Privacy policy

Home page
Privacy policy

Privacy policy of the Media-MED online shop

This Privacy Policy sets out the rules for the processing of personal data
users and customers using the online shop
Media-MED Sp. z o.o.

The document describes what data is collected and for what purposes it is used,
who they may be transferred to and what rights the data subjects have.

The Privacy Policy applies to the online shop available at:
https://sklep.media-med.pl/.

Key information

The data controller is Media-MED Sp. z o.o.

Data are processed for the purpose of order fulfilment and customer service.

Data may be transferred to payment operators, courier companies and technical service providers

The user has the right to access, rectify and erase data

Table of contents

Scope of the Privacy Policy

I. Data controller

II. Contact regarding data matters

III. Scope of processed data

IV. Purposes and legal bases for processing

V. Customer account

VI. Orders and payments

VII. Delivery of orders

VIII. Contact and complaints forms

IX. Newsletter

X. Data recipients

XI. Data retention period

XII. User rights

XIII. Voluntary provision of data

XIV. Transfer of data outside the EEA

XV. Data security

XVI. Cookies

XVII. Final provisions

Data controller

The controller of the personal data of users and customers of the online shop is:

Media-MED Sp. z o.o.
7 Promienistych Street
31-481 Kraków
NIP: 9452062062
KRS: 0000364874

The controller processes personal data in accordance with applicable laws,
in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council
dated 27 April 2016 on the protection of natural persons in relation to
relating to the protection of natural persons with regard to the processing of personal data and on the free movement of such data,
hereinafter referred to as the GDPR.

Contact regarding personal data

For matters relating to the processing of personal data, you can contact
With the Administrator:

by post to the address:
Media-MED Sp. z o.o., 7 Promienistych St., 31-481 Kraków,
by email to:
biuro@media-med.pl.

The controller has not appointed a Data Protection Officer.

III

Scope of processed personal data

The controller may process personal data provided by the user or the customer
when using the online shop, placing an order, creating an account,
contacting the shop, signing up for the newsletter or submitting a complaint.

Depending on the type of activity, they may be processed in particular
the following data:

full name,
company name,
residential address or registered office address,
delivery address,
email address,
phone number,
NI Number,
details necessary to issue an invoice,
order data,
payment details,
data contained in the correspondence with the Administrator,
data provided in the contact or complaints form.

Purposes and legal basis for data processing

Personal data is processed for the following purposes:

customer account management — pursuant to Article 6(1)(b) of the GDPR,
that is, for the purpose of providing a service electronically;
order fulfilment — pursuant to Article 6(1)(b) of the GDPR,
that is, for the purpose of concluding and performing a contract of sale;
payment processing — pursuant to Article 6(1)(b) of the GDPR,
that is, in order to process payment for the order;
issuing invoices and fulfilling tax obligations —
pursuant to Article 6(1)(c) of the GDPR;
order delivery —
pursuant to Article 6(1)(b) of the GDPR;
contact form support —
pursuant to Article 6(1)(f) of the GDPR, namely the legitimate interest
An administrator responsible for managing communications;
handling of complaints, returns and claims —
pursuant to Article 6(1)(b), (c) and (f) of the GDPR;
newsletter dispatch —
on the basis of the user’s consent, i.e. Article 6(1)(a) of the GDPR;
investigation or defence against claims —
pursuant to Article 6(1)(f) of the GDPR.

Customer account on the online shop

Users can create a customer account on the online shop.

Creating an account allows you, in particular, to:

faster placement of subsequent orders,
checking purchase history,
management of the data provided during registration,
address and company data management,
access to the features available to logged-in customers.

In order to set up and manage a customer account, the Administrator may process
in particular:

full name,
email address,
username and password,
address details,
company details,
order history.

Data is processed for the duration of the customer’s account, unless otherwise required by law
require longer retention of certain data.

Orders and payments

In order to place and process an order, the Customer provides the necessary data
for the conclusion and performance of the sales contract, in particular:

identification data,
contact details,
address details,
delivery details,
data required to issue a sales invoice.

Payments in the store can be processed via third-party
payment operators

PayU,
Revolut.

Regarding payment processing, data may be transferred to the payment operator
chosen by the Customer when placing the order, solely to the extent
necessary to carry out the transaction.

VII

Order delivery

In order to deliver the ordered products, the Administrator transfers the necessary data
to a courier company or another entity carrying out the delivery.

Order deliveries are fulfilled via:

GLS.

Data transferred for the purpose of executing the delivery may include:

first name and surname or company name,
delivery address,
phone number,
email address,
information necessary for the correct delivery of the shipment.

VIII

Contact form and complaints form

The forms available in the online shop may serve in particular to:

submitting enquiries regarding products or how the shop operates,
contacting the Customer Service Department,
submitting complaint claims,
transmission of the information necessary to handle the request.

The data provided in the contact form are processed in order to provide a response
to the submitted enquiry and for conducting further correspondence.

The data provided in the complaint form are processed in order to accept,
consideration and handling of the complaint.

The scope of processed data depends on the type of form and the information
provided by the user and may include in particular:

full name,
company name,
email address,
phone number,
order details,
product data,
content of the query or report,
documents or attachments provided by the user.

The user can voluntarily subscribe to the Media-MED newsletter.

A newsletter can be used to send:

commercial information,
marketing and promotional information,
information about products and new releases,
information about the Media-MED offer,
information relating to the company's operations.

The newsletter is managed using the following system:

MailerLite.

For the purpose of sending the newsletter, primarily the e-mail address is processed,
and other data provided voluntarily during registration.

The user can unsubscribe from the newsletter at any time:

by clicking the unsubscribe link in the newsletter email,
contacting the Administrator.

Recipients of personal data

Personal data may be transferred to entities supporting the Administrator
in running an online shop and fulfilling orders.

The recipients of the data may include, in particular:

hosting service providers
Cyber_Folks,
payment operators —
PayU i Revolut,
courier company
GLS,
accounting and tax service providers,
entities providing IT support for the shop,
newsletter provider —
MailerLite,
entities providing legal or advisory services,
entities authorised to obtain data on the basis of currently applicable laws
legal provisions.

Data is only transferred to the extent necessary for the performance of
a specific purpose.

Data retention period

Personal data is stored for the period necessary to fulfil the purposes,
for whom they were collected.

Data related to order fulfillment are stored for the required period
tax and accounting legislation.
Customer account data is stored for the duration of the account holding period
or until it is removed.
Newsletter data is stored until consent is withdrawn
or subscription cancellation.
Data related to complaints and claims are kept for a period of
necessary for handling the request and any potential establishment, exercise or defence of legal claims.
Data processed based on the Controller's legitimate interest
are retained until a valid objection is lodged or until they cease to apply
this business.

XII

Data subject rights

The data subject is entitled to the rights set out in the GDPR,
in particular:

right of access to your data,
the right to rectification,
right to erasure,
the right to restrict processing,
right to data portability,
right to object to data processing,
the right to withdraw consent at any time if data is being processed
on the basis of consent,
the right to lodge a complaint with the President of the Office for Personal Data Protection.

To exercise your rights, you can contact the Administrator
at the address:
biuro@media-med.pl.

Voluntary provision of data

Providing personal data is voluntary, but in some cases
essential to use certain store functionalities.

Providing data is necessary in particular for:

account setup and management,
placement and fulfilment of the order,
delivery of the purchased products,
issuing a sales document,
payment processing,
providing a response to the enquiry submitted via the form,
reception and consideration of complaints.

Failure to provide the details required to process the order will prevent its completion
submission or execution. Failure to provide details in the contact form may
prevent a reply from being given to the enquiry.

The following remains optional:

signing up for the newsletter,
consent to receive marketing communications.

XIV

Transfer of data outside the European Economic Area

As a general rule, the data controller does not transfer personal data outside the European
Economic Area.

However, data may be transferred outside the European Economic Area,
if this relates to the use of tools or services provided by suppliers
external parties who may process data outside the EEA.

Data may only be transferred outside the EEA if:

this is linked to the provision of services by an external supplier,
the supplier ensures an adequate level of data protection,
the appropriate safeguards required by the GDPR have been put in place,
In particular, standard contractual clauses or other mechanisms were used
as provided for by the applicable legislation.

Data security

The controller shall implement appropriate technical and organisational measures designed to
with the aim of protecting personal data.

The security measures in place are designed to protect data, in particular, against:

data loss,
unauthorised access,
unauthorised disclosure,
unauthorised alteration of data,
data destruction,
the processing of data by unauthorised persons.

In particular, the administrator shall:

technical security measures for IT systems,
organisational safeguards,
data access control,
restricting access solely to authorised persons and organisations,
procedures relating to the processing and protection of personal data.

Access to personal data is restricted to those individuals and organisations that require it
to carry out specific tasks relating to the running of the shop, orders and payments,
deliveries, complaints or customer contact.

Sixteenth

Cookies and analytics tools

The online shop may use cookies and similar technologies.

Detailed information regarding cookies includes in particular:

types of cookies used,
purposes of their use,
their storage period,
analytical tools used,
marketing tools used,
methods of user consent management,
methods of deleting or blocking cookies.

Detailed information regarding cookies and analytical tools
and marketing practices, as well as methods for managing consent, can be found
in a separate document:

Cookies Policy.

Tools such as Google Analytics, Google Search Console and Google Ads
and the LinkedIn Insight Tag have been or will be described in detail
in the Cookies Policy.

XVII