Privacy policy of the internet store www.illetto.com

1. AIM OF PERSONAL DATA PROCESSING AND LEGAL BASIS. The Administrator processes personal data of the Service Users of the www.illetto.com Store in the event of:

    1.1 Account registration in the Store in order to create an individual account and to manage this Account under Art. 6 section 1 letter b) of GDPR (execution of the agreement on providing electronic service in accordance with the Terms and Conditions of the Store),
    1.2 placing an Order in the Store to execute the Sales Agreements under Art.6 section 1 letter b) of GDPR (execution of the Sales Agreement),
    1.3 subscribing to the Newsletter in order to send commercial information electronically. Personal data are processed after giving a separate consent under Art. 6 section 1 letter a) of GDPR,
    1.4 using the Review System in order to facilitate the Client to express their opinion about the purchased Product in the Store and the Sales Agreement concluded with the Seller under Art. 6, section 1, letter f) of GDPR (legitimate interest of the entrepreneur),
    1.5 using the Contact Form in order to send a message to the Administrator under Art. 6 section 1, letter f) of GDPR (legitimate interest of the entrepreneur).

2. TYPE OF PROCESSED PERSONAL DATA. Service User gives the following information for:

   2.1 Account: e-mail address,
    2.2 Order: name and surname, address, Tax Identification Number, e-mail address, phone number,
    2.3 Newsletter: name and surname, e-mail address,
    2.4 Review System: name and surname, e-mail address,
    2.5 Contact Form: name and surname, e-mail address, phone number.

3. PERIOD OF PERSONAL DATA ARCHIVING. The Administrator archives personal data of the Service Users:

    3.1 when the basis for personal data processing is agreement execution, as long it is essential for agreement execution, and afterwards for the period of claim limitation. Unless the specific provision states otherwise, the limitation period is six years, and for claims of periodical performances and claims related to conducting business activity – three years.
    3.2 if the basis for data processing is consent, as long as the consent is not revoked, and after revoking the consent for a period of time corresponding to the period of limitation of claims that may be raised by the Administrator and which may be raised against him. Unless a specific provision states otherwise, the limitation period is six years, and for claims for periodical performances and claims related to conducting a business activity – three years.

4. When using the Store, additional information may be downloaded, in particular: the IP address assigned to the Customer’s computer or the external IP address of the Internet provider, domain name, browser type, access time, the type of operating system.

5. After expressing a separate consent pursuant to Art. 6 section 1 letter. a) of GDPR, the data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for direct marketing purposes – respectively in connection with Art. 10 section 2 of the Act of July 18, 2002 on Providing Services by Electronic Means or Art. 172 section 1 of the Act of July 16, 2004 – Telecommunications Law, including those directed as a result of profiling, provided that the Service User has given the appropriate consent.

6. Navigation data may also be collected from the Service Recipients, including information about links and references that they decide to click or other activities undertaken in the Store. The legal basis for this type of activity is the Administrator’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in facilitating the use of services provided electronically and improving the functionality of these services.

7. Providing personal data by the Customer is voluntary.

8. The administrator takes special care to protect the interests of data subjects and in particular ensures that the data collected by him are:

    8.1. processed in accordance with the law,
    8.2. collected for specified, lawful purposes and not subjected to further processing incompatible with these purposes,
    8.3. factually correct and adequate in relation to the purposes for which they are processed and stored in a form that allows identification of the persons they concern, no longer than it is necessary to achieve the purpose of processing.