The data controller is BOX4YOU Limited Liability Company (KRS 0001148360, NIP 5273145970, REGON 540620138). Registered office address: Grzybowska 87, 00-844 Warsaw, Poland. You can contact BOX4YOU in writing at the address indicated above or via email at: biuro@box4you.com.pl.
1. BOX4YOU Limited Liability Company has not appointed a Data Protection Officer.
2. The Privacy Policy constitutes an integral part of the Terms and Conditions. By using the services we offer, you entrust us with your information. This document is intended solely to help you understand what information and data are collected, for what purpose, and how they are used. This data is very important to us, which is why we kindly ask you to carefully read this document, as it defines the principles and methods of processing and protecting personal data. This document also sets out the rules for the use of “Cookies.”
3. We hereby inform you that we comply with the principles of personal data protection and all legal regulations provided for by the Personal Data Protection Act, as well as Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).
4. At the request of the person whose personal data is being processed, we provide comprehensive information on how we use their personal data. We always strive to clearly inform about the data we collect, how we use it, the purposes it serves and to whom it is disclosed, the protection we provide for such data when shared with other entities, as well as information about the institutions to contact in case of any doubts.
- We respect your privacy. We want to ensure your comfort while using our services.
- We value the trust you place in us by providing your personal data for the purpose of delivering our services. We always use personal data fairly and in a way that does not compromise your trust, only to the extent necessary to provide the services.
- As a User, you have the right to receive complete and clear information about how we use your personal data and for what purposes it is necessary. We always provide transparent information about the data we collect, how and to whom we disclose it, as well as details about the entities to contact in case of any doubts.
- In case of any doubts regarding our use of your personal data, we will immediately take action to clarify and resolve such concerns. We provide comprehensive answers to all related questions.
- We will take all reasonable measures to protect your data from improper and uncontrolled use.
- The legal basis for processing your personal data is:
- Art. 6(1)(a) – the data subject has given consent to the processing of their personal data for one or more specific purposes.
- Art. 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
- Art. 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
- Art. 6(1)(d) – processing is necessary in order to protect the vital interests of the data subject or of another natural person.
- Art. 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Art. 6(1)(f) – processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
- Your personal data related to the conclusion and performance of the contract will be processed for the duration of its performance, as well as for a period not longer than provided for by law, including the provisions of the Civil Code and the Accounting Act, i.e. no longer than 10 years from the end of the calendar year in which the last contract was performed.
- Your personal data processed for the purpose of concluding and performing future contracts will be processed until an objection is raised.
- You have the right to: access your personal data and obtain a copy of the personal data being processed; rectify your inaccurate data; request the erasure of data (the right to be forgotten) in circumstances provided for in Article 17 of the GDPR; request the restriction of data processing in cases specified in Article 18 of the GDPR; object to the processing of data in cases specified in Article 21 of the GDPR; and transfer the data you have provided, processed in an automated manner.
- If you believe that your personal data is being processed unlawfully, you may lodge a complaint with the supervisory authority (Personal Data Protection Office, ul. Stawki 2, Warsaw). If you need additional information regarding personal data protection or wish to exercise your rights, please contact us by mail at the correspondence address.
- We comply with all applicable laws and regulations regarding data protection and will cooperate with data protection authorities as well as law enforcement agencies authorized to do so. In the absence of data protection regulations, we will act in accordance with generally accepted data protection principles, principles of social conduct, and established practices.
- If you have any questions, please contact us through the website from which you were redirected to this Privacy Policy. Your request for contact will be promptly forwarded to the appropriate designated person.
- To help us respond or address the information provided, we kindly ask you to include your first and last name.
§ 3 Scope and Purpose of Personal Data Collection
- We process the necessary personal data for the purpose of providing services and for accounting purposes only. 2. We collect, process, and store the following user data:
- first and last name,
- residential address,
- correspondence address (if different from residential address),
- tax identification number (NIP),
- email address,
- telephone number (mobile, landline),
- information about the web browser used,
- other personal data voluntarily provided to us.
- Providing the above data is entirely voluntary, but also necessary for the full provision of services.
- We may transfer personal data to servers located outside your country of residence or to affiliated entities, third parties based in other countries, including countries within the EEA (European Economic Area – a free trade zone and Common Market comprising the European Union member states and the European Free Trade Association, EFTA), for the purpose of processing personal data by such entities on our behalf in accordance with this Privacy Policy and applicable laws, practices, and data protection regulations.
- Entities that may have access to your data are those providing services necessary for operating the website, such as:
- Hosting companies providing hosting or related services for the Controller
- Companies through which the Newsletter service is provided
- IT service and support companies performing maintenance or responsible for maintaining the IT infrastructure
- Companies intermediating online payments for goods or services offered within the Website (in the case of making purchase transactions on the Website)
- Companies intermediating mobile payments for goods or services offered within the Website (in the case of making purchase transactions on the Website)
- Companies responsible for the Controller’s accounting (in the case of making purchase transactions on the Website)
- Companies responsible for delivering physical products to the User (postal/courier services in the case of making purchase transactions on the Website)
- Cookies or similar technologies (hereinafter collectively referred to as “cookies”) are used, which should be understood as IT data, in particular text files, intended for the use of a website and stored on the end devices of Users browsing the site. Information collected through cookies allows services and content to be tailored to the individual needs and preferences of users, as well as being used to develop general statistics on users’ use of the site. Data collected using cookies is gathered solely for the purpose of performing specific functions for Users and is encrypted in a way that prevents unauthorized persons from accessing it.
- We use cookies on our website:
- Internal cookies – files placed and read from the User’s Device by the Service’s ICT system.
- External cookies – files placed and read from the User’s Device by the ICT systems of external services. Scripts of external services that may place cookies on the User’s Devices have been deliberately included in the Service through scripts and services made available and installed within the Service.
- Session cookies – files placed and read from the User’s Device by the Service during a single session of the given Device. After the session ends, the files are deleted from the User’s Device.
- Persistent cookies – files placed and read from the User’s Device by the Service until they are manually deleted. The files are not automatically deleted after the Device’s session ends, unless the User’s Device configuration is set to delete cookies after the session ends.
- On our website, the following types of cookies are used, depending on their necessity for the provision of services:
- Necessary cookies, enabling the use of services available on the website, in particular authentication cookies used for services requiring authentication;
- Security cookies, used in particular to detect authentication abuses;
- Performance cookies, enabling the collection of information on how websites are used;
- Functional cookies, allowing the “remembering” of user-selected settings and personalization of the user interface;
- Advertising cookies, enabling the delivery of advertising content tailored to users’ interests.
- Web browsing software (web browser) usually allows cookies to be stored on the end device by default. A User browsing the website may independently and at any time change the settings regarding cookies, specifying the conditions for their storage and access by cookies to their device. The changes referred to in the previous sentence can be made by the Client using the settings of the web browser. In particular, these settings may be changed in such a way as to block the automatic handling of cookies in the web browser settings or to inform each time cookies are placed on the User’s device. Detailed information on the possibilities and ways of handling cookies is available in the settings of the software (web browser).
- Using the website without changing cookie settings means consent to the storage of cookies. The Client may always withdraw consent by changing the cookie settings. Information on how to configure cookie settings in selected web browsers can be found here:
- Chrome
- Opera
- Firefox
- Edge
- Safari
- Internet Explorer 11
- So-called social media plug-ins may be present on our website.
- Facebook is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. To view Facebook plug-ins, go to: https://developers.facebook.com/docs/plugins
- Twitter is operated by Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. To view Twitter plug-ins, go to: https://dev.twitter.com/web/tweet-button
- The plug-in transmits to its provider only information about which of our websites you have accessed and at what time. If, while viewing or staying on our website, the user is logged into their account on, for example, Facebook or Twitter, the provider is able to link your interests, information preferences, and other data obtained, for instance, by clicking the Like button, leaving a comment, or entering a profile name in searches. Such information will also be transmitted directly to the provider by the browser. To prevent the plug-in from recording your visit on the selected user account while on our website, you must log out of your account before starting to browse our website.
§ 6 Rights and Obligations
- We have the right, and in cases specified by law also the legal obligation, to provide selected or all information regarding personal data to public authorities or third parties who submit such a request for information on the basis of applicable Polish law.
- The User has the right to:
- Access to personal data – The User has the right to obtain access to their personal data, exercised upon request submitted to the Controller.
- Rectification of personal data – The User has the right to request the Controller to promptly rectify any inaccurate personal data and/or complete incomplete personal data, exercised upon request submitted to the Controller.
- Erasure of personal data – The User has the right to request the Controller to promptly erase personal data, exercised upon request submitted to the Controller. In the case of user accounts, data erasure consists of anonymizing data that enables identification of the User. The Controller reserves the right to withhold the execution of a data erasure request in order to protect the Controller’s legitimate interest (e.g., when the User has violated the Terms and Conditions or data was obtained as a result of correspondence). For the Newsletter service, the User may delete their personal data independently by using the link included in each email message sent.
- Restriction of personal data processing – The User has the right to restrict the processing of personal data in cases specified in Article 18 of the GDPR, including contesting the accuracy of personal data, exercised upon request submitted to the Controller.
- Data portability – The User has the right to obtain from the Controller personal data concerning them in a structured, commonly used, machine-readable format, exercised upon request submitted to the Controller.
- Objection to the processing of personal data – The User has the right to object to the processing of their personal data in cases specified in Article 21 of the GDPR, exercised upon request submitted to the Controller.
- Lodging a complaint – The User has the right to lodge a complaint with the supervisory authority responsible for personal data protection.
