Respecting the right to privacy of those who have entrusted us with their personal data, we hereby set out YOKABA’s data protection policy, established in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter ‘GDPR’).
§ 1 GENERAL PROVISIONS
1. The data controller for personal data collected via the online shops yokaba.pl and b2b.yokaba.pl is:
Yokaba Limited Liability Company, with its registered office in Wilcza Góra
at ul. Żwirowa (Żwirowa) 28, 05-506 Wilcza Góra
, entered in the Register of Entrepreneurs by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, KRS No.: 0000901003, REGON: 388984100, NIP: 1231494244;
hereinafter referred to as the “Controller”;
2. The Privacy Policy of the yokaba.pl and b2b.yokaba.pl contains a set of rules concerning the processing and protection of personal data by the Controller in the Online Shop, including the grounds, purposes and scope of personal data processing and the rights of data subjects, as well as information regarding the use of cookies and analytical tools in the Online Shop;
3. Personal data on the Online Shop is processed by the Controller in accordance with applicable legislation, in particular:
1) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter ‘GDPR’,
2) the Act of 10 May 2018 on the protection of personal data
3) the Act of 18 July 2002 on the provision of electronic services,
4) the Act of 16 July 2004 – Telecommunications Law,
5) the Act of 30 May 2014 on Consumer Rights,
6) the Act of 23 April 1964 – the Civil Code.
4. Capitalised terms used in this Privacy Policy (e.g. Buyer) shall be understood in accordance with their definitions set out in the Terms and Conditions of the yokaba.pl and b2b.yokaba.pl online shops, available on the shops’ websites.
§ 2 PURPOSE, SCOPE, LEGAL BASIS AND DURATION OF PERSONAL DATA PROCESSING
- The Controller processes personal data for the following purposes:
1) To provide marketing services relating to its own products in accordance with Article 6(1)(f) of the GDPR, including:
§ displaying marketing content to the Buyer that is not tailored to their preferences (contextual advertising),
§ displaying marketing content to the buyer in line with their interests (behavioural advertising),
§ sending email notifications about interesting offers or content containing commercial information,
§ carrying out other activities in connection with the direct marketing of goods and services, and sending commercial information by email, SMS, MMS, telephone and other advertising and telemarketing activities.
For this purpose, the Controller processes the following personal data: first name and surname, email address, telephone number, until such time as an objection to the processing is raised;
2) For the purpose of providing the newsletter service with the data subject’s consent in accordance with Article 6(1)(a) of the GDPR. For this purpose, the Controller processes the following data: first name and surname, email address, until consent is withdrawn.
3) To create a Customer Account in accordance with Article 6(1)(b) of the GDPR. For this purpose, the Controller processes the following data: first name and surname or company name, email address, telephone number, residential or registered office address, delivery address (if different from the residential or registered office address), tax identification number (NIP), IP address, and cookies. Personal data will be processed until the account is deleted.
4) For the purpose of concluding and performing a contract with a Customer or business partner in accordance with Article 6(1)(b) of the GDPR. For this purpose, the Data Controller processes the following data: first name and surname or company name, email address, telephone number, residential or registered office address, delivery address (if different from the residential or registered office address), tax identification number (NIP), IP address, cookies, order number and bank account number. The data is processed for the period necessary to perform, terminate or allow the contract to expire.
5) For the purpose of handling complaints, requests and claims in accordance with Article 6(1)(f) of the GDPR. For this purpose, the Data Controller processes the following data: first name and surname or company name, email address, telephone number, residential address or registered office address, delivery address (if different from the residential address or registered office address), tax identification number (NIP), IP address, cookies, order number and bank account number. The data will be processed for the duration of the contract or until the expiry of the warranty period or the resolution of the complaint.
6) For the purpose of establishing, pursuing and defending claims in accordance with Article 6(1)(f) of the GDPR, for the duration until the expiry of the limitation periods for claims arising from the contract – in accordance with applicable law.
7) For the purposes of settlement, accounting and financial reporting in accordance with Article 6(1)(c) of the GDPR, for the period until the expiry of statutory data retention obligations, in particular the retention of accounting documents (as a general rule, for 5 years following the year in which the legal event occurred that gave rise to the obligation to issue the accounting document).
8) For the purpose of handling messages via the contact form in accordance with Article 6(1)(f) of the GDPR, the Controller processes the following data: first name and surname, email address, telephone number for the period necessary to respond to enquiries and carry out tasks related to the operation of the online shop or to lodge an objection to the processing of personal data.
9) For the purpose of providing the Online Booking service and performing the contract in accordance with Article 6(1)(b) of the GDPR, the Controller processes the following data: first name and surname, date of birth, email address, telephone number, choice of diet centre, type of appointment, appointment date. This data is processed for the period necessary to perform, terminate or allow the contract or a claim to lapse.
10) For analytical and statistical purposes to improve the services provided, as well as for security purposes – including IT security – and to prevent and combat attempts at fraud, in accordance with Article 6(1)(f) of the GDPR, the Controller processes the following data: IP address or other identifiers, and information collected via cookies or other similar technologies. This data will be processed for the period necessary to carry out tasks related to the operation of the online shop or to investigate incidents, or until an objection to the processing is raised.
11) To fulfil the obligations imposed on the business by the relevant legislation in accordance with Article 6(1)(c) of the GDPR. The controller processes the following data: first name and surname, company name, email address, telephone number, home address or registered office address, delivery address (if different from the home address or business address), tax identification number (NIP), order number and bank account number. The data will be processed for the period specified by law.
12) For the purpose of conducting day-to-day correspondence using tools provided by Facebook, including Messenger, Instagram, and carrying out other marketing activities. Data processing in connection with YOKABA’s profile on the social media platforms Facebook and Instagram is carried out in accordance with Article 6(1)(b) of the GDPR; the data will be processed until an objection to the processing is raised. When contacting YOKABA via social media platforms such as Facebook and Instagram, these platforms are considered separate controllers of personal data. The data will be processed until the contract has been fulfilled or consent has been withdrawn.
13) To tailor the content of websites to users’ needs, including for marketing purposes, and to optimise the use of websites. The processing of cookies in accordance with Article 6(1)(f) of the GDPR will take place for the periods specified in the Cookie Policy or until an objection is raised against the processing of data. An objection may only be lodged by changing the end-user’s browser settings, which will prevent the collection of information using cookies.
§ 3 DATA RECIPIENTS
1. Buyers’ personal data may be disclosed to the following recipients or categories of recipients:
1) carriers, freight forwarders, couriers and postal operators – in the case of a Buyer who, in the Online Shop, chooses to have the Product delivered by post or courier. The Controller provides the Buyer’s collected personal data to the selected carrier, freight forwarder, agent or postal operator carrying out deliveries on the Controller’s behalf, to the extent necessary to deliver the Product to the Buyer,
2) entities processing electronic or card payments – in the case of a Buyer who uses electronic or card payment methods in the Online Shop, The Controller shall make the Buyer’s personal data available to the selected entity processing the aforementioned payments in the Online Shop on the Controller’s behalf, to the extent necessary to process the payment made by the Buyer,
3) service providers supplying the Controller with technical, IT and organisational solutions enabling the Controller to conduct its business activities, including the Online Shop and the electronic services provided through it (in particular, suppliers of computer software, email and hosting providers, and providers of business management software and technical support to the Administrator) – whereby the aforementioned entities will process data solely on the basis of a contract with YOKABA and strictly in accordance with our instructions,
4) providers of accounting, legal and advisory services who provide the Controller with accounting, legal or advisory support (in particular an accountancy firm, a law firm or a debt collection agency), whereby the above entities will process data solely on the basis of a contract with YOKABA and strictly in accordance with our instructions, as well as marketing service providers, namely:
§ Edrone Sp. z o.o., ul. Lekarska 1, 31-203 Kraków, NIP: 676-248-20-64, KRS: 0000537197 – for the purpose of using the edrone.me mailing system, which is used to send the newsletter;
§ Edrone Sp. z o.o., ul. Lekarska 1, 31-203 Kraków, NIP: 676-248-20-64, KRS: 0000537197: – for marketing purposes, solely for the purposes of email, SMS and social media campaigns launched or specified by the Controller via the edrone system; 2. The Controller hereby informs you that it uses the following technologies to track the actions undertaken by the user/Customer on the Shop’s website: edrone tracking codes – for the purpose of analysing the Shop’s website statistics, as well as for marketing purposes solely for the purposes of email, SMS and social media campaigns launched or specified by the Controller using the edrone system.
2. The transfer of personal data by the Controller requires, in each case, the existence of at least one of the grounds set out in the Privacy Policy. The Controller transfers data only where this is necessary to fulfil a specific purpose of personal data processing and only to the extent necessary to achieve that purpose.
§ 4 TRANSFER OF PERSONAL DATA TO ENTITIES OUTSIDE THE EUROPEAN ECONOMIC AREA
1. As a general rule, personal data will not be transferred outside the European Economic Area (hereinafter: ‘EEA’). However, given that our subcontractors provide services in support of ICT services and IT infrastructure, YOKABA may commission recognised subcontractors operating outside the EEA to carry out specific IT activities or tasks, which may result in your data being transferred outside the EEA. In accordance with the European Commission’s decision, recipient countries outside the EEA ensure an adequate level of protection for personal data in line with EEA standards.
2. In the case of recipients in countries not covered by the European Commission’s decision, in order to ensure an adequate level of such protection, the Controller enters into agreements with recipients of personal data which are based on the standard contractual clauses issued by the European Commission in accordance with Article 46(2)(c) of the GDPR.
3. A copy of the standard contractual clauses may be obtained from the Controller. The method used by the Controller to safeguard your data complies with the principles set out in Chapter V of the GDPR. You may request further information about the safeguards applied in this regard, obtain a copy of these safeguards, and find out where they are made available.
§ 5 PROFILING IN THE ONLINE SHOP
1. The Controller may use profiling in the Online Shop, which means that, through automated data processing, the Controller evaluates selected factors relating to natural persons in order to analyse their behaviour or make predictions about the future, including for the purpose of carrying out marketing activities.
2. Decisions made on the basis of profiling do not relate to the conclusion or refusal to conclude a Sales Contract, nor to the ability to use electronic services in the Online Shop.
3. Profiling involves the automatic analysis or prediction of the Buyer’s behaviour on the Online Shop’s website using cookie data and historical data stored in the Customer’s Account, with the aim of assessing the Buyer’s preferences and interests (e.g. by adding a specific Product to the basket, viewing a specific Product’s page in the Online Shop, or by analysing the Buyer’s previous purchase history).
4. The data subject has the right not to be subject to a decision based solely on profiling or other automated processing and may object to the profiling of their data.
§ 6 RIGHTS OF THE DATA SUBJECT
1. The data subject is entitled to the following rights in accordance with the provisions of the GDPR:
1) access,
2) to rectification,
3) to erasure,
4) to restrict processing,
5) data portability,
6) withdrawal of consent, and the right to object to processing, including profiling,
§ if you have given your consent to the processing of your data, you may withdraw it at any time. Withdrawal does not affect the lawfulness of data processing carried out prior to withdrawal,
§ where the Controller bases the processing of your personal data on a balancing of interests, in particular pursuant to Article 6(1)(f) of the GDPR, you may object to the processing. This applies in particular where the processing is not necessary for the performance of a contract concluded with you, as referred to in § 2. When making such a request, you will be asked to explain the reasons why your personal data should not be processed by the Controller, who will assess the situation and either cease or adjust the processing of your data, or set out compelling legitimate grounds on the basis of which they will continue the processing,
§ you may, of course, object at any time to the processing of your personal data for direct marketing purposes; this also applies to profiling, insofar as it relates to such direct mail advertising,
7) to lodge a complaint with a supervisory authority if you consider that the processing of your personal data infringes the provisions of the GDPR.
2. To exercise the above rights, please contact the Controller by sending a written request, including by email, to the Controller’s address specified in § 1, or by using the contact form available on the Online Shop’s website.
§ 7 COOKIE POLICY, USAGE DATA AND ANALYTICS
1. Cookies are small pieces of text information in the form of text files which are sent by the server and stored on the visitor’s device (e.g. on a computer’s hard drive or a smartphone’s memory card – depending on which device the user is using). They usually contain the name of the website from which they originate, the duration for which they are stored on the end device and a unique number, but may also contain personal data in the form of an IP address and a unique device identifier stored in the file.
2. Cookies are used to:
1) enabling the use of specific website functions,
2) compiling statistics and analyses that help us understand how users interact with websites, in order to improve their structure and content, and consequently enhance the user experience,
3) tailoring the content of websites to the user’s preferences. In particular, these files enable the website to recognise the user’s device and display the website accordingly, tailored to their individual needs.
3. The Controller may process the data contained in cookies whilst visitors are using the Online Shop website for the purpose of:
1) identifying Buyers as logged-in users on their Customer Account and indicating that they are logged in,
2) to remember Products added to the basket for the purpose of placing an Order,
3) to remember the details entered in Order Forms or the login details for the Customer Account,
4) tailoring the content of the Online Shop website to the Buyer’s individual preferences and optimising the user experience on the Online Shop website,
5) compiling anonymous statistics showing how the Online Shop website is used,
6) to study the behaviour of visitors to the Online Shop through anonymous analysis of their activities, with a view to creating a profile and delivering adverts tailored to their anticipated interests.
4. The Online Shop uses session cookies, which are deleted when the web browser window is closed, as well as persistent cookies, which are stored for a specified period on the devices through which the Buyer uses the Online Shop.
5. The Online Shop uses the following types of cookies:
1) ‘Essential’ – these are basic cookies that enable our website to function correctly and allow you to use the most important features and services available in the Shop, e.g. logging in, viewing a specific product page and adding a selected product to the basket, comparing purchase history, etc. Without these cookies, we cannot provide our services.
2) ‘Functional’ – these cookies are used to provide a more personalised experience on our website. They allow us, for example, to ‘remember’ the settings you have chosen and to personalise the user interface, such as your chosen language or region, and the website’s appearance. They may also be used to provide specific services, such as watching video content or leaving comments. Our services may not function correctly if these cookies are disabled.
3) ‘Marketing’ cookies enable us to provide users of the online shop with advertising content that is better tailored to their interests. This content is provided by us and/or advertisers, who may combine information collected on our website with other information gathered as a result of your browser’s activity on the web. If you delete or disable these cookies, adverts will still be displayed. However, they may not be relevant to you.
4) ‘Analytical’ – these cookies collect information used to analyse traffic on our website and how visitors use our site. For example, they can track how long a user stays on the site or which pages they visit. This helps us understand how we can improve our website.
6. Every user can specify the conditions for the use of cookies via their own web browser settings, including partially restricting them or completely disabling the ability to store cookies – in the latter case, this may affect certain website functionalities. To view the cookies used on the website, click the icon (usually a padlock icon) next to the website address and select ‘Cookies’ (the text next to it will show how many cookies are in use). Once you have clicked on ‘Cookies’, you will be able to view information about individual cookies from the drop-down list, including their expiry dates, and take action: block or delete them.
Below is a guide to changing cookie settings in the most popular web browsers:
§ Chrome: ‘Settings’ > ‘Privacy and security’ > ‘Cookies and other site data’,
§ Edge: ‘Settings’ > ‘Privacy, search and services’,
§ Firefox: ‘Options’ > ‘Privacy and Security’,
§ Safari > ‘Preferences’ > ‘Privacy’.
7. The Controller may use Google Analytics and Universal Analytics services provided by Google Ireland Limited on the online shop. These services help the Controller to analyse traffic on the online shop. The data collected is processed anonymously as part of the aforementioned services (so-called usage data, which does not allow any individual to be identified) to generate statistics that assist in the management of the online shop. This data is aggregated and anonymous, i.e. it does not contain any identifying characteristics (personal data) of a person visiting the online shop’s website. Through the aforementioned services in the online shop, the Controller collects data such as the sources and media through which visitors to the online shop were acquired, as well as their behaviour on the shop’s website, information about devices and browsers via the name of the page visited, IP address and domain, geographical and demographic data (age, gender) and interests. The legal basis for the use of Google Analytics or Universal Analytics is your consent in accordance with Article 6(1)(a) of the GDPR. You can prevent Google from collecting data generated by the Google (Universal) Analytics cookie and relating to your use of the website (including your IP address), and from processing this data, by using the browser add-on available via the following link to download and install the plug-in: https://tools.google.com/dlpage/gaoptout?hl=pl You
can prevent Google (Universal) Analytics from collecting your data, even when using the website on a mobile device, by clicking the link below. An opt-out cookie will be set to prevent data collection when you visit this website in future:
Disable Google Analytics: https://support.google.com/analytics/answer/9019185?hl=pl Information
about the third-party provider: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Terms of use: https://marketingplatform.google.com/about/analytics/terms/pl/
Data protection overview: https://policies.google.com/?hl=pl
Data protection statement: https://policies.google.com/privacy?hl=pl
8. The Controller may use Facebook Ireland Limited’s pixel service in the online shop. This service helps the Controller to measure the effectiveness of adverts, gain insights into the activity of visitors to the online shop and display adverts tailored to them. When you are redirected to our website by clicking on a relevant advert on Facebook, a so-called pixel cookie is stored in your browser. This records your clicks and activity on our website and transmits the data collected in this way to Facebook so that adverts relevant to you can be displayed there in future. We use the Facebook pixel in what is known as ‘extended data matching mode’. As a result, in addition to clicks and activity, your personal data is also transmitted to Facebook. The legal basis for this data processing is your consent in accordance with Article 6(1)(a) of the GDPR. You can prevent the Facebook pixel cookie from being stored by adjusting your browser settings accordingly; however, please note that in this case, you may not be able to make full use of all the features of this website.
You can also prevent the Facebook pixel from collecting data whilst you are using our website by clicking on the link below. An opt-out cookie will be set, which prevents your data from being recorded when you visit this website in future after clicking on an advert placed on Facebook: Deactivate the Facebook pixel. https://pl-pl.facebook.com/business/help/186134205381987 Information about the third-party provider: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, D2 Dublin, Ireland.
Further information on the purpose and scope of data collection and its processing by Facebook can be found in the privacy policy. There you will also find further information about your rights and settings options to protect your privacy: Terms of Use: https://www.facebook.com/help/186325668085084
Data policy: https://www.facebook.com/about/privacy/your-info#everyoneinfo
§ 8 PROTECTION OF PERSONAL DATA
1. The Data Controller undertakes to protect the personal data being processed in accordance with applicable legislation, including by not disclosing it to unauthorised persons and by processing it solely for the purposes set out in this Policy. This does not apply to situations where personal data is disclosed, as previously indicated, to entities authorised to receive it under the relevant legislation.
2. The Controller declares that it makes every effort to ensure a high level of security for the Buyer when using the Online Shop and, to this end, employs:
1. technical and organisational measures, in particular with regard to the security of personal data processing,
2. measures ensuring:
a. the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services,
b. the ability to swiftly restore the availability of and access to personal data in the event of a physical or technical incident,
c. regular testing, measurement and evaluation of the effectiveness of the technical and organisational measures designed to ensure the security of processing.
3. Any incidents affecting the security of the transmission of information and personal data, including those relating to suspected security breaches or the disclosure of data to unauthorised persons, must be reported to the Controller at the following email address: gdpr@yokaba.pl
§ 9 AMENDMENTS TO THE PRIVACY POLICY
In light of changes in technology, legislation – including data protection law and regulations governing online business operations – and the offerings of the yokaba.pl and b2b.yokaba.pl online shops, the Controller may amend this Privacy Policy, which will be published on the website with a new date. The current version is effective from 18 August 2021.