Privacy Policy – How We Use & Protect Your Data
Personal data and privacy policy
We hereby inform you that the Controller of your personal data is Change of Scandinavia A/S with its registered office in Denmark, Farum Gydevej 73, 3520 Farum, CVR 28711328. If you have any questions regarding personal data protection, please contact us by letter or e-mail: [email protected].
The Controller has appointed a Data Protection Officer who can be contacted by post: Change of Scandinavia A/S, Farum Gydevej 73, 3520 Farum, CVR 28711328 or by e-mail: [email protected].
Personal data collected by the Administrator are processed only for the purposes described in this Privacy Policy.
Purposes and scope of personal data processing:
- in order to execute and perform the sales contract based on the order placed in the Store by the Customer:
Personal data of the person placing the order: first name, last name, email address, telephone number, shipping address; if the shipping address is different from the order address: first name, last name, email address, telephone number, address details, company name (optional). If placing the order in connection with a business activity – additionally: company name, tax identification number;
- to handle complaints and returns arising from the concluded sales contract: name, surname, e-mail address, telephone number, address details, shipping address, if different from the details of the person who placed the order: name, surname, e-mail address, telephone number, address details, company name (optional), and in the case of a complaint in connection with the conducted business activity: company name, Tax Identification Number;
- in order to register a customer account in the Online Store:
Account holder details: first name and last name, e-mail address, telephone number, address; in the case of registering an account in connection with business activities, additionally: company name, Tax Identification Number (NIP); • for issuing accounting documents, such as invoices and related tax liabilities: first name and last name, company name (if applicable), full address, PESEL or NIP number, other data required by local law;
- in order to register and participate in the "Club CHANGE" loyalty program: name and surname, address, country, telephone number, e-mail address, gender, size;
- in order to receive and respond to e-mail correspondence: first name and last name, last name (if provided), e-mail address, additional data provided by the person during the correspondence, necessary to settle the matter;
- to participate in competitions on the Change of Scandinavia profile on Facebook, Instagram or other social media platforms: name, surname, delivery address, telephone number, e-mail address;
- to meet legal requirements, including product recalls or the need to take other actions: data required by law or data necessary to perform tasks imposed by law, administrative or court decisions.
- for technical purposes and store statistics: IP address, location (if provided by the user), device type, operating system and browser;
- for marketing and commercial purposes, including sending a newsletter: after the Customer has given his/her express and specific consent: name, surname, e-mail address, telephone number;
Our store uses cookies to improve your browsing experience and provide personalized services. We use both essential and non-essential cookies. Essential cookies are essential for the Store to function properly, while non-essential cookies are used for analytical and marketing purposes. You can withdraw your consent to the use of non-essential cookies at any time by adjusting your browser settings. For more information about the types of cookies we use and their purposes, please refer to our cookie policy at the bottom of this website.
Legal basis for data processing:
- in connection with the need to perform the sales contract, handle complaints and returns, technical needs of the store: the legal basis for data processing is Article 6(1)(b) of the GDPR: processing is necessary for the performance of a contract to which the data subject is a party, or to take action at the request of the data subject before concluding a contract, and f) processing is necessary for the purposes of the legitimate interests pursued by the controller, such as pursuing claims arising from the concluded contract or taking action related to improving the operation of the Store, including ensuring data security;
- in connection with e-mail correspondence: the legal basis is Article 6(1)(f) of the GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller, i.e. receiving correspondence and responding to it;
- in connection with the customer's registration in the "Club Change" loyalty program, participation in competitions on Change of Scandinavia profiles on Facebook, Instagram and other social media platforms, for marketing and commercial purposes and sending the newsletter: the basis for data processing is the consent expressed by the data subject;
- in connection with the fulfillment of legal requirements: the legal basis for data processing, depending on the purpose, are specific legal provisions or decisions of state institutions.
Obligation to provide data:
Providing personal data in connection with the performance of a sales contract, handling complaints and returns, registering an account with the Store, or for technical purposes is voluntary, but necessary to achieve the purpose for which it was collected. Failure to provide the above data will result in the inability to place an order or process a complaint or return.
Personal data collected in connection with customer registration for the "Club Change" loyalty program, participation in contests on the Change profile on Facebook, Instagram, or other social media platforms, for marketing and commercial purposes, and for newsletter distribution are provided voluntarily based on your consent. Consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Sharing personal data
Personal data will be transferred to other recipients, such as: technical service partners, business partners, telecommunications companies, hosting and consulting companies, payment processing companies, marketing companies conducting SMS campaigns, newsletter sending, document archiving companies, postal operators, carriers, companies printing or handling correspondence, only to the extent necessary to achieve the purposes for which the data was collected. Data may also be shared with public authorities, such as administrative bodies, common courts, and the police.
By collaborating with external companies, the Administrator ensures that Customer data is processed in accordance with the highest standards of data protection. Customer data and the data of those sending correspondence are confidential and may not be used for purposes other than those collected and to the extent specified in the agreements concluded with contractors.
In accordance with the Personal Data Protection Regulation, the Customer has the following rights:
- the right to access personal data,
- the right to rectification, i.e. correcting incorrect data or supplementing incomplete personal data,
- the right to have your personal data deleted,
- the right to restrict the processing of personal data,
- the right to object to the use of personal data for direct marketing,
- the right to object to automated, individual decisions, including profiling,
- the right to transfer personal data,
- the right to withdraw consent at any time – in the case of data processing based on consent, without affecting the lawfulness of processing based on consent before its withdrawal,
- the right to lodge a complaint with the supervisory authority of your country of residence, which you can find HERE: https://edpb.europa.eu/about-edpb/about-edpb/members_en#member-cz.
Storage of personal data:
Customer data is retained for the period permitted by law. This period depends on the type of data and the purposes for which it was collected. The Administrator will process the Customer's personal data for accounting purposes for a period of 5 years from the end of the year in which the VAT invoice was issued.
The data of a Customer registered with Club Change, on whose profile the administrator does not observe any activity, will be deleted within three years, which is related to the period the Customer is entitled to file a complaint.
If the Customer exercises the right to delete data after the period during which the law requires the Administrator to store personal data, the Administrator shall anonymize the data, and non-personalized information will be processed solely for statistical purposes.
Data is deleted from the database when it is no longer necessary to achieve the purposes for which it was collected.
Personal data of persons sending correspondence to the Controller will be processed only for the period necessary to resolve the matter, no longer than 3 years after the end of correspondence in a given case in order to secure the possibility of realizing any claims of such persons.
Precautions
To ensure the security of our customers and business partners against unauthorized access, modification, disclosure or destruction of stored personal data, the following organizational and technical measures have been implemented:
- antivirus software in all IT systems processing personal data,
- backup copies of all IT systems in which personal data are processed,
- limited access to personal data, allowed only when necessary,
- password protection for all IT systems,
- data processing agreements with suppliers who process personal data on behalf of the Controller,
- confidentiality statements with employees who process personal data,
- guidelines for the secure processing of personal data and information resources for employees with access to IT systems,
- implementing risk assessment and documentation of all systems processing personal data in order to ensure a high level of security of the personal data processed.
Changes
This Policy is subject to change. Club Change members will be notified of any changes by email, provided they provide the appropriate information in the form.
Information about changes to the regulations will also be provided on the main page of change.shop.pl for a period of 14 consecutive calendar days.
Requests and complaints
Any requests or complaints regarding the processing of personal data, including declarations of withdrawal of consent (e.g. regarding the receipt of newsletters), requests to change data, delete data, limit data processing, access to data, should be sent to the following e-mail address: [email protected] or by contacting the Customer Service Department.