Privacy Policy
www.enjoygift.pl and subdomains *.enjoygift.pl
Table of Contents
1. Data Controller
- The controller of personal data collected via the Online Store enjoygift.pl and all of its subdomains is Infinity Plus sp. z o.o., registered at ul. Fabianowo 73, 60-005 Poznan, Poland, entered in the National Court Register (KRS) under number 0000583125, Tax ID (NIP) 7831733370, REGON 362998908, hereinafter referred to as the "Controller".
- The Controller may be contacted regarding personal data matters via:
Infinity Plus sp. z o.o.
ul. Fabianowo 73, 60-005 Poznan, Poland
e-mail: kontakt@enjoygift.pl
tel.: +48 508 556 952 - The Controller exercises particular care to protect the interests of data subjects and, in particular, ensures that the data it collects is processed lawfully, collected for specified and legitimate purposes, substantively accurate and adequate in relation to the purposes for which it is processed, and stored in a form that permits identification of data subjects for no longer than is necessary to achieve the purpose of processing.
2. Purposes and Legal Bases for Processing
Customers' personal data is processed by the Controller for the following purposes and on the following legal bases:
| Purpose of processing | Legal basis (GDPR) |
|---|---|
| Conclusion and performance of the Sales Agreement (placing an order, shipping, invoicing) | Art. 6(1)(b) — performance of a contract |
| Maintaining a Customer Account in the Store | Art. 6(1)(b) — performance of a contract |
| Handling complaints and returns | Art. 6(1)(b) — performance of a contract |
| Issuing and storing VAT invoices and accounting documents | Art. 6(1)(c) — legal obligation (tax and accounting regulations) |
| Handling enquiries submitted via the contact form, e-mail or telephone | Art. 6(1)(f) — legitimate interest of the Controller |
| Sending the Newsletter with commercial information | Art. 6(1)(a) — consent |
| Direct marketing of own products and services | Art. 6(1)(f) — legitimate interest of the Controller |
| Pursuing claims or defending against claims | Art. 6(1)(f) — legitimate interest of the Controller |
| Analytical and statistical purposes (improving service quality, traffic analysis) | Art. 6(1)(f) — legitimate interest of the Controller |
- Providing personal data is voluntary but necessary for concluding a Sales Agreement, creating an Account or using the contact form. Failure to provide the required data will prevent the given service from being performed.
- Providing data for the purpose of receiving the Newsletter is entirely voluntary. Consent to the Newsletter may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
3. Categories of Data Processed
- The Controller processes the following categories of Customers' personal data:
- identification data: first name, surname, company name, Tax ID (NIP),
- contact data: e-mail address, telephone number, correspondence address,
- address data: delivery address, company registered-office address,
- order data: order history, order value, product preferences,
- technical data: IP address, browser type, operating system, cookie data (details in the Cookie Policy).
4. Data Recipients
- Customers' personal data may be disclosed to the following categories of recipients:
- courier and postal companies — for the purpose of delivering ordered Products,
- payment operator TPay (Krajowy Integrator Platnosci S.A.) — for the purpose of processing electronic payments,
- IT service providers — hosting, server maintenance, e-mail systems (under data-processing agreements),
- accounting firm — for the purpose of bookkeeping and issuing accounting documents,
- analytical tool providers — Google Analytics, Facebook Pixel (anonymised or pseudonymised data),
- public authorities — upon request from authorised bodies, to the extent required by law.
- The Controller does not sell Customers' personal data to third parties.
5. Data Retention Period
| Purpose of processing | Retention period |
|---|---|
| Order fulfilment | Until full performance of the agreement, then for the limitation period for claims (3 years from the date of performance) |
| Accounting and tax documents | 5 years from the end of the calendar year in which the tax payment deadline expired |
| Customer Account | Until the Account is deleted by the Customer |
| Newsletter | Until consent is withdrawn (unsubscription) |
| Contact form | Up to 12 months after the end of correspondence |
| Pursuing claims | Until claims become time-barred |
| Analytical purposes | Up to 26 months (Google Analytics) or until cookie consent is withdrawn |
6. Rights of Data Subjects
- Every person whose data is processed has the following rights:
- right of access — the right to obtain information about the processing of personal data and a copy of the data (Art. 15 GDPR),
- right to rectification — the right to request correction of inaccurate data or supplementation of incomplete data (Art. 16 GDPR),
- right to erasure ("right to be forgotten") — the right to request deletion of data if it is no longer necessary for the purposes for which it was collected (Art. 17 GDPR),
- right to restriction of processing — the right to request restriction of data processing in specified circumstances (Art. 18 GDPR),
- right to data portability — the right to receive data in a structured format and to transmit it to another controller (Art. 20 GDPR),
- right to object — the right to object to data processing based on the Controller's legitimate interest, including for the purposes of direct marketing (Art. 21 GDPR),
- right to withdraw consent — at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR).
- To exercise the above rights, please contact the Controller by e-mail at kontakt@enjoygift.pl or in writing to the registered-office address.
- The Controller processes requests without undue delay, no later than within 30 days of receipt. In the case of complex requests, this period may be extended by a further 60 days, of which the data subject will be informed.
- Every person has the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
7. Profiling and Automated Decision-Making
- The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning the Customer or similarly significantly affect them.
- The Controller may use Customer data for analytical and statistical purposes (e.g. analysis of purchasing preferences), which does not constitute profiling within the meaning of Art. 22 GDPR.
8. Transfer of Data to Third Countries
- Due to the use of Google services (Google Analytics, Google Fonts) and Meta Platforms (Facebook Pixel), personal data may be transferred to the United States of America.
- Such transfers are carried out on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or on the basis of standard contractual clauses adopted by the European Commission.
- The Controller takes all available measures to ensure that personal data is processed with an appropriate level of protection.
9. Data Security
- The Controller applies appropriate technical and organisational measures to protect personal data, in particular:
- encrypted connections using SSL/TLS certificates,
- regular data backups,
- access-control systems (authorisation, authentication),
- protection against unauthorised access (firewalls, IDS/IPS systems),
- regular software and system updates,
- staff training on personal data protection.
10. Changes to the Privacy Policy
- The Controller reserves the right to amend this Privacy Policy as a result of changes in the law, changes to the Store's functionality, or changes to the purposes and methods of data processing.
- Customers will be informed of any changes via a notice on the Store pages at least 14 days before the changes take effect. Customers who hold an Account will also be notified by e-mail.
- The current version of the Privacy Policy is always available at enjoygift.pl and on every subdomain.
