Privacy Policy
Dear User!
We care about your privacy and want you to feel comfortable while using our services. Therefore, below we present the most important information about the principles of processing your personal data and the cookies used by our online store. This information has been prepared in accordance with the GDPR, which is the General Data Protection Regulation.
THEREFORE, IN ACCORDANCE WITH ARTICLE 13(1) AND (2) OF THE GENERAL DATA PROTECTION REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016 ON THE PROTECTION OF NATURAL PERSONS WITH REGARD TO THE PROCESSING OF PERSONAL DATA AND ON THE FREE MOVEMENT OF SUCH DATA, AND REPEALING DIRECTIVE 95/46/EC (GDPR), WE INFORM YOU AS FOLLOWS:
Personal Data Administrator (“Administrator”)
The administrator of your personal data is the company: Karol Ciaś HerbalMind Pouches, address: Błaszków 69, 26-220 Stąporków, NIP: 6582001910, REGON: 540259257. You can contact us in the following ways:
• by mail at: Błaszków 69, 26-220 Stąporków
• by e-mail: contact@herbalmind.eu
Personal and Private Data
If you intend to create a user account (a so-called “Customer Account”) and use our services, you will be asked to provide us with your personal data. Your data is processed by us for the purposes indicated below, related to the functioning of the online store and the provision of individual functionalities within it.
Purposes and Legal Basis for Processing
We process your personal data that you provide when placing an order for our products via the online store operating at the internet address: https://herbalmind.eu or when registering a user account (a so-called “Customer Account”) operating within the herbalmind.eu online store, and if you consent to receive newsletter messages (in the form of e-mail correspondence).
Furthermore, we may process your personal data that you provide by sending us a message, filing a complaint, or withdrawing from a contract. We also process your bank account number from which you will make payments or to which we will issue refunds. In the case of issuing a VAT invoice, we additionally process the company name, residential address or business address, and NIP number.
In connection with the above, we will process your personal data for the purpose of:
• enabling you to place an order for goods available in the online store,
• enabling you to register a user account (a so-called “Customer Account”) within the online store,
• paying for the order, as mentioned above,
• performing the concluded sales contract regarding the goods distributed by us in the online store, including for the purpose of exercising consumer rights and for after-sales service of goods distributed by us and handling complaint claims,
• conducting direct marketing activities, consisting of sending non-public commercial information to your indicated e-mail address by electronic means of communication (a so-called newsletter), in accordance with the Act of 18 July 2002 on
the provision of electronic services (i.e., Journal of Laws of 2020, item 344), i.e., in the form of e-mail messages – if you have given separate consent for this,
• evaluating and analyzing your activity and information as a customer of the herbalmind.eu online store, including through automated processing of personal data (profiling), aimed at presenting general advertisements, offers, and promotions of the Administrator’s products or services tailored to your individual interests (without, however, causing any legal effects for you or significantly affecting your decisions), as well as for adapting the newsletter service (if you have given appropriate consent for non-public commercial information by electronic means of communication) and for market and statistical analyses.
Basis for Processing
The legal basis for processing your personal data is:
• Your consent for registering a user account (a so-called “Customer Account”) within the online store, i.e., Article 6(1)(a) of the GDPR;
• Your consent for conducting direct marketing activities, consisting of sending non-public commercial information to your indicated e-mail address by electronic means of communication; i.e., Article 6(1)(a) of the GDPR, and our legitimate interest in conducting marketing activities, i.e., Article 6(1)(f) of the GDPR.
• the sales contract for goods distributed by us in the online store, i.e., Article 6(1)(b) of the GDPR, processing is necessary for the conclusion and performance of a civil law contract;
• our legitimate interest consisting of proper customer service of the online store and correct performance of the given sales contract regarding the goods distributed by us in the online store, i.e., Article 6(1)(f) of the GDPR;
• our legitimate interest consisting of processing data for analytical and statistical purposes and for customer satisfaction surveys, and for presenting general advertisements, offers, and promotions of the Administrator’s products or services tailored to your individual interests (Article 6(1)(f) of the GDPR);
• our legal obligations related to the exercise of consumer rights related to our customers’ use of the online store, i.e., Article 6(1)(c) of the GDPR.
If you consent to participate in a non-public promotional campaign requiring separate registration, we will process your data provided on the basis of separate consent, i.e., on the basis of Article 6(1)(a) of the GDPR.
Profiling
Profiling in the herbalmind.eu online store involves the automatic analysis or prediction of an individual’s behavior on the online store’s website, e.g., by analyzing products added to the cart, viewing a specific product page in the online store, or by analyzing the history of purchases made in the store. The Administrator uses automated processing tools such as Klaviyo, Hotjar, or Google Analytics for processing users’ personal data in the aforementioned scope. With the help of these tools, the Administrator is able to assess personal factors concerning a specific user, and in particular to analyze or predict aspects concerning, among others, personal preferences, interests, or behavior.
The above activities are aimed at presenting general advertisements, offers, and promotions of the Administrator’s products or services tailored to your individual preferences, interests, or behaviors, as well as for adapting the newsletter service (if you have given appropriate consent for non-public commercial information by electronic means of communication) and for market and statistical analyses, i.e., their purpose is to conduct direct marketing activities. However, the forms of automatic analysis or behavior prediction used by the Administrator (i.e., forms of profiling) do not cause any legal effects for users or significantly affect users’ decisions, in particular, decisions regarding the conclusion or refusal to conclude a sales contract or the possibility of using other services via the herbalmind.eu online store are not made based on them.
Not in every case will the profiling activities described above be associated with the processing of personal data. The condition for such processing is that the Administrator possesses the personal data of the individual (user).
Categories of Personal Data
To the extent specified in point 3 above, personal data provided in the relevant forms for placing an order or creating a user account (i.e.: first name, last name, e-mail address or phone number, delivery address) or consent to receive direct marketing messages (newsletter) will be processed. In connection with the order fulfillment, we also process the bank account number, and in the case of issuing a VAT invoice, we additionally process the company name, residential address or business address, NIP number, and for marketing activities (i.e., first name, last name, e-mail address).
Personal Data Retention Period
We will store your personal data for the time necessary to perform the contract and settle accounts related to it, as well as for the period during which the parties to the contract are entitled to civil law claims (statute of limitations). To the extent that you have given us consent to process personal data, we will cease processing your personal data immediately after you withdraw your consent or at the latest after a 2-year period of inactivity on your part (no transactions within the online store, no response to our marketing messages), counted from the end of the calendar year in which the aforementioned 2-year period expires, unless circumstances indicated in the first paragraph of this point above apply. To the extent that we process your personal data based on our legitimate legal interest, we will cease processing your personal data immediately after receiving an objection from you to the processing of personal data or at the latest after a 2-year period of inactivity on your part (no transactions within the online store, no response to our marketing messages), counted from the end of the calendar year in which the aforementioned 2-year period expires, unless circumstances indicated in the first paragraph of this point above apply.
Recipients of Your Personal Data
We will transfer your personal data to our suppliers to whom we outsource services related to personal data processing, e.g., IT service providers, courier service providers, payment service providers, and other services. Such entities process data based on an agreement with us and only in accordance with our instructions.
Transfer of data outside the European Economic Area
If it is necessary due to services provided to the Administrator by third parties, as referred to in the paragraph above, we reserve the right to transfer your personal data to recipients located outside the European Economic Area and the European Union. We guarantee that the transfer will in each case comply with applicable personal data protection regulations and an adequate level of protection for your data will be ensured.
Your Rights Related to Personal Data Processing
You have the following rights related to the processing of personal data: the right to withdraw consent to the processing of your data for the purpose of creating and maintaining a user account (a so-called “Customer Account”) and for the purpose of conducting direct marketing activities, consisting of sending information to your indicated e-mail address
commercial communications by electronic means – your withdrawal of consent to the processing of your personal data:
• for marketing activities will mean that you will no longer receive non-public commercial information from us by electronic means of communication about products, services, and non-public campaigns aimed at adult consumers, and will mean the loss of any other rights provided for users who have consented to direct marketing activities,
• for maintaining a user account (a so-called “Customer Account”) will mean that you will not be able to use the above functionality within the online store and the loss of any other rights provided for users who have created a user account (a so-called “Customer Account”),
• the right to access your personal data,
• the right to request rectification of your personal data,
• the right to request erasure of your personal data – exercising the right to request erasure of your personal data will mean that:
• you will no longer receive non-public commercial information from us by electronic means of communication and the loss of any other rights provided for users who have consented to direct marketing activities,
• you will not be able to use the user account (a so-called “Customer Account”) within the online store and the loss of any other rights provided for users who have created a user account (a so-called “Customer Account”),
• the right to request restriction of processing of your personal data,
• the right to object to the processing of your data due to your particular situation – in cases where we process your data based on our legitimate interest,
• the right to data portability, i.e., the right to receive your personal data from us in a structured, commonly used, machine-readable format. You can transmit this data to another data controller or request that we transmit your data to another controller. However, we will only do so if such transmission is technically feasible. The right to data portability applies only to data that we process based on a contract with you or based on your consent.
To exercise the above rights, please contact us (contact details in point 1 above).
We are obliged to provide you with information about the actions taken in response to your requests, without undue delay, and in any case within one month of receiving the request.
Obligation to provide data.
The obligation to provide your personal data is voluntary, however, it is necessary to place an order within the online store and conclude a sales contract for goods available in the online store or to create a user account within the online store (a so-called “Customer Account”).
Giving consent for direct marketing activities, i.e., sending marketing information and materials, is voluntary and not required to place an order within the online store. However, giving it enables you to receive commercial information
by electronic means of communication and to be granted any other rights provided for users who have consented to direct marketing activities.
Creating a user account within the online store (a so-called “Customer Account”) is voluntary and not required to place an order within the online store. However, creating it enables you to use the above functionality within the online store and to obtain any other rights provided for users who have created a user account (a so-called “Customer Account”).
Furthermore, your lack of consent, depending on the purpose for which the data is provided, may result in:
• inability to register a user account in the online store;
• inability to use the online store’s services;
• inability to make purchases in the online store;
• inability to receive information about promotions or special offers available in the online store.
Right to withdraw consent.
To the extent that your data is processed by us solely based on consent – you have the right to withdraw consent to data processing at any time. Withdrawal of consent does not affect the lawfulness of processing carried out based on your consent before its withdrawal. You can withdraw consent by contacting us (contact details in point 1 above).
Right to lodge a complaint with a supervisory authority.
Furthermore, you also have the right to lodge a complaint with the supervisory authority dealing with personal data protection, i.e., the President of the Personal Data Protection Office, with its registered office at ul. Stawki 2 in Warsaw (postal code: 00-193).
Data Security When processing
Your personal data, we apply organizational and technical measures in accordance with relevant legal provisions, including using connection encryption with an SSL certificate.
