Personal data controller The administrator of your personal data is Hanna Glinka, conducting business under the name Hanna Glinka Fashion Concept, ul. Mickiewicza 70, 66-300 Międzyrzecz, NIP 5961772120, REGON 544491749.

Point of contact for data protection
For matters related to the processing of personal data, as well as to exercise your rights in connection with the processing, contact Hanna Glinka in person at ul. Mickiewicza 70, 66-300 Międzyrzecz, via e-mail address hello@hannaglinka.com or by phone at +48 792 273 258.

Your personal data, as a person using the website (the “User”) www.hannaglinka.com (the “Website”), are processed in accordance with applicable laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation („GDPR”), as well as the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means.

Are your data secure?
The Controller undertakes to implement all security and personal data protection measures required by applicable law, to collect data with due diligence, and to adequately protect them against access by unauthorized persons.

Purposes of processing personal data
The Controller may process your personal data where this is necessary for you to use the Website.

The legal basis for processing your personal data is to enable you to use the Website, including the Contact Form.

The purposes of processing your personal data include:

a) provision of services by electronic means, consisting of:
• entering into and performing sales agreements with the User for products ordered by the User through the Website, including product returns and exchanges and handling complaints – the legal basis for  processing is Article 6(1)(b) GDPR;
• creating and managing the User’s account on the Website – the legal basis for processing is Article 6(1)(b) GDPR;
b) compliance with legal obligations

This includes accounting, bookkeeping and financial reporting obligations – the legal basis for processing is Article 6(1)(c) GDPR.

c) pursuing the Controller’s legitimate interests

The legal basis for processing is Article 6(1)(f) GDPR. These legitimate interests include:
• conducting marketing activities, including sending newsletters;
• communicating with you in connection with a message submitted via the contact form;
• ensuring the proper functioning of the Website, including the contact form, registration form and order form;
• archiving, statistical analysis, and potentially pursuing claims or defending against claims related to the provision of services by electronic means.

Data retention period

Your personal data will be processed for the period necessary to achieve the purposes for which the data are processed, namely:

• until the expiry of the limitation periods for any claims related to the operation of the Website, including claims arising from agreements concluded through the Website;
• until you submit a justified objection, with regard to data processed on the basis of the Controller’s legitimate interest;
• until you withdraw your consent to receive marketing information by email or telephone, or until you object to the processing of your data for marketing purposes;
• until the expiry of any statutory data retention obligations, including the obligation to retain accounting documents relating to concluded agreements.

Categories of recipients

Your data may be disclosed to entities whose services the Controller uses to perform its
obligations and conduct its business. These categories of entities include: IT service
providers; accounting service providers; marketing service providers; courier, transport and
postal companies; online payment operators.

Your data may also be disclosed to other entities authorized to access such data to the extent and for the purposes specified by law. Your personal data will always be processed using appropriate personal data protection and security measures.

The Controller does not intend to transfer your personal data to countries outside the European Economic Area or to international organizations. Automated decision-making / profiling The Controller will not make decisions concerning you solely by automated means, including through profiling.

Your rights
You have the right to:

• access your personal data and request that they be rectified, erased or that their processing be restricted;

• data portability;
• withdraw your consent to the processing of your personal data, to the extent that the processing is based on your consent (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
• object to the processing of your personal data, to the extent that the legal basis for processing is the Controller’s legitimate interest;
• lodge a complaint with the supervisory authority responsible for the protection of personal data (the President of the Personal Data Protection Office – UODO) if you believe that the processing of your data violates the GDPR.

To exercise your rights, please contact the Controller.

Do you have to provide your personal data?
Providing personal data is voluntary; however, it may be necessary to achieve the purposes specified in this Privacy Policy.