Privacy policy

§ 1. GENERAL PROVISIONS

1. This document (“Policy”) is for informational purposes only, which means it does not create obligations for users of the website: https://krakowduckstore.pl. The Policy outlines the principles regarding the processing of personal data, including the legal basis for processing, purposes, and the scope of processed personal data, as well as the rights of individuals whose data is being processed.
2. In addition to the information specified in paragraph 1 above, the Policy also includes details regarding the use of cookies and analytical tools on the aforementioned website.
3. If you have any questions or concerns about the processing of personal data, please contact us using the details provided in section III of this Policy.

§ 2. PERSONAL DATA ADMINISTRATOR

The administrator of your personal data collected via the website https://krakowduckstore.pl (“Website” or “Service”) is Michał Radwan, conducting business as a sole proprietorship under the name Michał Radwan RADMIS, based on an entry in the Central Register and Information on Economic Activity, located at ul. Szpitalna 32, 31-024 Kraków, NIP: 5512362387, REGON: 367359194 (“Administrator” or “Service Provider”).

The Administrator ensures the protection of your personal data, processes it with care, and in accordance with applicable laws, particularly the General Data Protection Regulation (“GDPR”).

§ 3. CONTACT DETAILS

For all matters related to the protection of your personal data, you can contact the Administrator:

• In writing – correspondence address: ul. Szpitalna 32, 31-024 Kraków;
• Via email – at: hello@krakowduckstore.pl;
• By phone – at: +48 504 283 476.

§ 4. COLLECTION AND PROCESSING OF PERSONAL DATA

To use the Website, you are not required to provide any personal data; however, the Administrator is entitled to collect data voluntarily provided by you.

Please note that the Website is equipped with all necessary systems and tools used for processing personal data for the purposes specified in Section V of this Policy.

If you voluntarily decide to use the available functionalities of the Website (e.g., newsletter services), the Administrator will obtain your consent to process personal data in accordance with applicable data protection regulations.

The Administrator will inform you about the collection and processing of personal data before obtaining and starting to process it.

The Website does not collect or process special categories of personal data as defined in Article 9 of the GDPR (so-called sensitive data) or data related to criminal convictions and offenses under Article 10 of the GDPR.

§ 5. PURPOSES, LEGAL BASIS FOR DATA PROCESSING, AND RETENTION PERIOD

The Administrator may process your personal data if it is necessary for your use of the Service.

Each time, the purpose, legal basis, processing period, scope of data, and categories of recipients of personal data will depend on the actions taken by the respective Service User or Client.

§ 6. ORDER FORM

If you decide to place an order in the store available on the Website, this will constitute an action directly aimed at entering into a Service Agreement with the Administrator, who will process the personal data provided in the order form:

• Identification data (first and last name),
• Delivery address (postal code, city, street, building number, apartment number),
• Email address,
• Phone number,
• Company name, registered address, and Tax Identification Number (NIP) – only if you are placing an order as part of your business activity,
• Additional correspondence details (e.g., floor, intercom code, staircase) – only if you voluntarily fill in the field; data such as the intercom code is not required to place an order.

The above data represents the maximum scope of information collected.

Providing data marked with an “*” in the contact form is necessary to place an order through the store (contractual requirement).

Providing the remaining data is voluntary and not required to place an order.

Purposes of Data Processing Provided in the Form:

• Conclusion and performance of a sales and delivery service agreement as specified in the Terms and Conditions – processing your data is necessary for the conclusion and execution of the agreement, and the processing is based on Article 6(1)(b) of the GDPR.
• Order fulfillment – processing your data is necessary for completing your order, based on Article 6(1)(b) of the GDPR.Issuance of an invoice and its inclusion in accounting records – processing is carried out in compliance with legal obligations under Article 6(1)(c) of the GDPR.
• Post-transaction processing – your personal data may be processed under Article 6(1)(f) of the GDPR to pursue the legitimate interests of the Administrator, such as archiving the order or determining, pursuing, and enforcing claims, as well as defending against claims arising from the Administrator’s business activities.

Data Retention Period:

Order-related data will be processed for the time necessary to complete the order and subsequently until the expiration of the limitation period for claims arising from the Service Agreement. This period is three years or six years, depending on whether the order was placed as part of business activity or as a consumer.  Invoices containing personal data, in accordance with applicable regulations, will be processed for a period of 5 years from the end of the tax year in which the tax obligation arose.

§ 7. CUSTOMER PANEL

If you decide to create an account on the Website, the Administrator will process your personal data provided during account registration or while using the account, specifically:

• Identification data (first name, last name),
• Contact details (phone number),
• Correspondence address (postal code, city, street, building number, apartment number),
• Email address,
• Phone number,
• Company name, registered address, and Tax Identification Number (NIP) – only if you place an order as part of your business activity,
• Additional correspondence details (e.g., floor, intercom code, staircase) – only if you voluntarily fill in the field; data such as the intercom code is not required to place an order,
• Other data you choose to provide while using the account.

Data Retention Period:

§ 8. CONTACT FORM

If you decide to contact the Administrator via the contact form available on the Website, the Administrator will process the following personal data:

• Identification data (first and last name),
• Email address.

Providing this data is necessary to send an email and fulfill the related purpose (contractual requirement).

Processing may also include additional personal data if you voluntarily include it in the content of your message.

Purposes of Data Processing Provided in the Form:

• Responding to your message and handling your inquiry in accordance with its content, based on the Administrator’s legitimate interest in addressing inquiries, pursuant to Article 6(1)(f) of the GDPR.
• Post-contact processing – after the conclusion of the correspondence, your personal data may be processed under Article 6(1)(f) of the GDPR to pursue the Administrator’s legitimate interest in archiving correspondence or determining, pursuing, and enforcing claims, as well as defending against claims arising from the Administrator’s business activities.

Additionally, you may voluntarily include other personal data in your message if you believe it is necessary for a response.

You have the right to request the Administrator to provide a history of correspondence, provided it has been archived, and to request its deletion unless its archiving is justified by the overriding interest of the Administrator, primarily related to defense against potential claims, in accordance with Article 6(1)(f) of the GDPR.

Data Retention Period:

§ 9. NEWSLETTER SERVICE

If you decide to subscribe to the newsletter, the Administrator will process the following personal data:

• Identification data (first and last name),
• Email address.

Purposes of Data Processing When Subscribing to the Service:

• Sending the newsletter – based on your voluntarily given consent, pursuant to Article 6(1)(a) of the GDPR.
• Archiving documents, statistical purposes, and potential claim enforcement or defense against claims related to the performance of the electronic service agreement (Newsletter) – based on the necessity of data processing to pursue the legitimate interests of the Administrator, pursuant to Article 6(1)(f) of the GDPR. The Administrator’s legitimate interests include document archiving, statistical analysis, claim enforcement, or defense again

Data Retention Period:

Your personal data will be processed until you withdraw your consent for its processing and unsubscribe from the newsletter.

Despite unsubscribing, your data will continue to be stored in the database to identify returning subscribers and to defend against claims related to newsletter delivery. This includes demonstrating that you consented to receive the newsletter and the timing of its withdrawal. Such processing constitutes a legitimate interest of the Administrator, as outlined in Article 6(1)(f) of the GDPR.

§ 10. COMPLAINTS

If you decide to submit a complaint regarding the functioning of the Website or products offered in the Store, the Administrator will process the personal data included in your complaint, in particular:

• Identification data,
• Email address,
• Correspondence address,
• Company name, registered address, and Tax Identification Number (NIP) – only if the order was placed as part of your business activity.

Purposes of Data Processing When Submitting a Complaint:

• Processing the complaint to address the issue raised.
• Pursuing the Administrator’s legitimate interest in determining, pursuing, and enforcing claims, as well as defending against claims arising from the Administrator’s business activities.

Data Retention Period:

§ 11. SOCIAL MEDIA MANAGEMENT

If you follow the Administrator’s profiles on social media platforms (Facebook, Instagram) or interact with content published by the Administrator on these platforms, the Administrator naturally gains access to personal data you have made public on your social media profile.

The Administrator processes this data solely within the given social media platform and exclusively for the purpose of managing the social media account. This constitutes the Administrator’s legitimate interest, as outlined in Article 6(1)(f) of the GDPR. The Administrator’s right to process this data ceases if a valid objection to such processing is submitted by the data subject.

§ 12. MARKETING OF THE ADMINISTRATOR’S SERVICES AND PRODUCTS

The Administrator may process personal data for the purpose of marketing services and products. The maximum scope of data includes:

• Identification data,
• Address (street, building/apartment number, postal code, city),
• Email address,
• Phone number,
• Previous order history in the Service.

The legal basis for processing personal data is Article 6(1)(a) of the GDPR, meaning the consent provided by the data subject.

Data Retention Period:

§ 13. ENSURING THE PROPER FUNCTIONING OF THE SERVICE

The Administrator may process the following personal data:

• IP address,
• Location data,
• Data on the source from which the User accessed the Website.

This is to ensure the proper functioning of the Service.

The legal basis for processing personal data is Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Administrator, namely the operation and maintenance of the Service.

Data is stored for the duration of the legitimate interest pursued by the Administrator but no longer than the limitation period for claims the Administrator may have against the data subject due to their business activities.

§ 14. STATISTICS AND ANALYTICS

The Administrator may process the following personal data:

• IP address,
• Location data,
• Data on the source from which the User accessed the Website.

This data is processed to compile statistics and analyze traffic on the Website to improve its functionality and increase sales of Services.

The legal basis for processing personal data is Article 6(1)(f) of the GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Administrator, namely increasing the sales of Services offered by the Administrator.

Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims the Administrator may have against the data subject due to their business activities.

§ 15. CATEGORIES OF PERSONAL DATA RECIPIENTS

The Administrator shares your personal data with other entities only when necessary to fulfill the Administrator’s legitimate needs. Data may be shared, in particular, with the Administrator’s subcontractors who assist in data processing or in providing services to you.

The Administrator will not disclose your personal data to other entities or third parties except in the following situations:

• You have given your consent,
• It is necessary for the provision of services by the Administrator while respecting the principles of data minimization and processing limitation,
• Your personal data will be shared with authorized employees and collaborators of the Administrator, postal operators, companies cooperating with the Administrator providing specialized services such as courier, logistics, legal, advisory, marketing, hosting, or IT services,
• It is necessary to ensure the security of the IT infrastructure, including online payments,
• It is necessary to fulfill obligations under applicable law, particularly tax regulations,
• It is justified by requests from state institutions or judicial authorities.

In the case of online payments, all personal data related to payments is provided directly by you to the payment operator – TPay S.A., based in Poznań. The data necessary to execute the transaction is subsequently provided by TPay S.A. to the Administrator. The transfer of data is governed by the agreement between the Administrator and TPay S.A.

§ 16. USER RIGHTS

In accordance with data protection regulations, particularly the GDPR, you are entitled to the following rights:

1. Withdrawal of consent for the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing carried out by the Administrator based on your consent before its withdrawal, pursuant to Article 7 of the GDPR.
2. Access to your personal data and obtaining confirmation whether your personal data is being processed by the Administrator. If so, you have the right to receive information about:
   • The purposes of processing,
   • Categories of personal data,
   • Recipients or categories of recipients to whom your data has been or will be disclosed, particularly recipients in third countries or international organizations,
   • The planned retention period of your personal data or the criteria for determining this period,
     pursuant to Article 15 of the GDPR.
3. Rectification or supplementation of your personal data if it is incomplete or inaccurate, pursuant to Article 16 of the GDPR.
4. Erasure of all or part of your personal data if:
   • The data is no longer necessary for the purposes for which it was collected or processed,
   • You withdraw consent, and the Administrator has no other legal basis for processing,
   • You object, and the Administrator considers the objection justified,
   • Your data has been processed unlawfully,
     pursuant to Article 17 of the GDPR.
5. Restriction of processing of your personal data if:
   • You contest the accuracy of your personal data, in which case the Administrator will restrict its processing until the accuracy is verified,
   • You question the lawfulness of processing by the Administrator,
   • The Administrator no longer needs the data, but it is necessary for you to establish, exercise, or defend legal claims,
   • You object to processing until the Administrator determines whether the objection is valid,
     pursuant to Article 18 of the GDPR.
6. Receiving a copy of your personal data provided to the Administrator, or transferring it to another entity if technically feasible, in a commonly used and machine-readable format, where the Administrator processes your data based on consent, for service provision, or in an automated manner, pursuant to Article 20 of the GDPR.
7. Objection to processing your personal data due to your particular situation, where data is processed based on the Administrator’s legitimate interests. Upon objection, the Administrator will assess whether your interests, rights, and freedoms outweigh the interests pursued through data processing, pursuant to Article 21(1) of the GDPR.
8. Lodging a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), located at ul. Stawki 2, 00-193 Warsaw, if you believe your personal data is being processed improperly.

§ 17. INFORMATION ABOUT PROFILING

Within the Service, the Administrator may use profiling for direct marketing purposes and, with prior consent, for marketing the Administrator’s Services and products.

Decisions based on profiling do not concern:

• The conclusion, performance, or refusal to conclude a Service Agreement,
• The ability to use Electronic Services,
• The conclusion, performance, or refusal to conclude any other agreement.

Effects of profiling may include:

• Sending a discount code,
• Reminders about unfinished purchases,
• Proposals for Services that may match a person’s interests or preferences,
• Offering better conditions compared to the standard offer available on the Service,
• Providing a gift in connection with a celebratory occasion,
• Granting a reward for loyal purchases.

Despite profiling, the individual retains complete freedom to decide whether to take advantage of the received discount, gift, reward, or improved terms and proceed with a purchase on the Service.

Profiling within the Service involves:

• Automatic analysis or forecasting of an individual’s behavior on the Service, such as adding a specific Service to the cart, browsing specific Service pages, and analyzing the history of previous orders.

The sole purpose of profiling is to provide the User or Client with a service that meets their individual needs and expectations.

Right to opt-out:
Individuals whose data is being processed have the right at any time to not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or similarly significantly affects them.

§ 18.  COOKIES:

The website uses cookies, which are stored on your device if you provide explicit consent. This does not apply to session cookies necessary to ensure the functionality and security of the Website (“necessary cookies”).

You can give your consent by continuing to use the Website without changing your cookie settings and clicking the “Accept and Close” button.
A cookie notification will be displayed the first time you visit the Website and will continue to appear until you accept cookies or change your settings using the “Cookie Settings” button. After making a selection, the notification will no longer appear, but you can modify your preferences at any time through the “Cookie Settings” tab.

By adjusting your cookie settings, you can delete cookies that have already been stored (e.g., along with your browsing history and cached files) or block new cookies from being saved. Depending on the settings you choose, you may block or delete all cookies, except those necessary for the proper functioning of the Website.

The website uses the following types of cookies:

• Necessary Cookies

Some cookies used by the Administrator are essential for the functioning of the Website and cannot be disabled, as they enable users to navigate and use the Website effectively.

Additionally, within the framework of necessary cookies, the Administrator stores information about user preferences regarding accepted cookie settings. This action is based on the Administrator’s legitimate interest, which involves compliance with accountability obligations regarding data processing consents, pursuant to Article 6(1)(f) of the GDPR.

Necessary cookies are designed to enhance and facilitate access to the Website.

• Google Analytics

The Administrator may use the Google Analytics tool provided by Google LLC. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). Activities in this regard are carried out based on the Administrator’s legitimate interest in creating statistics and analyzing them for further optimization of the Website, in accordance with Article 6(1)(f) of the GDPR.

Google Analytics automatically collects information about how you use the Website. This information is typically transmitted to Google servers in the United States.

Due to the IP anonymization activated by the Administrator, your IP address is shortened before further transmission.

The purpose and scope of data collection, as well as further processing and use by Google, including contact possibilities and your rights in this regard, as well as settings to protect your privacy, are described in Google’s Privacy Policy. You are encouraged to review it at: https://support.google.com/analytics/answer/6004245.

When visiting the Website for the first time, you decide whether you consent to the Administrator’s use of this tool. Remember, you can change your decision at any time by going to “Cookie Settings.”

• Pixel Facebook / Meta

The Administrator may use the Facebook Pixel service provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This service helps the Administrator measure the effectiveness of advertisements, analyze user actions, and display tailored ads to users. Remarketing lists based on cookies collected by the Pixel are created in the Facebook panel. Detailed information on how Facebook Pixel works can be found at the following link: https://www.facebook.com/business/help/742478679120153?helpref=page_content.

Managing Facebook Pixel functionality (ad preferences) is possible by adjusting your ad settings in your account on Facebook.com: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.

Please note that restricting the storage and access to cookies may result in the improper functioning of some features on the Website. If you limit the ability to store and read cookies, the Administrator is not responsible for improperly functioning Website features.

§ 19. SOCIAL MEDIA:

The Website features plugins and other social media tools provided by social media platforms (Facebook, Instagram, TikTok).

If you do not want social media platforms to associate data collected during your visit to the Website with your accounts, log out of those platforms before visiting the Website. You can also block plugins from loading on the Website by using appropriate extensions for your browser.

Any personal data or other information entered into social media applications by Website users may be read, collected, and used by other users and the providers of those applications. The Administrator is not responsible for the use, misuse, or misappropriation of personal data or other information entered by users into social media applications, including on the Administrator’s professional profiles available on these applications.

§ 20. FINAL PROVISIONS

1. The Website (including articles, posts, entries, or comments) may contain links to external sites. The Administrator is not responsible for the content located outside the Website.
2. This Policy is an integral part of the Website’s Terms of Service, which define the rules, rights, and obligations of users utilizing the Website.
3. Users of the Website are bound by the current content of the Policy.
4. The Administrator reserves the right to make changes to the Policy if required by law or due to changes introduced to the Website. The Administrator will inform users of any changes and their effective date via the Website in the “Privacy Policy” section and, where applicable, notify individuals whose data is affected through electronic means.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

The Privacy Policy was last updated on November 13, 2024.