I. General provisions

1. This Privacy Policy sets out how the personal data of Users necessary for the provision of services by electronic means through the salonfoto.com website (hereinafter: the Website) is collected, processed and stored.
2. The Website collects only the personal data necessary to provide and develop the services offered on it.
3. Personal data collected through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR), and with the Polish Personal Data Protection Act of 10 May 2018.

II. Data Controller

The controller of the personal data collected through the Website is Salonfoto.com Sandra Domogała, address: al. Niepodległości 87 lok. 37, 43-100 Tychy, Poland, NIP (tax ID): 6462681150, REGON: 384735385, e-mail address: salonfoto+rodo@gmail.com (hereinafter: the Controller).

III. Purpose of collecting personal data

1. Personal data is used for the purpose of:
   • registering an account and verifying the User’s identity,
   • enabling login to the Website,
   • performing the contract for services and e-services,
   • communicating with the User (live chat, contact form, etc.)
   • sending the newsletter (once the User has consented to receiving it),
   • operating the comment system,
   • providing social features,
   • promoting the Controller’s offer,
   • marketing, remarketing, affiliation,
   • personalising the Website for Users,
   • analytical and statistical activities,
   • debt collection,
   • establishing and pursuing claims or defending against them.
2. Providing data is voluntary, but necessary to conclude a contract or to use other functionalities of the Website.

IV. Type of personal data processed

The Controller may process the following personal data of the User: first name and surname, date of birth, residential address, e-mail address, telephone number, NIP (tax ID).

V. Period of personal data processing

Users’ personal data will be processed for the following period:

• where the basis for processing is the performance of a contract – until the claims arising after its performance become time-barred,
• where the basis for processing is consent – until that consent is withdrawn, and after its withdrawal until the claims become time-barred.

In both cases the limitation period is 6 years, and for claims for periodic payments and claims relating to the conduct of business activity it is 3 years (unless a specific provision states otherwise).

VI. Sharing personal data

1. Users’ personal data may be transferred to: entities affiliated with the Controller, its subcontractors, entities cooperating with the Controller, e.g. companies handling e-payments, companies providing courier or postal services, law firms.
2. Users’ personal data will not be transferred outside the European Economic Area (EEA).

VII. Users’ rights

1. A User of the Website has the right to: access the content of their personal data, rectify it, erase it, restrict its processing, transfer it, object to its processing, and withdraw consent at any time (which does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal).
2. A notification that the User is exercising one of the rights listed above should be sent to salonfoto+rodo@gmail.com.
3. The Controller shall comply with the request or refuse to comply with it without undue delay, within one month of receiving it at the latest.
4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing infringes their rights and freedoms (GDPR).

VIII. Cookies

1. The Website collects information using cookies: session cookies, persistent cookies and third-party cookies.
2. The collection of cookies supports the correct provision of services on the Website and serves statistical purposes.
3. The User may define the extent of cookie access to their device in their browser settings.

IX. Automated decision-making and profiling

1. Users’ data may not be processed in an automated manner in such a way that any decisions could be taken in relation to them as a result.
2. Users’ data may be profiled in order to tailor content and personalise the offer, once they have given their consent.

X. Final provisions

1. The Controller has the right to make changes to the Privacy Policy, provided that Users’ rights are not restricted.
2. Information about the changes made will appear in the form of a notice available on the Website.
3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and Polish law shall apply.