Data protection policy

1. The controller of data processed for the purpose of order fulfillment is Paper Studio Agata Mikulska, ul. Sporna 10, 26-110 Skarżysko-Kamienna, registered and visible in the CEIDG register under the NIP number: 6631807809 (" Controller ").
2. Contacting the Administrator in order to take action at the request of the data subject before concluding the contract is tantamount to expressing consent to the processing of personal data for the purpose of preparing and executing the order, within the meaning of Art. 6 sec. 1 letter a) of the GDPR. From the moment of concluding the contract (placing the order), the processing of the Buyer's personal data takes place on the basis of Art. 6 sec. 1 letter b) of the GDPR.
3. Personal data provided by the Buyer in the order fulfillment process are data necessary for its fulfillment and will be processed by the Store in order to perform the concluded contract.
4. The processing of personal data by the Store is carried out in accordance with the provisions of the GDPR, the Personal Data Protection Act of 10 May 2018 (Journal of Laws of 2018, item 1000, as amended), the Act of 18 July 2002 on the provision of services by electronic means (Journal of Laws of 2002, No. 144, item 1204, as amended), as well as the Act of 16 July 2004 - Telecommunications Law (Journal of Laws of 2004, No. 171, item 1800, as amended). In connection with the purposes for which the Store processes the personal data of Buyers, the recipient of their personal data may be entities participating in the performance of obligations arising from the contract (e.g. the Tax Office, the Social Insurance Institution or companies performing services related to the performance of the contract, such as transport companies), as well as entities intermediating in the activities performed by the administrator, e.g. IT service providers, accounting offices, marketing agencies or law firms.
5. The Buyer has the right to access the content of their personal data and correct it, as well as the right to rectify, delete and limit processing (in cases where it is permissible due to the factual situation and legal obligations incumbent on the Store), the right to transfer data, the right to object (e.g. if the data is processed for marketing purposes). The Buyer also has the right to lodge a complaint with the supervisory body - the President of the Office for Personal Data Protection.
6. If the processing of the Buyer's personal data is based on consent (e.g. the Buyer contacted the Store to obtain information about the Goods), the withdrawal of the Buyer's consent to the processing of his personal data does not affect the legality of the processing carried out by the administrator before the withdrawal of consent.
7. The Buyer may consent to receiving commercial information from the Store via electronic means of communication (e-mail address and telephone number).
8. The Buyer may consent to the Store's use of telecommunications terminal equipment for direct marketing purposes.

Data protection systems used

The Administrator’s personal data protection system consists primarily of the following components:

1. Data inventory . The Administrator identifies personal data resources, data classes, relationships between data resources, and identifies ways of using data (inventory), including:
   1. cases of processing data of persons not identified by the Administrator (unidentified data),
   2. cases of processing children's data,
   3. profiling,
2. Personal Data Processing Register . The Administrator develops, maintains and keeps a register of activities performed on personal data at the Administrator (hereinafter: " Register " or " RCPD "). The Register is a tool for settling the compliance of personal data processing at the Administrator with generally applicable legal provisions.
3. Legal bases . The Administrator ensures, identifies and verifies the legal bases for data processing and registers them in the Register, including:
   1. maintains a system for managing consent to data processing and remote communication in order to easily determine the possibility of communicating with individuals for specific purposes;
   2. justifies cases when the Administrator processes data on the basis of the legitimate interest of the Administrator.
4. Handling of individual rights . The Administrator fulfils the information obligations towards the persons whose data it processes and ensures the handling of their rights (Article 12, paragraph 3 of the GDPR), implementing the requests received in this regard, including:
   1. information obligation . The Administrator provides individuals with the required information when collecting data and in other situations (at the initial stage of implementing the provisions of the GDPR, the Administrator legalizes the existing database to the extent that it concerns notification of new rights granted to individuals by the GDPR) and organizes and ensures documentation of the implementation of these obligations in order to be able to demonstrate their fulfillment in the event of a potential inspection by the Office for Personal Data Protection,
   2. Fulfillment of requests of natural persons . The Administrator ensures the possibility of fulfilling requests addressed to it by natural persons whose personal data is processed by both itself and its processors (processor obligations imposed by means of personal data processing entrustment agreements),
   3. handling of requests from individuals . The Administrator provides appropriate financial and personnel resources, as well as procedures, so that the requests of individuals are fulfilled on time and in the manner required by the GDPR, and that their execution is documented in an appropriate manner each time,
   4. notification of breaches . The Administrator applies procedures that allow to determine the necessity of notifying persons affected by an identified breach of data protection. For this purpose, a member of the management board, in a person designated for this purpose, supervises the data processing processes in such a way that notification of breaches can be made immediately, but always within the deadlines not later than specified in generally applicable provisions of law.

1. Minimization . The Administrator has implemented principles and methods compatible with the minimization principle specified in the GDPR, in order not to process unnecessary and excessive personal data. Through the minimization principle, the Administrator aims to ensure that its database does not contain data that is not absolutely necessary for the correct performance of legal and factual relations between the Administrator and its customers and contractors ( privacy by default ), including:
   1. rules that help effectively manage data adequacy already at the data collection stage (forms adapted to not collect excess data),
   2. principles of managing access to the data of natural persons who request such access, through appropriate training of persons responsible for these matters within the Administrator’s area of ​​operations as well as preparation of an appropriate operating procedure,
   3. principles for managing the period of data storage and verifying further usefulness, and as a result, immediate deletion of personal data of natural persons when the legal basis for such action expires.

Security . The Administrator ensures an appropriate level of data security, including:

conducts the necessary risk analyses for data processing activities or their categories, using an appropriate risk scale, which is an annex to the Register of Data Processing Activities,

conducts data protection impact assessments where the risk of violating the rights and freedoms of individuals is high due to their nature or location,

adapts data protection measures to the identified risks,

has internal procedures for managing information security,

applies procedures to identify, assess and report identified data protection breaches to the Office for Personal Data Protection – manages incidents.

2. Processors . The Administrator has rules for verifying entities processing data on behalf of the Administrator, requirements regarding the terms of processing (for this purpose, an agreement on entrusting the processing of personal data is concluded with each entity processing personal data entrusted by the Administrator), rules for verifying the performance of entrustment agreements, primarily through the application of requirements for the presentation by processors of security procedures used by the Administrator, which are annexes to agreements on entrusting the processing of data on behalf of the Administrator.

3. Transfer of data to third countries . The Administrator verifies whether the personal data of natural persons are not transferred to third countries (i.e. outside the European Union, Norway, Liechtenstein and Iceland) or to international organizations and ensures the lawful conditions for such transfer, if it takes place.

4. Privacy by design . The Administrator manages changes affecting privacy and controls them in an appropriate manner due to the provisions on the protection of personal data. For this purpose, the procedures for launching new projects and investments by the Administrator take into account the need to assess the impact of the change on data protection, risk analysis, ensuring privacy (including compliance of processing purposes, data security and minimization) already in the design phase of the change, investment or at the beginning of a new project.

5. Cross-border processing . The Administrator shall verify each time whether there is a case of cross-border processing of personal data in order to fulfil all legal obligations imposed on the Administrator in this respect.

Requests of natural persons whose data is processed by the controller.

1. Third party rights . In implementing the rights of data subjects, the Administrator introduces guarantees for the protection of third party rights in the protection of their personal data. In a situation where, for example, fulfilling a person's request for a copy of data or the right to transfer data could adversely affect the rights and freedoms of other people or significantly violate their legal interests (e.g. rights related to the protection of other people's data when the Administrator would have to provide documents containing the personal data of the interested party, which also contain personal data of other people that cannot be anonymized for various reasons, intellectual property rights, trade secrets or personal rights), the Administrator may contact the person to clarify doubts or refuse to satisfy the request.
2. Refusal to comply with the request . The Administrator, by sending an appropriate form, informs the person, within one month of receiving the request, about the refusal to consider the request and about the person's rights related to it in the event that for various reasons referred to in this document or resulting directly from generally applicable provisions of law (e.g. tax obligations) fulfilling the person's request is impossible.
3. Access to personal data . At the request of a person regarding access to their data, the Administrator informs the person whether they are processing their data and informs the person about the details of processing, in accordance with Art. 15 of the GDPR (the scope of processing corresponds to the information obligation when collecting data). The Administrator provides access to personal data to the person who requests it, but only if it does not threaten the violation of the personal data of other people (no possibility of anonymizing personal data that does not directly concern the person making the request or the risk of disclosing a trade secret, etc.). Access to data may be implemented by issuing a copy of the data, provided that each subsequent (after the first) copy of personal data is a copy for which the Administrator may charge appropriate fees, justified by the amount of work related to obtaining it and issuing it to the interested person.
4. Cessation of processing . The administrator informs the person that he/she is not processing data concerning him/her if such a person has made a request concerning his/her rights.
5. Data rectification . The Administrator rectifies incorrect data at the request of a natural person whose personal data is processed by the Administrator. The Administrator has the right to refuse to rectify the data, unless the person reasonably demonstrates the incorrectness of the data that is being requested to be rectified.
6. Supplementing data . The Administrator supplements and updates data at the request of a person. The Administrator has the right to refuse to supplement data if the supplementation would be incompatible with the purposes of data processing in connection with the fact that documents have already been provided to the natural person informing them about the purposes of processing (e.g. the Administrator should not process data that is unnecessary or excessive in accordance with this document). The Administrator may rely on the person's statement regarding the supplemented data, unless this is insufficient in light of the procedures adopted by the Administrator (e.g. regarding the acquisition of such data), the law or there are factual circumstances justifying concerns that the statement of the person making the request is unreliable.
7. Copies of data . Upon request, the Administrator shall issue a copy of the data concerning the person and shall record the fact of issuing the first copy of the data, subject to the situations contained in this document related to the possibility of a breach of personal data of third parties.
8. Data transfer . At the request of a person, the Controller issues in a commonly used computer-readable format or transfers to another entity, if possible , data concerning that person, which he or she has provided to the Controller, processed on the basis of that person's consent or in order to conclude or perform a contract concluded with him or her in the Controller's IT systems.
9. The right to appeal when processing personal data . If the Administrator processes data automatically, including in particular profiling individuals, the Administrator also provides the possibility of appealing to the decision of an associate or member of the management board, authorized to perform such action on the part of the Administrator, unless such an automatic decision is necessary for the conclusion or performance of a contract between the appealing person and the Administrator, is expressly permitted by law, is based on the express consent of the appealing person.
10. Data deletion . At the request of a person, the Administrator deletes data when:

1. the data is not necessary for the purposes for which it was collected or processed for other lawful purposes or purposes required by law,
2. the consent to their processing has been withdrawn and the Administrator has no other legal basis for processing,
3. the natural person whose personal data is being processed has effectively objected to the processing of such data,
4. the data was processed unlawfully,
5. the necessity of deletion results from a legal obligation,
6. the request concerns the child's data collected on the basis of consent for the purpose of providing services offered directly to the child.

The Administrator determines the manner of exercising the right to delete data, taking into account the obligation to ensure the effective exercise of this right. This primarily concerns the security principle, as well as respect for the obligation to verify whether there are no exceptions referred to in Article 17 paragraph 3 of the GDPR.

If the data subject to deletion has been made public by the Administrator on a website or for the marketing purposes of an event organized by the Administrator or in which the Administrator takes an active part, while assuming that the necessary consents have been obtained from persons whose personal data are processed in this way, the Administrator shall take reasonable steps, including technical measures, to inform other administrators processing such personal data about the need to delete the data and access to it.

In the event of deletion of data, the Administrator informs the person about the recipients of the data, at that person’s request.

11. Processing restrictions . The administrator shall restrict the processing of data at the request of a person when:

personal data processed by the Administrator are questioned by the natural person whose data they concern – for the period necessary to verify their accuracy,

the processing is unlawful, but the data subject opposes the deletion of the personal data, only wanting their processing to be limited in relation to the purposes indicated by him,

The administrator no longer needs the personal data, but they are necessary for the data subject to establish, pursue or defend legal claims,

the person has objected to the processing of his or her personal data – until it is determined whether the Administrator has legally justified grounds that override the grounds for objection (e.g. tax regulations and others).

During the limitation of processing, the Administrator stores the data, but does not use it or transfer it to third parties or other entities separate from the Administrator and its employees, authorized to access the data in question. The exception is the express consent of the data subject as well as the establishment, pursuit or defense of claims.

In the event of restriction of data processing, the Administrator, at the request of the person whose personal data is being processed, shall inform that person about the recipients of the data.

11. Objection to the processing of personal data . If a person raises a justified objection to the processing of their data, and the data is processed by the Administrator based on the legitimate interest of the Administrator or on a task entrusted to the Administrator in the public interest, the Administrator will take the objection into account. An exception to this is the situation when the Administrator has important, legally justified grounds for processing, which, due to all the circumstances and generally applicable provisions of law, should be considered to override the interests and rights of the person filing the objection.

12. Objection to direct marketing . If a natural person whose personal data are processed by the Administrator objects to the processing of their data by the Administrator for the purposes of direct marketing, the Administrator will take into account the objection and discontinue such processing, without exceptions motivated by the factual situation or legal provisions.

Cookie Policy

We inform you that in order to optimize and adjust the content available on our website to the individual needs of the user, we use information stored in cookies on your end devices. Cookies are used to save information related to the navigation of the computer on the website, which we can read during your next visit to our website. This information includes the subpages visited, the date and time of your stay on a given subpage of our portal, the exact content of the information you have read, your preferences determined based on what you have viewed on our website. You can control the use of cookies through the appropriate browser settings. By continuing to use our website, you consent to the collection of the following data by us:

- unique device identifier,

- IP address of the mobile device,

- information about the operating system of the device from which our website is viewed,

- information about your location and mobile operator (to the extent permitted by law).

By choosing to use our website without changing your browser settings, you accept the use of cookies. We kindly ask you to ensure that your browser settings are consistent with your data privacy preferences.

Cookies are necessary for the proper functioning of our website. In order to provide services at the highest level, in a manner tailored to individual interests, we use them to collect statistical data in order to optimize the functionality of the website. Click "Accept and continue" to accept the use of cookies and go directly to our website or "More information" for a detailed description of the types of cookies used on our website, and then decide which one to accept.

What types of cookies do we use and how do we classify them?

All cookies fall into one of the following two types.

1. Session cookies - are deleted each time you close your browser.
2. Persistent files - remain on your device for a longer period of time. Thanks to these files, we are able to recognize your device when you visit our website again.

What can you do if you do not want cookies to be placed on your device?

By visiting our website, you agree to our use of cookies in accordance with the principles described in this document. However, you can easily adjust your privacy settings by selecting one of the three options, according to which cookies will be placed on your device in the manner described above.

It is important that you know that you can delete existing cookies from your device, as well as block cookies from being placed on it in the future. To do this, change your web browser settings.

NOTE! All modifications that limit the use of cookies by the browser will have a visible effect on your experience of using our website, and some of the services we have prepared may not function properly or at all!

Privacy Statement

We consider that protecting the privacy of an individual on the Internet is important not only because of the latest legal regulations, but also has an impact on the future of online business and makes users feel that their personal data is protected on the Internet to the same extent as in the real world. This privacy statement has been created to demonstrate our commitment to protecting individual rights in the field of personal data protection and privacy.

Is all content on our site compliant with our privacy policy?

Our website may contain links to foreign websites. We are not responsible for the content of these websites or their privacy practices. We therefore recommend that you read the privacy statements of foreign websites carefully.

What is this privacy statement about?

This privacy statement applies to personal data you provide to us or data relating to personal data.

What do we do with your personal data?

We process the personal data provided by you only in the manner described in this privacy statement as well as in our privacy policy. The processing of our customers' personal data is based on the legal relationships that connect us with our business partners or on the basis of the customer's consent. In exceptional circumstances, the legal basis for the processing of your personal data is our legitimate interest as a data controller.

How long will we process your personal data?

Once you have given your consent to the processing of your personal data, we will store your personal data in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

In no case will we process your personal data longer than is required to achieve the purposes specified in this document as well as in the documents signed by customers.

You may object to our use of your personal data even if we have a legitimate interest in doing so.

However, it may happen that our legal interest overrides your objection. In such a case, we will still be entitled to process your personal data.

If the processing of personal data is based on your consent, we will cease processing it when you withdraw your consent.

There may be situations in which we are required to store personal data for longer periods due to binding legal provisions. In the event of legal claims, we are entitled to process your personal data until the end of the relevant storage period or until the claims in question have been settled.