Privacy Policy

Privacy Policy

General Information

This privacy policy has been developed based on the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "GDPR"), and in particular Articles 13 and 14 of the GDPR, which set out the data controller's obligation to provide information, as well as national regulations on personal data protection.

Personal data (data) is any information relating to an identified or identifiable natural person (the data subject). An identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Personal data includes a natural person's email address, phone number, biometric information (e.g., fingerprints), location data, IP address, health care information, religious beliefs, social security number, and marital status.

This privacy policy explains how your personal data is used and what rights you have in connection with the processing of your personal data by the Controller. Please read this policy.

Who is the Controller of your personal data?

The controller of personal data is Cezary Siwik, who runs a business under the name: "LANO MEBLE" SIWIK CEZARY, VAT ID: 6190013551, REGON: 100363308 (hereinafter: "Controller"); the Controller can be contacted at "Lano Furniture" Siwik Cezary, Tyble 43C, 98-420 Sokolniki or by email: biuro@lanomeble.pl.

Categories of personal data processed by the Controller.

The Controller processes personal data related to your identification and identity verification, which includes, in particular, your name and surname, residential address/delivery address/business address/registered office (if different from the delivery address), email address, phone number, company name, and VAT number (if you are not a consumer).

Does the Controller carry out automated data processing?

Personal data may be processed by the Controller in an automated manner, including profiling, which involves creating personalised product offers available in the LanoMeble.pl store's assortment, presenting them on the website and sending them in marketing messages (if voluntary consent is given) by the Controller, which can significantly influence the ability to purchase products at the prices provided in the offer.

Purpose, scope, period, and legal basis for the processing of personal data.

The Controller may process personal data for the following purposes, scope, period, and on the legal basis of:

concluding and performing a contract for the provision of an electronic service or taking action at the request of the data subject before concluding the contract (Art. 6(1)(b) of the GDPR). The data is stored for the period necessary to perform, terminate, or otherwise expire the concluded contract. The scope of personal data processed: name and surname, email address, contact phone number, delivery address (street, house number, flat number, city, country, residential address/business address/registered office (if different from the delivery address)). In the case of non-consumers, the Controller may additionally process personal data in the form of the company name and tax identification number. This scope may change, in particular, if the delivery is collected in person;
fulfilling a legal obligation incumbent on the Controller in connection with the fulfilment of an order, including the complaint process, and accounting and tax obligations (Art. 6(1)(c) of the GDPR). The Controller processes data provided in connection with placing an order for the period necessary for its fulfilment, including the settlement of the concluded contract and the obligations arising from it, including accounting and tax obligations. The scope of personal data processed: name and surname, email address, mobile phone number, residential address/business address/registered office, tax identification number;
establishing, asserting, or defending claims in judicial, administrative, or other court proceedings that may be brought by or against the Controller (Art. 6(1)(f) of the GDPR). Personal data is stored for the purpose of asserting or defending against any claims for the period of their limitation specified by law. The scope of data processed: name and surname, email address, contact phone number, delivery address (street, house number, flat number, city, country, residential address/business address/registered office (if different from the delivery address)). In the case of non-consumers, the Controller may additionally process personal data in the form of the company name and tax identification number;
communication in connection with an inquiry sent to the Controller in the form of an email message or a phone call (Art. 6(1)(b) and (f) of the GDPR). Personal data provided in connection with the inquiry is processed for the period of the Controller's legitimate interest, which is related to the fulfilment of the inquiry sent by the data subject, including providing a response. The scope of data processed: email address, phone number, and data provided in the form;
contact in connection with placing a telephone order made at the request of the data subject (Art. 6(1)(b) and (f) of the GDPR). Personal data is processed until the end of the telephone communication with the data subject. The scope of data processed: phone number and data provided during the conversation;
marketing activities, direct marketing, including sending commercial information electronically – if consent has been given (Art. 6(1)(f) of the GDPR). Personal data is stored for the period of the legitimate interest pursued by the Controller, but no longer than until the data subject objects or for the duration of the Controller's legitimate interest. The scope of data processing: name and surname, email address;
personalised marketing and ad targeting (Google Customer Match) – if consent has been given (Art. 6(1)(f) of the GDPR). Personal data in the form of an email address may be used to conduct personalised marketing campaigns in the Google advertising ecosystem (e.g., in Google search, YouTube, Gmail). This process involves sending an encrypted version of your email address to Google, which compares the received data with its user database to determine whether you have an account in Google services. If the match is successful, you will be added to a list of custom recipients, which will allow us to direct personalised advertising messages to you. Personal data is processed until the moment. Personal data is processed until you withdraw your consent.

Where do we obtain your personal data?

We obtain personal data from you.

To whom can we disclose your personal data?

A data recipient means a natural or legal person, public authority, agency, or another body to which personal data is disclosed, whether a third party or not (a third party means a natural or legal person, public authority, agency, or body other than the data subject, controller, processor, or persons who, under the direct authority of the controller or processor, are authorised to process personal data). Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law are not regarded as recipients; the processing of that data by those public authorities must be in compliance with the applicable data protection rules according to the purposes of the processing. Disclosure constitutes the transfer of personal data to a data recipient who decides on the purposes and means of data processing.

The recipients of the disclosed personal data will be:

Poczta Polska Spółka Akcyjna with its registered office in Warsaw (00-940) at ul. Rodziny Hiszpańskich 8, VAT No.: 525-000-73-13, National Court Register (KRS): 0000334972,
suppliers of orders placed in the online store,
online payment operators available on the website: https://lanomeble.pl/.

To whom can we entrust your personal data?

A processor means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller. In the case of entrusting data, the processor receives personal data on the basis of a data processing agreement concluded with the controller. The Controller uses/may use the services of external providers, in particular such as:

entities supporting debt collection;
entities providing accounting services for the Controller;
entities providing legal services related to the Controller's business;
entities providing IT services related to the Controller's business, including hosting services;
providers of tools used for website analytics,
entities providing services in the field of assisting the Controller in carrying out marketing activities;
entities processing personal data on behalf of the Controller.

Such entities process data based on an agreement with the Controller and solely in accordance with the Controller's instructions.

Is personal data transferred to a third country or an international organisation?

The Controller strives to use providers that process data within the European Economic Area (EEA). However, in connection with the use of the services of global providers, such as Google LLC, your personal data may be transferred outside the EEA, in particular to the United States. In such cases, the data transfer is based on standard contractual clauses approved by the European Commission or other mechanisms provided for by the GDPR, which are intended to ensure an appropriate level of protection for your data.”

What rights do you have in connection with the processing of your personal data?

The data subject has the right to:

access their data, including confirmation of its processing, receiving a copy of the data, and information about its processing;
rectify incorrect data or request the completion of incomplete data;
request the immediate erasure of data if:

the data is no longer necessary for the purposes for which it was collected or otherwise processed;
the data subject has withdrawn consent to the processing of personal data, which is the basis for the data processing, and there is no other legal basis for processing the data;
the data subject has objected to the processing of personal data;
the personal data has been processed unlawfully;
the personal data must be erased to comply with a legal obligation;

request the restriction of data processing if:

the data is inaccurate – until it is verified;
the processing is unlawful, and the applicant opposes its erasure;
the Controller no longer needs the data, but the applicant needs it to establish, assert, or defend claims;
the data subject has objected to the data processing, pending verification of whether the Controller's legitimate grounds override the grounds for objection;

data portability, including receiving it in a structured, machine-readable format or requesting its transfer to another Controller, if the following conditions are met cumulatively:

the data processing is based on a contract concluded with the data subject or on the consent given by that person,
the processing is carried out by automated means;

lodge a complaint with a supervisory authority if the data subject considers that the processing of their personal data infringes the GDPR; the supervisory authority is:

President of the Personal Data Protection Office

Personal Data Protection Office

ul. Stawki 2, 00-193 Warsaw

tel. +48 22 531 03 00

fax. +48 22 531 03 01

kancelaria@uodo.gov.pl

if the processing of personal data is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
object to the processing of data for purposes resulting from the Controller's legitimate interests, in particular direct marketing.

The Controller will provide you with information on the actions taken in response to your request within one month of receiving it. In particularly complex cases, this period may be extended by another two months from the receipt of the request. To fulfil your request, we are entitled to verify your identity to ensure that your data does not fall into the hands of an unauthorised person. If your request proves to be manifestly unfounded or excessive, in particular due to its repetitive nature, the Controller may charge a reasonable fee for fulfilling the request or refuse to take action in connection with the request.

Marketing information.

You have the option to consent to receiving commercial and marketing information electronically. You can unsubscribe from marketing information at any time by writing to biuro@lanomeble.pl or by sending a registered letter to the Controller's address.

Cookies.

The Controller informs that the Website uses "cookies," which are installed on your end device. These are small text files that can be read by the Controller's system, as well as by systems belonging to other entities whose services the Controller uses (e.g., Facebook, Google).

The Controller uses cookies for the following purposes:

ensuring the correct operation of the Website – thanks to cookies, it is possible for the Website to function smoothly, for you to use its features and to move comfortably between individual subpages;
increasing the comfort of browsing the Website – thanks to cookies, it is possible to detect errors on some subpages and to constantly improve them;
creating statistics – cookies are used to analyse how the User uses the Website (e.g., how many users visit it, which content arouses the most interest), which allows for its constant improvement and adaptation to the preferences of Users;
conducting marketing activities – thanks to cookies, the Controller can direct advertisements to Users that are tailored to their preferences.

The Controller may place both permanent and temporary (session) files on your device. Session files are usually deleted when the browser is closed, while closing the browser does not delete permanent files.

Information about the cookies used by the Controller is displayed in the panel at the bottom of the Website. Depending on your decision, you can enable or disable cookies of individual categories (with the exception of necessary cookies) and change these settings at any time.

The data collected through cookies does not allow the Controller to identify you.

The Controller uses the following cookies or tools that use them:

necessary cookies of the Website – these files enable the proper and safe functioning of the Website (they are used, among other things, to adapt the website layout to the device's screen), and therefore their disabling is not possible (the operation of these files is a condition for using the Website). Necessary cookies remain on your end device for up to 1 year;
Google Analytics – this tool (using cookies provided by Google LLC) allows the collection of statistical data about how users use the website, including the number of visits, duration of visits, search engine used, and location. The collected data helps to improve the Website and make it more user-friendly. The cookies used by Google Analytics remain on your end device for up to 2 years;
other statistical tools (including Getsitecontrol, CUX, Hojtar) or optimisation tools (including Linkedin) – the files allow monitoring the number of visits to the Website, recording and saving user behaviour on the Website. This makes it possible to constantly improve the Website and adapt its operation to the preferences of users. The cookies remain on your end device for a period of 1 day (Hojtar, Linkedin), a session or permanently (CUX), permanently (Getsitecontrol);
Google Ads – this tool (using cookies provided by Google LLC) allows the collection of data about your preferences (including visited subpages, viewed content) and allows you to be targeted with advertisements displayed on other websites you visit. The cookies used by Google Ads remain on your end device for up to 3 months;
Facebook Pixel – this tool (using cookies provided by Meta Platforms Ireland Limited) allows you to determine that you have visited the Website, as well as to target you with advertisements displayed on the social media platforms Facebook and Instagram and to measure their effectiveness. The cookies used by Facebook Pixel remain on your end device for up to 3 months;

Through most commonly used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block their future installation by the Website or other websites. However, disabling or limiting the handling of cookies may cause significant difficulties in using the Website, e.g., in the form of the need to log in on each subpage, a longer loading time of the Website, or restrictions on the use of certain functionalities.