Privacy Policy
Privacy Policy
§1. Personal Data Controller
1. The controller of personal data, within the meaning of Article 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), is the company FOOTBALL MAT sp. z o.o. at ul. Gęsia 53, 97-300 Piotrków Trybunalski, NIP: 7712940223, REGON: 542668592, KRS: 0001192588.
2. The data controller’s email address is: [email protected].
3. The Controller, in accordance with Article 32(1) of the GDPR, adheres to the principles of personal data protection and implements appropriate technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data processed in connection with its operations.
4. Providing personal data by the customer is voluntary, but necessary for concluding an agreement with the data controller.
5. The data controller processes personal data to the extent necessary for the performance of the agreement or the provision of services to the data subject.
2. The data controller’s email address is: [email protected].
3. The Controller, in accordance with Article 32(1) of the GDPR, adheres to the principles of personal data protection and implements appropriate technical and organizational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to personal data processed in connection with its operations.
4. Providing personal data by the customer is voluntary, but necessary for concluding an agreement with the data controller.
5. The data controller processes personal data to the extent necessary for the performance of the agreement or the provision of services to the data subject.
§2. Purpose and legal bases for personal data processing
The Controller processes personal data for the following purposes:
a) preparing a commercial offer in response to customer interest, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
b) concluding and performing sales contracts with customers, based on the concluded contract (Article 6(1)(b) GDPR);
c) providing electronic services through the Online Store, based on the concluded contract (Article 6(1)(b) GDPR);
d) handling the complaint process, based on the obligation incumbent on the data controller in connection with applicable legal provisions (Article 6(1)(c) GDPR);
e) accounting related to issuing and accepting settlement documents, based on tax law provisions (Article 6(1)(c) GDPR);
f) data archiving for the possible establishment, exercise or defense of claims or the need to demonstrate facts, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
g) telephone or email contact, particularly in response to inquiries addressed to the data controller, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
h) sending technical information regarding the functioning of the Online Store and the services used by the customer, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
i) marketing, which constitutes its legitimate interest (Article 6(1)(f) GDPR) or is carried out based on prior consent (Article 6(1)(a) GDPR).
a) preparing a commercial offer in response to customer interest, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
b) concluding and performing sales contracts with customers, based on the concluded contract (Article 6(1)(b) GDPR);
c) providing electronic services through the Online Store, based on the concluded contract (Article 6(1)(b) GDPR);
d) handling the complaint process, based on the obligation incumbent on the data controller in connection with applicable legal provisions (Article 6(1)(c) GDPR);
e) accounting related to issuing and accepting settlement documents, based on tax law provisions (Article 6(1)(c) GDPR);
f) data archiving for the possible establishment, exercise or defense of claims or the need to demonstrate facts, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
g) telephone or email contact, particularly in response to inquiries addressed to the data controller, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
h) sending technical information regarding the functioning of the Online Store and the services used by the customer, which constitutes a legitimate interest of the data controller (Article 6(1)(f) GDPR);
i) marketing, which constitutes its legitimate interest (Article 6(1)(f) GDPR) or is carried out based on prior consent (Article 6(1)(a) GDPR).
§3. Data Recipients. Transfer of Data to Third Countries
1. Recipients of personal data processed by the data controller may include entities cooperating with the data controller when it is necessary for the performance of a contract concluded with the data subject.
2. Recipients of personal data processed by the data controller may also include subcontractors – entities whose services the data controller uses for data processing, e.g., accounting firms, law firms, IT service providers (including hosting services).
3. The data controller may be obliged to disclose personal data based on applicable legal provisions, in particular to disclose personal data to authorized state authorities or institutions.
4. Personal data, in connection with the controller’s use of tools for website traffic analysis and tracking, may be transferred to an entity located outside the European Economic Area, e.g., Google LLC. As an appropriate data protection measure, the data controller has agreed to standard contractual clauses in accordance with Article 46 of the GDPR with the providers of these services. More information on this topic is available here: https://commission.europa.eu/law/law-topic/data-protection_en.
2. Recipients of personal data processed by the data controller may also include subcontractors – entities whose services the data controller uses for data processing, e.g., accounting firms, law firms, IT service providers (including hosting services).
3. The data controller may be obliged to disclose personal data based on applicable legal provisions, in particular to disclose personal data to authorized state authorities or institutions.
4. Personal data, in connection with the controller’s use of tools for website traffic analysis and tracking, may be transferred to an entity located outside the European Economic Area, e.g., Google LLC. As an appropriate data protection measure, the data controller has agreed to standard contractual clauses in accordance with Article 46 of the GDPR with the providers of these services. More information on this topic is available here: https://commission.europa.eu/law/law-topic/data-protection_en.
§4. Personal Data Retention Period
1. The data controller stores personal data for the duration of the contract concluded with the data subject and after its termination for purposes related to the pursuit of claims arising from the contract, the fulfillment of obligations resulting from applicable legal provisions, but for no longer than the limitation period in accordance with the provisions of the Civil Code.
2. The data controller stores personal data contained in settlement documents for the period specified by the provisions of the Act on Goods and Services Tax and the Accounting Act.
3. The data controller stores personal data processed for marketing purposes for a period of 10 years, but no longer than until the withdrawal of consent to data processing or the lodging of an objection to data processing.
4. The data controller stores personal data for purposes other than those indicated in paragraphs 1-3 for a period of one year, unless consent to data processing was withdrawn earlier, and data processing cannot be continued on a basis other than the consent of the data subject.
2. The data controller stores personal data contained in settlement documents for the period specified by the provisions of the Act on Goods and Services Tax and the Accounting Act.
3. The data controller stores personal data processed for marketing purposes for a period of 10 years, but no longer than until the withdrawal of consent to data processing or the lodging of an objection to data processing.
4. The data controller stores personal data for purposes other than those indicated in paragraphs 1-3 for a period of one year, unless consent to data processing was withdrawn earlier, and data processing cannot be continued on a basis other than the consent of the data subject.
§5. Rights of the Data Subject
1. Every data subject has the right to:
a) access – to obtain confirmation from the controller as to whether personal data concerning them are being processed. If personal data are being processed, the data subject is entitled to obtain access to them and to obtain the following information: on the purposes of processing, categories of personal data, information on recipients or categories of recipients to whom the data have been or will be disclosed, on the data retention period or the criteria for determining it, on the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and to object to such processing (Article 15 GDPR);
b) to receive a copy of the data – to obtain a copy of the data undergoing processing, with the first copy being free of charge, and for subsequent copies, the controller may impose a reasonable fee based on administrative costs (Article 15(3) GDPR);
c) to rectification – to request the rectification of inaccurate personal data concerning them or the completion of incomplete data (Article 16 GDPR);
d) to erasure of data – to request the erasure of their personal data if the controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 GDPR);
e) to restriction of processing – to request the restriction of processing of personal data (Article 18 GDPR) when:
– the data subject contests the accuracy of the personal data – for a period enabling the controller to verify the accuracy of such data,
– the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
– the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims,
– the data subject has objected to processing – pending the verification whether the legitimate grounds of the controller override those of the data subject;
f) to data portability – to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means (Article 20 GDPR);
g) to object – to object to the processing of their personal data for the legitimate purposes of the controller, on grounds relating to their particular situation, including profiling. In such a case, the controller shall assess whether there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. If, according to the assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to cease processing data for these purposes (Article 21 GDPR).
2. To exercise the aforementioned rights, the data subject should contact the controller using the provided contact details and inform them which right and to what extent they wish to exercise it.
3. The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office in Warsaw.
a) access – to obtain confirmation from the controller as to whether personal data concerning them are being processed. If personal data are being processed, the data subject is entitled to obtain access to them and to obtain the following information: on the purposes of processing, categories of personal data, information on recipients or categories of recipients to whom the data have been or will be disclosed, on the data retention period or the criteria for determining it, on the right to request rectification, erasure or restriction of processing of personal data concerning the data subject, and to object to such processing (Article 15 GDPR);
b) to receive a copy of the data – to obtain a copy of the data undergoing processing, with the first copy being free of charge, and for subsequent copies, the controller may impose a reasonable fee based on administrative costs (Article 15(3) GDPR);
c) to rectification – to request the rectification of inaccurate personal data concerning them or the completion of incomplete data (Article 16 GDPR);
d) to erasure of data – to request the erasure of their personal data if the controller no longer has a legal basis for processing them or the data are no longer necessary for the purposes of processing (Article 17 GDPR);
e) to restriction of processing – to request the restriction of processing of personal data (Article 18 GDPR) when:
– the data subject contests the accuracy of the personal data – for a period enabling the controller to verify the accuracy of such data,
– the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
– the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims,
– the data subject has objected to processing – pending the verification whether the legitimate grounds of the controller override those of the data subject;
f) to data portability – to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or on a contract and the processing is carried out by automated means (Article 20 GDPR);
g) to object – to object to the processing of their personal data for the legitimate purposes of the controller, on grounds relating to their particular situation, including profiling. In such a case, the controller shall assess whether there are compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims. If, according to the assessment, the interests of the data subject outweigh the interests of the controller, the controller will be obliged to cease processing data for these purposes (Article 21 GDPR).
2. To exercise the aforementioned rights, the data subject should contact the controller using the provided contact details and inform them which right and to what extent they wish to exercise it.
3. The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office in Warsaw.
§6. Profiling
1. Personal data obtained by the data controller may be processed automatically – including in the form of profiling. Profiling of personal data carried out by the data controller involves assessing selected information about the data subject for the purposes of analyzing and predicting personal preferences and interests, particularly for the possibility of providing the data subject with a personalized offer.
2. Automated data processing carried out by the data controller does not produce any legal effects for the data subject. The data subject may object to the automated processing of their data at any time.
2. Automated data processing carried out by the data controller does not produce any legal effects for the data subject. The data subject may object to the automated processing of their data at any time.
§7. Google Analytics
1. The Controller uses Google Analytics, an internet analytics service provided by Google Inc. based in the USA.
2. Google Analytics uses cookies, which enable the analysis of website usage by the user. Information generated by the cookie about website usage is transmitted to and stored on Google’s server. On behalf of the Controller, Google will use this information to analyze website usage by users in order to prepare reports on website activity and to provide other services related to website and internet usage for the commissioning entity.
3. The data will not be used for the purpose of identifying any natural person.
4. The user can prevent the storage of cookies by adjusting their browser settings; however, in such a case, they may not be able to use the full functionality of the website. Furthermore, users can prevent Google from collecting data generated by cookies and related to their use of the website (including their IP address), as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=pl.
5. At any time, the user can object to the collection and processing of data related to the use of the Google website by downloading and installing the browser plugin available at the following address: https://tools.google.com/dlpage/gaoptout?hl=en.
2. Google Analytics uses cookies, which enable the analysis of website usage by the user. Information generated by the cookie about website usage is transmitted to and stored on Google’s server. On behalf of the Controller, Google will use this information to analyze website usage by users in order to prepare reports on website activity and to provide other services related to website and internet usage for the commissioning entity.
3. The data will not be used for the purpose of identifying any natural person.
4. The user can prevent the storage of cookies by adjusting their browser settings; however, in such a case, they may not be able to use the full functionality of the website. Furthermore, users can prevent Google from collecting data generated by cookies and related to their use of the website (including their IP address), as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=pl.
5. At any time, the user can object to the collection and processing of data related to the use of the Google website by downloading and installing the browser plugin available at the following address: https://tools.google.com/dlpage/gaoptout?hl=en.