Privacy policy

This translation is provided for information purposes only. The Polish version of the document is binding.

§1. Personal data controller

1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR, in Polish RODO) is FOOTBALL MAT sp. z o.o. at ul. Gęsia 53, 97-300 Piotrków Trybunalski, NIP: 7712940223, REGON: 542668592, KRS: 0001192588.
2. E-mail address of the data controller: sklep@football-mat.com.
3. In accordance with Article 32(1) GDPR, the controller complies with the principles of personal data protection and applies appropriate technical and organisational measures to prevent accidental or unlawful destruction, loss, modification, unauthorised disclosure of or unauthorised access to personal data processed in connection with its business activity.
4. Providing personal data is voluntary for the customer but necessary to conclude a contract with the data controller.
5. The data controller processes personal data to the extent necessary to perform the contract or provide services to the data subject.

§2. Purpose and legal bases of personal data processing

The controller processes personal data for the following purposes:
a) preparing a commercial offer in response to the customer's interest, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
b) concluding and performing sales contracts with customers, on the basis of the concluded contract (Article 6(1)(b) GDPR);
c) providing electronic services via the Online Shop, on the basis of the concluded contract (Article 6(1)(b) GDPR);
d) handling the complaints process, on the basis of an obligation incumbent on the data controller under the applicable laws (Article 6(1)(c) GDPR);
e) accounting purposes related to issuing and receiving settlement documents, on the basis of tax law provisions (Article 6(1)(c) GDPR);
f) archiving data for the possible establishment or pursuit of, or defence against, claims or the need to demonstrate facts, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
g) contact by telephone or e-mail, in particular in response to enquiries addressed to the data controller, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
h) sending technical information concerning the functioning of the Online Shop and the services used by the customer, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
i) marketing, which is its legitimate interest (Article 6(1)(f) GDPR) or takes place on the basis of previously given consent (Article 6(1)(a) GDPR).

§3. Data recipients. Transfer of data to third countries

1. The recipients of personal data processed by the data controller may be entities cooperating with the data controller, where this is necessary to perform the contract concluded with the data subject.
2. The recipients of personal data processed by the data controller may also be subcontractors, i.e. entities whose services the data controller uses when processing data, e.g. accounting offices, law firms, entities providing IT services (including hosting services).
3. The data controller may be obliged to make personal data available under the applicable laws, in particular to make personal data available to authorised state bodies or institutions.
4. In connection with the controller's use of tools for analysing and tracking traffic on the website, personal data may be transferred to an entity based outside the European Economic Area, e.g. Google LLC. As an appropriate data protection safeguard, the data controller has agreed to standard contractual clauses in accordance with Article 46 GDPR with the providers of these services. More information on this is available here: https://commission.europa.eu/law/law-topic/data-protection_en.

§4. Personal data retention period

1. The data controller stores personal data for the term of the contract concluded with the data subject and, after it ends, for purposes related to pursuing claims connected with the contract and fulfilling obligations arising from the applicable laws, but for no longer than the limitation period under the provisions of the Civil Code (Kodeks cywilny).
2. The data controller stores personal data contained in settlement documents for the period specified in the provisions of the Act on Goods and Services Tax (ustawa o podatku od towarów i usług) and the Accounting Act (ustawa o rachunkowości).
3. The data controller stores personal data processed for marketing purposes for a period of 10 years, but no longer than until consent to data processing is withdrawn or an objection to data processing is raised.
4. The data controller stores personal data for purposes other than those indicated in paragraphs 1-3 for a period of one year, unless consent to data processing has been withdrawn earlier and the data processing cannot be continued on a basis other than the consent of the data subject.

§5. Rights of the data subject

1. Every data subject has the right:
a) of access: to obtain confirmation from the controller as to whether their personal data are being processed. If data about the person are being processed, they are entitled to access them and to obtain the following information: the purposes of processing, the categories of personal data, information about the recipients or categories of recipients to whom the data have been or will be disclosed, the data retention period or the criteria for determining it, the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and the right to object to such processing (Article 15 GDPR);
b) to obtain a copy of the data: to obtain a copy of the data undergoing processing, the first copy being free of charge, while for further copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR);
c) to rectification: to request the rectification of inaccurate personal data concerning them or the completion of incomplete data (Article 16 GDPR);
d) to erasure: to request the erasure of their personal data if the controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 GDPR);
e) to restriction of processing: to request the restriction of processing of personal data (Article 18 GDPR) where:
• the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of those data,
• the processing is unlawful and the data subject opposes the erasure of the data, requesting the restriction of their use instead,
• the controller no longer needs the data, but they are required by the data subject for the establishment, pursuit or defence of claims,
• the data subject has objected to processing, pending verification of whether the legitimate grounds of the controller override the grounds of the data subject's objection;
f) to data portability: to receive, in a structured, commonly used and machine-readable format, the personal data concerning them that they have provided to the controller, and to request that those data be transmitted to another controller, if the data are processed on the basis of the data subject's consent or a contract concluded with them and the data are processed by automated means (Article 20 GDPR);
g) to object: to object to the processing of their personal data for the controller's legitimate purposes, on grounds relating to their particular situation, including profiling. In that case, the controller assesses whether there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subjects, or grounds for the establishment, pursuit or defence of claims. If, according to that assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to stop processing the data for those purposes (Article 21 GDPR).
2. To exercise the above rights, the data subject should contact the controller using the contact details provided and inform the controller which right they wish to exercise and to what extent.
3. The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Warsaw.

1. Personal data obtained by the data controller may be processed by automated means, including in the form of profiling. Profiling of personal data carried out by the data controller consists in evaluating selected information about the data subject for the purpose of analysing and forecasting personal preferences and interests, in particular to make it possible to provide the data subject with a personalised offer.
2. Automated data processing carried out by the data controller does not produce any legal effects for the data subject. The data subject may object to the automated processing of their data at any time.

1. The Controller uses Google Analytics, a web analytics service provided by Google Inc., based in the USA.
2. Google Analytics uses cookies, which enable analysis of how the user uses the website. The information generated by the cookie about the use of the website is transmitted to and stored on a Google server. On behalf of the Controller, Google will use this information to analyse the use of the website by users in order to compile reports on website activity and to provide other services related to website and Internet use to the commissioning entity.
3. The data will not be used to identify any natural person.
4. The user may prevent cookies from being stored by adjusting their browser settings accordingly; however, in that case they will not be able to use the full functionality of the website. In addition, users may prevent Google from collecting data generated by cookies and relating to their use of the website (including their IP address), as well as the processing of these data by Google, by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=pl.
5. At any time, the user may object to Google collecting and processing data related to their use of the website by downloading and installing a browser plug-in, which is available at the following address: https://tools.google.com/dlpage/gaoptout?hl=en.

6. If you consent to analytics cookies, we also use Microsoft Clarity, an analytics service provided by Microsoft Corporation. Clarity records how you use the website: clicks, scrolling and cursor movement. It presents this as click maps and session recordings, which help us improve the website.
7. Text you type into form fields is not included in recordings. The checkout, the order confirmation page and the customer account are recorded with no visible data.
8. Data from Clarity is sent to Microsoft and may be stored on servers in the USA. Microsoft participates in the EU-U.S. Data Privacy Framework. More information: https://privacy.microsoft.com/privacystatement.
9. You can withdraw your consent at any time in the page footer, under “Cookie settings”. From that moment Clarity stops working.