2. Primary goal S&T as the administrator of personal data of Guests, Customers and Suppliers, is to ensure privacy protection at a level at least corresponding to the standards set out in applicable legal regulations, in particular regarding:

• personal data protection – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (general regulation on data protection)
• provision of electronic services – the Act of 18 July 2002 on the provision of electronic services,
• protection of consumer rights – Act of 30 May 2014 on consumer rights.

3. In connection with the above, as well as in order to provide the persons whose data is processed by S&T access to information related to the protection of privacy, S&T has developed and adopted this privacy policy document. The document contains information regarding in particular:

• processing of personal data, including their acquisition and storage by S&T, 
• how to use personal data and other data collected in connection with the use of the Website,
  visiting Social Media, communicating via Instant Messaging or e-mail, as well as concluding with S&T and performance of contracts for the provision of electronic services, contracts for the sale of Goods or other contracts concluded by S&T with customers or suppliers,
• sharing personal data with other entities,
• obtain access to personal data and their modification and deletion,
• security of personal data and information processing,
• the period of personal data storage.

4. S&T collects personal data from Guests, Customers and Suppliers:

• when these persons and entities browse and use the content of the Website or Social Media as information: Transferred S&T directly by these persons/entities, including information provided when placing Orders on the Website, visiting and using Social Media (including, among others, tagging content posted by S&T as liked or commenting on them), exchanging correspondence via e-mail and instant messengers or obtained and collected by S&T when using the Services made available via the Website or Social Media, in particular regarding: the manner of using the Services, the Internet protocol used, the IP address, data on the operation of the device that is used to use the Services, as well as failures, IT systems activity, settings hardware, browser type and language, dates and times of requests sent and referring URLs, “cookies”,
• when communicating with S&T via e-mail or via instant messengers,
• in the course of negotiating and concluding contracts with Customers and Suppliers

The method, scope and purposes of personal data processing

1. S&T processing, i.e. collects, stores and analyzes personal data for the following purposes:

• conclusion and performance of concluded contracts (Article 6(1)(b) of the GDPR), including contracts for the provision of electronic services, contracts for the sale of Goods and contracts with Suppliers. This applies in particular to contacting Guests, Customers and Suppliers in connection with negotiating and concluding and performance of the Agreements, including providing information and handling inquiries, complaints, as well as pursuing claims and defending against claims arising from the Agreements,
• fulfillment of the obligations imposed on S&T obligations arising from legal provisions, in particular regarding the processing of data for tax and accounting purposes (Article 6(1)(c) of the GDPR) and ensuring the accountability of personal data protection, i.e. the possibility of demonstrating that: personal data is processed in accordance with the law, fairly and in a transparent manner for the person to whom it relates, the purpose of data processing is clearly defined, the processed data is adequate, relevant, limited only to the purposes related to their processing, personal data is correct and updated if necessary, personal data is processed in a way that ensures their security and the storage of data is limited to the strict minimum necessary to achieve the purposes for which they are processed,
• consent (Article 6(1)(a) of the GDPR) to the extent that obtaining consent is required by applicable law for data processing activities based on “cookies”, as well as in the field of direct marketing of services provided by S&T,
• implementation of legitimate interests S&T (Article 6(1)(f) of the GDPR), such as: conducting direct marketing of services provided by S&T including contacting Guests, Customers and Suppliers for purposes related to permitted marketing activities via e-mail or telephone, monitoring the activity of Visitors on the Website and in Social Media, resulting from the policy used byS&T Cookies policy for the purpose of: ensuring the security of the Services that are provided by S&T under concluded contracts for the provision of electronic services, including enforcing compliance with the internal rules of the Website and Social Media and preventing any abuse and ensuring traffic safety on the Website, optimizing the content and operation of the Website, performing statistical analyses, obtaining information on the range and interaction rates on the website, conducting satisfaction surveys of Guests, Customers and Suppliers, in terms of e.g. satisfaction with the results of the services provided or the Goods sold based on the concluded contract,

2. In cases where it is necessary for the provision of services by S&T or constitutes a legitimate interest S&T – is entitled to automatically obtain and record data provided by Guests, Customers and Suppliers, in particular data transferred to the server by web browsers or devices through which Guests gain access to the Website or Social Media. These data include: parameters and identification numbers of the software and hardware used, pages viewed, information on the use of the Website or other resources, as well as other data on devices and the use of systems. The collection of the above-mentioned information will take place in particular when the Visitor uses the Website or Social Media. The way S&T uses this type of technology, it is described in more detail in the “Cookies” policy, available on the Website.
   
3. S&T may perform profiling, i.e. automated processing of personal data of Guests, Customers and Suppliers in order to conclude about their characteristics. Profiling is used when it is necessary to perform certain services, as well as to improve the quality of the services offered and for marketing purposes.S&T however, it does not make any automated decisions based on profiling that could cause any legal effects or similarly significantly affect the scope of rights and obligations of data subjects.

Sharing and transferring data to third parties and to third countries

1. S&T maybe:

• entrust the data of the Persons to third parties that participate in the provision of services or support the implementation of obligations S&T resulting from contracts concluded with these Persons (or entities represented by these Persons) or for their benefit,
• share data with third parties: when it is allowed by the generally applicable provisions of law – for the purposes and on the terms resulting from these provisions, or with the consent of the Persons. This applies in particular to: Internet service providers, server rooms, IT companies, telecommunications companies, to the extent that these entities participate in the provision of services to Persons (entrusting personal data), third parties, e.g. specialized providers of data storage services, analytical services, in order to provide services by these entities toS&T, marketing, consulting or audit supporting companies S&T in conducting business and in the provision of electronic services, as well as in the provision of website and application development services, as well as branding and marketing (entrusting personal data).

2. In the case of entrusting personal data, third parties to whom the data is entrusted are not authorized to use the personal data of the Persons for their own purposes – the data will be processed on behalf of and for the purposes of S&T – and the actions of third parties are subject to the provisions of applicable law and this Privacy Policy. Entrusting data to another entity takes place in each case to the smallest possible extent, both in terms of the scope of data processed, as well as in terms of the scope of permissible data processing activities.
   
3. In the case of entrusting personal data to entities such as e.g. a bank that participate in the process related to the execution of payments under concluded contracts or arising from the obligations of Persons towards S&T (if provided), upon completion of the transaction, these entities – pursuant to applicable regulations – become administrators of the personal data of the Persons, processing their data on their own behalf and for their own needs. The administrators of the personal data of the Persons processing this data on their own behalf and for their own needs may also be other entities to whomS&T entrusts personal data if it results directly from applicable regulations.
   
4. In the event of sharing personal data (only on the basis of the consent of the person or entity represented by him or in a situation where it is allowed by generally applicable law), the entities to which the data are made available become separate from S&T personal data administrators. S&T stipulates that in such a case it has no influence on the data protection policy pursued by the entities and is not responsible for it.
   
5. S&T may provide third parties with anonymized data, i.e. data transformed in a way that prevents identification or assignment of individual information to a specific or identifiable natural person to whom the data relates or by whom the data was provided, in the form of statistical data.
   
6. S&T does not transfer personal data outside the European Economic Area or to international organizations. However, if the Guest uses the content posted by S&T on Social Media or contacting S&T via instant messengers, the Guest also uses the services provided by the administrators of these Social Media or producers of software intended for remote communication. These services are provided by other entities, on the basis of separate regulations, privacy policies and on the basis of a separate agreement for the provision of electronic services (separate legal relationship), of which S&T is not a Party. In this case, the data may be processed by entities based outside the European Union, therefore S&T recommends that you read the relevant regulations, instructions and privacy policy regarding the provision of the above-mentioned services by entities other than S&T.
   

Accessing and modifying personal data

1. Any person whose personal data is processed by S&T has the right – to the extent resulting from applicable regulations – to:

• obtain access to the processed personal data, including receiving a copy thereof,
• receiving information regarding: purposes of personal data processing, categories of processed personal data, information about the recipients or categories of recipients to whom personal data is disclosed, the period of personal data processing, use of automated decision-making (including profiling),
• rectification of her personal data, if the data is incorrect,
• supplement incomplete personal data (taking into account the purposes of processing),
• deletion of personal data concerning her if: the data are no longer necessary for the purposes for which they are processed byS&T, the data subject withdraws his consent to their processing, and the consent was the only legal basis for data processing or an effective objection to data processing has been filed, data processing is unlawful,
• restrictions on the processing of personal data where: the correctness of the data is questioned – then the data subject may request the restriction of data processing for a period allowing S&T check the correctness of the data, the data is processed unlawfully, but the data subject does not want his data to be deleted, the data is no longer needed S&T but they are needed by the data subject to defend or pursue claims, an objection to the processing of data has been raised – until it is determined whether there are legitimate interests S&T are superior to the interests of the Person indicated as grounds for objection
• object to data processing in the event of data processing for the purpose of: performance of a task carried out in the public interest or in the exercise of public authority entrusted S&T, resulting from legitimate interests S&T, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject, the needs of direct marketing, including profiling,
• receive data in a structured format, including for the purpose of transferring it to another data controller and requesting that data be sent by S&T to another administrator, if technically possible; this applies to a situation where the processing takes place on the basis of consent or a concluded contract and in an automated manner,
• withdrawal of consent to the processing of personal data with effect for the future in relation to the processing of data that is processed on the basis of consent; this applies, for example, to data from websites and mobile applications processed as part of cookies (in this case, changes should be made to the configuration of the web browser on the terms set out in the Cookies Policy used byS&T, which may, however, affect some of the functionalities available on the Website or Social Media website)
• lodging a complaint to the body supervising compliance with personal data protection regulations, i.e. to the President of the Office for Personal Data Protection.

Data and information security

S&T makes every effort to ensure that all collected and processed data are protected using adequate technical measures and security procedures in order to protect them against unauthorized access, unauthorized modification, disclosure and destruction. Especially:

• the website records unauthorized access attempts and in the event of a suspected burglary, it is possible to quickly verify whether a breach of security rules has occurred,
• when providing Services electronically S&T uses SSL encryption and firewalls,
• data on the servers of the Website are subject to cyclical archiving (so-called backup),
• S&T applies and controls its own methods of collecting, storing and processing information, including physical security measures (e.g. encryption of device disks, password-protecting access to devices or applications involved in data processing) to protect against unauthorized access to the processed data, in particular including data processed in connection with the use of e-mail or instant messengers by S&T to communicate with Persons. S&T reserves, however, that each person using instant messengers or e-mail is obliged to read the data security rules and information used by the entities providing the indicated communication tools, as well as to comply with the resulting provisions,
• access to personal data is granted only to these employees and contractors S&T which it is necessary to process them for the needs S&T or in connection with the provision of services. Affiliates with S&T, trusted partners and external service providers manage data in accordance with the requirements of security and privacy protection, and in the event of failure to meet these obligations, they may suffer appropriate legal consequences.

Personal data storage period

1. Personal data is stored by S&T for the period necessary to achieve the purposes of processing, in particular for the duration of the contracts being the basis for data processing, as well as after their completion for the following purposes: pursuing claims or protecting against claims in connection with the performance of the contract, performance of obligations arising from legal provisions, including in particular tax regulations
   and accounting, – until the statute of limitations for claims or tax liabilities, the dates of which result from generally applicable laws.

2. S&T stores personal data for marketing purposes until the Data Subject objects to such processing. In the case of the Newsletter service -S&T stores and processes data for sending mailings until the Subscriber unsubscribes (resigns).

3. To ensure accountability, i.e. to prove compliance with the provisions relating to the processing of personal data, S&T will store data of Persons for the period in which it is obliged to keep data or documents containing them, to document the fulfillment of legal requirements and to enable control of their fulfillment by public authorities.

Changing the provisions of the privacy policy

The S&T privacy policy may change. However, the rights of Persons under this Privacy Policy will not be limited in any way without their express consent. Any changes to the Privacy Policy will be published on the Website, and S&T will also inform about them in a visible way. S&T also retains previous versions of this Privacy Policy to allow Individuals to review them.

Data Protection Officer

In the absence of a legal obligation, S&T has not appointed a Data Protection Officer. In connection with the above, all matters related to the processing of personal data should be addressed directly to S&T as the administrator of personal data. Contact details are provided below.

Contact details

S&T Magdalena Ratajczak, ul.Mostowa 5d, 62-300 Nowy Folwark, Poland.

If you have any questions about this Privacy Policy, please contact us at e-mail: hello@shapesandtones.com.

Last Modified: 01/01/2023