Privacy Policy

I. General provisions

1. The words written in capital letters and not defined below have the meanings as in the Terms of Service.
2. This document defines the principles of processing and protection of personal data of Customers of this Website.
3. The controller of personal data (Personal Data) of Customers – natural persons – and users (data subjects) of the Website is Bacha Sport Sp. z o. o. with its registered office in Gliwice at ul. Kozielska 439, 44-164 Gliwice, e-mail: marketing@bachasport.pl, telephone: 32 302 97 14, entered into the register of entrepreneurs of the National Court Register maintained by the District Court in Gliwice,
4. 
    10th Commercial Division of the National Court Register under the KRS number 0000594954, the NIP number 9691616523, the REGON number 363368612.
5. Personal Data referred to in the Privacy Policy is information about an identified or identifiable natural person to whom the data relates, i.e. one who can be identified directly or indirectly, in particular on the basis of a feature such as: name and surname, identification number, location data, online identifier or one or more features defining the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person.
6. The Service Provider processes the Personal Data of data subjects in accordance with applicable regulations, in particular Polish law and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).
7. Processing, within the meaning of the Privacy Policy, means an operation or set of operations performed on Personal Data or sets of Personal Data in an automated or non-automated manner, such as collecting, recording, organizing, structuring, storing, adapting or modifying, downloading, viewing.

II. Scope and purpose of collected data

1. Personal Data are processed by the Administrator on the Website in order to enable the use of the Website’s functionalities, including automatically when using the Website, i.e. in order to:
   1. Registration on the Website;
   2. concluding contracts via or available on the Website, in particular placing and executing an Order;
   3. efficient operation and functioning of the Website, including the Online Store, and ensuring the safety of their use, including the detection of abuses and carrying out analyses;
   4. fulfilling the obligations of the Service Provider, in particular complaints regarding contracts concluded on the Website or via the Website and the functioning of the Website;
   5. preparing and presenting advertisements and offers tailored to the interests and needs of persons whose Personal Data relate to, and receiving commercial information, in particular sending the ordered Newsletter by the Service Provider to the e-mail address indicated by the Customer;
   6. for the purpose of publishing the Content.
2. In order to:
   1. Registration on the Website – the following Personal Data are processed – name and surname, e-mail address, Password, IP address, cookies;
   2. concluding contracts via or available on the Website, in particular placing and executing an Order – the following Personal Data are processed: name and surname, address (street, house number, town and postal code), contact telephone number, order number, IP address, cookies or other data provided by the Service Provider on the Website or during contact with the Customer;
   3. for the efficient operation and functioning of the Website, including the Online Store, and to ensure the safety of their use, including the detection of abuses, the creation of reports and analyses, including statistics on the viewing of subpages of the Website – the following Personal Data are processed – listed in point 8 b;
   4. fulfilling the obligations of the Service Provider, in particular complaints regarding contracts concluded on the Website or via the Website and the functioning of the Website – the following Personal Data are processed – name, surname, e-mail, telephone number, address (street, house number, town and postal code), IP address, cookies;
   5. preparing and presenting advertisements and offers tailored to the interests and needs of persons whose Personal Data relate to, and receiving commercial information, in particular sending the ordered Newsletter by the Service Provider to the e-mail address indicated by the Customer – the following Personal Data are processed: first name, last name, gender, date of birth, e-mail, telephone number, address (street, house number, town and postal code), IP address, cookies;
   6. publication of Content – ​​the following Personal Data are processed: name, surname, e-mail, username, IP address, cookies.

III. Legal basis for processing Personal Data

1. The legal basis for the processing of Personal Data is:
   1. consent of the person whose Personal Data relates to their processing;
   2. necessity to perform contracts concluded on or through the Website, or to take actions requested by the person to whom the Personal Data relates before concluding the contract;
   3. necessity to fulfil a legal obligation incumbent on the Service Provider;
   4. legitimate interests pursued by the Service Provider or by a third party, such as electronic payment operators or other interests pursued in connection with the functionality of the Website, provided that this basis for the processing of Personal Data does not apply to children.

IV. Period of processing of personal data

1. Personal Data collected on the Website will be stored for accounting purposes for a maximum period of 5 years, counted from the end of the calendar year in which the tax payment deadline related to the contract concluded on or through the Website expired. To the extent otherwise justified by the processing purposes, Personal Data will be stored for as long as there is a legal basis for their processing, unless applicable law requires a longer storage period, e.g., for use in proceedings concerning the operation of the Website. At the end of the storage period, personal data will be deleted or anonymized.

V. Voluntary provision of personal data

1. Providing Personal Data on the Website is voluntary, but necessary for the implementation of one or more of the purposes of processing Personal Data defined in point 7 above, which the Service Provider will not be able to implement if Personal Data is not provided on the Website, respectively for one or more of the purposes defined in point 7 above.

VI. Profiling of Personal Data

1. Personal Data will be processed in an automated manner. The following data will be used for this purpose: name, surname, address, telephone number, e-mail address, computer IP, cookies, preferred purchase methods/delivery addresses), in order to adapt marketing information and fulfill the order.

VII Cookies

1. The Service Provider informs that when using the Website, Personal Data is also collected automatically in the Website’s system logs, through Cookies.
2. The Service Provider uses cookies to collect information related to the Customer’s use of the Website. Cookies are IT data, in particular small text files, saved and stored on devices through which the Customer uses the Website, enabling:
   1. maintaining the Customer’s session (after logging in), thanks to which the Customer does not have to re-enter the Login and Password on each subpage of the Website,
   2. adapting and optimizing the Website to the needs of customers,
   3. personalization of marketing messages,
   4. ensuring the security and reliability of the Website.
   5. remembering the contents of your shopping cart;
   6. creating statistics and viewership reports on the website’s operation.
3. The Website uses session cookies, which are deleted after closing the web browser window, as well as persistent cookies, which are saved for a specified period of time on the devices through which the Customer uses the Website.
4. The Customer may independently and at any time change the cookie settings, specifying the conditions for their storage and access by Cookies to the Customer’s Device. The Customer may change the settings referred to in the preceding sentence using the web browser settings or through the service configuration. These settings may be changed, in particular, to block the automatic handling of Cookies in the web browser settings or to notify each time Cookies are placed on the Customer’s Device. Detailed information about the possibilities and methods of handling Cookies is available in the Customer’s software (web browser) settings.
5. The Customer may delete Cookies at any time using the functions available in the web browser he or she uses.
6. Restricting the use of cookies may affect some of the functionalities available on the Website.

VIII Rights and obligations of the Service Provider

1. The Service Provider reserves the right to disclose selected Personal Data to competent authorities or third parties who submit a request for such information, based on an appropriate legal basis, in accordance with applicable law.
2. The Service Provider declares that it entrusts the processing of Personal Data, on the basis of a written agreement concluded in accordance with applicable regulations, to entities providing the Service Provider with hosting, courier services, administration, maintenance and management of the Website, as well as services in the field of message optimization and management of promotional campaigns.
3. The Service Provider declares that it entrusts the processing of the Customer’s Personal Data to entities providing services to the Service Provider or directly to the Customer to the extent necessary to use the Website, including the execution of contracts, in particular Orders, consideration of complaints and the use of financial services available in the Online Store, on the basis of a written agreement concluded in accordance with applicable regulations.

IX Processing of Personal Data by Processors

1. Processors within the meaning of the Privacy Policy are entities referred to in points 23 and 24, which process Personal Data on behalf of the Service Provider.
2. The Processor is authorized and has the right to process Personal Data only for the purposes and to the extent specified in the Privacy Policy.
3. Personal Data may be processed only in Poland, a Member State of the European Union (EU) or a signatory to the Agreement on the European Economic Area (EEA).
4. The Processor processes the entrusted Personal Data in accordance with applicable legal provisions, in particular the Processor:
   1. applies technical and organizational measures required by law, in particular regarding the security of Personal Data processing.
   2. applies measures to ensure: i) the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services; ii) the ability to promptly restore the availability and access to personal data in the event of a physical or technical incident; iii) regular testing, measuring and assessing the effectiveness of technical and organisational measures to ensure the security of processing.
   3. applies Personal Data security measures at a level no lower than that used by the Service Provider.
5. The Processor may amend, delete, or block Personal Data being processed only upon the Data Controller’s instruction. If a data subject requests the Processor directly to amend or delete their Personal Data, the Processor shall immediately, but no later than 5 business days, forward such request to the Service Provider.
6. The Processor should not process Personal Data for any purpose other than fulfilling the obligations set out in the Privacy Policy. The Processor may not disclose Personal Data to third parties.
7. The Processor is liable to the person whose Personal Data are processed for any damage that the person may suffer as a result of the Processor’s actions and omissions.

X Rights and obligations of the person whose Personal Data is processed

1. Every customer has the right to:
   1. access to your Personal Data, the right to rectify it, delete it and the right to request restriction of processing.
   2. object to the processing of Personal Data, withdraw consent to the processing of Personal Data for one or more purposes for which it was granted, at any time without affecting the lawfulness of processing based on consent before its withdrawal, as well as the right to transfer your Personal Data.
2. In order to exercise the rights referred to in point 32 a) above, please send an e-mail to the following address: marketing@bachasport.pl or call 32 302 97 14.
3. In order to exercise the rights referred to in point 32 b) above, please send an e-mail to the following address: marketing@bachasport.pl by entering the word “objection” or “withdrawal of consent” in the title, call 32 302 97 14 and inform about the objection or withdrawal of consent, or send written information about the withdrawal of consent to receive commercial information to the address of the Service Provider: Bacha Sport Sp. z o. o., ul. Kozielska 439, 44-164 Gliwice, with the note PERSONAL DATA.
4. If the Customer places any personal data of other people on the Website (including their name, address, telephone number or e-mail address), they may do so only if they do not violate applicable law and the personal rights of such people.
5. The Customer is entitled to use Personal Data and content made available by other persons on the Website only in connection with the use of the Website and with their consent in a manner consistent with the provisions of applicable law, unless they obtain the consent of these other persons to process their Personal Data and their content within the scope or for the purpose provided for in the Privacy Policy and going beyond the use of the Website.
6. Every Customer has the right to lodge a complaint with the authority supervising the processing of Personal Data.

XI Personal Data Protection

1. The Service Provider declares that it makes every effort to provide Customers with a high level of security in the use of the Website and for this purpose:
   1. applies technical and organizational measures required by law, in particular regarding the security of Personal Data processing;
   2. applies measures to ensure: i) the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services; ii) the ability to promptly restore the availability and access to Personal Data in the event of a physical or technical incident; iii) regular testing, measuring and assessing the effectiveness of technical and organisational measures to ensure the security of processing.
2. Any events affecting the security of information and data transmission, including suspected sharing of files containing viruses and other files of a similar nature or other than files with destructive mechanisms, should be reported to the Service Provider via e-mail: marketing@bachasport.pl

XII Final Provisions

1. In matters not regulated in the Privacy Policy, legal provisions regarding the processing of Personal Data, including the GDPR, shall apply.
2. The Website Administrator reserves the right to change the privacy policy if required by applicable law, if the technological conditions of the Website’s operation change, or if the change introduces a standard higher than the minimum required by law. With each change, a new version of the Privacy Policy will appear on the Website and will be effective from the date of its posting.