PERSONAL DATA CONTROLLER

The entity responsible for the processing of your personal data is VELVA SP. Z O.O., located at Brzezińska 2H, 03-075 Warszawa, Poland, operating under the trade name Velva sp. z o.o., Mazowieckie (referred to hereafter as the “Controller”).

CONTROLLER’S CONTACT INFORMATION

For any inquiries or requests regarding the handling of your personal data, you may contact the Controller by post at the above address.

LEGAL BASES AND PURPOSES OF DATA PROCESSING

We process personal data in compliance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and Council of 27 April 2016) for the following reasons:

• Article 6(1)(b) GDPR – data processing is essential for fulfilling the contract involving the data subject and for promoting our own products and services.
• Article 6(1)(c) GDPR – data processing is necessary to fulfill legal obligations applicable to the Controller, including tax and financial reporting.
• Article 6(1)(f) GDPR – data processing serves the Controller’s legitimate interests, such as facilitating the exchange of information required for contract performance, claim establishment, defense, or enforcement, as well as direct marketing. 

PERSONAL DATA RECIPIENTS

Your personal data may be shared with third parties processing data on our behalf, including our accounting services, legal representatives, IT service providers, carriers, forwarding agents, and payment providers. Some IT providers whose systems we use may store data in the cloud, which may involve transferring data to third countries. The Controller ensures that data is transferred only to entities with adequate protection, typically under European Commission standard contractual clauses or other legally recognized safeguards.

DATA RETENTION PERIOD

Your personal data will be retained throughout the contract term and subsequently:

• Until the expiration of limitation periods as outlined in the Civil Code (generally three years);
• Select data, whose retention is required by tax and accounting laws, will be kept for the legally specified durations (typically five years). 

YOUR RIGHTS

Regarding your personal data, you have the right to:

• Access and obtain a copy of your data;
• Rectify (correct) your data;
• Request deletion of your data (the “right to be forgotten”);
• Request limitations on data processing;
• Object to data processing due to your particular situation or for direct marketing;
• Transfer your data to another entity. 

If you believe your rights have been infringed, you may file a complaint with the President of the Personal Data Protection Office. Contact details are below:

Office for Personal Data Protection
ul. Stawki 2, 00-193 Warsaw
Fax: 22 531 03 01
Email: kancelaria@uodo.gov.pl 

PROVISION OF DATA

Providing your personal data is voluntary but necessary for the conclusion and execution of a contract.

AUTOMATED PROCESSING

Your data may undergo automated processing in our IT systems, which may include automated decision-making and profiling. Profiling entails automated analysis or prediction of your behavior on our Online Store site for marketing purposes.