Privacy Policy

Privacy policy for customers of Zagatto online store

Administrator's data

We kindly inform you that the administrator of your personal data is PJ TEKSTIL Sp. z o.o. with its registered office at Litewska 12, 71-344 Szczecin, using the NIP number 8513171403, hereinafter referred to as “Zagatto”. Contact with Zagatto regarding personal data protection is possible at the following e-mail address: kontakt@zagatto.pl.

Purposes and grounds for processing personal data

In order to process orders in accordance with the scope of our business, Zagatto processes your personal data - for various purposes, but always in accordance with the law. Below you will find the specified purposes of processing your personal data, along with the legal basis.

In order to conclude and perform a contract, we process such personal data as:

Name
Address
E-mail address
Phone number

The legal basis for such processing is Article 6(1)(b) of the RODO, which allows us to process personal data if they are necessary for the performance of the contract or for taking steps to conclude the contract; if you choose to provide your name as well, we consider that you have given your consent to process your name as well, in which case the legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent.

In order to process a complaint, we process such personal data as:

name (if provided),
e-mail address,
Phone number
possibly residential address - if a refund is made,
possibly bank account number - if a refund is made.

The legal basis for such processing is Article 6(1)(b) of the RODO, which allows us to process personal data if it is necessary for the performance of a contract or taking steps to conclude a contract; if you choose to provide your name as well, we consider that you have given your consent to process your name as well - then the legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent.

For the purpose of sending e-mail notifications about messages in the customer panel, we process such personal data as:

e-mail address,

The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows processing personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to inform the customer about activities related to the implementation of the service in order to increase the comfort of the service).

In order to contact us by phone on matters related to the implementation of the service, we process such personal data as:

telephone number,

— insofar as you are interested in the form of telephone contact (we do not require mandatory provision of a telephone number, except for the purpose of processing an order). The legal basis for such data processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent.

In order to send sms notifications about messages in the customer panel, we process such personal data as:

telephone number,

— insofar as you are interested in receiving such notifications (we do not require a mandatory telephone number, except for the purpose of processing an order). Text messages sent do not contain any marketing content. The legal basis for such data processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent.

In order to issue an invoice and fulfill other obligations under tax law, such as keeping accounting records for 5 years, we process such personal data as:

name,
company,
residential or business address,
tax identification number,
order number.

The legal basis for such processing is Article 6(1)(c) of the RODO, which allows us to process personal data if such processing is necessary for the Data Controller to comply with its obligations under the law.

In order to store unpaid inquiries, we process such personal data as:

name,
email address,

— as it may happen that you decide to use the service some time after receiving the quote. The legal basis for such processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to enable the conclusion of a contract for a certain period of time without having to repeat the quote).

In order to survey satisfaction with the services offered, we process such personal data as:

email address,

The legal basis for such processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to learn about customers' opinions on the services provided in order to tailor them to the needs and expectations of those interested).

In order to create records and registers related to the RODO, including, for example, a register of customers who have objected in accordance with the RODO, we process such personal data as:

name,
email address,

because firstly, the RODO regulations impose certain documentation obligations on us to demonstrate compliance and accountability, and secondly, if you object, for example, to the processing of your personal data for marketing purposes, we need to know against whom not to use direct marketing because they do not wish it.

The legal basis for such processing is, first, Article 6(1)(c) of the RODO, which allows us to process personal data if such processing is necessary for the Data Controller to comply with its obligations under the law; second, Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Data Controller pursues its legitimate interest (in this case, the Company's interest is to know about individuals who are exercising their rights under the RODO).

In order to provide a discount (after giving consent under the provisions on the provision of electronic services), we process such personal data as:

name,
gender,
email address.

The legal basis for such data processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent.

For the purpose of establishing, investigating or defending against claims, we process such personal data as:

name (if name has been provided) or possibly company,
residential address (if provided),
PESEL number or NIP number (if provided),
e-mail address,
IP,
order number.

The legal basis for such processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to have personal data to establish, assert or defend against claims, including those of customers and third parties).

For archival and evidentiary purposes, we process such personal data as:

name (if provided),
e-mail address,
order number

— for the purpose of securing information that can be used to prove facts of legal significance. The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows us to process personal data if by doing so the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to have personal data to prove certain facts related to the performance of services, e.g. when some state authority requests it).

For analytical purposes, i.e. researching and analyzing activity on the website belonging to the Company, we process such personal data as:

date and time of website visit,
type of operating system,
approximate location,
type of web browser used to view the site,
time spent on the site,
sub-pages visited,
the subpage where the contact form was filled out.

The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows us to process personal data if, by doing so, the Personal Data Controller pursues its legitimate interest (in this case, the Company's interest is to learn about customer activity on the website).

In order to use cookies on the website, we process such textual information (cookies will be described in a separate section). The legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent (the first time you access the website, you are asked to consent to the use of cookies).

In order to administrate the website, we process such personal data as:

IP address,
date and time of the server,
web browser information,
information about the operating system

— these data are recorded automatically in the so-called server logs every time you use a website belonging to the Company. Administration of the website without the use of the server and without this automatic recording would not be possible. The legal basis for such data processing is Article 6(1)(f) of the RODO, which allows personal data to be processed if, by doing so, the Personal Data Administrator pursues its legitimate interest (in this case, the Company's interest is the administration of the website);

In order for you to post a comment on the website under a published article, we process personal data such as:

name or nickname,
IP number.

The legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent (in this case, we assume that posting a comment is a simultaneous consent to the processing of personal data).

In order for you to post an opinion about the services, we process such personal data as:

first name, possibly surname,
occupation,
age.

The legal basis for such processing is Article 6(1)(a) of the RODO, which allows us to process personal data on the basis of voluntarily given consent (in this case, we assume that posting an opinion is a simultaneous consent to the processing of personal data).

Cookies

Zagatto on its website, as well as other entities, uses so-called cookies, which are short text information stored on your computer, phone, tablet or other device. They can be read by our system, as well as by systems belonging to other entities whose services we use (e.g. Facebook, Google).
Cookies perform a great many functions on the website, most often useful, which we will try to describe below (if the information is insufficient, please contact us):

providing security - cookies are used to authenticate users and prevent unauthorized use of the customer panel. Thus, they are used to protect the user's personal information from unauthorized access;
Influence on the processes and efficiency of the use of the website - cookies are used to make the website run smoothly and to be able to use the functions available on it, which is possible, among other things, by remembering your settings between visits to the website. Thanks to them, therefore, you can efficiently navigate the website and individual subpages;
session status - cookies often store information about how visitors use the website, such as which subpages they view most often. They also make it possible to identify errors displayed on certain subpages. Cookies for storing so-called “session state” therefore help to improve services and enhance the browsing experience;
Maintaining session state - if a customer logs in to their panel, cookies enable the session to be maintained. This means that when you go to another subpage, you do not have to re-enter your login and password each time, which promotes the comfort of using the website;
creation of statistics - cookies are used to analyze how users use the website (how many open the website, how long they stay on it, which content arouses the most interest, etc.). This allows us to continuously improve the website and adapt its operation to users' preferences. We use Google's tools, such as Google Analytics, to track activity and generate statistics; in addition to reporting website usage statistics, the Google Analytics pixel can also be used, along with some of the cookies described above, to help display more relevant content to you on Google's services (e.g., Google Search) and across the web;
use of social features - we have a so-called Facebook pixel on the website, which allows you to like our fanpage on this service while using the website. However, for this to be possible, we need to use cookies provided by Facebook.

Importantly, many cookies are anonymized for us - without additional information, we are unable to identify your identity based on them.
Your web browser allows the use of cookies on your device by default, so we ask you to agree to the use of cookies on your first visit. However, if you do not wish to use cookies when browsing the website, you can change the settings in your web browser - completely block the automatic handling of cookies or request notification whenever cookies are placed on your device. You can change your settings at any time.
While respecting the autonomy of everyone who uses the website, we feel obliged to warn you that disabling or restricting the use of cookies may result in quite serious difficulties in using the website, such as having to log in to every subpage, longer loading times, restrictions on the use of functionality, restrictions on liking the Facebook page, etc.

Right to withdraw consent

If the processing of your personal data is based on consent, you may withdraw this consent at any time - at your own discretion.
If you would like to withdraw your consent to the processing of personal data, to do so, it is sufficient:

send an email directly to Zagatto at info@zagatto.pl or
delete the posted comment under the article or
delete a posted service review.

If the processing of your personal data was carried out on the basis of your consent, revoking it does not make the processing of your personal data illegal up to that point. In other words, we have the right to process your personal data until you revoke your consent, and revoking it does not affect the legality of previous processing.

Requirement to provide personal data

The provision of any personal data is voluntary and at your discretion. However, in some cases, the provision of certain personal data is necessary to meet your expectations for the use of the online store.
In order to place an order, it is necessary to provide your name, surname, address, telephone number and e-mail address - without this we are unable to conclude and execute the contract.
In order to make a complaint, it is necessary to provide your name, address, telephone number and e-mail address - without this we are not able to process the complaint.
In order for you to be able to receive an invoice for the services, it is necessary to provide all the data required by tax law, and therefore your name or company name, home or business address, tax ID number - without this we are unable to properly issue an invoice.
In order to be able to contact you by phone on matters related to the implementation of the service, it is necessary to provide a telephone number - without this we are unable to make telephone contact.
If you wish to receive SMS notifications about messages in the customer panel, it is necessary to provide a phone number - without this we are unable to send messages.
If you wish to receive discounts on future services, it is necessary to provide your name and email address - without this we are unable to send discount codes.

Automated decision-making and profiling

We kindly inform you that we do not perform automated decision-making, including based on profiling. The content of the inquiry that is sent via the contact form is not evaluated by the computer system. The proposed price of the service is in no way the result of an evaluation by any information system.

Recipients of personal data

Like most entrepreneurs, in our business we use the assistance of other entities, which sometimes involves the transfer of personal data. Therefore, if necessary, we transfer your personal data to our cooperating employees who perform services, companies that handle prompt payments, an accounting firm, a hosting company, as well as an insurance company (should there be a need to repair a claim).
In addition to this, it may happen that, for example, on the basis of a relevant legal provision or a decision of a competent authority, we will also have to transfer your personal data to other entities, whether public or private. Therefore, it is extremely difficult for us to predict who may come forward with a request for personal data. Nevertheless, for our part, we assure you that we analyze each case of request for sharing personal data very carefully and very thoroughly, so that we do not inadvertently provide information to an unauthorized person.

Transfer of personal data to third countries

1. Like most businesses, we use a variety of popular services and technologies offered by entities such as Facebook, Microsoft, Google. These companies are based outside the European Union, and are therefore considered third countries under the RODO.

2.The RODO imposes certain restrictions on the transfer of personal data to third countries, because since European laws do not apply there, as a rule, the protection of personal data of EU citizens may unfortunately be insufficient. Therefore, each controller of personal data is required to establish the legal basis for such transfers.

3.For our part, we assure you that when using our services and technologies, we transfer personal data only to entities in the United States and only to those that have joined the Privacy Shield program, based on the European Commission's Executive Decision of July 12, 2016. - You can read more about this on the European Commission's website, available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have joined the Privacy Shield program guarantee that they will comply with the high data protection standards that apply in the European Union, so the use of their services and offered technologies in the processing of personal data is lawful.

4.We will provide you with additional explanations at any time regarding the transfer of personal data, especially if the issue is of concern to you.

5. At any time you have the right to obtain a copy of personal data transferred to a third country.

Period of processing of personal data

In accordance with applicable laws, we do not process your personal data “indefinitely”, but for the time that is necessary to achieve the stated purpose. After this period, your personal data will be irreversibly deleted or destroyed.
In situations where we do not need to perform operations on your personal data other than storing them (e.g., when we store the contents of an order for the purpose of defending against claims), until the moment of permanent deletion or destruction we additionally secure them - by hashing the collections. It consists in securing personal data, or a set of personal data, in such a way that it cannot be read without an additional key, and therefore such information becomes completely useless to an unauthorized person.
Regarding the specific processing periods for personal data, we kindly inform you that we process personal data for the period of:

- the duration of the contract - with regard to personal data processed for the purpose of concluding and performing the contract;

- 6 years - with regard to personal data processed for the purpose of establishing, asserting or defending claims (the length of the period depends on whether both parties are entrepreneurs or not);

- 5 years - for personal data involving compliance with tax law obligations;

- until the withdrawal of consent or the achievement of the purpose of processing, but for no longer than 6 years - with regard to personal data processed on the basis of consent;

- until an effective objection is raised or the purpose of the processing is achieved, but for no longer than 6 years - with respect to personal data processed on the basis of the legitimate interests of the Personal Data Administrator or for marketing purposes;

- until obsolete or no longer useful, but for no longer than 3 years - for personal data processed primarily for analytical purposes, use of cookies and website administration.

We count the periods in years from the end of the year in which we began processing personal data to streamline the process of deleting or destroying personal data. Counting the period separately for each contract entered into would involve significant organizational and technical difficulties, as well as a significant financial outlay, so establishing a single date for the deletion or destruction of personal data allows us to manage the process more efficiently. Of course, in the event that you exercise your right to forget, such situations are considered on a case-by-case basis.
The additional year associated with the processing of personal data collected for the performance of a contract is dictated by the fact that, hypothetically, you may make a claim moments before the expiration of the statute of limitations, the demand may be served with a significant delay, or you may misstate the statute of limitations for your claim.In accordance with applicable laws, we do not process your personal data “indefinitely”, but for the time that is needed to achieve the stated purpose. After this period, your personal data will be irreversibly deleted or destroyed.

Rights of data subjects

We kindly inform you that you have the right to:

access to your personal data;
rectification of your personal data;
erasure of your personal data;
restriction of the processing of your personal data;
object to the processing of your personal data;
portability of personal data.

We respect your rights under data protection laws and strive to facilitate the exercise of these rights to the greatest extent possible.
We point out that the rights listed are not absolute, and therefore we may lawfully refuse you in certain situations. However, if we refuse to grant a request, it is only after careful consideration and only in situations where denial of the request is necessary.
Regarding the right to object, we explain that you have the right to object at any time to the processing of personal data on the basis of legitimate interests of the Personal Data Controller (these are listed in Section III) in connection with your particular situation. However, you must keep in mind that, in accordance with the regulations, we may refuse to consider your objection if we demonstrate that:

there are legitimate grounds for processing that override your interests, rights and freedoms, or
there are grounds for establishing, asserting or defending claims.

In addition, you may object at any time to the processing of your personal data for marketing purposes. In such a situation, upon receipt of your objection, we will cease processing for this purpose.
You may exercise your rights by:

sending an email directly to Zagatton address info@zagatto.pl or

We respect your rights under data protection laws and strive to facilitate their exercise to the greatest extent possible.

We point out that the enumerated rights are not absolute and, therefore, we may lawfully refuse you in certain situations. However, if we refuse to grant a request, it is only after careful consideration and only in situations where denial of the request is necessary.

Regarding the right to object, we explain that you have the right to object at any time to the processing of personal data on the basis of legitimate interests of the Personal Data Controller (these are listed in Section III) in connection with your particular situation. However, you must keep in mind that, in accordance with the regulations, we may refuse to consider your objection if we demonstrate that:

there are legitimate grounds for processing that override your interests, rights and freedoms, or
there are grounds for establishing, asserting or defending claims.
In addition, you may object at any time to the processing of your personal data for marketing purposes. In such a situation, upon receipt of your objection, we will cease processing for this purpose.

Right to file a complaint

If you believe that your personal data is being processed in violation of applicable law, you may file a complaint with the President of the Office for Personal Data Protection.

Final regulations

To the extent not regulated by this Privacy Policy, the data protection regulations shall apply.
You will be notified by e-mail about any changes made to this Privacy Policy.
This Privacy Policy is effective as of May 25, 2018.