RODO

www.yagayaga.pl

§1 Identity of the data controller

1. The administrator of personal data provided when using the Website and/or the Online Store run under the name WWW.yagayaga.pl is Joanna Sitkiewicz, running a business under the name Yaga Yaga Handmade Joanna Sitkiewicz at ul. Broniewskiego 3, 42-520 Dąbrowa Górnicza.

NIP: 6292234310, REGON: 521889094.

2. The data is processed in accordance with the applicable law; i.e. Regulation of the European Parliament and of the EU Council 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: GDPR), the Act of May 10, 2018 on data protection, as well as the Act of July 18, 2002 on the provision of electronic services.

3. The following Privacy Policy covers the rules for processing data of Website Users, as well as persons concluding contracts with the Data Administrator, including those related to the execution of the Order in the Online Store, as well as data collected through contact with the Data Administrator (e-mail address or telephone) or correspondence traditional, as well as people who like and/or follow the Administrator's fanpage in social media, if he runs it.

§2 Definitions used

1. The following definitions apply in this policy:

2. a) Website/Shop - a website available at WWW.yagayaga.pl through which the User can: browse its content, place orders for products and goods

3. b) Personal data administrator - the entity that decides on the purpose and means of data processing, in this policy it is understood as: Yaga Yaga Handmade Joanna Sitkiewicz, Broniewskiego 3, 42-520 Dąbrowa Górnicza

c) User - a natural person to whom the data pertains and who uses the services available on the Website/Store. d) Personal data - any information that can lead to the identification of a natural person without excessive time and cost, including their identification, address and contact details. §3 Purposes of personal data processing

1. The Personal Data Administrator processes personal data only when it is permitted by the applicable law, including for the purpose of:

a) preparation and implementation of the concluded sales contract, including the conclusion of a distance contract via an online store to which the person is a party, as well as the implementation of the rights arising from it, and this processing takes place on the basis of art. 6 sec. 1 lit

b) GDPR,

b) documenting the performance of contracts, including issuing a bill or invoice for a natural person, keeping accounting and tax documentation, pursuant to art. 6 sec. 1 lit.

c) GDPR, i.e. in order to fulfill the legal obligations incumbent on the Administrator of personal data, pursuant to art. 70 of the Act of August 29, 1997, Tax Ordinance,

d) GDPR, i.e. taking action at the request of the data subject, including answering questions asked via electronic means of communication or in order to handle traditional correspondence, and this processing is carried out on the basis of art. 6 sec. 1 letter e) marketing of the Data Administrator's own products and services by traditional means, pursuant to art. 6 sec. 1 lit.

f) GDPR, i.e. in order to implement the legitimate interests of the data controller or the data subject, a) in order to send an e-mail requesting an assessment of the Store and/or Goods/Products, is carried out on the basis of art. 6 sec. 1 lit

g) GDPR, and the processing takes place for the legitimate purpose of the data controller (Seller), which is to improve the offer and/or the Goods/Product and/or the Store by collecting reliable opinions about them by the Store owner,

h) pursuing rights and claims by the Data Administrator or the data subject, pursuant to art. 6 sec. 1 lit

i) GDPR and takes place for a legally justified purpose.

2. Providing personal data is necessary in order to perform the contract concluded remotely, including the shipment of goods or making a digital product available and issuing an accounting document, pursuing claims, as well as answering questions. Providing personal data in the remaining scope is voluntary.

3. Failure to provide the required data makes it impossible to perform a remote contract, issue a bill or invoice or make contact at the request of the data subject.

§4 Ways of obtaining data

1. The User's personal data is collected directly from the data subjects, i.e. through:

a) registering an account in the Store,

b) providing data for the preparation and conclusion of the contract,

c) direct contact with the data controller using the contact details available on the website or in traditional form at the place of business. §5 Scope of processed data

1. The scope of processed personal data has been limited to the minimum necessary to provide services in the field of:

a) placing an order in the online store: name and surname, e-mail address, telephone number, delivery address, possibly the address of the collection point,

b) issuing a bill or invoice: name and surname or name of the entity, address of the registered office, tax identification number,

c) preparation and conclusion of the contract: name and surname, address, etc.

§6 Data processing period

1. The period of data processing depends on the purpose for which the data was collected and amounts to:

a) conclusion and performance of a sales contract, including distance sales - for the period necessary to document the contract, including issuing a bill or invoice - 5 years from the end of the calendar year in which the tax payment deadline expired, pursuant to art. 112 of the Act of March 11, 2004 on tax on goods and services, in connection with art. 70 of the Act of August 29, 1997 - Tax Ordinance,

b) in order to send commercial information by electronic means (newsletter) and/or set up an Account in the Store/send a request for opinion by external satisfaction survey services - until the consent is revoked, without affecting the compliance of the processing that was carried out before its revocation,

c) for the period necessary to answer the question asked via the contact form or by phone, but not longer than 6 months, unless the person decides to conclude a contract with the Personal Data Administrator,

d) in order to pursue claims, pursuant to the Act of Art. 118 of the Act of April 23, 1964 - Civil Code. Unless a special provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business - three years.

§7 Recipients of data

1. The User's personal data may be entrusted to other entities in order to perform services at the request of the data administrator, in particular entities in the field of:

a) service and maintenance of IT systems in which data is processed, including for the purpose of newsletter automation, invoicing, order processing, etc.,

b) keeping accounting services,

c) providing office services,

d) courier services broker,

e) dropshipping and/or logistics services for orders.

2. The User's personal data may also be made available to entities supporting the data controller, including entities providing courier and postal services, online payment services.

3. The User's personal data is not transferred to third countries or international organizations.

§8 Fanpage of the Data Administrator in social media

1. The Data Administrator is also a co-administrator of the data of his followers in social media - especially people who use electronic means of communication on the fanpage - Facebook - @yagayagahandmade and / or Instagram under the account name @yagayagahandmade, run by the Data Administrator on these websites social.

2. In the remaining scope, the administrator of data of Users of these social networking sites is Meta Platforms Ireland Limited (formerly: Facebook Inc., with its registered office at 1 Hacker Way, Menlo Park, CA 94025, USA), and the processing of this data is carried out on the terms described in the regulations and privacy policies of users of these websites, including: https://www.facebook.com/privacy

3. Personal data of the User who likes and/or follows the Administrator's fanpage in social media will be processed outside the European Economic Area in the so-called a third country, in particular in the United States of America in connection with the use of IT solutions whose servers are located outside the European Economic Area.

6. The basis for data processing in third countries will be the decision of the European Commission 2021/914 on standard contractual clauses regarding the transfer of personal data to third countries. The data administrator and the service provider will provide the highest guarantees for the protection of entrusted data. Data processing will not violate the privacy of individuals.