities providing advertising and promotional services to the Administrator;
   9. Google — due to the use of Google Analytics to analyze website statistics and verify website traffic,
   10. other people visiting the Administrator's profile on Facebook, where your personal data is shared, i.e. only the name or nickname provided in connection with the comment posted on Facebook;
   11. entities to which the Administrator is obliged to provide personal data under generally applicable provisions of law.
3. The Administrator does not intend to transfer your personal data to third countries, unless this results from the obligations arising from generally applicable provisions of EU or national law.

Permissions in connection with data processing by the Administrator

The GDPR grants you the following rights related to the personal data processed:

1. the right to request access to your personal data,
2. the right to request rectification of personal data,
3. the right to request the deletion of personal data (right to be forgotten)
4. the right to request restriction of processing,
5. the right to transfer data,
6. the right to object to the processing of personal data,

If the processing is based on consent, you can also withdraw your consent at any time, without giving any reason, in any form, in particular by sending an e-mail to the Data Administrator. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of your data by the Administrator violates the law.

Not all the rights referred to in section 1 will be entitled to you in relation to each case of processing. This depends on the type of processing and its legal basis.

The Administrator may make decisions in an automated manner, including profiling, in relation to your personal data, in particular those collected, with your consent, via cookies. used on the website https://https://gsmok.com, however, it will not cause any legal consequences for you or significantly affect your situation in a similar way.

Final Provisions

When using the Website, you are obliged to comply with the law and good practices, as well as respect the personal data and other personal rights of third parties.

The Administrator may change the provisions of the Privacy Policy at any time. You will be notified about the scope and content of these changes before logging in for the first time to your account in the Store.